From ecfa0b8c47dc1b002edad9f225d5ea4d3479b431 Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Fri, 23 Oct 2026 10:55:57 -0400
Subject: [PATCH 1/5] =?UTF-8?q?=F0=9F=A7=AD=20feat:=20Gate=20Config=20Beha?=
 =?UTF-8?q?viour=20on=20the=20Server's=20Admin=20Config=20Contract=20and?=
 =?UTF-8?q?=20Accept=20Dotted=20Keys?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a gating layer that reads the admin config contract (GET /api/admin/config/meta) with bundled
fallbacks for older servers, accepts dotted record keys where the server keeps them, and fixes a
set of smaller configuration issues.
---
 src/components/access/EditRoleDialog.tsx      |  54 ++++-
 .../access/__tests__/EditRoleDialog.test.tsx  | 103 +++++++++
 .../configuration/ManagedNotice.tsx           |  14 +-
 src/components/configuration/edits.test.ts    |  40 +++-
 .../configuration/fields/KeyValueField.tsx    |  11 +-
 .../configuration/fields/ObjectEntryCard.tsx  |  13 +-
 .../fields/RecordObjectField.tsx              |  14 +-
 .../fields/__tests__/collections.test.tsx     |  70 +++++++
 src/components/configuration/import.test.ts   | 117 +++++++++++
 src/components/configuration/import.ts        |  45 +++-
 src/components/configuration/issues.ts        |  12 +-
 .../configuration/renderer/FieldRenderer.tsx  |  70 +++++--
 .../renderer/__tests__/controls.test.tsx      |  58 +++++
 src/components/configuration/review/diff.ts   |  52 ++++-
 src/components/configuration/review/revert.ts |  19 +-
 .../configuration/review/review.test.ts       |  97 +++++++++
 .../sections/LangfuseRenderer.tsx             |  10 +-
 .../__tests__/LangfuseRenderer.test.tsx       |  30 +--
 .../sections/features/Credential.tsx          |  22 +-
 .../features/__tests__/WebSearch.test.tsx     |  39 +++-
 .../sections/features/__tests__/harness.tsx   |  20 +-
 .../configuration/sections/mcp/Create.tsx     |  31 ++-
 .../configuration/sections/mcp/Editor.tsx     |  14 +-
 .../configuration/sections/mcp/Servers.tsx    |  13 +-
 .../sections/mcp/__tests__/Create.test.tsx    |  85 ++++++++
 .../sections/mcp/__tests__/Servers.test.tsx   | 198 ++++++++++++++++--
 .../sections/mcp/__tests__/logic.test.ts      |   9 +
 .../configuration/sections/mcp/list.ts        |  10 +-
 .../configuration/sections/mcp/names.ts       |   7 +-
 .../configuration/sections/mcp/transport.ts   |   9 +-
 src/components/users/UsersPage.tsx            |  11 +-
 src/constants/config.ts                       |  64 ++++--
 src/constants/contract.ts                     | 127 +++++++++++
 src/constants/index.ts                        |   1 +
 src/contexts/ContractContext.tsx              |  22 ++
 src/hooks/config/contract.ts                  |  31 +++
 src/hooks/config/import.test.tsx              | 189 ++++++++++++++++-
 src/hooks/config/import.ts                    |  97 ++++++---
 src/hooks/config/index.ts                     |   1 +
 src/hooks/config/save.ts                      |  21 +-
 src/locales/en/translation.json               |  20 ++
 src/routes/_app.tsx                           |  21 +-
 src/server/config.test.ts                     |  41 +++-
 src/server/config/index.ts                    |   1 +
 src/server/config/meta.test.ts                | 101 +++++++++
 src/server/config/meta.ts                     |  96 +++++++++
 src/server/config/save.test.ts                |  78 +++++++
 src/server/config/save.ts                     |  78 ++++---
 src/server/config/schema.ts                   |  19 +-
 src/server/langfuse.test.ts                   |   2 +-
 src/server/langfuse.ts                        |  24 +--
 src/server/users.test.ts                      |  54 +++++
 src/server/users.ts                           |  21 +-
 src/test/admin.ts                             |   8 +
 src/test/page.tsx                             |   7 +-
 src/types/access.ts                           |   9 +
 src/types/changes.ts                          |   8 +
 src/types/config-ui.ts                        |   7 +
 src/types/contract.ts                         | 132 ++++++++++++
 src/types/index.ts                            |   1 +
 src/types/review.ts                           |  16 +-
 src/utils/changes.test.ts                     | 142 +++++++++++--
 src/utils/changes.ts                          |  97 ++++++---
 src/utils/collections.ts                      |   4 +-
 src/utils/contract.test.ts                    |  80 +++++++
 src/utils/contract.ts                         |  44 ++++
 src/utils/format.test.ts                      |  27 ++-
 src/utils/format.ts                           |  15 +-
 src/utils/index.ts                            |   1 +
 src/utils/keys.test.ts                        |  27 +++
 src/utils/keys.ts                             |  31 ++-
 src/utils/leaves.ts                           | 104 +++++++--
 src/utils/paths.test.ts                       |  10 +
 src/utils/paths.ts                            |  11 +-
 src/utils/validation.ts                       |  42 ++++
 src/utils/values.ts                           |   4 +-
 76 files changed, 2892 insertions(+), 341 deletions(-)
 create mode 100644 src/components/access/__tests__/EditRoleDialog.test.tsx
 create mode 100644 src/components/configuration/sections/mcp/__tests__/Create.test.tsx
 create mode 100644 src/constants/contract.ts
 create mode 100644 src/contexts/ContractContext.tsx
 create mode 100644 src/hooks/config/contract.ts
 create mode 100644 src/server/config/meta.test.ts
 create mode 100644 src/server/config/meta.ts
 create mode 100644 src/server/users.test.ts
 create mode 100644 src/types/contract.ts
 create mode 100644 src/utils/contract.test.ts
 create mode 100644 src/utils/contract.ts

diff --git a/src/components/access/EditRoleDialog.tsx b/src/components/access/EditRoleDialog.tsx
index 3ff20e28..f2b31292 100644
--- a/src/components/access/EditRoleDialog.tsx
+++ b/src/components/access/EditRoleDialog.tsx
@@ -1,3 +1,4 @@
+import { PrincipalType } from 'librechat-data-provider';
 import { useState, useEffect, useCallback } from 'react';
 import { Button, Dialog, Tabs } from '@clickhouse/click-ui';
 import { useQuery, useMutation, useQueryClient, keepPreviousData } from '@tanstack/react-query';
@@ -8,6 +9,7 @@ import {
   removeRoleMemberFn,
   roleQueryOptions,
   roleMembersQueryOptions,
+  availableScopesOptions,
   updateRoleFn,
   updateRolePermissionsFn,
   MEMBERS_PAGE_SIZE,
@@ -16,13 +18,14 @@ import {
   Avatar,
   LoadingState,
   Pagination,
+  DecorativeIcon,
   SelectedMemberList,
   TrashButton,
   UserSearchInline,
 } from '@/components/shared';
 import { RolePermissionsPanel } from './RolePermissionsPanel';
+import { useLocalize, useConfigFeatures } from '@/hooks';
 import { cn, notifySuccess, notifyError } from '@/utils';
-import { useLocalize } from '@/hooks';
 
 type EditRoleTab = 'details' | 'permissions' | 'members';
 
@@ -44,6 +47,15 @@ export function EditRoleDialog({ role, canManage, onClose }: t.EditRoleDialogPro
     enabled: !!role,
   });
 
+  const { roleRenameMovesProfile } = useConfigFeatures();
+  const { data: scopes } = useQuery({ ...availableScopesOptions, enabled: !!role });
+  const hasProfile =
+    role != null &&
+    (scopes ?? []).some(
+      (scope) => scope.principalType === PrincipalType.ROLE && scope.principalId === role.name,
+    );
+  const isRenaming = role != null && name.trim() !== '' && name.trim() !== role.name;
+
   useEffect(() => {
     if (roleDetail.data && permissions === null) {
       setPermissions(roleDetail.data.permissions);
@@ -147,6 +159,9 @@ export function EditRoleDialog({ role, canManage, onClose }: t.EditRoleDialogPro
       if (data.roleId !== role?.id) {
         queryClient.invalidateQueries({ queryKey: ['roleMembers', data.roleId] });
       }
+      if (hasProfile && data.name !== role?.name) {
+        queryClient.invalidateQueries({ queryKey: ['availableScopes'] });
+      }
       notifySuccess(localize('com_toast_role_updated', { name: data.name }));
       onClose();
     },
@@ -223,8 +238,18 @@ export function EditRoleDialog({ role, canManage, onClose }: t.EditRoleDialogPro
                     disabled={role?.isSystemRole || !canManage}
                     readOnly={!canManage}
                     autoFocus
+                    aria-describedby={
+                      isRenaming && hasProfile ? 'edit-role-rename-note' : undefined
+                    }
                     className="rounded-lg border border-(--cui-color-stroke-default) bg-(--cui-color-background-default) px-3 py-2 text-sm text-(--cui-color-text-default) placeholder:text-(--cui-color-text-disabled) disabled:cursor-not-allowed disabled:opacity-50"
                   />
+                  {isRenaming && hasProfile && (
+                    <RenameProfileNote
+                      id="edit-role-rename-note"
+                      name={role.name}
+                      moves={roleRenameMovesProfile}
+                    />
+                  )}
                 </div>
                 <div className="flex flex-col gap-1.5">
                   <label
@@ -375,6 +400,33 @@ export function EditRoleDialog({ role, canManage, onClose }: t.EditRoleDialogPro
   );
 }
 
+/**
+ * What renaming a role does to its configuration profile: LibreChat keeps a
+ * role's profile under the role's name, so before it moved profiles on rename
+ * (`roleRenameMovesProfile`) the profile stays behind and stops applying.
+ */
+function RenameProfileNote({ id, name, moves }: t.RenameProfileNoteProps) {
+  const localize = useLocalize();
+  return (
+    <p
+      id={id}
+      className={cn(
+        'm-0 flex items-start gap-1.5 text-xs',
+        moves ? 'text-(--cui-color-text-muted)' : 'text-(--settings-warn-fg)',
+      )}
+    >
+      <span className="mt-px flex shrink-0">
+        <DecorativeIcon name={moves ? 'info-in-circle' : 'warning'} size="xs" />
+      </span>
+      <span>
+        {moves
+          ? localize('com_access_rename_profile_moves')
+          : localize('com_access_rename_profile_warning', { name })}
+      </span>
+    </p>
+  );
+}
+
 interface MemberListProps {
   members: AdminMember[];
   loading: boolean;
diff --git a/src/components/access/__tests__/EditRoleDialog.test.tsx b/src/components/access/__tests__/EditRoleDialog.test.tsx
new file mode 100644
index 00000000..ce490354
--- /dev/null
+++ b/src/components/access/__tests__/EditRoleDialog.test.tsx
@@ -0,0 +1,103 @@
+import { PrincipalType } from 'librechat-data-provider';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { act, fireEvent, render, screen } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import type * as t from '@/types';
+import { BUNDLED_CONFIG_FEATURES } from '@/constants';
+import { EditRoleDialog } from '../EditRoleDialog';
+
+const state = vi.hoisted(() => ({
+  features: {} as Record<string, boolean>,
+  scopes: [] as Array<Pick<t.ConfigScope, 'principalType' | 'principalId'>>,
+}));
+
+vi.mock('@/hooks', () => ({
+  useLocalize: () => (key: string, options?: Record<string, string | number>) =>
+    options ? `${key}(${Object.values(options).join(',')})` : key,
+  useConfigFeatures: () => state.features,
+}));
+
+vi.mock('@/server', () => ({
+  MEMBERS_PAGE_SIZE: 20,
+  roleQueryOptions: (name: string) => ({
+    queryKey: ['role', name],
+    queryFn: async () => ({ ...role, permissions: {} }),
+  }),
+  roleMembersQueryOptions: (id: string, page: number) => ({
+    queryKey: ['roleMembers', id, page],
+    queryFn: async () => ({ members: [], total: 0 }),
+  }),
+  availableScopesOptions: {
+    queryKey: ['availableScopes'],
+    queryFn: async () => state.scopes,
+  },
+  updateRoleFn: vi.fn(),
+  addRoleMemberFn: vi.fn(),
+  removeRoleMemberFn: vi.fn(),
+  updateRolePermissionsFn: vi.fn(),
+}));
+
+vi.mock('../RolePermissionsPanel', () => ({ RolePermissionsPanel: () => null }));
+
+const role: t.Role = {
+  id: 'r1',
+  name: 'EDITORS',
+  description: '',
+  isSystemRole: false,
+  isActive: true,
+  userCount: 0,
+  permissions: {},
+} as t.Role;
+
+function renderDialog() {
+  const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  render(
+    <QueryClientProvider client={queryClient}>
+      <EditRoleDialog role={role} canManage onClose={vi.fn()} />
+    </QueryClientProvider>,
+  );
+}
+
+async function rename(name: string) {
+  const input = await screen.findByLabelText('com_access_col_name');
+  fireEvent.change(input, { target: { value: name } });
+}
+
+beforeEach(() => {
+  state.features = { ...BUNDLED_CONFIG_FEATURES };
+  state.scopes = [{ principalType: PrincipalType.ROLE, principalId: 'EDITORS' }];
+});
+
+describe('EditRoleDialog rename note', () => {
+  it('warns that the profile stays under the old name on a server that does not move it', async () => {
+    renderDialog();
+    await rename('WRITERS');
+    expect(
+      await screen.findByText('com_access_rename_profile_warning(EDITORS)'),
+    ).toBeInTheDocument();
+  });
+
+  it('says the profile moves with the role when the server moves it', async () => {
+    state.features = { ...BUNDLED_CONFIG_FEATURES, roleRenameMovesProfile: true };
+    renderDialog();
+    await rename('WRITERS');
+    expect(await screen.findByText('com_access_rename_profile_moves')).toBeInTheDocument();
+    expect(screen.queryByText(/com_access_rename_profile_warning/)).not.toBeInTheDocument();
+  });
+
+  it('says nothing once the name is back to the current one', async () => {
+    renderDialog();
+    await rename('WRITERS');
+    expect(await screen.findByText(/com_access_rename_profile_warning/)).toBeInTheDocument();
+    await rename('EDITORS');
+    expect(screen.queryByText(/com_access_rename_profile/)).not.toBeInTheDocument();
+  });
+
+  it('says nothing for a role without a profile', async () => {
+    state.scopes = [{ principalType: PrincipalType.GROUP, principalId: 'EDITORS' }];
+    renderDialog();
+    await rename('WRITERS');
+    await act(async () => {});
+    expect(screen.queryByText(/com_access_rename_profile/)).not.toBeInTheDocument();
+  });
+});
diff --git a/src/components/configuration/ManagedNotice.tsx b/src/components/configuration/ManagedNotice.tsx
index 24087bc1..b1ee7fd3 100644
--- a/src/components/configuration/ManagedNotice.tsx
+++ b/src/components/configuration/ManagedNotice.tsx
@@ -5,18 +5,26 @@ import { useLocalize } from '@/hooks';
 
 /**
  * Explains why a field is read-only because LibreChat only applies it from
- * librechat.yaml. When the edit target still holds an override for the field
- * (written before it became read-only), offers to queue its removal.
+ * librechat.yaml (`kind` `startup`: reads it only while it starts; `count`: the
+ * settings below it the notice covers). When the edit target still holds an
+ * override for them (written before they became read-only), offers to queue
+ * its removal.
  */
 export function ManagedNotice({
+  kind = 'yaml',
+  count = 1,
   hasOverride,
   pendingRemoval,
   onRemoveOverride,
 }: t.ManagedNoticeProps) {
   const localize = useLocalize();
+  const text =
+    kind === 'startup'
+      ? localize('com_config_startup_only_field', { count })
+      : localize('com_config_yaml_managed_field');
   return (
     <div className="mb-2 flex flex-col gap-2">
-      <InfoBanner text={localize('com_config_yaml_managed_field')} dismissible={false} />
+      <InfoBanner text={text} dismissible={false} />
       {hasOverride && (
         <div
           role="status"
diff --git a/src/components/configuration/edits.test.ts b/src/components/configuration/edits.test.ts
index 09888757..4e451c43 100644
--- a/src/components/configuration/edits.test.ts
+++ b/src/components/configuration/edits.test.ts
@@ -161,9 +161,9 @@ describe('identity-keyed collection ops (SV-1)', () => {
     expect(ops).toEqual([
       expect.objectContaining({ op: 'upsertEntry', key: 'Moonshot', identity: 'Moonshot' }),
     ]);
-    expect(planConfigChanges(ops, { stored: {}, lower: root, lowerKind: 'yaml' }).issues).toEqual(
-      [],
-    );
+    expect(
+      planConfigChanges(ops, { stored: {}, tombstones: [], lower: root, lowerKind: 'yaml' }).issues,
+    ).toEqual([]);
   });
 
   it('restores a renamed entry deleted and then undone as the entry it was loaded as', () => {
@@ -225,7 +225,12 @@ describe('identity-keyed collection ops (SV-1)', () => {
       expect.objectContaining({ op: 'upsertEntry', identity: 'a', index: 1 }),
       expect.objectContaining({ op: 'upsertEntry', identity: 'b', index: 2 }),
     ]);
-    const plan = planConfigChanges(ops, { stored: {}, lower: specRoot, lowerKind: 'yaml' });
+    const plan = planConfigChanges(ops, {
+      stored: {},
+      tombstones: [],
+      lower: specRoot,
+      lowerKind: 'yaml',
+    });
     expect(plan.sets.map((set) => set.fieldPath)).toEqual(['modelSpecs.list']);
     const saved = plan.sets[0].value as t.ConfigRecord[];
     expect(saved.map((spec) => spec.name)).toEqual(['c', 'a', 'b']);
@@ -247,7 +252,12 @@ describe('identity-keyed collection ops (SV-1)', () => {
       schemaPaths,
       context({ root: specRoot, collections }),
     );
-    const plan = planConfigChanges(ops, { stored: {}, lower: specRoot, lowerKind: 'yaml' });
+    const plan = planConfigChanges(ops, {
+      stored: {},
+      tombstones: [],
+      lower: specRoot,
+      lowerKind: 'yaml',
+    });
     expect(plan.issues).toEqual([]);
     const saved = plan.sets[0].value as t.ConfigRecord[];
     expect(saved.map((entry) => entry.name)).toEqual(['b', 'c', 'x']);
@@ -273,7 +283,12 @@ describe('identity-keyed collection ops (SV-1)', () => {
       schemaPaths,
       context({ root: specRoot, collections }),
     );
-    const plan = planConfigChanges(ops, { stored: {}, lower: specRoot, lowerKind: 'yaml' });
+    const plan = planConfigChanges(ops, {
+      stored: {},
+      tombstones: [],
+      lower: specRoot,
+      lowerKind: 'yaml',
+    });
     expect(plan.issues).toEqual([]);
     const saved = plan.sets[0].value as t.ConfigRecord[];
     expect(saved.map((spec) => [spec.name, spec.label])).toEqual([
@@ -461,6 +476,17 @@ describe('issue display and summary', () => {
     });
   });
 
+  it('words an issue the admin API reported without parameters without placeholders', () => {
+    const issue: t.ConfigIssue = {
+      path: 'balance.startBalance',
+      code: 'too_small',
+      message: 'is too small',
+    };
+    const text = formatIssue(issue, issue.path, localize).inline;
+    expect(text).toMatch(/is too small$/);
+    expect(text).not.toContain('{{');
+  });
+
   it('names an entry without a name as such, not with an empty identity', () => {
     const issue: t.ConfigIssue = {
       path: 'endpoints.custom',
@@ -521,6 +547,7 @@ describe('issue display and summary', () => {
     const changeSet = buildConfigChanges(new Set(Object.keys(values)), values, schemaPaths, ctx);
     const plan = planConfigChanges(changeSet.ops, {
       stored: specsRoot,
+      tombstones: [],
       lower: {},
       lowerKind: 'yaml',
     });
@@ -549,6 +576,7 @@ describe('issue display and summary', () => {
     );
     const plan = planConfigChanges(changeSet.ops, {
       stored: {},
+      tombstones: [],
       lower: { ...root, balance: { refillAmount: 1000000 } },
       lowerKind: 'yaml',
     });
diff --git a/src/components/configuration/fields/KeyValueField.tsx b/src/components/configuration/fields/KeyValueField.tsx
index b2599951..ec4156cc 100644
--- a/src/components/configuration/fields/KeyValueField.tsx
+++ b/src/components/configuration/fields/KeyValueField.tsx
@@ -1,13 +1,12 @@
 import { useRef, useState, useEffect, useContext, useLayoutEffect } from 'react';
 import type { ReactNode } from 'react';
 import type * as t from '@/types';
+import { useDraftValue, useListKeys, useLocalize, useConfigKeyProblem } from '@/hooks';
 import { RowProblemsContext } from '@/contexts/RowProblemsContext';
-import { useDraftValue, useListKeys, useLocalize } from '@/hooks';
 import { AddItemButton, TrashButton } from '@/components/shared';
-import { cn, isBlankText, isUnsafeConfigKey } from '@/utils';
-import { BLOCK_UNSAFE_CONFIG_KEYS } from '@/constants';
 import { TextareaField } from './TextareaField';
 import { SelectField } from './SelectField';
+import { cn, isBlankText } from '@/utils';
 import { INPUT_CLASSES } from './display';
 import { FieldNotice } from './Notice';
 
@@ -121,6 +120,7 @@ export function KeyValueField({
   'aria-label': ariaLabel,
 }: t.KeyValueFieldProps) {
   const localize = useLocalize();
+  const unsafeKeyProblem = useConfigKeyProblem();
   const availableTypes = valueTypes ?? DEFAULT_TYPES;
   const keys = useListKeys({ items: pairs, identity: pairKey, prefix: `${id}-row` });
   const [drafts, setDrafts] = useState<Array<{ id: number; pair: t.KeyValuePair }>>([]);
@@ -230,9 +230,8 @@ export function KeyValueField({
     if (isDraft && key === '' && !isBlankText(pair.value)) {
       return localize('com_config_ctl_kv_key_missing');
     }
-    if (BLOCK_UNSAFE_CONFIG_KEYS && isUnsafeConfigKey(key)) {
-      return localize('com_config_unsafe_key_error');
-    }
+    const unsafe = unsafeKeyProblem(key);
+    if (unsafe) return unsafe;
     const taken = isDraft ? pairs.some((existing) => existing.key === key) : isTaken(key, index);
     if (key !== '' && taken) return localize('com_config_ctl_kv_duplicate');
     return null;
diff --git a/src/components/configuration/fields/ObjectEntryCard.tsx b/src/components/configuration/fields/ObjectEntryCard.tsx
index 21c500fe..1f593ec8 100644
--- a/src/components/configuration/fields/ObjectEntryCard.tsx
+++ b/src/components/configuration/fields/ObjectEntryCard.tsx
@@ -1,12 +1,11 @@
 import { useState, useCallback, useRef, useEffect, useId } from 'react';
 import type * as t from '@/types';
-import { useLocalize, useValuesScope, useExpandableState } from '@/hooks';
+import { useLocalize, useValuesScope, useConfigKeyProblem, useExpandableState } from '@/hooks';
 import { DecorativeIcon, StateChip } from '@/components/shared';
-import { BLOCK_UNSAFE_CONFIG_KEYS } from '@/constants';
-import { cn, isUnsafeConfigKey } from '@/utils';
 import { getEntrySummary } from './entries';
 import { sourceLabel } from '../values';
 import { CodeField } from './CodeField';
+import { cn } from '@/utils';
 
 const ACTION_CLASSES =
   'inline-flex shrink-0 cursor-pointer items-center gap-1 rounded-md border-none bg-transparent p-1.5 text-xs text-(--cui-color-text-muted) transition-colors hover:bg-(--cui-color-background-hover) hover:text-(--cui-color-text-default) disabled:cursor-not-allowed disabled:opacity-50';
@@ -55,6 +54,7 @@ export function ObjectEntryCard({
   editSessionId,
 }: t.ObjectEntryCardProps) {
   const localize = useLocalize();
+  const unsafeKeyProblem = useConfigKeyProblem();
   const generatedId = useId();
   const [isExpanded, setIsExpanded] = useExpandableState(
     defaultExpanded,
@@ -147,8 +147,9 @@ export function ObjectEntryCard({
 
   const commitRename = useCallback(() => {
     const trimmed = editKey.trim();
-    if (BLOCK_UNSAFE_CONFIG_KEYS && trimmed !== entryKey && isUnsafeConfigKey(trimmed)) {
-      setRenameError(localize('com_config_unsafe_key_error'));
+    const unsafe = trimmed !== entryKey ? unsafeKeyProblem(trimmed) : null;
+    if (unsafe) {
+      setRenameError(unsafe);
       return;
     }
     const problem = trimmed && trimmed !== entryKey ? (validateKey?.(trimmed) ?? null) : null;
@@ -163,7 +164,7 @@ export function ObjectEntryCard({
     } else {
       setEditKey(entryKey);
     }
-  }, [editKey, entryKey, onRename, validateKey, localize]);
+  }, [editKey, entryKey, onRename, validateKey, unsafeKeyProblem]);
 
   const cancelRename = useCallback(() => {
     setEditKey(entryKey);
diff --git a/src/components/configuration/fields/RecordObjectField.tsx b/src/components/configuration/fields/RecordObjectField.tsx
index 0d11b485..0b52d6d0 100644
--- a/src/components/configuration/fields/RecordObjectField.tsx
+++ b/src/components/configuration/fields/RecordObjectField.tsx
@@ -3,12 +3,11 @@ import { useId, useState, useContext, useCallback, useEffect, useRef, memo } fro
 import type * as t from '@/types';
 import { RowProblemsContext } from '@/contexts/RowProblemsContext';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
-import { cn, isRowVisible, isUnsafeConfigKey } from '@/utils';
-import { BLOCK_UNSAFE_CONFIG_KEYS } from '@/constants';
+import { useLocalize, useConfigKeyProblem } from '@/hooks';
 import { AddItemButton } from '@/components/shared';
 import { ObjectEntryCard } from './ObjectEntryCard';
+import { cn, isRowVisible } from '@/utils';
 import { INPUT_CLASSES } from './display';
-import { useLocalize } from '@/hooks';
 
 function asRecord(value: t.ConfigValue): t.ConfigRecord {
   return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
@@ -49,6 +48,7 @@ export function RecordObjectField({
   addLabel,
 }: t.RecordObjectFieldProps) {
   const localize = useLocalize();
+  const unsafeKeyProblem = useConfigKeyProblem();
   const keyListId = keyOptions ? `${id}-keys` : undefined;
   const rowFilter = useContext(RowFilterContext);
   const [showAddInput, setShowAddInput] = useState(false);
@@ -111,7 +111,7 @@ export function RecordObjectField({
   const handleRename = (oldKey: string, renamed: string) => {
     const current = recordRef.current;
     if (renamed === oldKey || renamed in current) return;
-    if (BLOCK_UNSAFE_CONFIG_KEYS && isUnsafeConfigKey(renamed)) return;
+    if (unsafeKeyProblem(renamed)) return;
     const next: t.ConfigRecord = {};
     for (const [k, v] of Object.entries(current)) {
       next[k === oldKey ? renamed : k] = v;
@@ -228,6 +228,7 @@ const AddKeyInput = memo(function AddKeyInput({
   keyListId?: string;
 }) {
   const localize = useLocalize();
+  const unsafeKeyProblem = useConfigKeyProblem();
   const [newKey, setNewKey] = useState('');
   const [error, setError] = useState<string | null>(null);
   const errorId = useId();
@@ -250,8 +251,9 @@ const AddKeyInput = memo(function AddKeyInput({
       setError(localize('com_config_ctl_kv_duplicate'));
       return;
     }
-    if (BLOCK_UNSAFE_CONFIG_KEYS && isUnsafeConfigKey(trimmed)) {
-      setError(localize('com_config_unsafe_key_error'));
+    const unsafe = unsafeKeyProblem(trimmed);
+    if (unsafe) {
+      setError(unsafe);
       return;
     }
     const problem = validateKey?.(trimmed) ?? null;
diff --git a/src/components/configuration/fields/__tests__/collections.test.tsx b/src/components/configuration/fields/__tests__/collections.test.tsx
index 1375e133..76a4e922 100644
--- a/src/components/configuration/fields/__tests__/collections.test.tsx
+++ b/src/components/configuration/fields/__tests__/collections.test.tsx
@@ -3,10 +3,12 @@ import { describe, it, expect, vi } from 'vitest';
 import { act, render, screen, waitFor, fireEvent } from '@testing-library/react';
 import type * as t from '@/types';
 import { matchVariant, switchVariant, VariantField } from '../VariantField';
+import { ConfigContractContext } from '@/contexts/ContractContext';
 import { RowProblemsContext } from '@/contexts/RowProblemsContext';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
 import { RecordObjectField } from '../RecordObjectField';
 import { ArrayObjectField } from '../ArrayObjectField';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 import { ObjectEntryCard } from '../ObjectEntryCard';
 import { KeyValueField } from '../KeyValueField';
 import { createField } from '@/test/fixtures';
@@ -299,6 +301,74 @@ describe('RecordObjectField', () => {
   });
 });
 
+describe('record keys the server cannot store', () => {
+  const dotted: t.ConfigContract = {
+    ...BUNDLED_CONFIG_CONTRACT,
+    features: { ...BUNDLED_CONFIG_CONTRACT.features, dottedKeys: true },
+  };
+
+  function addKey(key: string, contract?: t.ConfigContract) {
+    const onChange = vi.fn();
+    const field = (
+      <RecordObjectField
+        id="profiles"
+        path="fileConfig.endpoints"
+        value={{}}
+        fields={[]}
+        onChange={onChange}
+        allowPrimitiveValues
+        renderFields={renderNameFields}
+      />
+    );
+    render(
+      contract ? (
+        <ConfigContractContext.Provider value={contract}>{field}</ConfigContractContext.Provider>
+      ) : (
+        field
+      ),
+    );
+    fireEvent.click(screen.getByRole('button', { name: /com_ui_add_item/ }));
+    fireEvent.change(screen.getByRole('textbox', { name: 'com_ui_key' }), {
+      target: { value: key },
+    });
+    fireEvent.click(screen.getByRole('button', { name: 'com_ui_add' }));
+    return onChange;
+  }
+
+  it('refuses a dotted key on a server that drops it', () => {
+    const onChange = addKey('image/svg+xml.v2');
+    expect(screen.getByRole('alert')).toHaveTextContent('com_config_unsafe_key_error');
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  it('accepts a dotted key on a server that keeps dotted keys', () => {
+    const onChange = addKey('us.anthropic.claude', dotted);
+    expect(screen.queryByRole('alert')).not.toBeInTheDocument();
+    expect(onChange).toHaveBeenCalledWith({ 'us.anthropic.claude': true });
+  });
+
+  it('still refuses a $ key on a server that keeps dotted keys', () => {
+    const onChange = addKey('$where', dotted);
+    expect(screen.getByRole('alert')).toHaveTextContent('com_config_reserved_key_error');
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  it('flags a dotted key/value key only on a server that drops it', () => {
+    const pairs = [{ key: 'x-portkey.config', value: 'cfg', valueType: 'string' as const }];
+    const { unmount } = render(
+      <KeyValueField id="kv" pairs={pairs} onChange={vi.fn()} onClear={vi.fn()} />,
+    );
+    expect(screen.getByText('com_config_unsafe_key_error')).toBeInTheDocument();
+    unmount();
+    render(
+      <ConfigContractContext.Provider value={dotted}>
+        <KeyValueField id="kv" pairs={pairs} onChange={vi.fn()} onClear={vi.fn()} />
+      </ConfigContractContext.Provider>,
+    );
+    expect(screen.queryByText('com_config_unsafe_key_error')).not.toBeInTheDocument();
+  });
+});
+
 describe('VariantField', () => {
   const idVariant: t.FieldVariant = {
     key: 'existing',
diff --git a/src/components/configuration/import.test.ts b/src/components/configuration/import.test.ts
index 8a5db7db..9594656f 100644
--- a/src/components/configuration/import.test.ts
+++ b/src/components/configuration/import.test.ts
@@ -2,11 +2,14 @@ import { describe, expect, it } from 'vitest';
 import { configSchema } from 'librechat-data-provider';
 import type * as t from '@/types';
 import { collectImportEntries, planImport } from './import';
+import { BUNDLED_CONFIG_FEATURES } from '@/constants';
 import { extractSchemaTree } from '@/server/config';
 import { collectFieldPaths } from './counts';
 
 const tree = extractSchemaTree(configSchema as t.ZodSchemaLike);
 const paths = new Set(collectFieldPaths(tree));
+/** A LibreChat server that keeps dotted record keys (`dottedKeys`). */
+const DOTTED: t.ConfigFeatures = { ...BUNDLED_CONFIG_FEATURES, dottedKeys: true };
 
 describe('planImport', () => {
   it('writes exactly the snippet leaves and says why the others are left out', () => {
@@ -112,3 +115,117 @@ describe('collectImportEntries', () => {
     ]);
   });
 });
+
+describe('planImport on a server that keeps dotted keys', () => {
+  it('writes a record holding a dotted key whole, at its own path', () => {
+    const profiles = { 'us.anthropic.claude': 'arn:x', plain: 'arn:y' };
+    const plan = planImport(
+      { balance: { startBalance: 5 }, endpoints: { bedrock: { inferenceProfiles: profiles } } },
+      tree,
+      paths,
+      false,
+      DOTTED,
+    );
+    expect(plan.entries).toEqual([
+      { fieldPath: 'balance.startBalance', value: 5 },
+      { fieldPath: 'endpoints.bedrock.inferenceProfiles', value: profiles },
+    ]);
+    expect(plan.skipped).toEqual([]);
+  });
+
+  it('leaves out a dotted key where a setting name belongs', () => {
+    const plan = planImport(
+      { 'webSearch.serperApiKey': 'x', balance: { 'start.Balance': 5, refillAmount: 1 } },
+      tree,
+      paths,
+      false,
+      DOTTED,
+    );
+    expect(plan.entries).toEqual([{ fieldPath: 'balance.refillAmount', value: 1 }]);
+    expect(plan.skipped).toEqual([
+      { fieldPath: '', reason: 'dottedKey', key: 'webSearch.serperApiKey' },
+      { fieldPath: 'balance', reason: 'dottedKey', key: 'start.Balance' },
+    ]);
+  });
+
+  it('still leaves out a record holding a $ key, as reserved', () => {
+    const plan = planImport(
+      { endpoints: { bedrock: { inferenceProfiles: { 'us.a.b': 'arn', $where: 'x' } } } },
+      tree,
+      paths,
+      false,
+      DOTTED,
+    );
+    expect(plan.entries).toEqual([]);
+    expect(plan.skipped).toEqual([
+      { fieldPath: 'endpoints.bedrock.inferenceProfiles', reason: 'reservedKey' },
+    ]);
+  });
+
+  it('keeps skipping a dotted key inside a section the panel never writes', () => {
+    const plan = planImport(
+      {
+        endpoints: {
+          azureOpenAI: { groups: [{ group: 'eastus', models: { 'gpt-4.1': true } }] },
+        },
+      },
+      tree,
+      paths,
+      false,
+      DOTTED,
+    );
+    expect(plan.skipped).toEqual([
+      { fieldPath: 'endpoints.azureOpenAI.groups', reason: 'yamlOnly' },
+    ]);
+  });
+
+  /** A YAML with a dotted MCP server name next to an override of another server. */
+  const mcpImport: t.ConfigRecord = {
+    mcpServers: {
+      'my.server': { type: 'streamable-http', url: 'https://example.com/mcp' },
+      cloudflare: { serverInstructions: 'Use carefully', headers: { 'x-team.id': 'a' } },
+    },
+  };
+
+  it('imports MCP servers field by field and leaves a dotted server name out', () => {
+    const plan = planImport(mcpImport, tree, paths, false, DOTTED);
+    expect(plan.entries).toEqual([
+      { fieldPath: 'mcpServers.cloudflare.serverInstructions', value: 'Use carefully' },
+      { fieldPath: 'mcpServers.cloudflare.headers', value: { 'x-team.id': 'a' } },
+    ]);
+    expect(plan.skipped).toEqual([
+      { fieldPath: 'mcpServers', reason: 'dottedName', key: 'my.server' },
+    ]);
+  });
+
+  it('leaves out a dotted name in any record of setting groups, by schema or by value', () => {
+    const plan = planImport(
+      {
+        fileConfig: { endpoints: { 'my.endpoint': { fileLimit: 2 }, openAI: { fileLimit: 3 } } },
+        mcpServers: { 'a.b': 'not a server' },
+      },
+      tree,
+      paths,
+      false,
+      DOTTED,
+    );
+    expect(plan.entries).toEqual([
+      { fieldPath: 'fileConfig.endpoints.openAI.fileLimit', value: 3 },
+    ]);
+    expect(plan.skipped).toEqual([
+      { fieldPath: 'fileConfig.endpoints', reason: 'dottedName', key: 'my.endpoint' },
+      { fieldPath: 'mcpServers', reason: 'dottedName', key: 'a.b' },
+    ]);
+  });
+
+  it('on an older server, leaves the dotted server name out as unsafe', () => {
+    const plan = planImport(mcpImport, tree, paths);
+    expect(plan.entries).toEqual([
+      { fieldPath: 'mcpServers.cloudflare.serverInstructions', value: 'Use carefully' },
+    ]);
+    expect(plan.skipped).toEqual([
+      { fieldPath: 'mcpServers', reason: 'unsafeKey', key: 'my.server' },
+      { fieldPath: 'mcpServers.cloudflare.headers', reason: 'unsafeKey', key: 'x-team.id' },
+    ]);
+  });
+});
diff --git a/src/components/configuration/import.ts b/src/components/configuration/import.ts
index bb047bcc..37557f87 100644
--- a/src/components/configuration/import.ts
+++ b/src/components/configuration/import.ts
@@ -11,7 +11,7 @@ import {
   secretPathForPreviewPath,
   stripSecretPreviewValues,
 } from '@/utils';
-import { SKIP_REASON_KEYS } from '@/constants';
+import { SKIP_REASON_KEYS, BUNDLED_CONFIG_FEATURES } from '@/constants';
 import { findSchemaField } from './controls';
 import { normalizeForSave } from './edits';
 
@@ -19,9 +19,20 @@ import { normalizeForSave } from './edits';
 export const IMPORT_SKIP_KEYS: Readonly<Record<t.ImportSkipReason, string>> = {
   ...SKIP_REASON_KEYS,
   unsafeKey: 'com_config_review_import_skip_unsafe',
+  reservedKey: 'com_config_review_import_skip_reserved',
+  dottedKey: 'com_config_review_import_skip_dotted',
+  dottedName: 'com_config_review_import_skip_dotted_name',
   processMcp: 'com_config_review_import_skip_process',
 };
 
+/** Skips of one key, reported at the object holding it: a section the panel never writes wins. */
+const KEY_SKIP_REASONS: ReadonlySet<t.ImportSkipReason> = new Set([
+  'unsafeKey',
+  'reservedKey',
+  'dottedKey',
+  'dottedName',
+]);
+
 /**
  * One save entry per leaf of the imported YAML, minus metadata, empty objects
  * and redacted secret companions. Each value is normalized like a pending
@@ -29,16 +40,20 @@ export const IMPORT_SKIP_KEYS: Readonly<Record<t.ImportSkipReason, string>> = {
  * no value (`allowedDomains: [""]`, `titleModel: ""`) is reported as skipped
  * instead of being stored as an empty override that LibreChat would read as
  * "allow nothing". Keys the admin API can't store are reported as `unsafeKey`
- * (with the object holding them) instead of being split into nested paths.
+ * (`reservedKey` on a server that keeps dotted keys), a dotted key where
+ * the schema expects a setting name as `dottedKey`, and a dotted name of a
+ * setting group (an MCP server) as `dottedName`, with the object holding
+ * them, instead of being split into nested paths.
  */
 export function collectImportEntries(
   appConfig: t.ConfigRecord,
   fields: t.SchemaField[],
   schemaPathSet: ReadonlySet<string>,
+  features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
 ): t.ImportEntries {
   const entries: t.SaveEntry[] = [];
   const skipped: t.ImportSkippedKey[] = [];
-  const { leaves, unsafe } = flattenImport(appConfig);
+  const { leaves, unsafe, dotted, dottedNames } = flattenImport(appConfig, features);
   for (const [fieldPath, raw] of Object.entries(leaves)) {
     if (isConfigRecord(raw) && Object.keys(raw).length === 0) continue;
     if (secretPathForPreviewPath(fieldPath, schemaPathSet) != null) continue;
@@ -49,10 +64,20 @@ export function collectImportEntries(
     if (value == null) skipped.push({ fieldPath, reason: 'empty' });
     else entries.push({ fieldPath, value });
   }
-  for (const { path, key } of unsafe) skipped.push({ fieldPath: path, reason: 'unsafeKey', key });
+  const unsafeReason = unsafeKeyReason(features);
+  for (const { path, key } of unsafe) skipped.push({ fieldPath: path, reason: unsafeReason, key });
+  for (const { path, key } of dotted) skipped.push({ fieldPath: path, reason: 'dottedKey', key });
+  for (const { path, key } of dottedNames) {
+    skipped.push({ fieldPath: path, reason: 'dottedName', key });
+  }
   return { entries, skipped };
 }
 
+/** Why a key the admin API can't store is left out: dotted or `$` keys, or (with `dottedKeys`) `$` keys only. */
+function unsafeKeyReason(features: t.ConfigFeatures): t.ImportSkipReason {
+  return features.dottedKeys ? 'reservedKey' : 'unsafeKey';
+}
+
 /** The MCP server a path belongs to when that server is process-backed (stdio: command/args/env). */
 function processServerOf(path: string, appConfig: t.ConfigRecord): string | undefined {
   const [section, name] = path.split('.');
@@ -72,11 +97,14 @@ function skipReasonOf(
   path: string,
   value: t.ConfigValue,
   isScope: boolean,
+  features: t.ConfigFeatures,
 ): t.ImportSkipReason | null {
   const reason = getWriteSkipReason(path, false) ?? (isScope ? scopeGateSkipReason(path) : null);
   if (reason) return reason;
   if (findYamlManagedValues(path, value).length > 0) return 'yamlOnly';
-  if (findUnsafeKeys(value, path).length > 0) return 'unsafeKey';
+  if (findUnsafeKeys(value, path, features.dottedKeys).length > 0) {
+    return unsafeKeyReason(features);
+  }
   return null;
 }
 
@@ -93,8 +121,9 @@ export function planImport(
   fields: t.SchemaField[],
   schemaPathSet: ReadonlySet<string>,
   isScope = false,
+  features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
 ): t.ImportPlan {
-  const collected = collectImportEntries(appConfig, fields, schemaPathSet);
+  const collected = collectImportEntries(appConfig, fields, schemaPathSet, features);
   const entries: t.SaveEntry[] = [];
   const skipped: t.ImportSkippedKey[] = [];
   const unknown = new Set<string>();
@@ -107,7 +136,7 @@ export function planImport(
       processServers.add(server);
       continue;
     }
-    const reason = skipReasonOf(entry.fieldPath, entry.value, isScope);
+    const reason = skipReasonOf(entry.fieldPath, entry.value, isScope, features);
     if (reason) {
       skipped.push({ fieldPath: entry.fieldPath, reason });
       continue;
@@ -122,7 +151,7 @@ export function planImport(
     const server = processServerOf(skip.fieldPath, appConfig);
     if (server && processServers.has(server)) continue;
     const holderReason =
-      skip.reason === 'unsafeKey' && skip.fieldPath
+      KEY_SKIP_REASONS.has(skip.reason) && skip.fieldPath
         ? getWriteSkipReason(skip.fieldPath, false)
         : null;
     skipped.push(holderReason ? { fieldPath: skip.fieldPath, reason: holderReason } : skip);
diff --git a/src/components/configuration/issues.ts b/src/components/configuration/issues.ts
index 6e0aa010..7a6cf211 100644
--- a/src/components/configuration/issues.ts
+++ b/src/components/configuration/issues.ts
@@ -1,8 +1,9 @@
 import type * as t from '@/types';
 import {
   getEntryKey,
-  getKeyedCollection,
   hasIssueMessage,
+  getKeyedCollection,
+  paramlessIssueCode,
   findKeyedCollectionEntry,
 } from '@/utils';
 import { labelForPath } from './meta';
@@ -48,10 +49,15 @@ function displayParams(
   );
 }
 
-/** Localized message of an issue: `com_config_issue_<code>` when there is one, else the server's text. */
+/**
+ * Localized message of an issue: `com_config_issue_<code>` when there is one,
+ * else the server's text. An issue without parameters (the admin API reports
+ * codes only) is worded without them (`paramlessIssueCode`).
+ */
 function issuePredicate(issue: t.ConfigIssue, localize: t.LocalizeFn): string {
   if (!issue.code) return issue.message;
-  const key = `com_config_issue_${issue.code.toLowerCase()}`;
+  const code = issue.params ? issue.code : paramlessIssueCode(issue.code);
+  const key = `com_config_issue_${code.toLowerCase()}`;
   const localized = localize(key, displayParams(issue.params));
   return localized === key ? issue.message : localized;
 }
diff --git a/src/components/configuration/renderer/FieldRenderer.tsx b/src/components/configuration/renderer/FieldRenderer.tsx
index 8b0f73bc..828c1e4b 100644
--- a/src/components/configuration/renderer/FieldRenderer.tsx
+++ b/src/components/configuration/renderer/FieldRenderer.tsx
@@ -4,12 +4,12 @@ import type * as t from '@/types';
 import { isRowVisible, getSecretPreviewValue, isInterfacePermissionPath } from '@/utils';
 import { ConfiguredOnlyContext } from '@/contexts/ConfiguredOnlyContext';
 import { countConfigured, hasPathOverlap, isPathSet } from '../counts';
+import { isStartupOnlyPath, isYamlManagedPath } from '@/constants';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
 import { getControlType, orderFields } from '../controls';
 import { UnknownSettings } from '../UnknownSettings';
 import { SingleFieldRenderer } from './SingleField';
 import { ManagedNotice } from '../ManagedNotice';
-import { isYamlManagedPath } from '@/constants';
 import { NestedGroup } from './NestedGroup';
 import { labelForPath } from '../meta';
 import { useLocalize } from '@/hooks';
@@ -26,6 +26,37 @@ function asEnabled(value: t.ConfigValue): boolean | undefined {
   return undefined;
 }
 
+/** The notice a field managed only in librechat.yaml shows at its root, or null below the root or for any other field. */
+function managedNoticeKind(path: string, parentPath: string): t.ManagedNoticeKind | null {
+  if (!isYamlManagedPath(path) || isYamlManagedPath(parentPath)) return null;
+  return isStartupOnlyPath(path) ? 'startup' : 'yaml';
+}
+
+/**
+ * Each managed field's notice, by the index of the field it is shown above,
+ * with the paths it covers: consecutive startup-only fields share one notice
+ * above the first of them. A managed group shows its own notice inside it.
+ */
+function managedNoticeRuns(
+  groups: ReadonlyArray<{ type: string; path: string }>,
+  parentPath: string,
+): Map<number, string[]> {
+  const runs = new Map<number, string[]>();
+  let start = -1;
+  let kind: t.ManagedNoticeKind | null = null;
+  groups.forEach((group, index) => {
+    const next = group.type === 'nested' ? null : managedNoticeKind(group.path, parentPath);
+    if (next === 'startup' && next === kind) {
+      runs.get(start)?.push(group.path);
+      return;
+    }
+    kind = next;
+    start = index;
+    if (next != null) runs.set(index, [group.path]);
+  });
+  return runs;
+}
+
 /** `boolean | object` fields get an on/off header; interface permission fields stay plain groups. */
 function isSwitchObject(field: t.SchemaField, path: string): boolean {
   return getControlType(field) === 'switch-object' && !isInterfacePermissionPath(path);
@@ -101,19 +132,34 @@ export function FieldRenderer({
     }
   }
 
-  const managedNotice = (path: string): ReactNode => (
-    <ManagedNotice
-      hasOverride={hasPathOverlap(path, dbOverridePaths ?? NO_PATHS)}
-      pendingRemoval={pendingResets?.has(path) ?? false}
-      onRemoveOverride={disabled || !onResetField ? undefined : () => onResetField(path)}
-    />
-  );
+  const noticeRuns = managedNoticeRuns(groups, parentPath);
+
+  /** The notice of managed fields (`settings`: how many it covers), offering to remove their stale overrides. */
+  const managedNotice = (paths: string[], settings = paths.length): ReactNode => {
+    const overridden = paths.filter((path) => hasPathOverlap(path, dbOverridePaths ?? NO_PATHS));
+    return (
+      <ManagedNotice
+        kind={isStartupOnlyPath(paths[0]) ? 'startup' : 'yaml'}
+        count={settings}
+        hasOverride={overridden.length > 0}
+        pendingRemoval={
+          overridden.length > 0 && overridden.every((path) => pendingResets?.has(path))
+        }
+        onRemoveOverride={
+          disabled || !onResetField
+            ? undefined
+            : () => overridden.forEach((path) => onResetField(path))
+        }
+      />
+    );
+  };
 
   return (
     <ConfiguredOnlyContext.Provider value={Boolean(showConfiguredOnly && !previewMode)}>
-      {groups.map((group) => {
+      {groups.map((group, index) => {
         const managed = isYamlManagedPath(group.path);
         const managedRoot = managed && !isYamlManagedPath(parentPath);
+        const noticeRun = noticeRuns.get(index);
         const groupDisabled = disabled || managed;
         if (group.type === 'nested') {
           const nestedValue =
@@ -131,7 +177,7 @@ export function FieldRenderer({
               disabled={groupDisabled}
               revealPaths={[group.path]}
             >
-              {managedRoot && managedNotice(group.path)}
+              {managedRoot && managedNotice([group.path], group.field.children?.length)}
               <FieldRenderer
                 fields={group.field.children!}
                 parentValue={nestedValue}
@@ -200,7 +246,7 @@ export function FieldRenderer({
           const enabled = asEnabled(current) ?? asEnabled(schemaDefaults?.[group.path]) ?? false;
           return (
             <Fragment key={group.field.path}>
-              {managedRoot && managedNotice(group.path)}
+              {noticeRun && managedNotice(noticeRun)}
               {single}
               {enabled && (group.field.children?.length ?? 0) > 0 && (
                 <div className="settings-group">
@@ -238,7 +284,7 @@ export function FieldRenderer({
 
         return (
           <Fragment key={group.field.path}>
-            {managedRoot && managedNotice(group.path)}
+            {noticeRun && managedNotice(noticeRun)}
             {single}
           </Fragment>
         );
diff --git a/src/components/configuration/renderer/__tests__/controls.test.tsx b/src/components/configuration/renderer/__tests__/controls.test.tsx
index e633c2e6..24ddb493 100644
--- a/src/components/configuration/renderer/__tests__/controls.test.tsx
+++ b/src/components/configuration/renderer/__tests__/controls.test.tsx
@@ -532,4 +532,62 @@ describe('YAML-managed notice', () => {
     );
     expect(screen.getAllByText('com_config_yaml_managed_field')).toHaveLength(1);
   });
+
+  it('says a setting LibreChat reads only at startup never takes an override, and disables it', () => {
+    const backgroundTasks = createField({
+      key: 'backgroundTasks',
+      type: 'object',
+      isObject: true,
+      path: 'endpoints.agents.backgroundTasks',
+      children: [
+        createField({
+          key: 'completionResultBatchSize',
+          type: 'number',
+          path: 'endpoints.agents.backgroundTasks.completionResultBatchSize',
+        }),
+        createField({
+          key: 'completionResultMaxChars',
+          type: 'number',
+          path: 'endpoints.agents.backgroundTasks.completionResultMaxChars',
+        }),
+      ],
+    });
+    render(
+      <FieldRenderer
+        fields={[backgroundTasks]}
+        parentValue={{ backgroundTasks: { completionResultBatchSize: 5 } }}
+        parentPath="endpoints.agents"
+        getValue={getValue}
+        onChange={vi.fn()}
+      />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: /backgroundTasks/ }));
+    expect(screen.getAllByText('com_config_startup_only_field:{"count":1}')).toHaveLength(1);
+    expect(screen.queryByText('com_config_yaml_managed_field')).not.toBeInTheDocument();
+  });
+
+  it('shows one notice above consecutive startup-only settings', () => {
+    const number = (key: string) =>
+      createField({ key, type: 'number', path: `mcpSettings.catalogRecovery.${key}` });
+    render(
+      <FieldRenderer
+        fields={[
+          number('maxStateEntries'),
+          number('maxDetachedDiscoveries'),
+          number('generationReadTimeoutMs'),
+          number('authorizationFenceRetryIntervalMs'),
+        ]}
+        parentValue={{}}
+        parentPath="mcpSettings.catalogRecovery"
+        getValue={getValue}
+        onChange={vi.fn()}
+      />,
+    );
+    expect(
+      screen.getAllByText(/^com_config_startup_only_field/).map((el) => el.textContent),
+    ).toEqual([
+      'com_config_startup_only_field:{"count":2}',
+      'com_config_startup_only_field:{"count":1}',
+    ]);
+  });
 });
diff --git a/src/components/configuration/review/diff.ts b/src/components/configuration/review/diff.ts
index dee68c97..d89ec8d3 100644
--- a/src/components/configuration/review/diff.ts
+++ b/src/components/configuration/review/diff.ts
@@ -438,6 +438,23 @@ function diffPositionalList(
   return items;
 }
 
+/**
+ * Items of the value under `key` of the object at `path`. A key with a dot
+ * (`us.anthropic.claude-sonnet-4-6`) reads as several keys in a dot-path, so
+ * these items carry their path's segments, the key kept whole. Items under a
+ * dotted key nested deeper already carry theirs: only the part up to this key
+ * is replaced.
+ */
+function underKey(items: t.ChangeSummaryItem[], path: string, key: string): t.ChangeSummaryItem[] {
+  if (!key.includes('.')) return items;
+  const parent = path.split('.');
+  const depth = parent.length + key.split('.').length;
+  return items.map((item) => ({
+    ...item,
+    segments: [...parent, key, ...(item.segments ?? item.path.split('.')).slice(depth)],
+  }));
+}
+
 /** Entries of a record collection (`mcpServers`) saved as a whole, matched by key. */
 function diffRecordCollection(
   path: string,
@@ -452,9 +469,31 @@ function diffRecordCollection(
       entryPath: `${path}.${key}`,
       identity: key,
     };
-    if (before[key] == null) return [entryItem('added', entryRef, undefined, after[key], ctx)];
-    if (after[key] == null) return [entryItem('removed', entryRef, before[key], undefined, ctx)];
-    return diffValue(entryRef.entryPath, before[key], after[key], ctx, entryRef);
+    if (before[key] == null) {
+      return underKey([entryItem('added', entryRef, undefined, after[key], ctx)], path, key);
+    }
+    if (after[key] == null) {
+      return underKey([entryItem('removed', entryRef, before[key], undefined, ctx)], path, key);
+    }
+    return underKey(
+      diffValue(entryRef.entryPath, before[key], after[key], ctx, entryRef),
+      path,
+      key,
+    );
+  });
+}
+
+/** Leaves of an object set where nothing was, each a row (`flattenObject`, dotted keys kept whole). */
+function addedLeaves(
+  path: string,
+  after: t.ConfigRecord,
+  ctx: DiffContext,
+  entry: t.ChangeEntryRef | undefined,
+): t.ChangeSummaryItem[] {
+  return Object.entries(after).flatMap(([key, value]) => {
+    const leaves = Object.entries(flattenObject({ [key]: value }, path));
+    const items = leaves.map(([leafPath, leaf]) => leafItem(leafPath, undefined, leaf, ctx, entry));
+    return underKey(items, path, key);
   });
 }
 
@@ -495,12 +534,13 @@ function diffValue(
   }
   if (isConfigRecord(after) && isConfigRecord(before)) {
     const keys = [...new Set([...Object.keys(before), ...Object.keys(after)])];
-    return keys.flatMap((key) => diffValue(`${path}.${key}`, before[key], after[key], ctx, entry));
+    return keys.flatMap((key) =>
+      underKey(diffValue(`${path}.${key}`, before[key], after[key], ctx, entry), path, key),
+    );
   }
   if (isConfigRecord(after) && before == null) {
     if (isEntryPath && entry) return [entryItem('added', entry, undefined, after, ctx)];
-    const leaves = Object.entries(flattenObject(after, path));
-    return leaves.map(([leafPath, value]) => leafItem(leafPath, undefined, value, ctx, entry));
+    return addedLeaves(path, after, ctx, entry);
   }
   if (after == null && isEntryPath && entry) {
     return [entryItem('removed', entry, before, undefined, ctx)];
diff --git a/src/components/configuration/review/revert.ts b/src/components/configuration/review/revert.ts
index 16c329a2..b90e8246 100644
--- a/src/components/configuration/review/revert.ts
+++ b/src/components/configuration/review/revert.ts
@@ -16,6 +16,21 @@ function relativeSegments(path: string, base: string): string[] {
   return path === base ? [] : path.slice(base.length + 1).split('.');
 }
 
+/**
+ * The segments of a row's path below `base` (a prefix of it). A dotted record
+ * key (`us.anthropic.claude-sonnet-4-6`) stays one segment: the row carries
+ * its path's `segments`, since splitting the path would break the key apart.
+ */
+function segmentsBelow(item: t.ChangeSummaryItem, base: string): string[] {
+  if (!item.segments) return relativeSegments(item.path, base);
+  let prefix = '';
+  for (let i = 0; i < item.segments.length; i++) {
+    prefix = i === 0 ? item.segments[i] : `${prefix}.${item.segments[i]}`;
+    if (prefix === base) return item.segments.slice(i + 1);
+  }
+  return relativeSegments(item.path, base);
+}
+
 /**
  * `pending` with the value at `segments` put back to the one in `baseline`
  * (removed when the baseline has none). Where the pending value is shaped
@@ -97,7 +112,7 @@ function revertListEntry(
     next[index] = revertAt(pending[index], previous, [key]);
     return next;
   }
-  next[index] = revertAt(pending[index], previous, relativeSegments(item.path, entryPath));
+  next[index] = revertAt(pending[index], previous, segmentsBelow(item, entryPath));
   return next;
 }
 
@@ -113,7 +128,7 @@ function revertWithin(
   item: t.ChangeSummaryItem,
 ): t.ConfigValue {
   const { collectionPath } = item;
-  const byPath = () => revertAt(pending, baseline, relativeSegments(item.path, sourcePath));
+  const byPath = () => revertAt(pending, baseline, segmentsBelow(item, sourcePath));
   if (
     collectionPath == null ||
     (collectionPath !== sourcePath && !collectionPath.startsWith(`${sourcePath}.`))
diff --git a/src/components/configuration/review/review.test.ts b/src/components/configuration/review/review.test.ts
index 4873b267..af70621c 100644
--- a/src/components/configuration/review/review.test.ts
+++ b/src/components/configuration/review/review.test.ts
@@ -762,6 +762,103 @@ describe('planRevert', () => {
       value: { ...zai, apiKey: 'k9' },
     });
   });
+
+  describe('dotted record keys', () => {
+    const PROFILES = 'endpoints.bedrock.inferenceProfiles';
+    const US = 'us.anthropic.claude-sonnet-4-6';
+    const GLOBAL = 'global.anthropic.claude-opus-5-5';
+    const pairs = (record: Record<string, string>) =>
+      Object.entries(record).map(([key, value]) => ({ key, value }));
+    const withProfiles = (profiles?: t.ConfigRecord): t.ConfigRecord =>
+      profiles ? { endpoints: { bedrock: { inferenceProfiles: profiles } } } : {};
+
+    function rowsOf(profiles: t.ConfigRecord | undefined, pending: Record<string, string>) {
+      const tree = withProfiles(profiles);
+      const saves = [{ fieldPath: PROFILES, value: pending }];
+      const items = summarizeChanges(makeInput({ baseline: tree, saves, isOwned: () => true }));
+      return { tree, items, edited: { [PROFILES]: pairs(pending) } };
+    }
+
+    it('keeps the key whole in the row, so Revert drops only that added key', () => {
+      const pending = { plainA: 'arn:a', [US]: 'arn:us', [GLOBAL]: 'arn:global' };
+      const { tree, items, edited } = rowsOf({ plainA: 'arn:a' }, pending);
+      expect(items.map((item) => item.path)).toEqual([
+        `${PROFILES}.${US}`,
+        `${PROFILES}.${GLOBAL}`,
+      ]);
+      const us = items[0];
+      expect(us.segments).toEqual(['endpoints', 'bedrock', 'inferenceProfiles', US]);
+      expect(planRevert(us, edited, tree)).toEqual({
+        op: 'set',
+        path: PROFILES,
+        value: { plainA: 'arn:a', [GLOBAL]: 'arn:global' },
+      });
+    });
+
+    it('puts a removed stored key back and keeps the other change', () => {
+      const pending = { [US]: 'arn:us2' };
+      const { tree, items, edited } = rowsOf({ [US]: 'arn:us', [GLOBAL]: 'arn:global' }, pending);
+      const removed = items.find((item) => item.kind === 'removed')!;
+      expect(removed.segments).toEqual(['endpoints', 'bedrock', 'inferenceProfiles', GLOBAL]);
+      expect(planRevert(removed, edited, tree)).toEqual({
+        op: 'set',
+        path: PROFILES,
+        value: { [US]: 'arn:us2', [GLOBAL]: 'arn:global' },
+      });
+      const changed = items.find((item) => item.kind === 'changed')!;
+      expect(planRevert(changed, edited, tree)).toEqual({
+        op: 'set',
+        path: PROFILES,
+        value: { [US]: 'arn:us' },
+      });
+    });
+
+    it('reverts a key of a record set where nothing was stored', () => {
+      const pending = { [US]: 'arn:us', [GLOBAL]: 'arn:global' };
+      const { tree, items, edited } = rowsOf(undefined, pending);
+      const global = items.find((item) => item.path === `${PROFILES}.${GLOBAL}`)!;
+      expect(global).toMatchObject({ kind: 'added', segments: [...PROFILES.split('.'), GLOBAL] });
+      expect(planRevert(global, edited, tree)).toEqual({
+        op: 'set',
+        path: PROFILES,
+        value: { [US]: 'arn:us' },
+      });
+    });
+
+    it('reverts a dotted header of a list entry and keeps its other change', () => {
+      const team = { ...moonshot, headers: { 'x-team': 'eng' } };
+      const tree = { ...baseline, endpoints: { custom: [team, zai, vercel] } };
+      const edited = {
+        ...team,
+        modelDisplayLabel: 'Kimi',
+        headers: { 'x-team': 'eng', 'x-portkey.config': 'cfg' },
+      };
+      const pending = [edited, zai, vercel];
+      const items = summarizeChanges(makeInput({ baseline: tree, saves: saveList(pending) }));
+      const header = items.find(
+        (item) => item.path === 'endpoints.custom.0.headers.x-portkey.config',
+      )!;
+      expect(header.segments).toEqual(['endpoints', 'custom', '0', 'headers', 'x-portkey.config']);
+      expect(planRevert(header, { 'endpoints.custom': pending }, tree)).toEqual({
+        op: 'set',
+        path: 'endpoints.custom',
+        value: [{ ...team, modelDisplayLabel: 'Kimi' }, zai, vercel],
+      });
+    });
+
+    it('restores a dotted entry name of a record collection saved as a whole', () => {
+      const docs = { type: 'http', url: 'https://docs.example/mcp' };
+      const tree = { mcpServers: { ...baseline.mcpServers, 'my.server': docs } };
+      const pending = { ...baseline.mcpServers };
+      const saves = [{ fieldPath: 'mcpServers', value: pending }];
+      const [removed] = summarizeChanges(makeInput({ baseline: tree, saves }));
+      expect(removed).toMatchObject({ kind: 'removed', segments: ['mcpServers', 'my.server'] });
+      expect(planRevert(removed, { mcpServers: pending }, tree)).toEqual({
+        op: 'discard',
+        paths: ['mcpServers'],
+      });
+    });
+  });
 });
 
 describe('formatReviewValue', () => {
diff --git a/src/components/configuration/sections/LangfuseRenderer.tsx b/src/components/configuration/sections/LangfuseRenderer.tsx
index 4eb5c062..ad9ea275 100644
--- a/src/components/configuration/sections/LangfuseRenderer.tsx
+++ b/src/components/configuration/sections/LangfuseRenderer.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useRef, useState } from 'react';
 import { Button, Select, TextField } from '@clickhouse/click-ui';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import type { LangfuseConnectionStatus } from '@/server';
+import type { TLangfuseConnectionStatus } from 'librechat-data-provider';
 import type * as t from '@/types';
 import {
   getLangfuseConnectionFn,
@@ -14,7 +14,7 @@ import { useLocalize } from '@/hooks';
 
 type VerificationState = 'idle' | 'unverified' | 'checking' | 'verified' | 'failed';
 
-function getConnectionKey(status?: LangfuseConnectionStatus): string | undefined {
+function getConnectionKey(status?: TLangfuseConnectionStatus): string | undefined {
   if (!status?.configured || !status.destination || !status.publicKey) return undefined;
   return `${status.destination}\u0000${status.publicKey}`;
 }
@@ -60,7 +60,7 @@ function getVerificationDotClass(state: VerificationState): string {
 export function LangfuseRenderer({ disabled, isEditingScope }: t.FieldRendererProps) {
   const localize = useLocalize();
   const queryClient = useQueryClient();
-  const [status, setStatus] = useState<LangfuseConnectionStatus>();
+  const [status, setStatus] = useState<TLangfuseConnectionStatus>();
   const [destination, setDestination] = useState('');
   const [publicKey, setPublicKey] = useState('');
   const [secretKey, setSecretKey] = useState('');
@@ -264,7 +264,7 @@ export function LangfuseRenderer({ disabled, isEditingScope }: t.FieldRendererPr
   const handleCancel = () => {
     hasDraftRef.current = false;
     const latestStatus =
-      queryClient.getQueryData<LangfuseConnectionStatus>(LANGFUSE_CONNECTION_QUERY_KEY) ?? status;
+      queryClient.getQueryData<TLangfuseConnectionStatus>(LANGFUSE_CONNECTION_QUERY_KEY) ?? status;
     setStatus(latestStatus);
     const storedDestination = latestStatus?.destination;
     setDestination(storedDestination ?? '');
@@ -395,7 +395,7 @@ export function LangfuseRenderer({ disabled, isEditingScope }: t.FieldRendererPr
             }}
             aria-label={`${localize('com_ui_edit')} ${localize('com_config_langfuse_secret_key')}`}
           >
-            <code className="text-sm">{status?.displaySecretKey}</code>
+            <code className="text-sm">{status?.secretKeyPreview}</code>
           </button>
         ) : (
           <TextField
diff --git a/src/components/configuration/sections/__tests__/LangfuseRenderer.test.tsx b/src/components/configuration/sections/__tests__/LangfuseRenderer.test.tsx
index 0b7ae90d..0fad035e 100644
--- a/src/components/configuration/sections/__tests__/LangfuseRenderer.test.tsx
+++ b/src/components/configuration/sections/__tests__/LangfuseRenderer.test.tsx
@@ -1,14 +1,14 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { act, fireEvent, render, screen, waitFor } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { act, fireEvent, render, screen, waitFor } from '@testing-library/react';
 import type * as t from '@/types';
-import { LangfuseRenderer } from '../LangfuseRenderer';
 import {
   getLangfuseConnectionFn,
   LANGFUSE_CONNECTION_QUERY_KEY,
   testLangfuseConnectionFn,
   updateLangfuseConnectionFn,
 } from '@/server';
+import { LangfuseRenderer } from '../LangfuseRenderer';
 
 vi.mock('@/hooks', () => ({
   useLocalize: () => (key: string) => key,
@@ -152,7 +152,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-1234567890abcdef',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     });
     renderLangfuse();
 
@@ -173,7 +173,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-1234567890abcdef',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     });
     renderLangfuse({ disabled: true });
 
@@ -190,11 +190,13 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'removed-region',
       publicKey: 'pk-lf-1234567890abcdef',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     });
     renderLangfuse();
 
-    expect(await screen.findByRole('button', { name: 'com_config_langfuse_disable' })).toBeVisible();
+    expect(
+      await screen.findByRole('button', { name: 'com_config_langfuse_disable' }),
+    ).toBeVisible();
     expect(
       screen.queryByRole('button', { name: 'com_config_langfuse_save_and_enable' }),
     ).not.toBeInTheDocument();
@@ -207,7 +209,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-new',
-      displaySecretKey: 'sk-lf-...cret',
+      secretKeyPreview: 'sk-lf-...cret',
     });
     renderLangfuse();
 
@@ -250,7 +252,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-old',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     };
     mockGet.mockResolvedValue(configuredStatus);
     mockUpdate.mockResolvedValue({ ...configuredStatus, publicKey: 'pk-lf-new' });
@@ -292,7 +294,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-stored',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     };
     mockGet.mockResolvedValue(configuredStatus);
     const { queryClient } = renderLangfuse();
@@ -327,7 +329,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-stored',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     };
     mockGet.mockResolvedValue(configuredStatus);
     mockTest.mockRejectedValueOnce(new Error('Langfuse is temporarily unavailable'));
@@ -384,7 +386,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-existing',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     };
     mockGet.mockResolvedValue(configuredStatus);
     mockUpdate.mockResolvedValue({ ...configuredStatus, enabled: false });
@@ -411,7 +413,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-existing',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     };
     mockGet.mockResolvedValue(configuredStatus);
     mockUpdate.mockResolvedValue({ ...configuredStatus, enabled: true });
@@ -440,7 +442,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-existing',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     };
     mockGet.mockResolvedValue(configuredStatus);
     mockUpdate.mockResolvedValue({ ...configuredStatus, enabled: true, publicKey: 'pk-lf-new' });
@@ -469,7 +471,7 @@ describe('LangfuseRenderer', () => {
       destinations,
       destination: 'eu',
       publicKey: 'pk-lf-existing',
-      displaySecretKey: 'sk-lf-...515f',
+      secretKeyPreview: 'sk-lf-...515f',
     });
     renderLangfuse();
     await screen.findByText('com_config_langfuse_verified');
diff --git a/src/components/configuration/sections/features/Credential.tsx b/src/components/configuration/sections/features/Credential.tsx
index de12928e..7d894546 100644
--- a/src/components/configuration/sections/features/Credential.tsx
+++ b/src/components/configuration/sections/features/Credential.tsx
@@ -2,10 +2,10 @@ import { useId } from 'react';
 import type * as t from '@/types';
 import { SecretField, SecretInput } from '../../fields/SecretField';
 import { FieldControl } from '../../renderer/FieldControl';
+import { useLocalize, useConfigFeatures } from '@/hooks';
 import { DecorativeIcon } from '@/components/shared';
 import { TextField } from '../../fields/TextField';
 import { credentialState } from './state';
-import { useLocalize } from '@/hooks';
 import { cn } from '@/utils';
 
 /** `${SERPER_API_KEY}`: how librechat.yaml references the credential's environment variable. */
@@ -19,14 +19,29 @@ const TONE_CLASSES: Record<t.StatusTone, string> = {
   warn: 'text-(--settings-warn-fg)',
 };
 
-/** The status line of a credential: its source, and whether something is wrong. */
+/** States in which the credential's value is the one typed or stored here, not an environment reference. */
+const LITERAL_STATES: ReadonlySet<t.CredentialStatus> = new Set(['pending', 'stored', 'set']);
+
+/**
+ * The status line of a credential: its source, and whether something is
+ * wrong. Before `webSearchStoredKeys`, LibreChat resolves web search values
+ * only from `${VAR}` references, so a value typed or stored here is ignored.
+ */
 function statusLine(
   state: t.CredentialState,
   credential: t.WebSearchCredential,
   serviceName: string,
   inUse: boolean,
+  storedKeysUsed: boolean,
   localize: t.LocalizeFn,
 ): t.CredentialStatusLine | null {
+  if (!storedKeysUsed && LITERAL_STATES.has(state.status)) {
+    return {
+      tone: 'warn',
+      icon: 'warning',
+      text: localize('com_config_features_cred_env_only', { ref: envRef(credential) }),
+    };
+  }
   switch (state.status) {
     case 'pending':
       return credential.encrypted
@@ -88,10 +103,11 @@ export function CredentialControl({
   ...props
 }: t.CredentialControlProps) {
   const localize = useLocalize();
+  const { webSearchStoredKeys } = useConfigFeatures();
   const statusId = useId();
   if (props.disabled) return <FieldControl {...props} />;
   const state = credentialState({ ...props, credential });
-  const line = statusLine(state, credential, serviceName, inUse, localize);
+  const line = statusLine(state, credential, serviceName, inUse, webSearchStoredKeys, localize);
   const text = typeof props.value === 'string' ? props.value : '';
   const placeholder = localize(
     credential.secret
diff --git a/src/components/configuration/sections/features/__tests__/WebSearch.test.tsx b/src/components/configuration/sections/features/__tests__/WebSearch.test.tsx
index 3fd42c4a..68845d4d 100644
--- a/src/components/configuration/sections/features/__tests__/WebSearch.test.tsx
+++ b/src/components/configuration/sections/features/__tests__/WebSearch.test.tsx
@@ -95,12 +95,17 @@ describe('WebSearchRenderer', () => {
   });
 
   it('masks a typed key and says it will be stored encrypted', () => {
-    renderSection(WebSearchRenderer, { section: 'webSearch', yaml: YAML });
+    renderSection(WebSearchRenderer, {
+      section: 'webSearch',
+      yaml: YAML,
+      features: { webSearchStoredKeys: true },
+    });
     const key = screen.getByLabelText('Cohere API key');
     fireEvent.change(key, { target: { value: 'co-secret-1234567890' } });
     expect(key).toHaveAttribute('type', 'password');
     fireEvent.blur(key);
     expect(screen.getByText('Will be stored encrypted when you save.')).toBeInTheDocument();
+    expect(screen.queryByText(/environment variable references/)).not.toBeInTheDocument();
   });
 
   it('shows a stored key only as its masked preview, with Replace', () => {
@@ -108,6 +113,7 @@ describe('WebSearchRenderer', () => {
       section: 'webSearch',
       yaml: YAML,
       overrides: { webSearch: { cohereApiKeyPreview: '...7890' } },
+      features: { webSearchStoredKeys: true },
     });
     expect(screen.getByDisplayValue('...7890')).toBeDisabled();
     expect(screen.getByRole('button', { name: /Replace/ })).toBeInTheDocument();
@@ -116,6 +122,37 @@ describe('WebSearchRenderer', () => {
     ).toBeInTheDocument();
   });
 
+  describe('on a server that reads web search values only from ${VAR} references', () => {
+    const ENV_ONLY = /only from environment variable references such as \$\{COHERE_API_KEY\}/;
+
+    it('warns that a typed key is ignored', () => {
+      renderSection(WebSearchRenderer, { section: 'webSearch', yaml: YAML });
+      const key = screen.getByLabelText('Cohere API key');
+      fireEvent.change(key, { target: { value: 'co-secret-1234567890' } });
+      fireEvent.blur(key);
+      expect(screen.getByText(ENV_ONLY)).toBeInTheDocument();
+      expect(screen.queryByText('Will be stored encrypted when you save.')).not.toBeInTheDocument();
+    });
+
+    it('warns that a stored key is ignored', () => {
+      renderSection(WebSearchRenderer, {
+        section: 'webSearch',
+        yaml: YAML,
+        overrides: { webSearch: { cohereApiKeyPreview: '...7890' } },
+      });
+      expect(screen.getByDisplayValue('...7890')).toBeDisabled();
+      expect(screen.getByText(ENV_ONLY)).toBeInTheDocument();
+    });
+
+    it('does not warn about a ${VAR} reference', () => {
+      renderSection(WebSearchRenderer, {
+        section: 'webSearch',
+        yaml: { webSearch: { ...YAML.webSearch, cohereApiKey: '${COHERE_API_KEY}' } },
+      });
+      expect(screen.queryByText(ENV_ONLY)).not.toBeInTheDocument();
+    });
+  });
+
   it('flags a required credential a selected service is missing', () => {
     renderSection(WebSearchRenderer, {
       section: 'webSearch',
diff --git a/src/components/configuration/sections/features/__tests__/harness.tsx b/src/components/configuration/sections/features/__tests__/harness.tsx
index 058cad5b..a988ad42 100644
--- a/src/components/configuration/sections/features/__tests__/harness.tsx
+++ b/src/components/configuration/sections/features/__tests__/harness.tsx
@@ -15,7 +15,9 @@ import {
 } from '@/utils';
 import { extractSchemaTree, extractSchemaDefaults, getSchemaPathSet } from '@/server/config';
 import { ConfigValuesProvider } from '@/contexts/ConfigValuesContext';
+import { ConfigContractContext } from '@/contexts/ContractContext';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 
 const TREE = extractSchemaTree(configSchema as t.ZodSchemaLike);
 const SCHEMA_PATHS = getSchemaPathSet();
@@ -41,6 +43,8 @@ interface SectionSetup {
   /** Data paths the tab filter matches. */
   filter?: string[];
   props?: Partial<t.FieldRendererProps>;
+  /** Admin config features the server reports (none: an older server). */
+  features?: Partial<t.ConfigFeatures>;
 }
 
 function withoutKey<T>(record: Record<string, T>, key: string): Record<string, T> {
@@ -78,6 +82,10 @@ export function renderSection(Component: ComponentType<t.FieldRendererProps>, se
   };
   const configuredPaths = new Set([...collectLeafPaths(yaml), ...collectLeafPaths(overrides)]);
   const filter = setup.filter ? createPathIndex(setup.filter) : null;
+  const contract: t.ConfigContract = {
+    ...BUNDLED_CONFIG_CONTRACT,
+    features: { ...BUNDLED_CONFIG_CONTRACT.features, ...setup.features },
+  };
   let newSession = () => {};
 
   function Page() {
@@ -133,11 +141,13 @@ export function renderSection(Component: ComponentType<t.FieldRendererProps>, se
       ...setup.props,
     };
     return (
-      <ConfigValuesProvider value={values}>
-        <RowFilterContext.Provider value={filter}>
-          <Component {...props} />
-        </RowFilterContext.Provider>
-      </ConfigValuesProvider>
+      <ConfigContractContext.Provider value={contract}>
+        <ConfigValuesProvider value={values}>
+          <RowFilterContext.Provider value={filter}>
+            <Component {...props} />
+          </RowFilterContext.Provider>
+        </ConfigValuesProvider>
+      </ConfigContractContext.Provider>
     );
   }
 
diff --git a/src/components/configuration/sections/mcp/Create.tsx b/src/components/configuration/sections/mcp/Create.tsx
index 9cdacef2..fdec4ce0 100644
--- a/src/components/configuration/sections/mcp/Create.tsx
+++ b/src/components/configuration/sections/mcp/Create.tsx
@@ -19,16 +19,16 @@ import {
   isConfigValueEqual,
 } from '@/utils';
 import { planTransportSwitch, transportLabelKey, transportOf, TRANSPORTS } from './transport';
+import { deepClone, isPlainObject, resolveEntryKey, setLeaf } from './validation';
 import { ConfiguredOnlyContext } from '@/contexts/ConfiguredOnlyContext';
 import { ConfigErrorsProvider } from '@/contexts/ConfigErrorsContext';
 import { RowProblemsContext } from '@/contexts/RowProblemsContext';
-import { deepClone, isPlainObject, setLeaf } from './validation';
+import { useLocalize, useConfigFeatures } from '@/hooks';
 import { FormDialog } from '@/components/shared';
 import { toFieldId } from '../../renderer/paths';
 import { serverNameProblem } from './names';
 import { McpServerEditor } from './Editor';
 import { labelForPath } from '../../meta';
-import { useLocalize } from '@/hooks';
 import { McpNote } from './Note';
 
 /** Data path of the draft: field ids and the tri-states' names derive from it ("New server: Startup"). */
@@ -96,17 +96,27 @@ function toEntry(value: t.ConfigRecord, fields?: t.SchemaField[]): t.ConfigRecor
 /**
  * The label of a missing field: under a record of objects it names the
  * entry ("User variables › MY_KEY › Title"), else the field ("Server URL").
+ * The entry is found among the draft's own names, so a dotted one
+ * (`MY.TOKEN`, with `dottedKeys`) is named whole.
  */
-function missingLabel(rest: string, fields: t.SchemaField[], localize: t.LocalizeFn): string {
-  const [head, entryKey, ...leaf] = rest.split('.');
+function missingLabel(
+  rest: string,
+  entry: t.ConfigRecord,
+  fields: t.SchemaField[],
+  localize: t.LocalizeFn,
+): string {
+  const [head] = rest.split('.', 1);
   const field = fields.find((candidate) => candidate.key === head);
-  if (!isRecordOfObjects(field) || entryKey === undefined || leaf.length === 0) {
+  const located = isRecordOfObjects(field)
+    ? resolveEntryKey(rest.slice(head.length + 1), Object.keys(asConfigRecord(entry[head])))
+    : null;
+  if (!located || located.segments.length === 0) {
     return labelForPath(`mcpServers.{}.${rest}`, localize);
   }
   return [
     labelForPath(`mcpServers.{}.${head}`, localize),
-    entryKey,
-    labelForPath(`mcpServers.{}.${head}.{}.${leaf.join('.')}`, localize),
+    located.entryKey,
+    labelForPath(`mcpServers.{}.${head}.{}.${located.segments.join('.')}`, localize),
   ].join(' › ');
 }
 
@@ -159,7 +169,7 @@ function checkDraft(
     }
     const rest = issue.path.slice(DRAFT_PATH.length + 1);
     if (issue.code === 'required' && valueAt(entry, rest) === undefined) {
-      missing.push(missingLabel(rest, fields, localize));
+      missing.push(missingLabel(rest, entry, fields, localize));
     } else if (!(issue.path in errors)) {
       errors[issue.path] = issue.message;
     }
@@ -280,6 +290,7 @@ export function CreateMcpServerDialog({
   hiddenKeys,
 }: t.CreateMcpServerDialogProps) {
   const localize = useLocalize();
+  const { dottedKeys } = useConfigFeatures();
   const [name, setName] = useState('');
   const [draft, setDraft] = useState<t.ConfigRecord>(NEW_SERVER);
   const [rowProblems, setRowProblems] = useState<ReadonlyMap<string, number>>(() => new Map());
@@ -306,10 +317,10 @@ export function CreateMcpServerDialog({
   const shownNameProblem = trimmed === '' || nameProblem == null ? null : localize(nameProblem);
   /** Rows the key/value editors flag (blank, missing, repeated or dotted keys), by field label. */
   const rowsToFix = useMemo(() => {
-    const unsafe = findUnsafeKeys(entry, DRAFT_PATH).map(({ path }) => toFieldId(path));
+    const unsafe = findUnsafeKeys(entry, DRAFT_PATH, dottedKeys).map(({ path }) => toFieldId(path));
     const ids = new Set([...rowProblems.keys(), ...unsafe]);
     return [...ids].map((fieldId) => labelOfFieldId(fieldId, localize));
-  }, [entry, rowProblems, localize]);
+  }, [entry, rowProblems, dottedKeys, localize]);
   const isDirty = name !== '' || !isConfigValueEqual(draft, NEW_SERVER);
   const blocked =
     !isInherited &&
diff --git a/src/components/configuration/sections/mcp/Editor.tsx b/src/components/configuration/sections/mcp/Editor.tsx
index 67a54d76..027398ee 100644
--- a/src/components/configuration/sections/mcp/Editor.tsx
+++ b/src/components/configuration/sections/mcp/Editor.tsx
@@ -8,7 +8,13 @@ import {
   isHttpTransport,
   transportLabelKey,
 } from './transport';
-import { isConfigRecord, isConfigValueEqual, asConfigRecord, hasConfigValue } from '@/utils';
+import {
+  hasDottedKey,
+  isConfigRecord,
+  asConfigRecord,
+  hasConfigValue,
+  isConfigValueEqual,
+} from '@/utils';
 import { renderCollectionEntryFields, renderInlineField, toFieldId } from '../../renderer';
 import { RecordObjectField } from '../../fields/RecordObjectField';
 import { UnknownSettings } from '../../UnknownSettings';
@@ -369,6 +375,8 @@ function UrlHint({ transport }: { transport: t.McpTransport }) {
  * The values each user enters (customUserVars), as cards keyed by variable
  * name. Only the variables that change are written, so a server's override
  * stays sparse; variables the layer beneath defines can't be removed (D3).
+ * While a variable's name has a dot (`dottedKeys`), the variables are
+ * written as one record: a dot-path can't name that variable.
  */
 function UserVariables({
   field,
@@ -390,6 +398,10 @@ function UserVariables({
   const current = asConfigRecord(value);
   const write = (next: t.ConfigValue) => {
     const nextRecord = asConfigRecord(next);
+    if (hasDottedKey(current) || hasDottedKey(nextRecord)) {
+      onChange(field.key, Object.keys(nextRecord).length > 0 ? nextRecord : undefined);
+      return;
+    }
     for (const [key, item] of Object.entries(nextRecord)) {
       if (!isConfigValueEqual(current[key], item)) onChange(`${field.key}.${key}`, item);
     }
diff --git a/src/components/configuration/sections/mcp/Servers.tsx b/src/components/configuration/sections/mcp/Servers.tsx
index 871e9a0d..104af4d4 100644
--- a/src/components/configuration/sections/mcp/Servers.tsx
+++ b/src/components/configuration/sections/mcp/Servers.tsx
@@ -3,15 +3,15 @@ import { isProcessMCPServerConfig } from 'librechat-data-provider';
 import { useContext, useEffect, useMemo, useRef, useState } from 'react';
 import type * as t from '@/types';
 import { getValueAtPath, isConfigRecord, isRowVisible, asConfigRecord } from '@/utils';
+import { previewedSecret, storedSecrets, usesSecret } from './validation';
 import { ConfiguredOnlyContext } from '@/contexts/ConfiguredOnlyContext';
+import { useLocalize, useValuesScope, useConfigFeatures } from '@/hooks';
 import { ConfigValuesContext } from '@/contexts/ConfigValuesContext';
-import { previewedSecret, storedSecrets, usesSecret } from './validation';
 import { McpDeletedRow, McpHiddenRow, McpServerCard } from './Card';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
 import { INSPECTOR_DERIVED, transportOf } from './transport';
 import { copyName, serverNameProblem } from './names';
 import { buildServerList, leafEntries } from './list';
-import { useLocalize, useValuesScope } from '@/hooks';
 import { CreateMcpServerDialog } from './Create';
 import { sourceLabel } from '../../values';
 import { McpServerEditor } from './Editor';
@@ -97,6 +97,7 @@ export function McpServersRenderer({
   editSessionId,
 }: t.FieldRendererProps) {
   const localize = useLocalize();
+  const { dottedKeys } = useConfigFeatures();
   const scope = useValuesScope();
   const rowFilter = useContext(RowFilterContext);
   const valuesData = useContext(ConfigValuesContext);
@@ -552,13 +553,17 @@ export function McpServersRenderer({
   };
 
   /**
-   * Why a card's fields are read-only: a dotted name the admin API drops, a
+   * Why a card's fields are read-only: a dotted name (an older admin API drops
+   * it; a newer one keeps it, but a field path can't address it), a
    * stdio server (LibreChat applies no override to it, so overrides stored
    * anyway can only be removed), or an inherited server not overridden yet.
    */
   const readOnlyNoteFor = (key: string, reason: t.McpReadOnlyReason | null, overrides: number) => {
     if (reason === 'dotted') {
-      return <McpNote tone="lock">{localize('com_config_mcp_dotted_name')}</McpNote>;
+      const noteKey = dottedKeys
+        ? 'com_config_mcp_dotted_name_paths'
+        : 'com_config_mcp_dotted_name';
+      return <McpNote tone="lock">{localize(noteKey)}</McpNote>;
     }
     if (reason === 'process') {
       const canRemove = overrides > 0 && !disabled && !list.reverted.has(key);
diff --git a/src/components/configuration/sections/mcp/__tests__/Create.test.tsx b/src/components/configuration/sections/mcp/__tests__/Create.test.tsx
new file mode 100644
index 00000000..57a4ab53
--- /dev/null
+++ b/src/components/configuration/sections/mcp/__tests__/Create.test.tsx
@@ -0,0 +1,85 @@
+import '@/locales/i18n';
+import { describe, expect, it, vi } from 'vitest';
+import { configSchema } from 'librechat-data-provider';
+import { act, fireEvent, render, screen, within } from '@testing-library/react';
+import type * as t from '@/types';
+import { ConfigContractContext } from '@/contexts/ContractContext';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
+import { extractSchemaTree } from '@/server/config';
+import { CreateMcpServerDialog } from '../Create';
+
+const fields =
+  extractSchemaTree(configSchema as t.ZodSchemaLike).find((field) => field.key === 'mcpServers')
+    ?.children ?? [];
+
+const DOTTED_KEYS: t.ConfigContract = {
+  ...BUNDLED_CONFIG_CONTRACT,
+  features: { ...BUNDLED_CONFIG_CONTRACT.features, dottedKeys: true },
+};
+
+const NONE: ReadonlySet<string> = new Set();
+
+describe('CreateMcpServerDialog — dotted user variable names (dottedKeys)', () => {
+  it('names a dotted variable whole in what is still needed, then creates it as one record', async () => {
+    const onCreate = vi.fn();
+    render(
+      <ConfigContractContext.Provider value={DOTTED_KEYS}>
+        <CreateMcpServerDialog
+          open
+          onClose={vi.fn()}
+          onCreate={onCreate}
+          onOverride={vi.fn()}
+          onUnhide={vi.fn()}
+          fields={fields}
+          existingKeys={NONE}
+          inheritedKeys={NONE}
+          hiddenKeys={NONE}
+        />
+      </ConfigContractContext.Provider>,
+    );
+    const dialog = await screen.findByRole('dialog');
+    fireEvent.change(within(dialog).getByPlaceholderText('e.g. github or acme-docs'), {
+      target: { value: 'vars' },
+    });
+    const url = dialog.querySelector<HTMLInputElement>('#mcpDraft-url input, input#mcpDraft-url');
+    if (!url) throw new Error('no URL input');
+    fireEvent.change(url, { target: { value: 'https://mcp.example.com/vars' } });
+    fireEvent.blur(url);
+    fireEvent.click(within(dialog).getByRole('button', { name: /User variables/ }));
+    const vars = dialog.querySelector<HTMLElement>('#mcpDraft-customUserVars');
+    if (!vars) throw new Error('no user variables editor');
+    fireEvent.click(within(vars).getByRole('button', { name: /^Add ./ }));
+    fireEvent.change(within(vars).getByRole('textbox', { name: 'Key' }), {
+      target: { value: 'MY.TOKEN' },
+    });
+    fireEvent.click(within(vars).getByRole('button', { name: 'Add' }));
+
+    const create = within(dialog).getByRole('button', { name: 'Create' });
+    expect(create).toBeDisabled();
+    const needed = within(dialog).getByText(/Still needed:/);
+    expect(needed).toHaveTextContent(/User variables › MY\.TOKEN › /);
+    expect(needed).not.toHaveTextContent(/› MY ›/);
+
+    for (const [leaf, value] of [
+      ['title', 'Token'],
+      ['description', 'Your token'],
+    ]) {
+      const input = vars.querySelector<HTMLInputElement>(
+        `input[id$="-${leaf}"], [id$="-${leaf}"] input, textarea[id$="-${leaf}"]`,
+      );
+      if (!input) throw new Error(`no ${leaf} input`);
+      fireEvent.change(input, { target: { value } });
+      fireEvent.blur(input);
+    }
+    expect(create).toBeEnabled();
+    await act(async () => {
+      fireEvent.click(create);
+    });
+    expect(onCreate).toHaveBeenCalledWith(
+      'vars',
+      expect.objectContaining({
+        customUserVars: { 'MY.TOKEN': { title: 'Token', description: 'Your token' } },
+      }),
+    );
+  });
+});
diff --git a/src/components/configuration/sections/mcp/__tests__/Servers.test.tsx b/src/components/configuration/sections/mcp/__tests__/Servers.test.tsx
index 54333385..e5b87874 100644
--- a/src/components/configuration/sections/mcp/__tests__/Servers.test.tsx
+++ b/src/components/configuration/sections/mcp/__tests__/Servers.test.tsx
@@ -18,8 +18,10 @@ import {
 } from '@/utils';
 import { extractSchemaTree, getSchemaPathSet } from '@/server/config';
 import { ConfigValuesProvider } from '@/contexts/ConfigValuesContext';
+import { ConfigContractContext } from '@/contexts/ContractContext';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
 import { usePendingConfigValues } from '@/hooks/config/layers';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 import { useConfigEdits } from '@/hooks/config/edits';
 import { McpServersRenderer } from '../Servers';
 
@@ -106,6 +108,7 @@ function Harness({
   showConfiguredOnly = false,
   preset,
   extra,
+  contract = BUNDLED_CONFIG_CONTRACT,
 }: {
   scope?: boolean;
   scopeData?: Partial<t.ResolvedConfigData>;
@@ -113,6 +116,7 @@ function Harness({
   showConfiguredOnly?: boolean;
   preset?: t.FlatConfigMap;
   extra?: t.ConfigRecord;
+  contract?: t.ConfigContract;
 }) {
   const layers = useMemo(() => layersFor(scope, scopeData, extra), [scope, scopeData, extra]);
   const config = layers.effective ?? {};
@@ -136,26 +140,28 @@ function Harness({
     [layers, editedValues, shown, visibilityEdits],
   );
   return (
-    <ConfigValuesProvider value={data}>
-      <RowFilterContext.Provider value={filter}>
-        <McpServersRenderer
-          fields={mcpFields}
-          parentPath="mcpServers"
-          parentValue={config.mcpServers}
-          getValue={(path, fallback) => deriveFieldValue(path, fallback, data)}
-          onChange={edits.handleFieldChange}
-          onDiscardField={edits.handleDiscardField}
-          onHideField={edits.handleHideField}
-          onUnhideField={edits.handleUnhideField}
-          onRenameEntry={edits.handleRenameEntry}
-          editedValues={editedValues}
-          yamlBaseKeys={new Set(Object.keys(YAML_SERVERS))}
-          isEditingScope={scope}
-          showConfiguredOnly={showConfiguredOnly}
-          editSessionId={edits.editSessionId}
-        />
-      </RowFilterContext.Provider>
-    </ConfigValuesProvider>
+    <ConfigContractContext.Provider value={contract}>
+      <ConfigValuesProvider value={data}>
+        <RowFilterContext.Provider value={filter}>
+          <McpServersRenderer
+            fields={mcpFields}
+            parentPath="mcpServers"
+            parentValue={config.mcpServers}
+            getValue={(path, fallback) => deriveFieldValue(path, fallback, data)}
+            onChange={edits.handleFieldChange}
+            onDiscardField={edits.handleDiscardField}
+            onHideField={edits.handleHideField}
+            onUnhideField={edits.handleUnhideField}
+            onRenameEntry={edits.handleRenameEntry}
+            editedValues={editedValues}
+            yamlBaseKeys={new Set(Object.keys(YAML_SERVERS))}
+            isEditingScope={scope}
+            showConfiguredOnly={showConfiguredOnly}
+            editSessionId={edits.editSessionId}
+          />
+        </RowFilterContext.Provider>
+      </ConfigValuesProvider>
+    </ConfigContractContext.Provider>
   );
 }
 
@@ -763,6 +769,158 @@ describe('McpServersRenderer — delete, undo and rename (MCP-12, D9)', () => {
   });
 });
 
+describe('McpServersRenderer — dotted record keys (dottedKeys)', () => {
+  const dottedContract: t.ConfigContract = {
+    ...BUNDLED_CONFIG_CONTRACT,
+    features: { ...BUNDLED_CONFIG_CONTRACT.features, dottedKeys: true },
+  };
+  const HEADERS: t.ConfigRecord = { 'X-Team': 'docs', 'x.api.version': '2024-10' };
+  const USER_VARS: t.ConfigRecord = {
+    'MY.TOKEN': { title: 'Token', description: 'Your token' },
+  };
+  const versioned: t.ConfigRecord = {
+    versioned: {
+      type: 'streamable-http',
+      url: 'https://mcp.versioned.dev/mcp',
+      headers: HEADERS,
+      customUserVars: USER_VARS,
+    },
+  };
+
+  /** Pending edit paths under a server's record field (none means it was written whole). */
+  function splitPaths(server: string, field: string): string[] {
+    return Object.keys(edits.editedValues).filter((path) =>
+      path.startsWith(`mcpServers.${server}.${field}.`),
+    );
+  }
+
+  it('creates a server with a dotted header as one headers record', async () => {
+    render(<Harness contract={dottedContract} />);
+    fireEvent.click(screen.getByRole('button', { name: /com_config_create_mcp_server/ }));
+    const dialog = await screen.findByRole('dialog');
+    fireEvent.change(
+      within(dialog).getByPlaceholderText('com_config_mcp_create_name_placeholder'),
+      { target: { value: 'srv-v' } },
+    );
+    const url = dialog.querySelector<HTMLInputElement>('#mcpDraft-url input, input#mcpDraft-url');
+    if (!url) throw new Error('no URL input');
+    fireEvent.change(url, { target: { value: 'https://mcp.example.com/v' } });
+    fireEvent.blur(url);
+    const headers = dialog.querySelector<HTMLElement>('#mcpDraft-headers');
+    if (!headers) throw new Error('no headers editor');
+    for (const [n, [key, value]] of Object.entries(HEADERS).entries()) {
+      fireEvent.click(within(headers).getByRole('button', { name: /com_ui_add_item/ }));
+      const keyInput = within(headers).getByRole('textbox', { name: `com_ui_key ${n + 1}` });
+      fireEvent.change(keyInput, { target: { value: key } });
+      fireEvent.blur(keyInput);
+      const valueInput = within(headers).getByRole('textbox', { name: `com_ui_value ${n + 1}` });
+      fireEvent.change(valueInput, { target: { value } });
+      fireEvent.blur(valueInput);
+    }
+    const create = within(dialog).getByRole('button', { name: 'com_ui_create' });
+    expect(create).toBeEnabled();
+    await act(async () => {
+      fireEvent.click(create);
+    });
+    expect(edits.editedValues['mcpServers.srv-v.headers']).toEqual(HEADERS);
+    expect(splitPaths('srv-v', 'headers')).toEqual([]);
+  });
+
+  /** Opens Create with a valid URL and adds the user variable `MY.TOKEN`, its fields still empty. */
+  async function createWithDottedVariable() {
+    render(<Harness contract={dottedContract} />);
+    fireEvent.click(screen.getByRole('button', { name: /com_config_create_mcp_server/ }));
+    const dialog = await screen.findByRole('dialog');
+    fireEvent.change(
+      within(dialog).getByPlaceholderText('com_config_mcp_create_name_placeholder'),
+      { target: { value: 'srv-u' } },
+    );
+    const url = dialog.querySelector<HTMLInputElement>('#mcpDraft-url input, input#mcpDraft-url');
+    if (!url) throw new Error('no URL input');
+    fireEvent.change(url, { target: { value: 'https://mcp.example.com/u' } });
+    fireEvent.blur(url);
+    fireEvent.click(within(dialog).getByRole('button', { name: /com_config_mcp_group_user_vars/ }));
+    const vars = dialog.querySelector<HTMLElement>('#mcpDraft-customUserVars');
+    if (!vars) throw new Error('no user variables editor');
+    fireEvent.click(within(vars).getByRole('button', { name: /com_ui_add_item/ }));
+    fireEvent.change(within(vars).getByRole('textbox', { name: 'com_ui_key' }), {
+      target: { value: 'MY.TOKEN' },
+    });
+    fireEvent.click(within(vars).getByRole('button', { name: 'com_ui_add' }));
+    return { dialog, vars };
+  }
+
+  it('creates a server with a dotted user variable as one customUserVars record', async () => {
+    const { dialog, vars } = await createWithDottedVariable();
+    for (const [leaf, value] of [
+      ['title', 'Token'],
+      ['description', 'Your token'],
+    ]) {
+      const input = vars.querySelector<HTMLInputElement>(
+        `input[id$="-${leaf}"], [id$="-${leaf}"] input, textarea[id$="-${leaf}"]`,
+      );
+      if (!input) throw new Error(`no ${leaf} input`);
+      fireEvent.change(input, { target: { value } });
+      fireEvent.blur(input);
+    }
+    const create = within(dialog).getByRole('button', { name: 'com_ui_create' });
+    expect(create).toBeEnabled();
+    await act(async () => {
+      fireEvent.click(create);
+    });
+    expect(edits.editedValues['mcpServers.srv-u.customUserVars']).toEqual(USER_VARS);
+    expect(splitPaths('srv-u', 'customUserVars')).toEqual([]);
+  });
+
+  it('duplicates a server keeping its dotted header and user variable whole', async () => {
+    render(<Harness contract={dottedContract} extra={versioned} />);
+    openMenu('versioned');
+    await act(async () => {
+      fireEvent.click(menuItem('com_config_mcp_action_duplicate'));
+    });
+    expect(edits.editedValues).toEqual({
+      'mcpServers.versioned-copy.type': 'streamable-http',
+      'mcpServers.versioned-copy.url': 'https://mcp.versioned.dev/mcp',
+      'mcpServers.versioned-copy.headers': HEADERS,
+      'mcpServers.versioned-copy.customUserVars': USER_VARS,
+    });
+  });
+
+  it('keeps the record whole on an older server too, so Save refuses the key instead of splitting it', async () => {
+    render(<Harness extra={versioned} />);
+    openMenu('versioned');
+    await act(async () => {
+      fireEvent.click(menuItem('com_config_mcp_action_duplicate'));
+    });
+    expect(edits.editedValues['mcpServers.versioned-copy.headers']).toEqual(HEADERS);
+    expect(splitPaths('versioned-copy', 'headers')).toEqual([]);
+  });
+
+  it('renames a server keeping its dotted header and user variable whole', async () => {
+    render(<Harness contract={dottedContract} extra={versioned} />);
+    openMenu('versioned');
+    await act(async () => {
+      fireEvent.click(menuItem('com_config_mcp_action_rename'));
+    });
+    const input = screen.getByRole('textbox', { name: 'com_a11y_rename_entry:versioned' });
+    fireEvent.change(input, { target: { value: 'versioned-v2' } });
+    fireEvent.keyDown(input, { key: 'Enter' });
+    expect(edits.editedValues).toEqual({
+      'mcpServers.versioned': undefined,
+      'mcpServers.versioned-v2.type': 'streamable-http',
+      'mcpServers.versioned-v2.url': 'https://mcp.versioned.dev/mcp',
+      'mcpServers.versioned-v2.headers': HEADERS,
+      'mcpServers.versioned-v2.customUserVars': USER_VARS,
+    });
+    expand('versioned-v2');
+    const headers = card('versioned-v2').querySelector<HTMLElement>(
+      '#mcpServers-versioned-v2-headers',
+    );
+    if (!headers) throw new Error('no headers editor');
+    expect(within(headers).getByDisplayValue('x.api.version')).toBeInTheDocument();
+  });
+});
+
 describe('McpServersRenderer — profiles (MCP-10)', () => {
   it('lists every inherited server read-only until its fields are overridden', () => {
     render(<Harness scope />);
diff --git a/src/components/configuration/sections/mcp/__tests__/logic.test.ts b/src/components/configuration/sections/mcp/__tests__/logic.test.ts
index 181d97da..2bb2d986 100644
--- a/src/components/configuration/sections/mcp/__tests__/logic.test.ts
+++ b/src/components/configuration/sections/mcp/__tests__/logic.test.ts
@@ -251,4 +251,13 @@ describe('leafEntries', () => {
       [['d'], {}],
     ]);
   });
+
+  it('keeps an object with a dotted key whole, so no dot-path splits the key', () => {
+    const headers = { 'X-Team': 'docs', 'x.api.version': '2024-10' };
+    expect(leafEntries({ url: 'https://x.dev', headers, apiKey: { source: 'admin' } })).toEqual([
+      [['url'], 'https://x.dev'],
+      [['headers'], headers],
+      [['apiKey', 'source'], 'admin'],
+    ]);
+  });
 });
diff --git a/src/components/configuration/sections/mcp/list.ts b/src/components/configuration/sections/mcp/list.ts
index 230ac4cf..2607b5b4 100644
--- a/src/components/configuration/sections/mcp/list.ts
+++ b/src/components/configuration/sections/mcp/list.ts
@@ -1,5 +1,6 @@
 import type * as t from '@/types';
 import { isPlainObject, resolveEntryKey, setLeaf, deepClone } from './validation';
+import { hasDottedKey } from '@/utils';
 
 function readLeaf(value: t.ConfigValue, segments: string[]): t.ConfigValue {
   let cursor = value;
@@ -10,14 +11,19 @@ function readLeaf(value: t.ConfigValue, segments: string[]): t.ConfigValue {
   return cursor;
 }
 
-/** Every leaf of an object as `[segments, value]`; arrays and scalars are leaves. */
+/**
+ * Every leaf of an object as `[segments, value]`; arrays and scalars are
+ * leaves, and so is an object with a dotted key (`hasDottedKey`: a header
+ * named `x.api.version`), which a dot-path built from the segments would
+ * split, so it is written whole.
+ */
 export function leafEntries(
   value: t.ConfigRecord,
   prefix: string[] = [],
 ): Array<[string[], t.ConfigValue]> {
   return Object.entries(value).flatMap(([key, child]): Array<[string[], t.ConfigValue]> => {
     const segments = [...prefix, key];
-    if (isPlainObject(child) && Object.keys(child).length > 0) {
+    if (isPlainObject(child) && Object.keys(child).length > 0 && !hasDottedKey(child)) {
       return leafEntries(child, segments);
     }
     return [[segments, child]];
diff --git a/src/components/configuration/sections/mcp/names.ts b/src/components/configuration/sections/mcp/names.ts
index f9cfadba..91332213 100644
--- a/src/components/configuration/sections/mcp/names.ts
+++ b/src/components/configuration/sections/mcp/names.ts
@@ -1,5 +1,3 @@
-import { isUnsafeConfigKey } from '@/utils';
-
 /** Characters LibreChat keeps in tool names as they are (others are replaced with `_`). */
 const NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
 
@@ -10,13 +8,14 @@ const TOOL_DELIMITER = '_mcp_';
 
 /**
  * Locale key of what is wrong with a new server name, or null: required,
- * no dots or leading `$` (the admin API drops such keys), not a reserved
+ * no dots or leading `$` (a field path can't address a dotted name, and the
+ * admin API drops or refuses `$` keys), not a reserved
  * word, letters, numbers, `-` and `_` only, not LibreChat's tool delimiter,
  * and not a name already in the list (in any letter case).
  */
 export function serverNameProblem(name: string, existing: Iterable<string>): string | null {
   if (name === '') return 'com_config_server_name_required';
-  if (isUnsafeConfigKey(name)) return 'com_config_server_name_no_dots';
+  if (name.includes('.') || name.startsWith('$')) return 'com_config_server_name_no_dots';
   if (RESERVED.has(name)) return 'com_config_server_name_invalid';
   if (!NAME_PATTERN.test(name)) return 'com_config_mcp_name_chars';
   if (name.includes(TOOL_DELIMITER)) return 'com_config_mcp_name_delimiter';
diff --git a/src/components/configuration/sections/mcp/transport.ts b/src/components/configuration/sections/mcp/transport.ts
index c743d66b..90da6752 100644
--- a/src/components/configuration/sections/mcp/transport.ts
+++ b/src/components/configuration/sections/mcp/transport.ts
@@ -1,5 +1,6 @@
 import type * as t from '@/types';
 import { isConfigRecord, hasConfigValue } from '@/utils';
+import { PROCESS_MCP_FIELDS } from '@/constants';
 
 /** Transports in the order the type choice lists them: Streamable HTTP is the default and recommended. */
 export const TRANSPORTS = ['streamable-http', 'sse', 'websocket', 'stdio'] as const;
@@ -16,13 +17,7 @@ export const INSPECTOR_DERIVED: ReadonlySet<string> = new Set([
 ]);
 
 /** A stdio server's process fields: only librechat.yaml can set them (D10). */
-export const PROCESS_FIELDS: ReadonlySet<string> = new Set([
-  'command',
-  'args',
-  'env',
-  'cwd',
-  'stderr',
-]);
+export const PROCESS_FIELDS: ReadonlySet<string> = new Set(PROCESS_MCP_FIELDS);
 
 /** Fields only one kind of transport reads. */
 const TRANSPORT_FIELDS: Readonly<Record<string, ReadonlySet<string>>> = {
diff --git a/src/components/users/UsersPage.tsx b/src/components/users/UsersPage.tsx
index fa1158fc..84128a55 100644
--- a/src/components/users/UsersPage.tsx
+++ b/src/components/users/UsersPage.tsx
@@ -19,12 +19,12 @@ import {
   ScreenReaderAnnouncer,
   SearchInput,
 } from '@/components/shared';
+import { SystemCapabilities, USER_DELETE_UNAVAILABLE } from '@/constants';
 import { useAnnouncement, useCapabilities, useLocalize } from '@/hooks';
-import { cn, notifySuccess, notifyError } from '@/utils';
+import { cn, errorText, notifySuccess, notifyError } from '@/utils';
 import { CreateUserDialog } from './CreateUserDialog';
 import { UserDetailDialog } from './UserDetailDialog';
 import { ConfirmDialog } from '@/components/access';
-import { SystemCapabilities } from '@/constants';
 
 const ROLE_FILTER_LABELS: Record<t.RoleFilter, string> = {
   all: 'com_ui_all',
@@ -72,7 +72,12 @@ export function UsersPage() {
       notifySuccess(localize('com_toast_user_deleted', { name: user.name }));
       setDeleteTarget(null);
     },
-    onError: (err: Error) => notifyError(err.message),
+    onError: (err: Error) =>
+      notifyError(
+        err.message === USER_DELETE_UNAVAILABLE
+          ? localize('com_users_delete_unavailable')
+          : errorText(err, localize('com_users_delete_failed'), localize),
+      ),
   });
 
   const applyFilters = (list: TUser[], q: string, role: t.RoleFilter) =>
diff --git a/src/constants/config.ts b/src/constants/config.ts
index 040fa77e..8daf6ec7 100644
--- a/src/constants/config.ts
+++ b/src/constants/config.ts
@@ -2,15 +2,15 @@ import { BASE_ONLY_CONFIG_SECTIONS, BASE_PRINCIPAL_CONFIG_SECTIONS } from 'libre
 import type * as t from '@/types';
 
 /**
- * LibreChat's request sanitizer silently drops object keys that contain `.` or
- * start with `$` from every admin config write, so the panel blocks them up
- * front. Set to `false` once the admin config API accepts such keys.
+ * Issue codes of a record key the admin API can't store. `UNSAFE_KEY`: an
+ * older LibreChat's request sanitizer silently drops keys that contain `.`
+ * or start with `$`. `RESERVED_KEY`: a server that keeps dotted keys
+ * (`dottedKeys`) refuses `$`-prefixed keys and the prototype names.
  */
-export const BLOCK_UNSAFE_CONFIG_KEYS = true;
+export const UNSAFE_KEY_CODES: ReadonlySet<string> = new Set(['UNSAFE_KEY', 'RESERVED_KEY']);
 
-/** Why a key blocked by `BLOCK_UNSAFE_CONFIG_KEYS` cannot be saved or imported. */
-export const UNSAFE_CONFIG_KEY_MESSAGE =
-  "keys containing '.' or starting with '$' can't be saved through the admin API yet; set this in librechat.yaml";
+/** `deleteUserFn`'s error when the LibreChat server has no admin user-delete route (it ships disabled). */
+export const USER_DELETE_UNAVAILABLE = 'user_delete_unavailable';
 
 /** The admin API's 403 code while the signed-in admin hasn't accepted LibreChat's terms of service. */
 export const TERMS_NOT_ACCEPTED_CODE = 'terms_not_accepted';
@@ -67,10 +67,32 @@ export const APP_SERVICE_KEY_ALIASES: Readonly<Record<string, string>> = {
   mcpConfig: 'mcpServers',
 };
 
+/**
+ * Settings LibreChat reads once at startup, from librechat.yaml alone
+ * (`getAppConfig({ baseOnly: true })` while the server boots), so an admin
+ * override never takes effect: the agents' background, event and approval
+ * hook runtime, and MCP catalog recovery's state limits and fence retry
+ * worker. `catalogRecovery.authorizationFenceTimeoutMs` is not one: requests
+ * read it from the merged config too.
+ */
+export const STARTUP_ONLY_FIELDS: ReadonlySet<string> = new Set([
+  'endpoints.agents.eventDriven',
+  'endpoints.agents.subagentActivity',
+  'endpoints.agents.toolApproval.hooks',
+  'endpoints.agents.backgroundTasks.shutdownInterruptGraceMs',
+  'endpoints.agents.backgroundTasks.completionResultBatchSize',
+  'endpoints.agents.backgroundTasks.completionReceiptBatching',
+  'mcpSettings.catalogRecovery.maxStateEntries',
+  'mcpSettings.catalogRecovery.maxDetachedDiscoveries',
+  'mcpSettings.catalogRecovery.authorizationFenceRetryIntervalMs',
+  'mcpSettings.catalogRecovery.authorizationFenceRetryBatchSize',
+]);
+
 /**
  * Fields LibreChat only processes from librechat.yaml (overrides are merged
- * after `azureConfigSetup`/`vertexConfigSetup` run), so edits would be silent
- * no-ops. Rendered read-only until the backend re-processes overrides.
+ * after `azureConfigSetup`/`vertexConfigSetup` run, or read only at startup),
+ * so edits would be silent no-ops. Rendered read-only until the backend
+ * re-processes overrides.
  */
 export const YAML_MANAGED_FIELDS: ReadonlySet<string> = new Set([
   'endpoints.azureOpenAI.groups',
@@ -80,6 +102,7 @@ export const YAML_MANAGED_FIELDS: ReadonlySet<string> = new Set([
   /** Social sign-in and OpenID discovery are set up once at startup from librechat.yaml. */
   'registration.oauthStateTtlMs',
   'registration.openidDiscovery',
+  ...STARTUP_ONLY_FIELDS,
 ]);
 
 /** Config keys for values that must never be displayed in plain text. */
@@ -107,6 +130,12 @@ export const SKIP_REASON_KEYS: Readonly<Record<t.SkipReason, string>> = {
   inheritedMerged: 'com_scope_skip_inherited_merged',
 };
 
+/** Why a lower-layer key comes back after a write: LibreChat merges it in, so it is reported but not lost. */
+export const MERGED_BACK_REASONS: ReadonlySet<t.SkipReason> = new Set([
+  'yamlMerged',
+  'inheritedMerged',
+]);
+
 /** The top-level config section of a dot-path (`balance.startBalance` → `balance`). */
 export function getConfigSection(path: string): string {
   const dot = path.indexOf('.');
@@ -118,10 +147,19 @@ export function getReadOnlyReason(path: string): t.ReadOnlyReason | undefined {
   return READ_ONLY_CONFIG_SECTIONS.get(getConfigSection(path));
 }
 
-/** Whether `path` is, or is inside, a field managed only in librechat.yaml. */
-export function isYamlManagedPath(path: string): boolean {
-  for (const managed of YAML_MANAGED_FIELDS) {
-    if (path === managed || path.startsWith(`${managed}.`)) return true;
+function isAtOrUnderAny(path: string, fields: ReadonlySet<string>): boolean {
+  for (const field of fields) {
+    if (path === field || path.startsWith(`${field}.`)) return true;
   }
   return false;
 }
+
+/** Whether `path` is, or is inside, a field managed only in librechat.yaml. */
+export function isYamlManagedPath(path: string): boolean {
+  return isAtOrUnderAny(path, YAML_MANAGED_FIELDS);
+}
+
+/** Whether `path` is, or is inside, a setting LibreChat reads only at startup (`STARTUP_ONLY_FIELDS`). */
+export function isStartupOnlyPath(path: string): boolean {
+  return isAtOrUnderAny(path, STARTUP_ONLY_FIELDS);
+}
diff --git a/src/constants/contract.ts b/src/constants/contract.ts
new file mode 100644
index 00000000..c0a4214d
--- /dev/null
+++ b/src/constants/contract.ts
@@ -0,0 +1,127 @@
+import {
+  configSchema,
+  PERMISSION_SUB_KEYS,
+  INTERFACE_PERMISSION_FIELDS,
+  BASE_PRINCIPAL_CONFIG_SECTIONS,
+  RUNTIME_CONFIG_INTERFACE_FIELDS,
+} from 'librechat-data-provider';
+import type * as t from '@/types';
+import { APP_SERVICE_KEY_ALIASES, READ_ONLY_CONFIG_SECTIONS } from './config';
+import { KEYED_COLLECTIONS } from './collections';
+
+/** Every flag of the admin config contract the panel reads. */
+export const CONFIG_FEATURE_FLAGS: readonly t.ConfigFeatureFlag[] = [
+  'dottedKeys',
+  'sectionAllowlist',
+  'readFilteredWriteResponses',
+  'preAuthBaseOverrides',
+  'webSearchStoredKeys',
+  'expectedRevision',
+  'prunesEmptyParents',
+  'awaitedInvalidation',
+  'changesBatch',
+  'yamlMcpHide',
+  'deterministicPrecedence',
+  'priorityRoute',
+  'principalCheck',
+  'roleRenameMovesProfile',
+  'recordSecrets',
+  'azureGroupSecrets',
+  'yamlSecretPreview',
+  'envAllowlist',
+  'secretRebinding',
+];
+
+/** A server without the meta route (or one that leaves a flag out) has none of these behaviours. */
+export const BUNDLED_CONFIG_FEATURES: t.ConfigFeatures = Object.fromEntries(
+  CONFIG_FEATURE_FLAGS.map((flag) => [flag, false]),
+) as Record<t.ConfigFeatureFlag, boolean>;
+
+/** The limits LibreChat enforced before it reported them. */
+export const BUNDLED_CONFIG_LIMITS: t.ConfigLimits = {
+  maxPatchEntries: 100,
+  maxChangeOps: 0,
+  overrideCacheTtlMs: 60_000,
+};
+
+/** A stdio MCP server's process fields: only librechat.yaml sets them (D10). */
+export const PROCESS_MCP_FIELDS: readonly string[] = ['command', 'args', 'env', 'cwd', 'stderr'];
+
+/** Secrets LibreChat encrypted before it reported its registry (`${VAR}` references stay readable). */
+const BUNDLED_SECRET_PATHS: ReadonlyArray<[path: string, allowEnvPlaceholder: boolean]> = [
+  ['langfuse.secretKey', false],
+  ['ocr.apiKey', true],
+  ['speech.tts.openai.apiKey', true],
+  ['speech.tts.azureOpenAI.apiKey', true],
+  ['speech.tts.elevenlabs.apiKey', true],
+  ['speech.tts.localai.apiKey', true],
+  ['speech.stt.openai.apiKey', true],
+  ['speech.stt.azureOpenAI.apiKey', true],
+  ['webSearch.serperApiKey', true],
+  ['webSearch.searxngApiKey', true],
+  ['webSearch.firecrawlApiKey', true],
+  ['webSearch.tavilyApiKey', true],
+  ['webSearch.jinaApiKey', true],
+  ['webSearch.cohereApiKey', true],
+  ['endpoints.assistants.apiKey', true],
+  ['endpoints.azureAssistants.apiKey', true],
+];
+
+const keyedCollections = [...KEYED_COLLECTIONS.values()];
+
+/**
+ * The write rules of a LibreChat server that does not report its own, as the
+ * panel knows them: the bundled config schema and data-provider constants,
+ * and the panel's mirrors of LibreChat's merge rules.
+ */
+export const BUNDLED_CONFIG_RULES: t.ConfigRules = {
+  acceptedSections: Object.keys(configSchema.shape),
+  baseOnlySections: [...READ_ONLY_CONFIG_SECTIONS]
+    .filter(([, reason]) => reason === 'baseOnly')
+    .map(([section]) => section),
+  basePrincipalSections: [...BASE_PRINCIPAL_CONFIG_SECTIONS],
+  baseOnlyPaths: [],
+  arrayMergeKeys: Object.fromEntries(
+    keyedCollections
+      .filter((collection) => collection.merge === 'byKey')
+      .map((collection) => [collection.path, collection.key]),
+  ),
+  atomicMergePaths: ['interface.theme'],
+  overrideKeyMap: Object.fromEntries(
+    Object.entries(APP_SERVICE_KEY_ALIASES).map(([alias, section]) => [section, alias]),
+  ),
+  secretFields: BUNDLED_SECRET_PATHS.map(([path, allowEnvPlaceholder]) => ({
+    path,
+    previewPath: `${path}Preview`,
+    allowEnvPlaceholder,
+  })),
+  arraySecretFields: keyedCollections.flatMap((collection) =>
+    collection.secret
+      ? [
+          {
+            arrayPath: collection.path,
+            secretKey: collection.secret.key,
+            previewKey: collection.secret.preview,
+            identityKey: collection.key,
+          },
+        ]
+      : [],
+  ),
+  recordSecretFields: [],
+  refusedMaps: ['langfuse.headers'],
+  processMcpFields: [...PROCESS_MCP_FIELDS],
+  interface: {
+    permissionFields: [...INTERFACE_PERMISSION_FIELDS],
+    runtimeFields: [...RUNTIME_CONFIG_INTERFACE_FIELDS],
+    permissionSubKeys: [...PERMISSION_SUB_KEYS],
+  },
+  titleResolution: 'block',
+};
+
+/** The contract of a LibreChat server without `GET /api/admin/config/meta`: every behaviour as before it. */
+export const BUNDLED_CONFIG_CONTRACT: t.ConfigContract = {
+  source: 'bundled',
+  features: BUNDLED_CONFIG_FEATURES,
+  limits: BUNDLED_CONFIG_LIMITS,
+  rules: BUNDLED_CONFIG_RULES,
+};
diff --git a/src/constants/index.ts b/src/constants/index.ts
index a114d861..1ed3112d 100644
--- a/src/constants/index.ts
+++ b/src/constants/index.ts
@@ -4,6 +4,7 @@ export * from './role';
 export * from './scope';
 export * from './config';
 export * from './collections';
+export * from './contract';
 export * from './providers';
 export * from './endpoints';
 export * from './features';
diff --git a/src/contexts/ContractContext.tsx b/src/contexts/ContractContext.tsx
new file mode 100644
index 00000000..f4694fab
--- /dev/null
+++ b/src/contexts/ContractContext.tsx
@@ -0,0 +1,22 @@
+import { createContext } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import type * as t from '@/types';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
+import { configContractOptions } from '@/server';
+
+/**
+ * The connected LibreChat server's admin config contract. Outside the
+ * provider, and until the server's has loaded, it is the bundled contract:
+ * every behaviour as it was before servers reported one.
+ */
+export const ConfigContractContext = createContext<t.ConfigContract>(BUNDLED_CONFIG_CONTRACT);
+
+/** Reads the server's contract once for the whole app (see `getAdminConfigMetaFn`). */
+export function ConfigContractProvider({ children }: t.ConfigContractProviderProps) {
+  const { data } = useQuery(configContractOptions);
+  return (
+    <ConfigContractContext.Provider value={data ?? BUNDLED_CONFIG_CONTRACT}>
+      {children}
+    </ConfigContractContext.Provider>
+  );
+}
diff --git a/src/hooks/config/contract.ts b/src/hooks/config/contract.ts
new file mode 100644
index 00000000..aa7bee95
--- /dev/null
+++ b/src/hooks/config/contract.ts
@@ -0,0 +1,31 @@
+import { useContext, useCallback } from 'react';
+import type * as t from '@/types';
+import { ConfigContractContext } from '@/contexts/ContractContext';
+import { useLocalize } from '../useLocalize';
+import { isUnsafeConfigKey } from '@/utils';
+
+/** The connected server's admin config contract (the bundled one until it loads, or without one). */
+export function useConfigContract(): t.ConfigContract {
+  return useContext(ConfigContractContext);
+}
+
+/** Which admin config behaviours the connected server has (all off for an older server). */
+export function useConfigFeatures(): t.ConfigFeatures {
+  return useContext(ConfigContractContext).features;
+}
+
+/**
+ * Why a record key can't be saved, or null: a key the admin API would drop
+ * (`$`-prefixed, a prototype name, and before `dottedKeys` any key with a dot).
+ */
+export function useConfigKeyProblem(): (key: string) => string | null {
+  const localize = useLocalize();
+  const { dottedKeys } = useConfigFeatures();
+  return useCallback(
+    (key: string) => {
+      if (!isUnsafeConfigKey(key, dottedKeys)) return null;
+      return localize(dottedKeys ? 'com_config_reserved_key_error' : 'com_config_unsafe_key_error');
+    },
+    [dottedKeys, localize],
+  );
+}
diff --git a/src/hooks/config/import.test.tsx b/src/hooks/config/import.test.tsx
index e74a69ef..e8772fc5 100644
--- a/src/hooks/config/import.test.tsx
+++ b/src/hooks/config/import.test.tsx
@@ -1,13 +1,16 @@
+import '@/locales/i18n';
 import { describe, it, expect, vi } from 'vitest';
+import { createToast } from '@clickhouse/click-ui';
+import { act, renderHook } from '@testing-library/react';
 import { configSchema, PrincipalType } from 'librechat-data-provider';
-import { renderHook } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { ReactNode } from 'react';
 import type * as t from '@/types';
 import { extractSchemaTree, getSchemaPathSet } from '@/server/config';
-import { useImportPreview } from './import';
-import { flattenObject } from '@/utils';
-import '@/locales/i18n';
+import { ConfigContractContext } from '@/contexts/ContractContext';
+import { useImportPreview, useConfigImport } from './import';
+import { flattenObject, setValueAtPath } from '@/utils';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 
 vi.mock('@/server', () => ({
   baseConfigOptions: { queryKey: ['baseConfig'], queryFn: vi.fn(), staleTime: Infinity },
@@ -16,6 +19,11 @@ vi.mock('@/server', () => ({
   createGroupFn: vi.fn(),
 }));
 
+vi.mock('@clickhouse/click-ui', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@clickhouse/click-ui')>();
+  return { ...actual, createToast: vi.fn() };
+});
+
 const tree = extractSchemaTree(configSchema as t.ZodSchemaLike);
 const schemaPathSet = getSchemaPathSet();
 const moonshot = {
@@ -84,15 +92,28 @@ const engineeringData: t.ResolvedConfigData = {
   tombstones: [],
 };
 
-function renderPreview(appConfig: t.ConfigRecord, target: t.ImportTarget = { type: 'base' }) {
+function renderPreview(
+  appConfig: t.ConfigRecord,
+  target: t.ImportTarget = { type: 'base' },
+  {
+    features = {},
+    baseData = base,
+  }: { features?: Partial<t.ConfigFeatures>; baseData?: t.BaseConfigData } = {},
+) {
   const client = new QueryClient();
-  client.setQueryData(['baseConfig'], base);
+  client.setQueryData(['baseConfig'], baseData);
   client.setQueryData(
     ['resolvedConfig', engineering.principalType, engineering.principalId],
     engineeringData,
   );
+  const contract: t.ConfigContract = {
+    ...BUNDLED_CONFIG_CONTRACT,
+    features: { ...BUNDLED_CONFIG_CONTRACT.features, ...features },
+  };
   const wrapper = ({ children }: { children: ReactNode }) => (
-    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+    <QueryClientProvider client={client}>
+      <ConfigContractContext.Provider value={contract}>{children}</ConfigContractContext.Provider>
+    </QueryClientProvider>
   );
   return renderHook(
     () => useImportPreview({ schemaTree: tree, schemaPathSet, appConfig, target }),
@@ -101,6 +122,109 @@ function renderPreview(appConfig: t.ConfigRecord, target: t.ImportTarget = { typ
 }
 
 describe('useImportPreview', () => {
+  it('on a server that keeps dotted keys, merges an imported dotted record into the stored one', () => {
+    const profiles = { 'us.anthropic.a': 'arn:a' };
+    const bedrock = { inferenceProfiles: profiles };
+    const baseData: t.BaseConfigData = {
+      ...base,
+      config: setValueAtPath(base.config, 'endpoints.bedrock', bedrock),
+      dbOverrides: setValueAtPath(dbOverrides, 'endpoints.bedrock', bedrock),
+    };
+    const { result } = renderPreview(
+      { endpoints: { bedrock: { inferenceProfiles: { 'us.anthropic.b': 'arn:b' } } } },
+      { type: 'base' },
+      { features: { dottedKeys: true }, baseData },
+    );
+    const rows = result.current.groups.flatMap((group) => group.rows.flatMap((row) => row.rows));
+    expect(rows.map((row) => row.item.kind)).toEqual(['added']);
+    expect(result.current.entriesFor(new Set(['endpoints.bedrock.inferenceProfiles']))).toEqual([
+      {
+        fieldPath: 'endpoints.bedrock.inferenceProfiles',
+        value: { 'us.anthropic.a': 'arn:a', 'us.anthropic.b': 'arn:b' },
+      },
+    ]);
+  });
+
+  it('on a server that keeps dotted keys, never lists librechat.yaml record keys as removed', () => {
+    const bedrock = { inferenceProfiles: { 'us.anthropic.a': 'arn:a' } };
+    const baseData: t.BaseConfigData = {
+      ...base,
+      config: setValueAtPath(base.config, 'endpoints.bedrock', bedrock),
+      yamlConfig: setValueAtPath(yamlConfig, 'endpoints.bedrock', bedrock),
+    };
+    const { result } = renderPreview(
+      { endpoints: { bedrock: { inferenceProfiles: { 'us.anthropic.b': 'arn:b' } } } },
+      { type: 'base' },
+      { features: { dottedKeys: true }, baseData },
+    );
+    const rows = result.current.groups.flatMap((group) => group.rows.flatMap((row) => row.rows));
+    expect(rows.map((row) => [row.item.kind, row.item.path])).toEqual([
+      ['added', 'endpoints.bedrock.inferenceProfiles.us.anthropic.b'],
+    ]);
+    expect(result.current.entriesFor(new Set(['endpoints.bedrock.inferenceProfiles']))).toEqual([
+      { fieldPath: 'endpoints.bedrock.inferenceProfiles', value: { 'us.anthropic.b': 'arn:b' } },
+    ]);
+  });
+
+  it('on a server that keeps dotted keys, imports MCP servers field by field and leaves a dotted name out', () => {
+    const cloudflare = { type: 'streamable-http', url: 'https://mcp.cloudflare.com/mcp' };
+    const everything = { type: 'streamable-http', url: 'https://everything.example.com/mcp' };
+    const stored = { timeout: 45000, initTimeout: 20000 };
+    const yaml = setValueAtPath(yamlConfig, 'mcpServers', { cloudflare, everything });
+    const baseData: t.BaseConfigData = {
+      ...base,
+      config: setValueAtPath(base.config, 'mcpServers', {
+        cloudflare: { ...cloudflare, ...stored },
+        everything,
+      }),
+      yamlConfig: yaml,
+      yamlPaths: Object.keys(flattenObject(yaml)),
+      dbOverrides: setValueAtPath(dbOverrides, 'mcpServers', { cloudflare: stored }),
+    };
+    const { result } = renderPreview(
+      {
+        mcpServers: {
+          'my.server': { type: 'streamable-http', url: 'https://example.com/mcp' },
+          cloudflare: { ...cloudflare, serverInstructions: 'Use carefully' },
+          everything: { serverInstructions: 'Sparse' },
+        },
+      },
+      { type: 'base' },
+      { features: { dottedKeys: true }, baseData },
+    );
+    const paths = new Set(result.current.plan?.entries.map((entry) => entry.fieldPath));
+    expect(paths.has('mcpServers')).toBe(false);
+    const rows = result.current.groups.flatMap((group) => group.rows.flatMap((row) => row.rows));
+    expect(rows.map((row) => [row.item.kind, row.item.path])).toEqual([
+      ['added', 'mcpServers.cloudflare.serverInstructions'],
+      ['added', 'mcpServers.everything.serverInstructions'],
+    ]);
+    expect(result.current.skipped).toEqual([
+      expect.objectContaining({
+        path: 'mcpServers',
+        label: expect.stringContaining('"my.server"'),
+        reason: expect.stringContaining('name with a dot'),
+      }),
+    ]);
+    expect(result.current.entriesFor(paths)).toEqual(
+      expect.arrayContaining([
+        { fieldPath: 'mcpServers.cloudflare.serverInstructions', value: 'Use carefully' },
+        { fieldPath: 'mcpServers.everything.serverInstructions', value: 'Sparse' },
+      ]),
+    );
+    expect(result.current.issuesFor(paths)).toEqual([]);
+  });
+
+  it('on an older server, leaves out a record holding a dotted key', () => {
+    const { result } = renderPreview({
+      endpoints: { bedrock: { inferenceProfiles: { 'us.anthropic.b': 'arn:b' } } },
+    });
+    expect(result.current.groups).toEqual([]);
+    expect(result.current.skipped.map((row) => row.path)).toEqual([
+      'endpoints.bedrock.inferenceProfiles',
+    ]);
+  });
+
   it('lists only the keys a partial custom endpoint sets, merged by name (D4)', () => {
     const { result } = renderPreview({
       endpoints: { custom: [{ name: 'Moonshot', modelDisplayLabel: 'Kimi Import' }] },
@@ -180,3 +304,54 @@ describe('useImportPreview', () => {
     expect(onBase.result.current.issuesFor(all)).toEqual(['Server URL is required']);
   });
 });
+
+describe('useConfigImport', () => {
+  function renderImport(skipped: t.SkippedChange[]) {
+    const client = new QueryClient();
+    const writeChanges = vi.fn<t.WriteChangesFn>().mockResolvedValue(skipped);
+    const describeSkipped = (items: t.SkippedChange[]) =>
+      items.map((item) => item.fieldPath).join(', ');
+    const wrapper = ({ children }: { children: ReactNode }) => (
+      <QueryClientProvider client={client}>{children}</QueryClientProvider>
+    );
+    const { result } = renderHook(() => useConfigImport({ writeChanges, describeSkipped }), {
+      wrapper,
+    });
+    return { result, writeChanges };
+  }
+  const entries: t.SaveEntry[] = [
+    { fieldPath: 'mcpServers.github.headers', value: { 'x-team.id': 'eng' } },
+    { fieldPath: 'balance.startBalance', value: 5 },
+  ];
+
+  it('reports keys LibreChat merges back as the merge asked for, not as left out', async () => {
+    const toast = vi.mocked(createToast);
+    toast.mockClear();
+    const { result, writeChanges } = renderImport([
+      { fieldPath: 'mcpServers.github.headers.Authorization', reason: 'yamlMerged' },
+    ]);
+    await act(() => result.current.handleImport({ target: { type: 'base' }, entries }));
+    expect(writeChanges).toHaveBeenCalledWith({ type: 'base' }, entries, []);
+    expect(toast).toHaveBeenCalledWith({
+      type: 'success',
+      title: 'Imported 2 values into the base configuration',
+    });
+  });
+
+  it('still reports a value that was not stored', async () => {
+    const toast = vi.mocked(createToast);
+    toast.mockClear();
+    const { result } = renderImport([
+      { fieldPath: 'mcpServers.github.headers.Authorization', reason: 'yamlMerged' },
+      { fieldPath: 'balance.startBalance', reason: 'notStored' },
+    ]);
+    await act(() => result.current.handleImport({ target: { type: 'base' }, entries }));
+    expect(toast).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: 'warning',
+        title: 'Imported 1 value into the base configuration',
+        description: 'balance.startBalance',
+      }),
+    );
+  });
+});
diff --git a/src/hooks/config/import.ts b/src/hooks/config/import.ts
index 38e807f9..86db70af 100644
--- a/src/hooks/config/import.ts
+++ b/src/hooks/config/import.ts
@@ -3,24 +3,12 @@ import { PrincipalType } from 'librechat-data-provider';
 import { useQuery, useQueryClient } from '@tanstack/react-query';
 import type * as t from '@/types';
 import {
-  locate,
-  fieldLabel,
-  describePath,
-  scopeTypeLabel,
-  buildReviewModel,
-  principalTypeLabel,
-} from '@/components/configuration/review/group';
-import {
-  lowerValue,
-  applySaves,
-  identityKeyFor,
-  summarizeChanges,
-} from '@/components/configuration/review/diff';
-import {
+  hasDottedKey,
   notifySuccess,
   notifyWarning,
   flattenObject,
   isConfigRecord,
+  asConfigRecord,
   getValueAtPath,
   revertTargetAt,
   createBaseLayers,
@@ -31,12 +19,28 @@ import {
   getKeyedCollection,
   stripSecretPreviewValues,
 } from '@/utils';
+import {
+  locate,
+  fieldLabel,
+  describePath,
+  scopeTypeLabel,
+  buildReviewModel,
+  principalTypeLabel,
+} from '@/components/configuration/review/group';
+import {
+  lowerValue,
+  applySaves,
+  identityKeyFor,
+  summarizeChanges,
+} from '@/components/configuration/review/diff';
 import { createRoleFn, createScopeFn, createGroupFn, baseConfigOptions } from '@/server';
 import { isConfigValueEqual, normalizeForSave } from '@/components/configuration/edits';
 import { planImport, IMPORT_SKIP_KEYS } from '@/components/configuration/import';
 import { findSchemaField } from '@/components/configuration/controls';
 import { describeIssues } from '@/components/configuration/issues';
 import { resolvedConfigOptions, runtimeDefaultAt } from './layers';
+import { MERGED_BACK_REASONS } from '@/constants';
+import { useConfigFeatures } from './contract';
 import { useLocalize } from '../useLocalize';
 
 /** Lists LibreChat merges with librechat.yaml by name; an import upserts their entries by name. */
@@ -164,6 +168,29 @@ function upsertByName(path: string, own: t.ConfigValue, incoming: t.ConfigValue)
   ];
 }
 
+/**
+ * A record of plain values imported whole (it holds a dotted key, which no
+ * path can address) merges into `record` key by key, as its keys would one
+ * by one (D4): into the target's own record for the write, so keys the YAML
+ * leaves out stay, and into what the target has now for the preview, since
+ * LibreChat merges the stored record over the layer beneath it.
+ */
+function mergeIntoRecord(record: t.ConfigValue, incoming: t.ConfigRecord): t.ConfigRecord {
+  return { ...asConfigRecord(record), ...incoming };
+}
+
+/** Whether a planned entry is a record imported whole (see `mergeIntoRecord`). */
+function isWholeRecord(value: t.ConfigValue): value is t.ConfigRecord {
+  return isConfigRecord(value) && hasDottedKey(value);
+}
+
+/** An entry as the preview compares it with `baseline`: a whole record reads merged into it. */
+function previewOf(entry: t.SaveEntry, baseline: t.ConfigRecord): t.SaveEntry {
+  if (!isWholeRecord(entry.value)) return entry;
+  const value = mergeIntoRecord(getValueAtPath(baseline, entry.fieldPath), entry.value);
+  return { fieldPath: entry.fieldPath, value };
+}
+
 /** Only the entries the import lists, so the preview never reads the others as removed. */
 function onlyImported(
   path: string,
@@ -201,6 +228,7 @@ export function useImportPreview({
   target,
 }: t.ImportPreviewOptions): t.ImportPreviewState {
   const localize = useLocalize();
+  const features = useConfigFeatures();
   const { data: base, isLoading: baseLoading } = useQuery(baseConfigOptions);
   const existingScope = target?.type === 'scope' && target.exists ? target.scope : undefined;
   const { data: scopeData, isLoading: scopeLoading } = useQuery(
@@ -211,8 +239,11 @@ export function useImportPreview({
 
   const isScopeTarget = target != null && target.type !== 'base';
   const plan = useMemo(
-    () => (appConfig ? planImport(appConfig, schemaTree, schemaPathSet, isScopeTarget) : undefined),
-    [appConfig, schemaTree, schemaPathSet, isScopeTarget],
+    () =>
+      appConfig
+        ? planImport(appConfig, schemaTree, schemaPathSet, isScopeTarget, features)
+        : undefined,
+    [appConfig, schemaTree, schemaPathSet, isScopeTarget, features],
   );
 
   /** librechat.yaml and the base overrides as layers, so a value is labelled by the layer that sets it. */
@@ -238,6 +269,11 @@ export function useImportPreview({
     const isScope = target.type !== 'base';
     const written = plan.entries.flatMap((entry): t.SaveEntry[] => {
       const path = entry.fieldPath;
+      if (isWholeRecord(entry.value)) {
+        return [
+          { fieldPath: path, value: mergeIntoRecord(getValueAtPath(own, path), entry.value) },
+        ];
+      }
       if (!MERGED_COLLECTIONS.has(path)) return [entry];
       const effective = isScope
         ? mergeConfigLayers(getValueAtPath(base.config, path), getValueAtPath(own, path), path)
@@ -295,7 +331,7 @@ export function useImportPreview({
         : baseline;
       const save = isMerged
         ? { fieldPath: path, value: withoutPreviews(mergedEntries(path, existing, entry.value)) }
-        : entry;
+        : previewOf(entry, baseline);
       const items = !written.has(path)
         ? []
         : summarizeChanges({
@@ -374,14 +410,24 @@ export function useImportPreview({
     [entries, own],
   );
 
-  /** The target's stored overrides and the layer beneath, as the validated write reads them. */
+  /** The target's stored overrides and tombstones and the layer beneath, as the validated write reads them. */
   const snapshot = useMemo<t.WriteSnapshot | null>(() => {
     if (!target || !base) return null;
     if (target.type === 'base') {
-      return { stored: base.dbOverrides ?? {}, lower: base.yamlConfig ?? {}, lowerKind: 'yaml' };
+      return {
+        stored: base.dbOverrides ?? {},
+        tombstones: base.dbTombstones,
+        lower: base.yamlConfig ?? {},
+        lowerKind: 'yaml',
+      };
     }
-    return { stored: own, lower: base.config ?? {}, lowerKind: 'inherited' };
-  }, [target, base, own]);
+    return {
+      stored: own,
+      tombstones: (existingScope && scopeData?.tombstones) || [],
+      lower: base.config ?? {},
+      lowerKind: 'inherited',
+    };
+  }, [target, base, own, existingScope, scopeData]);
 
   /** The same pre-flight the write runs, so the preview refuses what Import would (an endpoint with only a name). */
   const issuesFor = useCallback(
@@ -391,10 +437,10 @@ export function useImportPreview({
         ({ fieldPath, value }): t.ConfigChange => ({ op: 'set', path: fieldPath, value }),
       );
       if (ops.length === 0) return [];
-      const { issues } = planConfigChanges(ops, snapshot);
+      const { issues } = planConfigChanges(ops, snapshot, features);
       return describeIssues(issues, [], localize).summaries;
     },
-    [snapshot, entriesFor, localize],
+    [snapshot, entriesFor, features, localize],
   );
 
   return {
@@ -450,7 +496,10 @@ export function useConfigImport({
           queryClient.invalidateQueries({ queryKey: ['groups'] }),
         ]);
       }
-      const skipped = await writeChanges(writeTarget, entries, []);
+      /** Keys LibreChat merges back from the layer beneath are the merge an import asks for (D4), not a loss. */
+      const skipped = (await writeChanges(writeTarget, entries, [])).filter(
+        (item) => !MERGED_BACK_REASONS.has(item.reason),
+      );
       const written = Math.max(0, entries.length - skipped.length);
       const message =
         writeTarget.type === 'scope'
diff --git a/src/hooks/config/index.ts b/src/hooks/config/index.ts
index b5fddc6b..eb8d66b6 100644
--- a/src/hooks/config/index.ts
+++ b/src/hooks/config/index.ts
@@ -1,4 +1,5 @@
 export * from './baseline';
+export * from './contract';
 export * from './counts';
 export * from './draft';
 export * from './edits';
diff --git a/src/hooks/config/save.ts b/src/hooks/config/save.ts
index ee087773..f47a476f 100644
--- a/src/hooks/config/save.ts
+++ b/src/hooks/config/save.ts
@@ -16,15 +16,16 @@ import {
   ADMIN_API_KEY_FIELD,
   validateMcpCrossField,
 } from '@/components/configuration/sections/mcp/validation';
+import { TERMS_NOT_ACCEPTED_ISSUE, TERMS_NOT_ACCEPTED_CODE, UNSAFE_KEY_CODES } from '@/constants';
 import { buildConfigChanges, normalizeEditValue } from '@/components/configuration/edits';
 import { specListIssues } from '@/components/configuration/sections/specs/validation';
 import { isResetSent, summarizeChanges } from '@/components/configuration/summary';
 import { describeSkippedChanges } from '@/components/configuration/review/group';
-import { TERMS_NOT_ACCEPTED_ISSUE, TERMS_NOT_ACCEPTED_CODE } from '@/constants';
 import { applyConfigChangesFn, resetBaseConfigFn } from '@/server';
 import { describeIssues } from '@/components/configuration/issues';
 import { hasPathOverlap } from '@/components/configuration/counts';
 import { labelForPath } from '@/components/configuration/meta';
+import { useConfigFeatures } from './contract';
 import { useLocalize } from '../useLocalize';
 
 function toTargetRef(target: t.WriteTarget): t.WriteTargetRef {
@@ -80,6 +81,7 @@ export function useConfigSave({
 }: t.ConfigSaveOptions): t.ConfigSaveState {
   const localize = useLocalize();
   const queryClient = useQueryClient();
+  const features = useConfigFeatures();
   const {
     configValues,
     dbOverrides,
@@ -242,19 +244,28 @@ export function useConfigSave({
     [touchedPaths, editedValues, schemaPathSet, changeContext],
   );
 
-  /** The target's stored overrides and the layer beneath, as loaded (the server re-reads them). */
+  /** The target's stored overrides and tombstones and the layer beneath, as loaded (the server re-reads them). */
   const snapshot = useMemo<t.WriteSnapshot>(() => {
     if (isEditingScope) {
       return {
         stored: valueLayers?.scope?.overrides ?? {},
+        tombstones: [...(valueLayers?.scope?.tombstones ?? [])],
         lower: configValues ?? {},
         lowerKind: 'inherited',
       };
     }
-    return { stored: dbOverrides ?? {}, lower: yamlConfig ?? {}, lowerKind: 'yaml' };
+    return {
+      stored: dbOverrides ?? {},
+      tombstones: [...(valueLayers?.baseTombstones ?? [])],
+      lower: yamlConfig ?? {},
+      lowerKind: 'yaml',
+    };
   }, [isEditingScope, valueLayers, configValues, dbOverrides, yamlConfig]);
 
-  const plan = useMemo(() => planConfigChanges(changeSet.ops, snapshot), [changeSet, snapshot]);
+  const plan = useMemo(
+    () => planConfigChanges(changeSet.ops, snapshot, features),
+    [changeSet, snapshot, features],
+  );
 
   const clientIssues = useMemo(
     () => [...changeSet.issues, ...plan.issues, ...specListIssues(changeSet)],
@@ -302,7 +313,7 @@ export function useConfigSave({
   const unsafeKeys = useMemo(
     () =>
       plan.issues
-        .filter((issue) => issue.code === 'UNSAFE_KEY')
+        .filter((issue) => issue.code != null && UNSAFE_KEY_CODES.has(issue.code))
         .map((issue) => ({ path: issue.path, key: String(issue.params?.key ?? '') })),
     [plan.issues],
   );
diff --git a/src/locales/en/translation.json b/src/locales/en/translation.json
index 321e1948..20b0a33b 100644
--- a/src/locales/en/translation.json
+++ b/src/locales/en/translation.json
@@ -322,6 +322,7 @@
   "com_config_mcp_defined_in_base_yaml": "Defined in Base (librechat.yaml). Override its fields for this profile instead.",
   "com_config_mcp_override_note": "{{scope}} overrides this Base server. Only the fields you change here are saved for {{scope}}.",
   "com_config_mcp_dotted_name": "This server's name contains a dot, which the admin API can't store. Rename it in librechat.yaml to edit it here.",
+  "com_config_mcp_dotted_name_paths": "This server's name contains a dot, so its settings can't be saved one by one here. Rename it in librechat.yaml to edit it here.",
   "com_config_mcp_draft_label": "New server",
   "com_config_mcp_enum_auth_basic": "Basic auth",
   "com_config_mcp_enum_auth_bearer": "Bearer token",
@@ -523,6 +524,9 @@
   "com_config_review_import_show_unchanged_other": "Show {{count}} settings that are already set",
   "com_config_review_import_skip_process": "process-backed (stdio) MCP servers can only be defined in librechat.yaml",
   "com_config_review_import_skip_unsafe": "keys containing '.' or starting with '$' can't be saved through the admin API yet; set this in librechat.yaml",
+  "com_config_review_import_skip_reserved": "keys starting with '$', and the names __proto__, constructor and prototype, can't be saved",
+  "com_config_review_import_skip_dotted": "a key with a dot can name entries (headers, inference profiles, MIME types), not settings",
+  "com_config_review_import_skip_dotted_name": "a name with a dot can't be imported here: its settings are saved one by one, and a setting path can't name it. Rename it without the dot",
   "com_config_review_import_skip_hidden_secret": "LibreChat hides the librechat.yaml key here, so the import cannot tell whether this one differs; replace it in the endpoint card",
   "com_config_review_import_skipped_title_one": "{{count}} key won't be imported",
   "com_config_review_import_skipped_title_other": "{{count}} keys won't be imported",
@@ -684,15 +688,26 @@
   "com_config_issue_too_small_length": "must be at least {{minimum}} characters",
   "com_config_issue_union_dropped_key": "isn't valid for this kind of value",
   "com_config_issue_unsafe_key": "has a key LibreChat can't store yet (\"{{key}}\" contains '.' or starts with '$'); set it in librechat.yaml",
+  "com_config_issue_reserved_key": "has a key LibreChat can't store (\"{{key}}\" starts with '$' or is a reserved name); rename it",
+  "com_config_issue_dotted_key": "has a key with a dot where LibreChat expects a setting's name",
+  "com_config_issue_unknown_section": "isn't a section LibreChat knows",
+  "com_config_issue_invalid_value": "is not a valid value",
+  "com_config_issue_wrong_type": "has the wrong type of value",
+  "com_config_issue_invalid_option": "is not one of the allowed values",
+  "com_config_issue_too_small_value": "is too small",
+  "com_config_issue_too_big_value": "is too large",
   "com_config_issue_yaml_entry_immutable": "\"{{name}}\" is defined in librechat.yaml, so it can't be {{action}} here",
   "com_config_issue_yaml_managed": "is managed in librechat.yaml; LibreChat ignores admin overrides for it until it re-processes them",
   "com_config_unsafe_key_error": "Keys containing '.' or starting with '$' can't be saved through the admin API yet. Set this in librechat.yaml.",
+  "com_config_reserved_key_error": "Keys starting with '$', and the names __proto__, constructor and prototype, can't be saved. Choose another key.",
   "com_config_base_only_section": "Configured in librechat.yaml only. LibreChat ignores admin overrides for this section, so it is read-only here and shows the current librechat.yaml values.",
   "com_config_yaml_only_section": "Read from librechat.yaml when LibreChat starts. Admin overrides have no effect, so this section is read-only here and shows the current librechat.yaml values.",
   "com_config_read_only_empty": "Nothing here is set in librechat.yaml, so LibreChat's defaults apply.",
   "com_config_read_only_show_fields": "Show all fields",
   "com_config_read_only_hide_fields": "Hide fields",
   "com_config_yaml_managed_field": "Managed in librechat.yaml until LibreChat applies admin overrides for this setting. Shown read-only.",
+  "com_config_startup_only_field_one": "LibreChat reads the setting below only when it starts, and only from librechat.yaml: admin overrides never take effect. Shown read-only.",
+  "com_config_startup_only_field_other": "LibreChat reads the {{count}} settings below only when it starts, and only from librechat.yaml: admin overrides never take effect. Shown read-only.",
   "com_config_stale_override": "A stored admin override for this setting has no effect.",
   "com_config_stale_override_pending": "The stale override will be removed when you save.",
   "com_config_remove_stale_override": "Remove stale override",
@@ -2025,6 +2040,7 @@
   "com_config_field_jwksUri": "JWKS URI",
   "com_config_features_cred_default": "Not set here: LibreChat reads the {{env}} environment variable on the server.",
   "com_config_features_cred_env": "Read from the {{env}} environment variable on the server.",
+  "com_config_features_cred_env_only": "This LibreChat server reads web search settings only from environment variable references such as {{ref}}, so a value entered here is ignored. Reference an environment variable instead.",
   "com_config_features_cred_key_placeholder": "Paste a key, or {{ref}}",
   "com_config_features_cred_missing": "{{service}} needs this. Paste a value, or reference an environment variable such as {{ref}}.",
   "com_config_features_cred_pending": "Will be stored encrypted when you save.",
@@ -2943,6 +2959,8 @@
   "com_users_role_label": "Role",
   "com_users_delete_title": "Delete user",
   "com_users_delete_desc": "Are you sure you want to delete {{name}}? This action cannot be undone.",
+  "com_users_delete_failed": "The user could not be deleted.",
+  "com_users_delete_unavailable": "This LibreChat server doesn't allow deleting users through the admin API yet, so the user was not deleted.",
   "com_users_no_assignments": "No roles or groups assigned",
   "com_users_assign_role": "Add to role…",
   "com_users_assign_group": "Add to group…",
@@ -3028,6 +3046,8 @@
   "com_access_group_name_placeholder": "e.g. Engineering",
   "com_access_group_desc_placeholder": "Optional description…",
   "com_access_role_name_placeholder": "e.g. Content Moderator",
+  "com_access_rename_profile_warning": "This role has a configuration profile, stored under \"{{name}}\". Renaming the role leaves the profile there: it stops applying to the role's members, and a role created later with that name would get it.",
+  "com_access_rename_profile_moves": "Its configuration profile is renamed with it.",
   "com_access_role_desc_placeholder": "Optional description…",
   "com_access_active": "Active",
   "com_access_paused": "Paused",
diff --git a/src/routes/_app.tsx b/src/routes/_app.tsx
index deab9e03..1f7f741f 100644
--- a/src/routes/_app.tsx
+++ b/src/routes/_app.tsx
@@ -3,6 +3,7 @@ import { Icon } from '@clickhouse/click-ui';
 import { createFileRoute, Outlet, useRouter, Link, redirect } from '@tanstack/react-router';
 import type { ErrorComponentProps } from '@tanstack/react-router';
 import { useCapabilities, useCommandMenu, useLocalize } from '@/hooks';
+import { ConfigContractProvider } from '@/contexts/ContractContext';
 import { CommandMenu } from '@/components/CommandMenu';
 import { AccessDenied } from '@/components/shared';
 import { SystemCapabilities } from '@/constants';
@@ -79,16 +80,18 @@ function AppLayout() {
   const title = matchedKey ? localize(ROUTE_TITLE_KEYS[matchedKey]) : undefined;
 
   return (
-    <div className="flex h-screen overflow-hidden">
-      <Sidebar user={user} collapsed={sidebarCollapsed} onToggle={toggleSidebar} />
-      <div className="flex min-w-0 flex-1 flex-col">
-        <Header title={title} onSearchClick={() => setOpen(true)} />
-        <main className="flex min-h-0 flex-1 flex-col overflow-auto">
-          <Outlet />
-        </main>
+    <ConfigContractProvider>
+      <div className="flex h-screen overflow-hidden">
+        <Sidebar user={user} collapsed={sidebarCollapsed} onToggle={toggleSidebar} />
+        <div className="flex min-w-0 flex-1 flex-col">
+          <Header title={title} onSearchClick={() => setOpen(true)} />
+          <main className="flex min-h-0 flex-1 flex-col overflow-auto">
+            <Outlet />
+          </main>
+        </div>
+        <CommandMenu open={open} onOpenChange={setOpen} />
       </div>
-      <CommandMenu open={open} onOpenChange={setOpen} />
-    </div>
+    </ConfigContractProvider>
   );
 }
 
diff --git a/src/server/config.test.ts b/src/server/config.test.ts
index bb038361..e025563a 100644
--- a/src/server/config.test.ts
+++ b/src/server/config.test.ts
@@ -78,39 +78,60 @@ function findField(fields: t.SchemaField[], key: string): t.SchemaField | undefi
 }
 
 describe('applyLangfuseSchemaVisibility', () => {
+  const langfuseTree = () =>
+    extractSchemaTree(z3.object({ langfuse: z3.object({ schemaOnlyField: z3.string() }) }));
+
   it('removes a Langfuse section supplied by the schema when fanout is disabled', () => {
     const tree = extractSchemaTree(z3.object({ langfuse: z3.object({ enabled: z3.boolean() }) }));
 
-    applyLangfuseSchemaVisibility(tree, false);
+    applyLangfuseSchemaVisibility(tree, { langfuseFanoutEnabled: false });
 
     expect(findField(tree, 'langfuse')).toBeUndefined();
   });
 
   it('preserves the schema-provided Langfuse section when fanout is enabled', () => {
-    const tree = extractSchemaTree(
-      z3.object({ langfuse: z3.object({ schemaOnlyField: z3.string() }) }),
-    );
+    const tree = langfuseTree();
 
-    applyLangfuseSchemaVisibility(tree, true);
+    applyLangfuseSchemaVisibility(tree, { langfuseFanoutEnabled: true });
 
     expect(findField(tree, 'schemaOnlyField')).toBeDefined();
     expect(tree.filter((field) => field.key === 'langfuse')).toHaveLength(1);
   });
 
   it('preserves a schema-provided Langfuse section when fanout state is unknown', () => {
-    const tree = extractSchemaTree(
-      z3.object({ langfuse: z3.object({ schemaOnlyField: z3.string() }) }),
-    );
+    const tree = langfuseTree();
 
     applyLangfuseSchemaVisibility(tree, undefined);
 
     expect(findField(tree, 'schemaOnlyField')).toBeDefined();
   });
 
+  it('hides the section when LibreChat denies the admin connection access, fanout on or not', () => {
+    const tree = langfuseTree();
+
+    applyLangfuseSchemaVisibility(tree, {
+      langfuseFanoutEnabled: true,
+      langfuseConnectionAccess: false,
+    });
+
+    expect(findField(tree, 'langfuse')).toBeUndefined();
+  });
+
+  it('keeps the section when LibreChat grants connection access', () => {
+    const tree = langfuseTree();
+
+    applyLangfuseSchemaVisibility(tree, {
+      langfuseFanoutEnabled: true,
+      langfuseConnectionAccess: true,
+    });
+
+    expect(findField(tree, 'schemaOnlyField')).toBeDefined();
+  });
+
   it('keeps the Langfuse section shipped in the pinned configSchema', () => {
     const tree = extractSchemaTree(realConfigSchema);
 
-    applyLangfuseSchemaVisibility(tree, true);
+    applyLangfuseSchemaVisibility(tree, { langfuseFanoutEnabled: true });
 
     expect(findField(tree, 'langfuse')?.isObject).toBe(true);
     expect(findField(tree, 'destination')?.path).toBe('langfuse.destination');
@@ -1331,7 +1352,7 @@ function preflight(saves: t.SaveEntry[], resets: string[] = []) {
     ...saves.map(({ fieldPath, value }): t.ConfigChange => ({ op: 'set', path: fieldPath, value })),
     ...resets.map((path): t.ConfigChange => ({ op: 'reset', path })),
   ];
-  const plan = planConfigChanges(ops, { stored: {}, lower: {}, lowerKind: 'yaml' });
+  const plan = planConfigChanges(ops, { stored: {}, tombstones: [], lower: {}, lowerKind: 'yaml' });
   return { issues: plan.issues, skipped: plan.skipped };
 }
 
diff --git a/src/server/config/index.ts b/src/server/config/index.ts
index d478a8e8..229b4d2c 100644
--- a/src/server/config/index.ts
+++ b/src/server/config/index.ts
@@ -3,3 +3,4 @@ export * from './base';
 export * from './normalize';
 export * from './save';
 export * from './import';
+export * from './meta';
diff --git a/src/server/config/meta.test.ts b/src/server/config/meta.test.ts
new file mode 100644
index 00000000..169731bd
--- /dev/null
+++ b/src/server/config/meta.test.ts
@@ -0,0 +1,101 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { BUNDLED_CONFIG_RULES, BUNDLED_CONFIG_LIMITS, BUNDLED_CONFIG_CONTRACT } from '@/constants';
+
+const apiFetchMock = vi.fn();
+
+vi.mock('../utils/api', () => ({
+  apiFetch: (path: string, init?: RequestInit) => apiFetchMock(path, init),
+}));
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({ handler: (fn: (...args: never[]) => unknown) => fn }),
+}));
+
+import { getAdminConfigMetaFn, readConfigContract } from './meta';
+
+/** `GET /api/admin/config/meta` as a LibreChat server with the contract answers it (abridged). */
+const META = {
+  metaVersion: 1,
+  versions: { librechat: 'v0.8.9-rc1', dataProvider: '0.8.528', configSchema: '1.3.18' },
+  features: { dottedKeys: true, webSearchStoredKeys: true, roleRenameMovesProfile: true },
+  limits: { maxPatchEntries: 100, maxChangeOps: 1000, overrideCacheTtlMs: 60000 },
+  rules: {
+    arrayMergeKeys: { 'endpoints.custom': 'name', 'endpoints.azureOpenAI.groups': 'group' },
+    recordSecretFields: [
+      { recordPath: 'mcpServers', secretPath: 'apiKey.key', previewPath: 'apiKey.keyPreview' },
+    ],
+    titleResolution: 'field',
+  },
+};
+
+function reply(status: number, body?: object): Response {
+  return new Response(body ? JSON.stringify(body) : null, { status });
+}
+
+beforeEach(() => {
+  apiFetchMock.mockReset();
+});
+
+describe('readConfigContract', () => {
+  it("reads the server's features, limits and rules", async () => {
+    apiFetchMock.mockResolvedValue(reply(200, META));
+    const contract = await readConfigContract();
+    expect(apiFetchMock).toHaveBeenCalledWith('/api/admin/config/meta', undefined);
+    expect(contract.source).toBe('server');
+    expect(contract.versions).toEqual(META.versions);
+    expect(contract.features).toMatchObject({
+      dottedKeys: true,
+      webSearchStoredKeys: true,
+      roleRenameMovesProfile: true,
+      changesBatch: false,
+    });
+    expect(contract.limits).toEqual(META.limits);
+    expect(contract.rules.arrayMergeKeys).toEqual(META.rules.arrayMergeKeys);
+    expect(contract.rules.recordSecretFields).toEqual(META.rules.recordSecretFields);
+    expect(contract.rules.titleResolution).toBe('field');
+    expect(contract.rules.processMcpFields).toEqual(BUNDLED_CONFIG_RULES.processMcpFields);
+  });
+
+  it.each([
+    ['an older server without the route', 404],
+    ['a caller without config read access', 403],
+    ['an expired session', 401],
+    ['a failing server', 500],
+  ])('falls back to the bundled contract for %s', async (_case, status) => {
+    apiFetchMock.mockResolvedValue(reply(status, { message: 'Endpoint not found' }));
+    await expect(readConfigContract()).resolves.toBe(BUNDLED_CONFIG_CONTRACT);
+  });
+
+  it('falls back to the bundled contract when the request throws', async () => {
+    apiFetchMock.mockRejectedValue(new Error('No admin session token available'));
+    await expect(readConfigContract()).resolves.toBe(BUNDLED_CONFIG_CONTRACT);
+  });
+
+  it('reads a malformed part as not reported, keeping the rest', async () => {
+    apiFetchMock.mockResolvedValue(
+      reply(200, {
+        features: { dottedKeys: 'yes', webSearchStoredKeys: true },
+        limits: { maxPatchEntries: 0, overrideCacheTtlMs: 5000 },
+        rules: { titleResolution: 'sometimes', arrayMergeKeys: ['endpoints.custom'] },
+      }),
+    );
+    const contract = await readConfigContract();
+    expect(contract.features.dottedKeys).toBe(false);
+    expect(contract.features.webSearchStoredKeys).toBe(true);
+    expect(contract.limits).toEqual({ ...BUNDLED_CONFIG_LIMITS, overrideCacheTtlMs: 5000 });
+    expect(contract.rules.titleResolution).toBe('block');
+    expect(contract.rules.arrayMergeKeys).toEqual(BUNDLED_CONFIG_RULES.arrayMergeKeys);
+  });
+
+  it('treats a reply that is not an object as no contract', async () => {
+    apiFetchMock.mockResolvedValue(new Response('"ok"', { status: 200 }));
+    await expect(readConfigContract()).resolves.toBe(BUNDLED_CONFIG_CONTRACT);
+  });
+});
+
+describe('getAdminConfigMetaFn', () => {
+  it('returns the contract readConfigContract resolves', async () => {
+    apiFetchMock.mockResolvedValue(reply(404));
+    await expect(getAdminConfigMetaFn()).resolves.toBe(BUNDLED_CONFIG_CONTRACT);
+  });
+});
diff --git a/src/server/config/meta.ts b/src/server/config/meta.ts
new file mode 100644
index 00000000..8be121a1
--- /dev/null
+++ b/src/server/config/meta.ts
@@ -0,0 +1,96 @@
+import { z } from 'zod';
+import { queryOptions } from '@tanstack/react-query';
+import { createServerFn } from '@tanstack/react-start';
+import type * as t from '@/types';
+import { resolveConfigContract } from '@/utils';
+import { apiFetch } from '../utils/api';
+
+/** A part of the reply that is missing or malformed reads as not reported (the bundled value applies). */
+function lenient<T extends z.ZodType>(schema: T): z.ZodCatch<z.ZodOptional<T>> {
+  return schema.optional().catch(undefined);
+}
+
+const text = z.string();
+const names = z.array(z.string());
+const count = z.number().int().nonnegative();
+const nameMap = z.record(z.string(), z.string());
+
+const rulesSchema = z.object({
+  acceptedSections: lenient(names),
+  baseOnlySections: lenient(names),
+  basePrincipalSections: lenient(names),
+  baseOnlyPaths: lenient(names),
+  arrayMergeKeys: lenient(nameMap),
+  atomicMergePaths: lenient(names),
+  overrideKeyMap: lenient(nameMap),
+  secretFields: lenient(
+    z.array(z.object({ path: text, previewPath: text, allowEnvPlaceholder: z.boolean() })),
+  ),
+  arraySecretFields: lenient(
+    z.array(z.object({ arrayPath: text, secretKey: text, previewKey: text, identityKey: text })),
+  ),
+  recordSecretFields: lenient(
+    z.array(z.object({ recordPath: text, secretPath: text, previewPath: text })),
+  ),
+  refusedMaps: lenient(names),
+  processMcpFields: lenient(names),
+  interface: lenient(
+    z.object({ permissionFields: names, runtimeFields: names, permissionSubKeys: names }),
+  ),
+  titleResolution: lenient(z.enum(['block', 'field'])),
+});
+
+/** `GET /api/admin/config/meta`, read leniently: forks and newer servers may add, drop or reshape parts. */
+const metaSchema = z.object({
+  versions: lenient(
+    z.object({ librechat: text, dataProvider: text, configSchema: text }).partial(),
+  ),
+  features: lenient(z.record(z.string(), z.boolean().catch(false))),
+  limits: lenient(
+    z.object({
+      maxPatchEntries: lenient(z.number().int().positive()),
+      maxChangeOps: lenient(count),
+      overrideCacheTtlMs: lenient(count),
+    }),
+  ),
+  rules: lenient(rulesSchema),
+});
+
+/** Statuses of a server without the meta route (404) or a caller who may not read it (401, 403). */
+const NO_CONTRACT_STATUSES: ReadonlySet<number> = new Set([401, 403, 404]);
+
+/**
+ * The connected LibreChat server's admin config contract. A server without
+ * `GET /api/admin/config/meta` (an older LibreChat), a caller who may not
+ * read it, and a reply that can't be read all get the bundled contract, so
+ * every behaviour stays as it was before the server reported one.
+ */
+export async function readConfigContract(): Promise<t.ConfigContract> {
+  try {
+    const response = await apiFetch('/api/admin/config/meta');
+    if (!response.ok) {
+      if (!NO_CONTRACT_STATUSES.has(response.status)) {
+        console.warn(`[readConfigContract] meta request failed: ${response.status}`);
+      }
+      return resolveConfigContract(null);
+    }
+    const parsed = metaSchema.safeParse(await response.json());
+    return resolveConfigContract(parsed.success ? parsed.data : null);
+  } catch (error) {
+    console.warn('[readConfigContract] meta request failed:', error);
+    return resolveConfigContract(null);
+  }
+}
+
+/** The admin config contract of the connected LibreChat server (see `readConfigContract`). */
+export const getAdminConfigMetaFn = createServerFn({ method: 'GET' }).handler(
+  (): Promise<t.ConfigContract> => readConfigContract(),
+);
+
+/** Shared query: every page reads the same contract, refreshed every few minutes. */
+export const configContractOptions = queryOptions({
+  queryKey: ['configContract'],
+  queryFn: () => getAdminConfigMetaFn(),
+  staleTime: 5 * 60_000,
+  retry: false,
+});
diff --git a/src/server/config/save.test.ts b/src/server/config/save.test.ts
index 565a09de..f9e21637 100644
--- a/src/server/config/save.test.ts
+++ b/src/server/config/save.test.ts
@@ -292,6 +292,27 @@ describe('applyConfigChanges — validated, ordered, compensated (SV-2)', () =>
     expect(api.current!.stored()).toBeUndefined();
   });
 
+  it('words a backend issue it gets no parameters for without placeholders', async () => {
+    api.current!.setOverride((request) =>
+      request.method === 'PATCH'
+        ? {
+            status: 400,
+            body: {
+              error: 'Invalid config override',
+              code: 'CONFIG_OVERRIDE_INVALID',
+              issues: [{ path: 'balance.startBalance', code: 'too_small' }],
+            },
+          }
+        : undefined,
+    );
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'balance.startBalance', value: 5 },
+    ]);
+    expect(result.failed).toEqual([
+      { path: 'balance.startBalance', code: 'too_small', message: 'is too small' },
+    ]);
+  });
+
   it('blocks provider: openai with the field and entry named', async () => {
     const gpt = customEntries[1];
     const result = await applyConfigChanges(base, [
@@ -325,6 +346,15 @@ describe('applyConfigChanges — clear/reset and verification (SV-4, SV-5, SV-7)
     expect(api.current!.stored()).toEqual({});
   });
 
+  it('keeps a stored tombstone when removing an override would empty its section (BE-11)', async () => {
+    api.current!.seed('role/__base__', { balance: { startBalance: 5 } }, ['balance.refillAmount']);
+    await applyConfigChanges(base, [{ op: 'reset', path: 'balance.startBalance' }]);
+    expect(api.current!.writes()).toMatchObject([
+      { method: 'DELETE', path: expect.stringContaining('fieldPath=balance.startBalance') },
+    ]);
+    expect(api.current!.tombstones()).toEqual(['balance.refillAmount']);
+  });
+
   it('reports a value LibreChat dropped as not stored', async () => {
     api.current!.stripSection('speech');
     const result = await applyConfigChanges(base, [
@@ -440,3 +470,51 @@ describe('applyConfigChanges — switching a union away from a librechat.yaml ke
     expect(api.current.writes()).toEqual([]);
   });
 });
+
+describe('applyConfigChanges — the server contract (GET /api/admin/config/meta)', () => {
+  const profiles = { 'us.anthropic.claude-sonnet-4-6': 'arn:aws:bedrock:us:1:profile/x' };
+
+  it('blocks a dotted record key on a server without the contract (it would drop the key)', async () => {
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'endpoints.bedrock.inferenceProfiles', value: profiles },
+    ]);
+    expect(result.issues.map((issue) => issue.code)).toEqual(['UNSAFE_KEY']);
+    expect(api.current!.writes()).toEqual([]);
+    expect(api.current!.requests.map((request) => request.path)).toContain(
+      '/api/admin/config/meta',
+    );
+  });
+
+  it('writes a dotted record whole when the server keeps dotted keys', async () => {
+    api.current!.reportMeta({ features: { dottedKeys: true } });
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'endpoints.bedrock.inferenceProfiles', value: profiles },
+    ]);
+    expect(result).toMatchObject({ issues: [], failed: [], applied: 1, skipped: [] });
+    expect(api.current!.writes()).toMatchObject([
+      {
+        method: 'PATCH',
+        body: { entries: [{ fieldPath: 'endpoints.bedrock.inferenceProfiles', value: profiles }] },
+      },
+    ]);
+  });
+
+  it('still refuses a $ key when the server keeps dotted keys', async () => {
+    api.current!.reportMeta({ features: { dottedKeys: true } });
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'endpoints.bedrock.inferenceProfiles', value: { $where: 'x' } },
+    ]);
+    expect(result.issues.map((issue) => issue.code)).toEqual(['RESERVED_KEY']);
+    expect(api.current!.writes()).toEqual([]);
+  });
+
+  it("splits sets into PATCHes of the server's maxPatchEntries", async () => {
+    api.current!.reportMeta({ limits: { maxPatchEntries: 2 } });
+    await applyConfigChanges(base, [
+      { op: 'set', path: 'balance.startBalance', value: 5 },
+      { op: 'set', path: 'balance.refillAmount', value: 6 },
+      { op: 'set', path: 'balance.refillIntervalValue', value: 7 },
+    ]);
+    expect(api.current!.writes().map((request) => request.body?.entries?.length)).toEqual([2, 1]);
+  });
+});
diff --git a/src/server/config/save.ts b/src/server/config/save.ts
index 0ffc5559..7f0bcd79 100644
--- a/src/server/config/save.ts
+++ b/src/server/config/save.ts
@@ -2,7 +2,6 @@ import { z } from 'zod';
 import { createServerFn } from '@tanstack/react-start';
 import { PrincipalType } from 'librechat-data-provider';
 import { SystemCapabilities } from '@librechat/data-schemas/capabilities';
-import type { AdminConfigResponse } from '@librechat/data-schemas';
 import type * as t from '@/types';
 import {
   verifyWrite,
@@ -13,27 +12,31 @@ import {
   getKeyedCollection,
   getWriteSkipReason,
   describeIssueCode,
+  paramlessIssueCode,
   stripSecretPreviewValues,
 } from '@/utils';
+import {
+  getConfigSection,
+  MERGED_BACK_REASONS,
+  TERMS_NOT_ACCEPTED_CODE,
+  TERMS_NOT_ACCEPTED_ISSUE,
+} from '@/constants';
 import {
   requireCapability,
   requireAnyCapability,
   requireAllSectionCapabilities,
 } from '../capabilities';
-import { getConfigSection, TERMS_NOT_ACCEPTED_CODE, TERMS_NOT_ACCEPTED_ISSUE } from '@/constants';
 import { apiErrorMessage, apiFetch } from '../utils/api';
 import { BASE_CONFIG_PRINCIPAL_ID } from '../constants';
 import { MISSING_SCOPE_MESSAGE } from '../scopes/read';
 import { normalizeAppServiceKeys } from './normalize';
 import { safeFieldPath } from '../utils/validation';
 import { getApiBaseUrl } from '../utils/url';
+import { readConfigContract } from './meta';
 import { getSchemaPathSet } from './schema';
 
 export { parseIndexedArrayPath } from '@/utils';
 
-/** The admin API accepts at most this many entries per PATCH. */
-const MAX_PATCH_ENTRIES = 100;
-
 /** How long to wait before re-reading the effective config once (LibreChat clears its caches asynchronously). */
 const VERIFY_RETRY_MS = 400;
 
@@ -64,18 +67,28 @@ async function readJson<T>(response: Response): Promise<T> {
 }
 
 /**
- * The target's stored overrides (redacted by the admin API); `{}` when base
- * has no config yet. A profile whose document is gone is refused (PR-3): the
- * admin API would otherwise silently recreate it, active and at the default
- * priority.
+ * The target's stored overrides (redacted by the admin API) and tombstones;
+ * none when base has no config yet. A profile whose document is gone is
+ * refused (PR-3): the admin API would otherwise silently recreate it, active
+ * and at the default priority.
  */
-async function readStoredOverrides(target: t.WriteTargetRef): Promise<t.ConfigRecord> {
+async function readStoredLayer(
+  target: t.WriteTargetRef,
+): Promise<Pick<t.WriteSnapshot, 'stored' | 'tombstones'>> {
   const response = await apiFetch(targetConfigUrl(target));
   if (response.status === 404 && target.type === 'scope') throw new Error(MISSING_SCOPE_MESSAGE);
-  if (response.status === 404) return {};
+  if (response.status === 404) return { stored: {}, tombstones: [] };
   if (!response.ok) throw new Error(`Failed to read the stored config: ${response.status}`);
-  const { config } = await readJson<AdminConfigResponse>(response);
-  return normalizeAppServiceKeys((config?.overrides ?? {}) as t.ConfigRecord);
+  const { config } = await readJson<t.AdminConfigDocResponse>(response);
+  return {
+    stored: normalizeAppServiceKeys((config?.overrides ?? {}) as t.ConfigRecord),
+    tombstones: config?.tombstones ?? [],
+  };
+}
+
+/** The target's stored overrides (see `readStoredLayer`). */
+async function readStoredOverrides(target: t.WriteTargetRef): Promise<t.ConfigRecord> {
+  return (await readStoredLayer(target)).stored;
 }
 
 /** The base config: merged with the base overrides, or librechat.yaml alone (`baseOnly`). */
@@ -88,13 +101,13 @@ async function readBaseConfig(baseOnly: boolean): Promise<t.ConfigRecord> {
 
 /**
  * The layers a write is planned against, read fresh: the target's stored
- * overrides and the layer beneath it (librechat.yaml for base, the merged
- * base config for a profile).
+ * overrides and tombstones and the layer beneath it (librechat.yaml for base,
+ * the merged base config for a profile).
  */
 async function readWriteSnapshot(target: t.WriteTargetRef): Promise<t.WriteSnapshot> {
   const isBase = target.type === 'base';
-  const [stored, lower] = await Promise.all([readStoredOverrides(target), readBaseConfig(isBase)]);
-  return { stored, lower, lowerKind: isBase ? 'yaml' : 'inherited' };
+  const [own, lower] = await Promise.all([readStoredLayer(target), readBaseConfig(isBase)]);
+  return { ...own, lower, lowerKind: isBase ? 'yaml' : 'inherited' };
 }
 
 async function authorizeWrite(target: t.WriteTargetRef, ops: t.ConfigChange[]): Promise<void> {
@@ -137,10 +150,12 @@ function sanitizeOps(ops: t.ConfigChange[]): t.ConfigChange[] {
 /**
  * A rejected value the admin API reported by path. Paths index into the
  * array that was sent, so an index inside a keyed collection is mapped to the
- * identity of that sent entry.
+ * identity of that sent entry. The admin API reports codes without their
+ * parameters, so a code whose message needs one (`too_small`'s minimum) is
+ * worded without it.
  */
 function attributeBackendIssue(path: string, code: string, batch: t.SaveEntry[]): t.ConfigIssue {
-  const message = describeIssueCode(code, undefined, 'is not a valid value');
+  const message = describeIssueCode(paramlessIssueCode(code), undefined, 'is not a valid value');
   const sent = batch.find(
     ({ fieldPath }) => path === fieldPath || path.startsWith(`${fieldPath}.`),
   );
@@ -183,14 +198,16 @@ interface WriteOutcome {
   failure?: t.ConfigIssue[];
 }
 
+/** Sets in PATCHes of at most the server's `maxPatchEntries` entries each. */
 async function patchFields(
   target: t.WriteTargetRef,
   entries: t.SaveEntry[],
   outcome: WriteOutcome,
+  maxEntries: number,
 ): Promise<boolean> {
   const priority = target.type === 'base' ? { priority: 0 } : {};
-  for (let i = 0; i < entries.length; i += MAX_PATCH_ENTRIES) {
-    const batch = entries.slice(i, i + MAX_PATCH_ENTRIES);
+  for (let i = 0; i < entries.length; i += maxEntries) {
+    const batch = entries.slice(i, i + maxEntries);
     const response = await apiFetch(`${targetConfigUrl(target)}/fields`, {
       method: 'PATCH',
       body: JSON.stringify({ entries: batch, ...priority }),
@@ -255,11 +272,15 @@ async function writeFieldOps(
  * Sets precede resets, so a rename writes the new entry before removing the
  * old one. Stops at the first failure.
  */
-async function executePlan(target: t.WriteTargetRef, plan: t.WritePlan): Promise<WriteOutcome> {
+async function executePlan(
+  target: t.WriteTargetRef,
+  plan: t.WritePlan,
+  contract: t.ConfigContract,
+): Promise<WriteOutcome> {
   const outcome: WriteOutcome = { writes: [], dropped: [] };
   const steps = [
     () => writeFieldOps(target, 'tombstone', plan.tombstones, outcome),
-    () => patchFields(target, plan.sets, outcome),
+    () => patchFields(target, plan.sets, outcome, contract.limits.maxPatchEntries),
     () => writeFieldOps(target, 'reset', plan.resets, outcome),
     () => writeFieldOps(target, 'untombstone', plan.untombstones, outcome),
   ];
@@ -358,7 +379,8 @@ function hasWrites(plan: t.WritePlan): boolean {
 
 /**
  * The one write path for config changes (SV-1/SV-2/SV-4). Reads the target's
- * stored overrides and the layer beneath it, plans the changes against them
+ * stored overrides and the layer beneath it, and the server's contract
+ * (`readConfigContract`), plans the changes against them
  * (`planConfigChanges`: keyed collection ops by identity, validation of
  * fields, entries and whole sections, write rules), and writes nothing when
  * any issue is found. Otherwise it writes tombstones, sets, then resets;
@@ -371,8 +393,8 @@ export async function applyConfigChanges(
   ops: t.ConfigChange[],
 ): Promise<t.ApplyConfigChangesResult> {
   await authorizeWrite(target, ops);
-  const snapshot = await readWriteSnapshot(target);
-  const plan = planConfigChanges(sanitizeOps(ops), snapshot);
+  const [snapshot, contract] = await Promise.all([readWriteSnapshot(target), readConfigContract()]);
+  const plan = planConfigChanges(sanitizeOps(ops), snapshot, contract.features);
   const result: t.ApplyConfigChangesResult = {
     applied: 0,
     failed: [],
@@ -381,7 +403,7 @@ export async function applyConfigChanges(
     skipped: plan.skipped,
   };
   if (plan.issues.length > 0 || !hasWrites(plan)) return result;
-  const outcome = await executePlan(target, plan);
+  const outcome = await executePlan(target, plan, contract);
   if (outcome.failure) {
     const compensated = await compensate(target, outcome.writes, snapshot.stored);
     return { ...result, failed: outcome.failure, compensated };
@@ -389,7 +411,7 @@ export async function applyConfigChanges(
   const notEffective = [...outcome.dropped, ...(await verifyTarget(target, plan, snapshot))];
   const lost = new Set(
     notEffective
-      .filter((item) => item.reason !== 'yamlMerged' && item.reason !== 'inheritedMerged')
+      .filter((item) => !MERGED_BACK_REASONS.has(item.reason))
       .map((item) => item.fieldPath),
   );
   return {
diff --git a/src/server/config/schema.ts b/src/server/config/schema.ts
index 0a6fb8fa..a9f4e99e 100644
--- a/src/server/config/schema.ts
+++ b/src/server/config/schema.ts
@@ -1,6 +1,7 @@
 import { queryOptions } from '@tanstack/react-query';
 import { configSchema } from 'librechat-data-provider';
 import { createServerFn } from '@tanstack/react-start';
+import type { TStartupConfig } from 'librechat-data-provider';
 import type * as t from '@/types';
 import {
   unwrapSchema,
@@ -15,13 +16,19 @@ import {
 import { RUNTIME_NUMBER_LIMITS } from '@/constants';
 import { apiFetch } from '../utils/api';
 
-/** Hide the Langfuse section when LibreChat reports fanout is disabled. When the
- *  fanout state is unknown (older backends), the schema-provided section is kept. */
+/**
+ * Hides the Langfuse section when LibreChat reports the signed-in admin can't
+ * use its connection settings (`langfuseConnectionAccess`: tracing or tenant
+ * export is off, credentials come from the environment, or the admin lacks
+ * the Langfuse capability). A backend without that flag is judged by
+ * `langfuseFanoutEnabled`; with neither, the schema-provided section is kept.
+ */
 export function applyLangfuseSchemaVisibility(
   tree: t.SchemaField[],
-  fanoutEnabled: boolean | undefined,
+  startup: Pick<TStartupConfig, 'langfuseFanoutEnabled' | 'langfuseConnectionAccess'> | undefined,
 ): t.SchemaField[] {
-  if (fanoutEnabled !== false) return tree;
+  const available = startup?.langfuseConnectionAccess ?? startup?.langfuseFanoutEnabled;
+  if (available !== false) return tree;
   const langfuseIndex = tree.findIndex((section) => section.key === 'langfuse');
   if (langfuseIndex >= 0) tree.splice(langfuseIndex, 1);
   return tree;
@@ -568,9 +575,9 @@ export const getConfigSchemaFields = createServerFn({ method: 'GET' }).handler(a
     const tree = extractSchemaTree(configSchema);
     const startupConfigResponse = await apiFetch('/api/config');
     const startupConfig = startupConfigResponse.ok
-      ? ((await startupConfigResponse.json()) as { langfuseFanoutEnabled?: boolean })
+      ? ((await startupConfigResponse.json()) as TStartupConfig)
       : undefined;
-    applyLangfuseSchemaVisibility(tree, startupConfig?.langfuseFanoutEnabled);
+    applyLangfuseSchemaVisibility(tree, startupConfig);
     for (const section of tree) {
       if (section.key === 'interface' && section.children) {
         section.children = filterInterfacePermissionChildren(section.children);
diff --git a/src/server/langfuse.test.ts b/src/server/langfuse.test.ts
index 159c17fa..acd96d40 100644
--- a/src/server/langfuse.test.ts
+++ b/src/server/langfuse.test.ts
@@ -36,7 +36,7 @@ const status = {
   destinations: [{ key: 'eu', baseUrl: 'https://cloud.langfuse.com' }],
   destination: 'eu',
   publicKey: 'pk-lf-public',
-  displaySecretKey: 'sk-lf-...515f',
+  secretKeyPreview: 'sk-lf-...515f',
 };
 
 beforeEach(() => {
diff --git a/src/server/langfuse.ts b/src/server/langfuse.ts
index 265a6392..f150f697 100644
--- a/src/server/langfuse.ts
+++ b/src/server/langfuse.ts
@@ -1,23 +1,9 @@
 import { z } from 'zod';
 import { createServerFn } from '@tanstack/react-start';
+import type { TLangfuseConnectionStatus } from 'librechat-data-provider';
 import { requireAllSectionCapabilities } from './capabilities';
 import { apiFetch, extractApiError } from './utils/api';
 
-export interface LangfuseDestinationOption {
-  key: string;
-  baseUrl: string;
-}
-
-export interface LangfuseConnectionStatus {
-  configured: boolean;
-  enabled: boolean;
-  destinations: LangfuseDestinationOption[];
-  destination?: string;
-  publicKey?: string;
-  displaySecretKey?: string;
-  updatedAt?: string;
-}
-
 export interface LangfuseConnectionTestResponse {
   success: boolean;
   message?: string;
@@ -39,19 +25,19 @@ const connectionTestInputSchema = connectionInputSchema.omit({ enabled: true });
  * destination allowlist, encrypted-secret handling, and credential checks.
  */
 export const getLangfuseConnectionFn = createServerFn({ method: 'GET' }).handler(
-  async (): Promise<LangfuseConnectionStatus> => {
+  async (): Promise<TLangfuseConnectionStatus> => {
     await requireAllSectionCapabilities(['langfuse']);
     const response = await apiFetch('/api/admin/langfuse/connection');
     if (!response.ok) {
       return extractApiError(response, 'Failed to read Langfuse connection');
     }
-    return (await response.json()) as LangfuseConnectionStatus;
+    return (await response.json()) as TLangfuseConnectionStatus;
   },
 );
 
 export const updateLangfuseConnectionFn = createServerFn({ method: 'POST' })
   .inputValidator(connectionInputSchema)
-  .handler(async ({ data }): Promise<LangfuseConnectionStatus> => {
+  .handler(async ({ data }): Promise<TLangfuseConnectionStatus> => {
     await requireAllSectionCapabilities(['langfuse']);
     const response = await apiFetch('/api/admin/langfuse/connection', {
       method: 'PUT',
@@ -60,7 +46,7 @@ export const updateLangfuseConnectionFn = createServerFn({ method: 'POST' })
     if (!response.ok) {
       return extractApiError(response, 'Failed to update Langfuse connection');
     }
-    return (await response.json()) as LangfuseConnectionStatus;
+    return (await response.json()) as TLangfuseConnectionStatus;
   });
 
 export const testLangfuseConnectionFn = createServerFn({ method: 'POST' })
diff --git a/src/server/users.test.ts b/src/server/users.test.ts
new file mode 100644
index 00000000..dd20a8fc
--- /dev/null
+++ b/src/server/users.test.ts
@@ -0,0 +1,54 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { USER_DELETE_UNAVAILABLE } from '@/constants';
+
+const apiFetchMock = vi.fn();
+
+vi.mock('./utils/api', () => ({
+  apiFetch: (path: string, init?: RequestInit) => apiFetchMock(path, init),
+  extractApiError: async (response: Response, fallback: string) => {
+    const body = (await response.json().catch(() => ({}))) as { error?: string };
+    throw new Error(body.error ?? `${fallback}: ${response.status}`);
+  },
+}));
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: () => ({
+    handler: (fn: (...args: never[]) => unknown) => fn,
+    inputValidator: () => ({ handler: (fn: (...args: never[]) => unknown) => fn }),
+  }),
+}));
+
+import { deleteUserFn } from './users';
+
+function reply(status: number, body: object): Response {
+  return new Response(JSON.stringify(body), { status });
+}
+
+const remove = () => deleteUserFn({ data: { id: 'u 1' } });
+
+beforeEach(() => {
+  apiFetchMock.mockReset();
+});
+
+describe('deleteUserFn', () => {
+  it('deletes the user through the admin users API', async () => {
+    apiFetchMock.mockResolvedValue(reply(200, { message: 'User deleted' }));
+    await expect(remove()).resolves.toBeUndefined();
+    expect(apiFetchMock).toHaveBeenCalledWith('/api/admin/users/u%201', { method: 'DELETE' });
+  });
+
+  it("treats LibreChat's own user-not-found reply as already deleted", async () => {
+    apiFetchMock.mockResolvedValue(reply(404, { error: 'User not found' }));
+    await expect(remove()).resolves.toBeUndefined();
+  });
+
+  it('fails when the server has no delete route, instead of reporting a deletion', async () => {
+    apiFetchMock.mockResolvedValue(reply(404, { message: 'Endpoint not found' }));
+    await expect(remove()).rejects.toThrow(USER_DELETE_UNAVAILABLE);
+  });
+
+  it("fails with the admin API's message on any other refusal", async () => {
+    apiFetchMock.mockResolvedValue(reply(403, { error: 'Forbidden' }));
+    await expect(remove()).rejects.toThrow('Forbidden');
+  });
+});
diff --git a/src/server/users.ts b/src/server/users.ts
index c4ec8fd3..cebb62ef 100644
--- a/src/server/users.ts
+++ b/src/server/users.ts
@@ -12,6 +12,7 @@ import { createServerFn } from '@tanstack/react-start';
 import type { AdminUserSearchResult } from '@librechat/data-schemas';
 import type { TUser } from 'librechat-data-provider';
 import { apiFetch, extractApiError } from './utils/api';
+import { USER_DELETE_UNAVAILABLE } from '@/constants';
 
 // ── Server functions ─────────────────────────────────────────────────
 
@@ -44,15 +45,29 @@ export const createUserFn = createServerFn({ method: 'POST' })
     throw new Error('Not implemented: createUserFn');
   });
 
+/** The admin users API's reply when the user to delete no longer exists. */
+const USER_NOT_FOUND_ERROR = 'User not found';
+
+/**
+ * Deletes a user. LibreChat's own "user not found" 404 means the user is
+ * already gone, which is success; any other 404 is a server without the
+ * delete route (LibreChat ships it disabled), reported as
+ * `USER_DELETE_UNAVAILABLE` so the page explains it instead of claiming the
+ * user was deleted.
+ */
 export const deleteUserFn = createServerFn({ method: 'POST' })
   .inputValidator(z.object({ id: z.string() }))
-  .handler(async ({ data }) => {
+  .handler(async ({ data }): Promise<void> => {
     const response = await apiFetch(`/api/admin/users/${encodeURIComponent(data.id)}`, {
       method: 'DELETE',
     });
-    if (!response.ok && response.status !== 404) {
-      throw new Error(`Failed to delete user: ${response.status}`);
+    if (response.ok) return;
+    if (response.status === 404) {
+      const body = (await response.json().catch(() => ({}))) as { error?: string };
+      if (body.error === USER_NOT_FOUND_ERROR) return;
+      throw new Error(USER_DELETE_UNAVAILABLE);
     }
+    await extractApiError(response, 'Failed to delete user');
   });
 
 export const searchUsersFn = createServerFn({ method: 'GET' })
diff --git a/src/test/admin.ts b/src/test/admin.ts
index 8130bdbd..38388135 100644
--- a/src/test/admin.ts
+++ b/src/test/admin.ts
@@ -57,6 +57,7 @@ export function createFakeAdminApi(yaml: t.ConfigRecord) {
   const requests: FakeAdminRequest[] = [];
   const strippedSections = new Set<string>();
   let override: FakeAdminOverride | undefined;
+  let meta: t.AdminConfigMetaBody | undefined;
 
   const docKey = (principalType: string, principalId: string) =>
     `${principalType}/${decodeURIComponent(principalId)}`;
@@ -106,6 +107,9 @@ export function createFakeAdminApi(yaml: t.ConfigRecord) {
     if (url.pathname === '/api/admin/grants/effective') {
       return reply(200, { capabilities: ['manage:configs'] });
     }
+    if (url.pathname === '/api/admin/config/meta') {
+      return meta ? reply(200, meta) : reply(404, { message: 'Endpoint not found' });
+    }
     if (url.pathname === '/api/admin/config/base') {
       const config = url.searchParams.get('baseOnly') === 'true' ? yaml : baseMerged();
       return reply(200, { config: redact(config) });
@@ -173,6 +177,10 @@ export function createFakeAdminApi(yaml: t.ConfigRecord) {
     setOverride: (next?: FakeAdminOverride) => {
       override = next;
     },
+    /** Serves `GET /api/admin/config/meta` (a server with the contract); unset, it answers 404 like an older server. */
+    reportMeta: (body?: t.AdminConfigMetaBody) => {
+      meta = body;
+    },
     /** Every write request (PATCH, DELETE, POST), in order. */
     writes: () => requests.filter((r) => r.method !== 'GET'),
   };
diff --git a/src/test/page.tsx b/src/test/page.tsx
index 0890b8bf..5115c9cd 100644
--- a/src/test/page.tsx
+++ b/src/test/page.tsx
@@ -131,7 +131,12 @@ function TabPage({ tab, tree, yaml, overrides, expandAll, state }: HarnessProps)
       collections: edits.collectionEdits,
       visibility: edits.visibilityEdits,
     });
-    return planConfigChanges(changes.ops, { stored: overrides, lower: yaml, lowerKind: 'yaml' });
+    return planConfigChanges(changes.ops, {
+      stored: overrides,
+      tombstones: [],
+      lower: yaml,
+      lowerKind: 'yaml',
+    });
   };
 
   return (
diff --git a/src/types/access.ts b/src/types/access.ts
index d489bf70..8b8498a4 100644
--- a/src/types/access.ts
+++ b/src/types/access.ts
@@ -59,3 +59,12 @@ export interface RolePermissionsPanelProps {
 export interface RolesTabProps {
   onCreateRole: () => void;
 }
+
+/** The note under a role's name while it is renamed and the role has a configuration profile. */
+export interface RenameProfileNoteProps {
+  id: string;
+  /** The role's current name, which its profile is stored under. */
+  name: string;
+  /** LibreChat moves the profile with the role (`roleRenameMovesProfile`). */
+  moves: boolean;
+}
diff --git a/src/types/changes.ts b/src/types/changes.ts
index d17acf4d..66f8a069 100644
--- a/src/types/changes.ts
+++ b/src/types/changes.ts
@@ -114,6 +114,12 @@ export type ChangeKind =
 /** One human-readable row of the change review (WS1 produces, WS7 renders). */
 export interface ChangeSummaryItem {
   path: string;
+  /**
+   * The segments of `path` when a record key in it holds a dot (an inference
+   * profile `us.anthropic.claude-sonnet-4-6`), which splitting `path` would
+   * break apart; Revert follows them.
+   */
+  segments?: string[];
   /** Identity (e.g. name) of the collection entry the change belongs to. */
   entryIdentity?: string;
   kind: ChangeKind;
@@ -167,6 +173,8 @@ export type LowerLayerKind = 'yaml' | 'inherited';
 export interface WriteSnapshot {
   /** The target's own stored overrides (secrets redacted). */
   stored: ConfigRecord;
+  /** Paths the target hides from the layer beneath (its stored tombstones). */
+  tombstones: readonly string[];
   /** The layer beneath the target: librechat.yaml for base, the base config for a profile. */
   lower: ConfigRecord;
   lowerKind: LowerLayerKind;
diff --git a/src/types/config-ui.ts b/src/types/config-ui.ts
index 00be13e3..66fae118 100644
--- a/src/types/config-ui.ts
+++ b/src/types/config-ui.ts
@@ -554,7 +554,14 @@ export interface ConfigWriteResult {
   skipped: SkippedChange[];
 }
 
+/** Why a field is managed only in librechat.yaml: read once at startup, or not re-processed after overrides. */
+export type ManagedNoticeKind = 'startup' | 'yaml';
+
 export interface ManagedNoticeProps {
+  /** `startup`: LibreChat reads the field only at startup (`STARTUP_ONLY_FIELDS`); `yaml` by default. */
+  kind?: ManagedNoticeKind;
+  /** How many settings the notice covers (consecutive startup-only fields share one). */
+  count?: number;
   /** The edit target holds its own (ignored) override for the field. */
   hasOverride: boolean;
   /** Removal of that override is already queued for the next save. */
diff --git a/src/types/contract.ts b/src/types/contract.ts
new file mode 100644
index 00000000..1be7a882
--- /dev/null
+++ b/src/types/contract.ts
@@ -0,0 +1,132 @@
+import type { ReactNode } from 'react';
+
+/**
+ * A behaviour of the admin config API that a LibreChat server reports in
+ * `GET /api/admin/config/meta`. Mirrors `AdminConfigFeatureFlag` of newer
+ * `@librechat/data-schemas` releases (the pinned one has no meta contract).
+ */
+export type ConfigFeatureFlag =
+  | 'dottedKeys'
+  | 'sectionAllowlist'
+  | 'readFilteredWriteResponses'
+  | 'preAuthBaseOverrides'
+  | 'webSearchStoredKeys'
+  | 'expectedRevision'
+  | 'prunesEmptyParents'
+  | 'awaitedInvalidation'
+  | 'changesBatch'
+  | 'yamlMcpHide'
+  | 'deterministicPrecedence'
+  | 'priorityRoute'
+  | 'principalCheck'
+  | 'roleRenameMovesProfile'
+  | 'recordSecrets'
+  | 'azureGroupSecrets'
+  | 'yamlSecretPreview'
+  | 'envAllowlist'
+  | 'secretRebinding';
+
+/** Which admin config behaviours the server has; a flag it does not report is `false`. */
+export type ConfigFeatures = Readonly<Record<ConfigFeatureFlag, boolean>>;
+
+export interface ConfigLimits {
+  /** Most entries one `PATCH /fields` accepts. */
+  maxPatchEntries: number;
+  /** Most ops one `POST /changes` accepts (`0` without `changesBatch`). */
+  maxChangeOps: number;
+  /** How long another LibreChat instance may serve resolved config from before a write. */
+  overrideCacheTtlMs: number;
+}
+
+/** A secret config field: encrypted at rest, omitted from reads, kept when a write omits it. */
+export interface ConfigSecretFieldRule {
+  path: string;
+  /** Masked-preview companion returned on reads; never writable. */
+  previewPath: string;
+  /** Whether a `${ENV_VAR}` reference is stored as is instead of encrypted. */
+  allowEnvPlaceholder: boolean;
+}
+
+/** A secret held by every item of an array, matched across writes by `identityKey`. */
+export interface ConfigArraySecretFieldRule {
+  arrayPath: string;
+  secretKey: string;
+  previewKey: string;
+  identityKey: string;
+}
+
+/** A secret every entry of a record keyed by entry name holds, such as each MCP server's. */
+export interface ConfigRecordSecretFieldRule {
+  recordPath: string;
+  secretPath: string;
+  previewPath: string;
+}
+
+export interface ConfigInterfaceRules {
+  /** Interface fields that are role permissions; overrides drop them. */
+  permissionFields: string[];
+  /** Permission fields whose boolean form is a runtime toggle overrides keep. */
+  runtimeFields: string[];
+  /** Sub-keys of an object-form permission field that are permission bits. */
+  permissionSubKeys: string[];
+}
+
+/** The write rules a server enforces, in `librechat.yaml` key names. */
+export interface ConfigRules {
+  /** Top-level sections the server's config schema defines. */
+  acceptedSections: string[];
+  /** Sections only `librechat.yaml` sets; writes to them are dropped. */
+  baseOnlySections: string[];
+  /** Sections only the base document holds, through their dedicated APIs. */
+  basePrincipalSections: string[];
+  /** Fields inside overridable sections that only `librechat.yaml` sets. */
+  baseOnlyPaths: string[];
+  /** Arrays merged item by item on a key field instead of replaced. */
+  arrayMergeKeys: Readonly<Record<string, string>>;
+  /** Objects an override replaces whole instead of merging into. */
+  atomicMergePaths: string[];
+  /** Override sections the resolved config holds under another name. */
+  overrideKeyMap: Readonly<Record<string, string>>;
+  secretFields: ConfigSecretFieldRule[];
+  arraySecretFields: ConfigArraySecretFieldRule[];
+  recordSecretFields: ConfigRecordSecretFieldRule[];
+  /** Maps of credentials admin writes are refused for. */
+  refusedMaps: string[];
+  /** MCP server fields that make a server process-backed; only `librechat.yaml` sets them. */
+  processMcpFields: string[];
+  interface: ConfigInterfaceRules;
+  /** Whether `endpoints.all` title settings apply as one block or per field. */
+  titleResolution: 'block' | 'field';
+}
+
+export interface ConfigVersions {
+  librechat: string;
+  dataProvider: string;
+  configSchema: string;
+}
+
+/**
+ * The admin config API contract of the connected LibreChat server: what it
+ * reports in `GET /api/admin/config/meta`, each part it leaves out (or an
+ * older server without the route) filled from the panel's bundled fallback.
+ */
+export interface ConfigContract {
+  /** `server`: read from the meta route; `bundled`: the server has none, or it could not be read. */
+  source: 'server' | 'bundled';
+  versions?: ConfigVersions;
+  features: ConfigFeatures;
+  limits: ConfigLimits;
+  rules: ConfigRules;
+}
+
+/** `GET /api/admin/config/meta` as parsed: every part optional, since forks and older servers differ. */
+export interface AdminConfigMetaBody {
+  versions?: Partial<ConfigVersions>;
+  features?: Partial<Record<string, boolean>>;
+  limits?: Partial<ConfigLimits>;
+  rules?: Partial<ConfigRules>;
+}
+
+export interface ConfigContractProviderProps {
+  children: ReactNode;
+}
diff --git a/src/types/index.ts b/src/types/index.ts
index ac163a90..bf52e879 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -3,6 +3,7 @@ export type * from './auth';
 export type * from './changes';
 export type * from './config';
 export type * from './config-ui';
+export type * from './contract';
 export type * from './endpoints';
 export type * from './controls';
 export type * from './features';
diff --git a/src/types/review.ts b/src/types/review.ts
index 40e64d47..d4dedd07 100644
--- a/src/types/review.ts
+++ b/src/types/review.ts
@@ -262,21 +262,31 @@ export interface ReviewRowViewProps {
 }
 
 /** Why an imported key is left out (WS7). */
-export type ImportSkipReason = SkippedChange['reason'] | 'unsafeKey' | 'processMcp';
+export type ImportSkipReason =
+  | SkippedChange['reason']
+  | 'unsafeKey'
+  | 'reservedKey'
+  | 'dottedKey'
+  | 'dottedName'
+  | 'processMcp';
 
 /** An imported leaf that will not be written, and why (WS7). */
 export interface ImportSkippedKey {
   fieldPath: string;
   reason: ImportSkipReason;
-  /** For `unsafeKey`: the key, held by the object at `fieldPath`. */
+  /** For `unsafeKey`, `reservedKey`, `dottedKey` and `dottedName`: the key, held by the object at `fieldPath`. */
   key?: string;
 }
 
 /** Leaves of an imported YAML, and the keys the admin API can't store (WS7). */
 export interface ImportLeaves {
   leaves: FlatConfigMap;
-  /** Keys containing `.` or starting with `$`, with the path of the object holding them. */
+  /** Keys the admin API can't store (`isUnsafeConfigKey`), with the path of the object holding them. */
   unsafe: UnsafeConfigKey[];
+  /** With `dottedKeys`: dotted keys where the schema expects a setting name, not a free key. */
+  dotted: UnsafeConfigKey[];
+  /** With `dottedKeys`: dotted names in a record of setting groups (an MCP server), written field by field. */
+  dottedNames: UnsafeConfigKey[];
 }
 
 /** Imported leaves split into what can be written and what is left out (WS7). */
diff --git a/src/utils/changes.test.ts b/src/utils/changes.test.ts
index 60925502..45acf2fb 100644
--- a/src/utils/changes.test.ts
+++ b/src/utils/changes.test.ts
@@ -7,6 +7,7 @@ import {
   parseIndexedArrayPath,
 } from './changes';
 import { validateEntry, validateSection, validateField } from './validation';
+import { BUNDLED_CONFIG_FEATURES } from '@/constants';
 
 const yaml: t.ConfigRecord = {
   balance: { enabled: true, startBalance: 1000000, refillAmount: 1000000 },
@@ -30,8 +31,12 @@ const yaml: t.ConfigRecord = {
   },
 };
 
-function snapshot(stored: t.ConfigRecord = {}, lower: t.ConfigRecord = yaml): t.WriteSnapshot {
-  return { stored, lower, lowerKind: 'yaml' };
+function snapshot(
+  stored: t.ConfigRecord = {},
+  lower: t.ConfigRecord = yaml,
+  tombstones: string[] = [],
+): t.WriteSnapshot {
+  return { stored, tombstones, lower, lowerKind: 'yaml' };
 }
 
 describe('validateSection / validateEntry / validateField', () => {
@@ -163,6 +168,42 @@ describe('planConfigChanges', () => {
     ]);
   });
 
+  describe('on a server that keeps dotted keys', () => {
+    const dotted: t.ConfigFeatures = { ...BUNDLED_CONFIG_FEATURES, dottedKeys: true };
+
+    it('sends a record with dotted keys whole, at its own path', () => {
+      const profiles = { 'us.anthropic.claude-sonnet-4-6': 'arn:aws:bedrock:x' };
+      const ops: t.ConfigChange[] = [
+        { op: 'set', path: 'endpoints.bedrock.inferenceProfiles', value: profiles },
+      ];
+      expect(planConfigChanges(ops, snapshot()).issues.map((issue) => issue.code)).toEqual([
+        'UNSAFE_KEY',
+      ]);
+      const plan = planConfigChanges(ops, snapshot(), dotted);
+      expect(plan.issues).toEqual([]);
+      expect(plan.sets).toEqual([
+        { fieldPath: 'endpoints.bedrock.inferenceProfiles', value: profiles },
+      ]);
+    });
+
+    it('refuses $-prefixed and prototype keys as reserved', () => {
+      const plan = planConfigChanges(
+        [
+          {
+            op: 'set',
+            path: 'mcpServers.github.headers',
+            value: { $where: '1', 'X-Thread.Id': '2' },
+          },
+        ],
+        snapshot(),
+        dotted,
+      );
+      expect(plan.issues).toMatchObject([
+        { code: 'RESERVED_KEY', path: 'mcpServers.github.headers', params: { key: '$where' } },
+      ]);
+    });
+  });
+
   it('names the entry of an unsafe key inside a stored endpoint list, not its stored position', () => {
     const baseline = ((yaml.endpoints as t.ConfigRecord).custom as t.ConfigRecord[])[1];
     const stored = {
@@ -452,6 +493,46 @@ describe('planConfigChanges', () => {
     expect(plan.storedAfter).toEqual({});
   });
 
+  it('never widens a reset past a parent with a stored tombstone under it', () => {
+    const plan = planConfigChanges(
+      [{ op: 'reset', path: 'balance.startBalance' }],
+      snapshot({ balance: { startBalance: 5 } }, yaml, ['balance.refillAmount']),
+    );
+    expect(plan.resets).toEqual(['balance.startBalance']);
+  });
+
+  it('never widens a reset past a tombstone the same batch writes', () => {
+    const plan = planConfigChanges(
+      [
+        { op: 'reset', path: 'balance.startBalance' },
+        { op: 'tombstone', path: 'balance.refillAmount' },
+      ],
+      snapshot({ balance: { startBalance: 5 } }),
+    );
+    expect(plan.resets).toEqual(['balance.startBalance']);
+    expect(plan.tombstones).toEqual(['balance.refillAmount']);
+  });
+
+  it('still widens over tombstones under the reset path itself, which the reset removes anyway', () => {
+    const plan = planConfigChanges(
+      [{ op: 'reset', path: 'mcpServers.github.headers' }],
+      snapshot({ mcpServers: { github: { headers: { 'X-A': '1' } } } }, yaml, [
+        'mcpServers.github.headers.Authorization',
+      ]),
+    );
+    expect(plan.resets).toEqual(['mcpServers']);
+  });
+
+  it('widens up to the last parent without another tombstone under it', () => {
+    const plan = planConfigChanges(
+      [{ op: 'reset', path: 'endpoints.anthropic.models.default' }],
+      snapshot({ endpoints: { anthropic: { models: { default: ['claude-opus-5-5'] } } } }, yaml, [
+        'endpoints.anthropic.titleModel',
+      ]),
+    );
+    expect(plan.resets).toEqual(['endpoints.anthropic.models']);
+  });
+
   it('folds a reset with new descendant values into one set (rename onto the same key)', () => {
     const stored = { mcpServers: { srv: { type: 'sse', url: 'https://old', title: 'Old' } } };
     const plan = planConfigChanges(
@@ -503,21 +584,28 @@ describe('planConfigChanges', () => {
   });
 
   it('expands an item write of a plain array into the whole array', () => {
-    const lower = {
-      modelSpecs: { list: [{ name: 'a', label: 'A', preset: { endpoint: 'openAI' } }] },
-    };
+    const lower = { endpoints: { agents: { allowedProviders: ['openAI', 'anthropic'] } } };
     const plan = planConfigChanges(
-      [
-        {
-          op: 'set',
-          path: 'endpoints.agents.toolApproval.hooks.0',
-          value: { module: 'm' },
-        },
-      ],
+      [{ op: 'set', path: 'endpoints.agents.allowedProviders.1', value: 'google' }],
       snapshot({}, lower),
     );
     expect(plan.sets).toEqual([
-      { fieldPath: 'endpoints.agents.toolApproval.hooks', value: [{ module: 'm' }] },
+      { fieldPath: 'endpoints.agents.allowedProviders', value: ['openAI', 'google'] },
+    ]);
+  });
+
+  it('never sends a setting LibreChat reads only at startup', () => {
+    const plan = planConfigChanges(
+      [
+        { op: 'set', path: 'endpoints.agents.toolApproval.hooks.0', value: { module: 'm' } },
+        { op: 'set', path: 'mcpSettings.catalogRecovery.maxStateEntries', value: 10 },
+      ],
+      snapshot(),
+    );
+    expect(plan.sets).toEqual([]);
+    expect(plan.skipped).toEqual([
+      { fieldPath: 'endpoints.agents.toolApproval.hooks.0', reason: 'yamlOnly' },
+      { fieldPath: 'mcpSettings.catalogRecovery.maxStateEntries', reason: 'yamlOnly' },
     ]);
   });
 
@@ -560,6 +648,34 @@ describe('verifyWrite', () => {
     ]);
   });
 
+  it('compares a record with dotted keys whole, without splitting its keys into paths', () => {
+    const headers = { 'x-portkey.config': 'cfg', 'X-Plain': '1' };
+    const entry = {
+      name: 'Portkey',
+      apiKey: 'user_provided',
+      baseURL: 'https://api.portkey.ai/v1',
+      models: { default: ['m'] },
+      headers,
+    };
+    const plan = planConfigChanges(
+      [
+        {
+          op: 'upsertEntry',
+          path: 'endpoints.custom',
+          key: 'Portkey',
+          identity: null,
+          value: entry,
+        },
+      ],
+      snapshot(),
+      { ...BUNDLED_CONFIG_FEATURES, dottedKeys: true },
+    );
+    const storedActual = { endpoints: { custom: [entry] } };
+    const yamlEntries = (yaml.endpoints as t.ConfigRecord).custom as t.ConfigRecord[];
+    const effective = { endpoints: { custom: [...yamlEntries, entry] } };
+    expect(verifyWrite(plan, snapshot(), storedActual, effective)).toEqual([]);
+  });
+
   it('accepts redacted secrets and an effective value that differs from YAML', () => {
     const plan = planConfigChanges(
       [{ op: 'set', path: 'webSearch.tavilyApiKey', value: 'tvly-secret' }],
diff --git a/src/utils/changes.ts b/src/utils/changes.ts
index f92c2199..dfb87a77 100644
--- a/src/utils/changes.ts
+++ b/src/utils/changes.ts
@@ -13,6 +13,14 @@ import {
   resolveCollectionOps,
   findKeyedCollectionEntry,
 } from './collections';
+import {
+  hasDottedKey,
+  isConfigRecord,
+  getValueAtPath,
+  setValueAtPath,
+  removeValueAtPath,
+  isConfigValueEqual,
+} from './format';
 import {
   validateEntry,
   validateField,
@@ -24,21 +32,13 @@ import {
   getConfigSection,
   getReadOnlyReason,
   SECRET_CONFIG_KEYS,
-  BLOCK_UNSAFE_CONFIG_KEYS,
-  UNSAFE_CONFIG_KEY_MESSAGE,
+  BUNDLED_CONFIG_FEATURES,
 } from '@/constants';
-import {
-  isConfigRecord,
-  getValueAtPath,
-  setValueAtPath,
-  removeValueAtPath,
-  isConfigValueEqual,
-} from './format';
 import { isSecretKey, toSecretPreviewKey, valueOrSecretPreview } from './secrets';
 import { findYamlManagedValues, getWriteSkipReason } from './writes';
+import { isBlankText, findBlankText, findUnsafeKeys } from './keys';
 import { resolveSubSchema, unwrapSchema } from './schema';
 import { scopeGateSkipReason } from './scopes';
-import { isBlankText, findBlankText, findUnsafeKeys } from './keys';
 
 /** Whether a write at `path` sets a process-backed (stdio) MCP server field, which the admin API rejects. */
 export function isProcessMcpWrite(path: string, value: t.ConfigValue): boolean {
@@ -53,11 +53,16 @@ export function isProcessMcpWrite(path: string, value: t.ConfigValue): boolean {
 
 /**
  * Write-rule problems of one value: YAML-managed fields, process-backed MCP
- * fields and unsafe keys. In a keyed collection's list, each problem names
+ * fields and keys the server can't store (dotted keys only before its
+ * `dottedKeys` feature). In a keyed collection's list, each problem names
  * its entry, since the list's positions are not the ones the page shows.
  */
-export function findWriteRuleIssues(path: string, value: t.ConfigValue): t.ConfigIssue[] {
-  const issues = findValueRuleIssues(path, value);
+export function findWriteRuleIssues(
+  path: string,
+  value: t.ConfigValue,
+  features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
+): t.ConfigIssue[] {
+  const issues = findValueRuleIssues(path, value, features);
   const collection = getKeyedCollection(path);
   if (!collection || !Array.isArray(value) || issues.length === 0) return issues;
   return issues.map((issue) => withEntryOf(issue, collection, value));
@@ -75,7 +80,11 @@ function withEntryOf(
   return { ...issue, entryIdentity: identity, entryPath: located.rest };
 }
 
-function findValueRuleIssues(path: string, value: t.ConfigValue): t.ConfigIssue[] {
+function findValueRuleIssues(
+  path: string,
+  value: t.ConfigValue,
+  features: t.ConfigFeatures,
+): t.ConfigIssue[] {
   const managed = findYamlManagedValues(path, value);
   if (managed.length > 0) {
     return managed.map((managedPath) => ({
@@ -94,11 +103,11 @@ function findValueRuleIssues(path: string, value: t.ConfigValue): t.ConfigIssue[
     ];
   }
   const blank = [...blankPathKeys(path), ...findBlankText(value, path)].map(blankTextIssue);
-  if (!BLOCK_UNSAFE_CONFIG_KEYS) return blank;
-  const unsafe = findUnsafeKeys(value, path).map(({ path: holder, key }) => ({
+  const code = features.dottedKeys ? 'RESERVED_KEY' : 'UNSAFE_KEY';
+  const unsafe = findUnsafeKeys(value, path, features.dottedKeys).map(({ path: holder, key }) => ({
     path: holder,
-    code: 'UNSAFE_KEY',
-    message: `"${key}": ${UNSAFE_CONFIG_KEY_MESSAGE}`,
+    code,
+    message: describeIssueCode(code, { key }, ''),
     params: { key },
   }));
   return [...unsafe, ...blank];
@@ -129,6 +138,7 @@ function blankTextIssue({ path, key }: t.BlankConfigText): t.ConfigIssue {
 
 interface PlanState {
   snapshot: t.WriteSnapshot;
+  features: t.ConfigFeatures;
   sets: Map<string, t.ConfigValue>;
   resets: string[];
   tombstones: string[];
@@ -407,12 +417,37 @@ function parentPath(path: string): string {
   return path.slice(0, Math.max(0, path.lastIndexOf('.')));
 }
 
+function isAtOrUnder(path: string, ancestor: string): boolean {
+  return path === ancestor || path.startsWith(`${ancestor}.`);
+}
+
+/**
+ * Whether removing `ancestor` would also remove a tombstone that removing
+ * `path` leaves: LibreChat drops every tombstone at or under a removed path,
+ * so widening a reset over one would show again a value the target hides.
+ */
+function holdsOtherTombstone(
+  ancestor: string,
+  path: string,
+  tombstones: readonly string[],
+): boolean {
+  return tombstones.some(
+    (tombstone) => isAtOrUnder(tombstone, ancestor) && !isAtOrUnder(tombstone, path),
+  );
+}
+
 /**
  * The highest ancestor a removal leaves empty, so no `{}` remains stored: a
  * parent whose only key is the emptied child (`endpoints.anthropic.models`
  * after its last key goes, then `endpoints.anthropic`, then `endpoints`).
+ * It never widens past an ancestor with another tombstone under it (stored,
+ * or written by this batch), which the wider removal would drop.
  */
-function emptiedAncestor(storedAfter: t.ConfigRecord, path: string): string {
+function emptiedAncestor(
+  storedAfter: t.ConfigRecord,
+  path: string,
+  tombstones: readonly string[],
+): string {
   let current = path;
   const leftEmpty = getValueAtPath(storedAfter, current);
   if (isConfigRecord(leftEmpty) && Object.keys(leftEmpty).length > 0) return current;
@@ -421,6 +456,7 @@ function emptiedAncestor(storedAfter: t.ConfigRecord, path: string): string {
     const value = getValueAtPath(storedAfter, parent);
     const child = current.slice(parent.length + 1);
     if (!isConfigRecord(value) || Object.keys(value).some((key) => key !== child)) break;
+    if (holdsOtherTombstone(parent, path, tombstones)) break;
     current = parent;
     parent = parentPath(current);
   }
@@ -446,7 +482,8 @@ function applyToStored(state: PlanState): t.ConfigRecord {
 /** Widens each reset to the highest parent it leaves empty, then returns the stored overrides afterwards. */
 function pruneEmptyParents(state: PlanState): t.ConfigRecord {
   const removed = applyToStored(state);
-  const widened = state.resets.map((path) => emptiedAncestor(removed, path));
+  const tombstones = [...state.snapshot.tombstones, ...state.tombstones];
+  const widened = state.resets.map((path) => emptiedAncestor(removed, path, tombstones));
   state.resets = [...new Set(widened)].filter((path) => !hasAncestorIn(path, widened));
   return applyToStored(state);
 }
@@ -504,7 +541,7 @@ function isIntroducedIssue(state: PlanState, path: string, issue: t.ConfigIssue)
 function validateSets(state: PlanState): Set<string> {
   const blocked = new Set<string>();
   for (const [path, value] of state.sets) {
-    const ruleIssues = findWriteRuleIssues(path, value).filter((issue) =>
+    const ruleIssues = findWriteRuleIssues(path, value, state.features).filter((issue) =>
       isIntroducedIssue(state, path, issue),
     );
     if (ruleIssues.length > 0) {
@@ -601,16 +638,22 @@ function findMergedBackKeys(state: PlanState): void {
 
 /**
  * Resolves a batch of changes against the target's stored overrides and the
- * layer beneath it, into the admin API writes that implement it. Everything
+ * layer beneath it, into the admin API writes that implement it, by the
+ * server's contract `features` (the bundled ones: an older server). Everything
  * is checked before anything may be written: write rules (read-only and
  * YAML-managed paths, process-backed MCP fields, unsafe keys), field and
  * entry schemas, whole sections, and the keyed collection rules. The client
  * runs it for the review and inline errors; the server runs it again against
  * freshly read layers right before writing.
  */
-export function planConfigChanges(ops: t.ConfigChange[], snapshot: t.WriteSnapshot): t.WritePlan {
+export function planConfigChanges(
+  ops: t.ConfigChange[],
+  snapshot: t.WriteSnapshot,
+  features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
+): t.WritePlan {
   const state: PlanState = {
     snapshot,
+    features,
     sets: new Map(),
     resets: [],
     tombstones: [],
@@ -659,9 +702,13 @@ function stripSecrets(value: t.ConfigValue): t.ConfigValue {
   return Object.keys(result).length === 0 ? undefined : result;
 }
 
-/** Leaf paths (relative) and values of a value; arrays are leaves, secrets are skipped. */
+/**
+ * Leaf paths (relative) and values of a value; arrays are leaves, and so is an
+ * object with a dotted key, which no path can split (`hasDottedKey`); secrets
+ * are skipped.
+ */
 function leavesOf(value: t.ConfigValue, prefix = ''): Array<[string, t.ConfigValue]> {
-  if (!isConfigRecord(value)) return [[prefix, value]];
+  if (!isConfigRecord(value) || hasDottedKey(value)) return [[prefix, value]];
   return Object.entries(value).flatMap(([key, child]) =>
     isRedactedKey(key) ? [] : leavesOf(child, prefix ? `${prefix}.${key}` : key),
   );
diff --git a/src/utils/collections.ts b/src/utils/collections.ts
index 32346aaa..697850a8 100644
--- a/src/utils/collections.ts
+++ b/src/utils/collections.ts
@@ -1,12 +1,12 @@
 import type * as t from '@/types';
 import { isConfigRecord, getValueAtPath, isConfigValueEqual } from './format';
-import { KEYED_COLLECTIONS } from '@/constants';
+import { KEYED_COLLECTIONS, BUNDLED_CONFIG_RULES } from '@/constants';
 
 type UpsertEntryOp = Extract<t.EntryChange, { op: 'upsertEntry' }>;
 type RemoveEntryOp = Extract<t.EntryChange, { op: 'removeEntry' }>;
 
 /** Object paths LibreChat replaces whole instead of merging (its `ATOMIC_MERGE_PATHS`, in YAML keys). */
-const ATOMIC_MERGE_PATHS: ReadonlySet<string> = new Set(['interface.theme']);
+const ATOMIC_MERGE_PATHS: ReadonlySet<string> = new Set(BUNDLED_CONFIG_RULES.atomicMergePaths);
 
 /** The keyed collection stored at exactly `path`. */
 export function getKeyedCollection(path: string): t.KeyedCollection | undefined {
diff --git a/src/utils/contract.test.ts b/src/utils/contract.test.ts
new file mode 100644
index 00000000..cdf8f46f
--- /dev/null
+++ b/src/utils/contract.test.ts
@@ -0,0 +1,80 @@
+import { describe, it, expect } from 'vitest';
+import {
+  CONFIG_FEATURE_FLAGS,
+  BUNDLED_CONFIG_RULES,
+  BUNDLED_CONFIG_LIMITS,
+  BUNDLED_CONFIG_CONTRACT,
+} from '@/constants';
+import { resolveConfigContract } from './contract';
+
+describe('resolveConfigContract', () => {
+  it('is the bundled contract, every feature off, for a server without the meta route', () => {
+    const contract = resolveConfigContract(null);
+    expect(contract).toBe(BUNDLED_CONFIG_CONTRACT);
+    expect(contract.source).toBe('bundled');
+    expect(Object.values(contract.features).every((on) => on === false)).toBe(true);
+    expect(Object.keys(contract.features).sort()).toEqual([...CONFIG_FEATURE_FLAGS].sort());
+  });
+
+  it('turns on exactly the flags the server reports as true', () => {
+    const contract = resolveConfigContract({
+      features: { dottedKeys: true, webSearchStoredKeys: false, someFutureFlag: true },
+    });
+    expect(contract.source).toBe('server');
+    expect(contract.features.dottedKeys).toBe(true);
+    expect(contract.features.webSearchStoredKeys).toBe(false);
+    expect(contract.features.changesBatch).toBe(false);
+    expect(contract.features).not.toHaveProperty('someFutureFlag');
+  });
+
+  it('fills limits and rules the server leaves out from the bundled ones', () => {
+    const contract = resolveConfigContract({
+      limits: { maxPatchEntries: 50, maxChangeOps: undefined },
+      rules: {
+        titleResolution: 'field',
+        baseOnlyPaths: ['endpoints.agents.pullRequests.provider'],
+      },
+    });
+    expect(contract.limits).toEqual({ ...BUNDLED_CONFIG_LIMITS, maxPatchEntries: 50 });
+    expect(contract.rules).toEqual({
+      ...BUNDLED_CONFIG_RULES,
+      titleResolution: 'field',
+      baseOnlyPaths: ['endpoints.agents.pullRequests.provider'],
+    });
+  });
+
+  it('reports versions only when all three are given', () => {
+    const versions = { librechat: 'v0.8.9', dataProvider: '0.8.528', configSchema: '1.3.18' };
+    expect(resolveConfigContract({ versions }).versions).toEqual(versions);
+    expect(resolveConfigContract({ versions: { librechat: 'v0.8.9' } }).versions).toBeUndefined();
+  });
+});
+
+describe('BUNDLED_CONFIG_RULES', () => {
+  it('mirrors what LibreChat enforced before it reported its rules', () => {
+    expect(BUNDLED_CONFIG_RULES.arrayMergeKeys).toEqual({ 'endpoints.custom': 'name' });
+    expect(BUNDLED_CONFIG_RULES.arraySecretFields).toEqual([
+      {
+        arrayPath: 'endpoints.custom',
+        secretKey: 'apiKey',
+        previewKey: 'apiKeyPreview',
+        identityKey: 'name',
+      },
+    ]);
+    expect(BUNDLED_CONFIG_RULES.overrideKeyMap).toEqual({
+      interface: 'interfaceConfig',
+      turnstile: 'turnstileConfig',
+      mcpServers: 'mcpConfig',
+    });
+    expect(BUNDLED_CONFIG_RULES.baseOnlySections).toEqual(
+      expect.arrayContaining(['filters', 'mcpAppSandbox']),
+    );
+    expect(BUNDLED_CONFIG_RULES.recordSecretFields).toEqual([]);
+    expect(BUNDLED_CONFIG_RULES.titleResolution).toBe('block');
+    expect(BUNDLED_CONFIG_RULES.secretFields).toContainEqual({
+      path: 'langfuse.secretKey',
+      previewPath: 'langfuse.secretKeyPreview',
+      allowEnvPlaceholder: false,
+    });
+  });
+});
diff --git a/src/utils/contract.ts b/src/utils/contract.ts
new file mode 100644
index 00000000..46ac0c53
--- /dev/null
+++ b/src/utils/contract.ts
@@ -0,0 +1,44 @@
+import type * as t from '@/types';
+import {
+  CONFIG_FEATURE_FLAGS,
+  BUNDLED_CONFIG_RULES,
+  BUNDLED_CONFIG_LIMITS,
+  BUNDLED_CONFIG_CONTRACT,
+} from '@/constants';
+
+/**
+ * The contract a server reported, every part it leaves out filled from the
+ * bundled fallback: a flag it does not report is off, and a limit or rule it
+ * does not report is the one LibreChat enforced before it reported them.
+ * `null` (no meta route, or an unreadable reply) is the bundled contract.
+ */
+export function resolveConfigContract(body: t.AdminConfigMetaBody | null): t.ConfigContract {
+  if (!body) return BUNDLED_CONFIG_CONTRACT;
+  const reported = body.features ?? {};
+  const features = Object.fromEntries(
+    CONFIG_FEATURE_FLAGS.map((flag) => [flag, reported[flag] === true]),
+  ) as Record<t.ConfigFeatureFlag, boolean>;
+  const versions = body.versions;
+  return {
+    source: 'server',
+    versions:
+      versions?.librechat != null && versions.dataProvider != null && versions.configSchema != null
+        ? {
+            librechat: versions.librechat,
+            dataProvider: versions.dataProvider,
+            configSchema: versions.configSchema,
+          }
+        : undefined,
+    features,
+    limits: { ...BUNDLED_CONFIG_LIMITS, ...definedOnly(body.limits) },
+    rules: { ...BUNDLED_CONFIG_RULES, ...definedOnly(body.rules) },
+  };
+}
+
+/** A copy without the keys whose value is `undefined`, so they don't hide the fallback's. */
+function definedOnly<T extends object>(value: T | undefined): Partial<T> {
+  if (!value) return {};
+  return Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => entry !== undefined),
+  ) as Partial<T>;
+}
diff --git a/src/utils/format.test.ts b/src/utils/format.test.ts
index 19843bc0..6327dc19 100644
--- a/src/utils/format.test.ts
+++ b/src/utils/format.test.ts
@@ -1,5 +1,30 @@
 import { describe, it, expect } from 'vitest';
-import { serializeKVPairs, deepSerializeKVPairs } from './format';
+import { hasDottedKey, flattenObject, serializeKVPairs, deepSerializeKVPairs } from './format';
+
+describe('flattenObject', () => {
+  it('flattens nested objects into dot-paths', () => {
+    expect(flattenObject({ balance: { startBalance: 5, refill: { amount: 1 } } })).toEqual({
+      'balance.startBalance': 5,
+      'balance.refill.amount': 1,
+    });
+  });
+
+  it('keeps an object with a dotted key as one leaf (a path would split the key)', () => {
+    const profiles = { 'us.anthropic.claude': 'arn:a', plain: 'arn:b' };
+    expect(flattenObject({ endpoints: { bedrock: { inferenceProfiles: profiles } } })).toEqual({
+      'endpoints.bedrock.inferenceProfiles': profiles,
+    });
+  });
+});
+
+describe('hasDottedKey', () => {
+  it('is true only for an object with a key containing a dot', () => {
+    expect(hasDottedKey({ 'gpt-4.1': true })).toBe(true);
+    expect(hasDottedKey({ gpt4: true, nested: { 'a.b': 1 } })).toBe(false);
+    expect(hasDottedKey(['a.b'])).toBe(false);
+    expect(hasDottedKey('a.b')).toBe(false);
+  });
+});
 
 describe('serializeKVPairs', () => {
   it('converts KV pairs to a record', () => {
diff --git a/src/utils/format.ts b/src/utils/format.ts
index 5f6620de..aae36de4 100644
--- a/src/utils/format.ts
+++ b/src/utils/format.ts
@@ -62,9 +62,19 @@ export function getInitials(name: string): string {
   return (parts[0]?.[0] ?? '').toUpperCase();
 }
 
+/**
+ * Whether an object has a key containing `.` (a Bedrock inference profile ID,
+ * a MIME type, a dotted header name). A dot-path can't name such a key, so
+ * the object is a leaf of its tree: it is read and written whole.
+ */
+export function hasDottedKey(value: t.ConfigValue): boolean {
+  return isConfigRecord(value) && Object.keys(value).some((key) => key.includes('.'));
+}
+
 /**
  * Recursively flattens a nested object into dot-separated paths.
- * Plain objects become prefixes; arrays, primitives, and null become leaf entries.
+ * Plain objects become prefixes; arrays, primitives, and null become leaf entries,
+ * and so does an object with a dotted key (`hasDottedKey`), which no path can split.
  * e.g. { balance: { startBalance: 100 } } → { 'balance.startBalance': 100 }
  */
 export function flattenObject(obj: Record<string, t.ConfigValue>, prefix = ''): t.FlatConfigMap {
@@ -77,7 +87,8 @@ export function flattenObject(obj: Record<string, t.ConfigValue>, prefix = ''):
       value !== null &&
       typeof value === 'object' &&
       !Array.isArray(value) &&
-      Object.keys(value).length > 0
+      Object.keys(value).length > 0 &&
+      !hasDottedKey(value)
     ) {
       Object.assign(result, flattenObject(value as Record<string, t.ConfigValue>, path));
     } else {
diff --git a/src/utils/index.ts b/src/utils/index.ts
index ccda65c7..3e01aa92 100644
--- a/src/utils/index.ts
+++ b/src/utils/index.ts
@@ -3,6 +3,7 @@ export * from './capabilities';
 export * from './changes';
 export * from './cn';
 export * from './collections';
+export * from './contract';
 export * from './domains';
 export * from './errors';
 export * from './fallback';
diff --git a/src/utils/keys.test.ts b/src/utils/keys.test.ts
index c98a5abc..2835339f 100644
--- a/src/utils/keys.test.ts
+++ b/src/utils/keys.test.ts
@@ -13,6 +13,16 @@ describe('isUnsafeConfigKey', () => {
     expect(isUnsafeConfigKey('X-Thread-ID')).toBe(false);
     expect(isUnsafeConfigKey('price$')).toBe(false);
   });
+
+  it('with dotted keys allowed, flags only $-prefixed keys and the prototype names', () => {
+    expect(isUnsafeConfigKey('us.anthropic.claude-sonnet-4-6', true)).toBe(false);
+    expect(isUnsafeConfigKey('gpt-4.1', true)).toBe(false);
+    expect(isUnsafeConfigKey('$where', true)).toBe(true);
+    expect(isUnsafeConfigKey('__proto__', true)).toBe(true);
+    expect(isUnsafeConfigKey('constructor', true)).toBe(true);
+    expect(isUnsafeConfigKey('prototype', true)).toBe(true);
+    expect(isUnsafeConfigKey('constructorName', true)).toBe(false);
+  });
 });
 
 describe('findUnsafeKeys', () => {
@@ -46,6 +56,23 @@ describe('findUnsafeKeys', () => {
     ).toEqual([{ path: 'endpoints.custom.11.headers', key: 'x.thread.id' }]);
   });
 
+  it('with dotted keys allowed, finds only the keys the server refuses', () => {
+    expect(
+      findUnsafeKeys(
+        {
+          inferenceProfiles: { 'us.anthropic.x': 'arn' },
+          headers: [{ key: '$x', value: '1', valueType: 'string' }],
+          nested: { deeper: { $set: 1, 'a.b': 2 } },
+        },
+        'endpoints.bedrock',
+        true,
+      ),
+    ).toEqual([
+      { path: 'endpoints.bedrock.headers', key: '$x' },
+      { path: 'endpoints.bedrock.nested.deeper', key: '$set' },
+    ]);
+  });
+
   it('ignores dots in values and returns nothing for safe input', () => {
     expect(findUnsafeKeys({ url: 'https://a.b.c', models: ['gpt-4.1'] }, 'x')).toEqual([]);
     expect(findUnsafeKeys('a.b', 'x')).toEqual([]);
diff --git a/src/utils/keys.ts b/src/utils/keys.ts
index fd95fe02..bac33cb5 100644
--- a/src/utils/keys.ts
+++ b/src/utils/keys.ts
@@ -2,9 +2,17 @@ import type * as t from '@/types';
 
 const UNSAFE_KEY_RE = /^\$|\./;
 
-/** Record keys the admin API cannot store: containing `.` or starting with `$`. */
-export function isUnsafeConfigKey(key: string): boolean {
-  return UNSAFE_KEY_RE.test(key);
+/** Keys a server that keeps dotted keys (`dottedKeys`) refuses: `$`-prefixed and prototype names. */
+const RESERVED_KEY_RE = /^\$|^(?:__proto__|constructor|prototype)$/;
+
+/**
+ * Record keys the admin API cannot store. An older server silently drops a
+ * key containing `.` or starting with `$`; one that keeps dotted keys
+ * (`allowDots`, its `dottedKeys` feature) refuses only `$`-prefixed keys and
+ * the prototype names.
+ */
+export function isUnsafeConfigKey(key: string, allowDots = false): boolean {
+  return (allowDots ? RESERVED_KEY_RE : UNSAFE_KEY_RE).test(key);
 }
 
 function isKeyValuePairList(value: t.ConfigValue[]): value is t.KeyValuePair[] {
@@ -20,22 +28,27 @@ function isKeyValuePairList(value: t.ConfigValue[]): value is t.KeyValuePair[] {
 
 /**
  * Every object key (or key/value-pair key) under `value` that the admin API
- * would silently drop, with the dot-path of the object that holds it.
+ * would drop or refuse (see `isUnsafeConfigKey`), with the dot-path of the
+ * object that holds it.
  */
-export function findUnsafeKeys(value: t.ConfigValue, basePath: string): t.UnsafeConfigKey[] {
+export function findUnsafeKeys(
+  value: t.ConfigValue,
+  basePath: string,
+  allowDots = false,
+): t.UnsafeConfigKey[] {
   if (value == null || typeof value !== 'object') return [];
   if (Array.isArray(value)) {
     if (isKeyValuePairList(value)) {
       return value
-        .filter((pair) => typeof pair.key === 'string' && isUnsafeConfigKey(pair.key))
+        .filter((pair) => typeof pair.key === 'string' && isUnsafeConfigKey(pair.key, allowDots))
         .map((pair) => ({ path: basePath, key: pair.key }));
     }
-    return value.flatMap((item, index) => findUnsafeKeys(item, `${basePath}.${index}`));
+    return value.flatMap((item, index) => findUnsafeKeys(item, `${basePath}.${index}`, allowDots));
   }
   const found: t.UnsafeConfigKey[] = [];
   for (const [key, child] of Object.entries(value)) {
-    if (isUnsafeConfigKey(key)) found.push({ path: basePath, key });
-    found.push(...findUnsafeKeys(child, basePath ? `${basePath}.${key}` : key));
+    if (isUnsafeConfigKey(key, allowDots)) found.push({ path: basePath, key });
+    found.push(...findUnsafeKeys(child, basePath ? `${basePath}.${key}` : key, allowDots));
   }
   return found;
 }
diff --git a/src/utils/leaves.ts b/src/utils/leaves.ts
index 88000dc3..7794b60e 100644
--- a/src/utils/leaves.ts
+++ b/src/utils/leaves.ts
@@ -1,29 +1,93 @@
 import { configSchema } from 'librechat-data-provider';
 import type * as t from '@/types';
-import { APP_SERVICE_KEY_ALIASES } from '@/constants';
-import { resolveSubSchema } from './schema';
+import { APP_SERVICE_KEY_ALIASES, BUNDLED_CONFIG_FEATURES } from '@/constants';
+import { isUnionSchema, resolveSubSchema, unwrapSchema } from './schema';
+import { hasDottedKey, isConfigRecord } from './format';
 import { isUnsafeConfigKey } from './keys';
-import { isConfigRecord } from './format';
 
 /** Top-level YAML keys that describe the file itself rather than a setting. */
 const IMPORT_METADATA_KEYS = new Set(['version']);
 const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 
+/** Schema nodes whose keys are free names (where LibreChat keeps dotted keys), not setting names. */
+const FREE_KEY_TYPES: ReadonlySet<string> = new Set(['ZodRecord', 'ZodAny', 'ZodUnknown']);
+
+/** Schema nodes whose value is a group of settings (an MCP server, a file config endpoint). */
+const GROUP_TYPES: ReadonlySet<string> = new Set(['ZodObject', 'ZodRecord', 'ZodIntersection']);
+
+/** Type names of a schema node, one per union option (wrappers stripped, nested unions flattened). */
+function typeNamesOf(schema: t.ZodSchemaLike): string[] {
+  const node = unwrapSchema(schema);
+  if (!isUnionSchema(node)) return [node?._def?.typeName ?? ''];
+  return (node._def?.options ?? []).flatMap(typeNamesOf);
+}
+
+/**
+ * Whether the object at `path` names its keys freely (a record of headers,
+ * inference profiles, MIME types): the bundled schema says so (for a union,
+ * one of its options), or does not describe the path (a newer LibreChat's
+ * setting, which LibreChat judges). Top-level sections and fixed-shape
+ * objects name settings instead.
+ */
+function holdsFreeKeys(path: string): boolean {
+  if (!path) return false;
+  const schema = resolveSubSchema(configSchema as t.ZodSchemaLike, path.split('.'));
+  if (!schema) return true;
+  return typeNamesOf(schema).some((name) => FREE_KEY_TYPES.has(name));
+}
+
+/**
+ * Whether the free-key record `value` at `path` names groups of settings
+ * (MCP servers, file config endpoints) rather than plain values: the schema
+ * says its entries are objects, or one of them is. Such an entry is imported
+ * field by field, merged into the stored one, so a whole-record write (which
+ * replaces each entry) can't stand in for it.
+ */
+function holdsGroups(path: string, value: t.ConfigRecord): boolean {
+  if (Object.values(value).some(isConfigRecord)) return true;
+  const entry = resolveSubSchema(configSchema as t.ZodSchemaLike, [...path.split('.'), '*']);
+  if (!entry) return false;
+  const names = typeNamesOf(entry);
+  return names.length > 0 && names.every((name) => GROUP_TYPES.has(name));
+}
+
 /**
  * Leaves of `value` by dot-path, like `flattenObject`, except that a key the
- * admin API can't store (containing `.` or starting with `$`) is never split
- * into a nested path: it is reported in `unsafe` and its value is left out.
+ * admin API can't store (`isUnsafeConfigKey`) is never split into a nested
+ * path: it is reported in `unsafe` and its value is left out. With
+ * `allowDots` (the server's `dottedKeys`), a record of plain values that
+ * holds a dotted key is one leaf at its own path (a dot-path can't address
+ * the key); a dotted name in a record of setting groups is reported in
+ * `dottedNames` (its fields are written one by one, by path), and a dotted
+ * key where the schema expects a setting name in `dotted`.
  */
-function collectLeaves(value: t.ConfigRecord, prefix: string, out: t.ImportLeaves): void {
+function collectLeaves(
+  value: t.ConfigRecord,
+  prefix: string,
+  out: t.ImportLeaves,
+  allowDots: boolean,
+): void {
+  const freeKeys = allowDots && hasDottedKey(value) && holdsFreeKeys(prefix);
+  if (freeKeys && !holdsGroups(prefix, value)) {
+    out.leaves[prefix] = value;
+    return;
+  }
   for (const [key, child] of Object.entries(value)) {
     if (DANGEROUS_KEYS.has(key)) continue;
-    if (isUnsafeConfigKey(key)) {
+    if (isUnsafeConfigKey(key, allowDots)) {
       out.unsafe.push({ path: prefix, key });
       continue;
     }
+    if (key.includes('.')) {
+      (freeKeys ? out.dottedNames : out.dotted).push({ path: prefix, key });
+      continue;
+    }
     const path = prefix ? `${prefix}.${key}` : key;
-    if (isConfigRecord(child) && Object.keys(child).length > 0) collectLeaves(child, path, out);
-    else out.leaves[path] = child;
+    if (isConfigRecord(child) && Object.keys(child).length > 0) {
+      collectLeaves(child, path, out, allowDots);
+    } else {
+      out.leaves[path] = child;
+    }
   }
 }
 
@@ -32,7 +96,10 @@ function collectLeaves(value: t.ConfigRecord, prefix: string, out: t.ImportLeave
  * sections (`interfaceConfig`) are merged with their canonical section
  * (`interface`) leaf by leaf, the canonical spelling winning on conflicts.
  */
-export function flattenImport(appConfig: t.ConfigRecord): t.ImportLeaves {
+export function flattenImport(
+  appConfig: t.ConfigRecord,
+  features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
+): t.ImportLeaves {
   const aliased: t.ConfigRecord = {};
   const canonical: t.ConfigRecord = {};
   for (const [key, value] of Object.entries(appConfig)) {
@@ -41,19 +108,24 @@ export function flattenImport(appConfig: t.ConfigRecord): t.ImportLeaves {
     if (alias) aliased[alias] = value;
     else canonical[key] = value;
   }
-  const fromAlias: t.ImportLeaves = { leaves: {}, unsafe: [] };
-  const fromCanonical: t.ImportLeaves = { leaves: {}, unsafe: [] };
-  collectLeaves(aliased, '', fromAlias);
-  collectLeaves(canonical, '', fromCanonical);
+  const fromAlias: t.ImportLeaves = { leaves: {}, unsafe: [], dotted: [], dottedNames: [] };
+  const fromCanonical: t.ImportLeaves = { leaves: {}, unsafe: [], dotted: [], dottedNames: [] };
+  collectLeaves(aliased, '', fromAlias, features.dottedKeys);
+  collectLeaves(canonical, '', fromCanonical, features.dottedKeys);
   return {
     leaves: { ...fromAlias.leaves, ...fromCanonical.leaves },
     unsafe: [...fromAlias.unsafe, ...fromCanonical.unsafe],
+    dotted: [...fromAlias.dotted, ...fromCanonical.dotted],
+    dottedNames: [...fromAlias.dottedNames, ...fromCanonical.dottedNames],
   };
 }
 
 /** Leaf paths of an imported YAML the bundled config schema does not describe (aliases resolved). */
-export function findUnknownImportPaths(appConfig: t.ConfigRecord): string[] {
-  return Object.keys(flattenImport(appConfig).leaves).filter(
+export function findUnknownImportPaths(
+  appConfig: t.ConfigRecord,
+  features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
+): string[] {
+  return Object.keys(flattenImport(appConfig, features).leaves).filter(
     (path) => resolveSubSchema(configSchema as t.ZodSchemaLike, path.split('.')) == null,
   );
 }
diff --git a/src/utils/paths.test.ts b/src/utils/paths.test.ts
index af13c031..9a65937d 100644
--- a/src/utils/paths.test.ts
+++ b/src/utils/paths.test.ts
@@ -28,6 +28,16 @@ describe('collectLeafPaths', () => {
     ]);
   });
 
+  it('keeps an object with a dotted key whole, since no path can name the key', () => {
+    expect(
+      collectLeafPaths({
+        endpoints: {
+          bedrock: { inferenceProfiles: { 'us.anthropic.x': 'arn:a', plain: 'arn:b' }, x: 1 },
+        },
+      }),
+    ).toEqual(['endpoints.bedrock.inferenceProfiles', 'endpoints.bedrock.x']);
+  });
+
   it('returns the prefix itself for a primitive under a prefix', () => {
     expect(collectLeafPaths(true, 'interface.schedules')).toEqual(['interface.schedules']);
     expect(collectLeafPaths(undefined, 'x')).toEqual([]);
diff --git a/src/utils/paths.ts b/src/utils/paths.ts
index c6460881..9ceedede 100644
--- a/src/utils/paths.ts
+++ b/src/utils/paths.ts
@@ -1,5 +1,5 @@
 import type * as t from '@/types';
-import { isConfigRecord } from './format';
+import { hasDottedKey, isConfigRecord } from './format';
 
 const UNSAFE_SEGMENTS: ReadonlySet<string> = new Set(['__proto__', 'constructor', 'prototype']);
 
@@ -9,7 +9,7 @@ function collectInto(value: t.ConfigRecord, prefix: string, out: string[]): void
     const child = value[key];
     if (child === undefined) continue;
     const path = prefix ? `${prefix}.${key}` : key;
-    if (isConfigRecord(child)) {
+    if (isConfigRecord(child) && !hasDottedKey(child)) {
       collectInto(child, path, out);
     } else {
       out.push(path);
@@ -18,9 +18,10 @@ function collectInto(value: t.ConfigRecord, prefix: string, out: string[]): void
 }
 
 /**
- * Leaf paths a config tree sets: arrays, primitives and `null` are leaves, and
- * an empty object sets nothing (LibreChat leaves `{}` behind when the last
- * override under a section is removed, and it must not count as a setting).
+ * Leaf paths a config tree sets: arrays, primitives, `null` and objects with a
+ * dotted key (`hasDottedKey`) are leaves, and an empty object sets nothing
+ * (LibreChat leaves `{}` behind when the last override under a section is
+ * removed, and it must not count as a setting).
  */
 export function collectLeafPaths(value: t.ConfigValue, prefix = ''): string[] {
   if (!isConfigRecord(value)) return value === undefined || !prefix ? [] : [prefix];
diff --git a/src/utils/validation.ts b/src/utils/validation.ts
index 358443f9..96d58f5a 100644
--- a/src/utils/validation.ts
+++ b/src/utils/validation.ts
@@ -124,8 +124,50 @@ const ISSUE_MESSAGES: Readonly<Record<string, string>> = {
     'can only be configured in librechat.yaml for process-backed MCP servers (command, args, env, cwd, stderr, stdio)',
   BLANK_VALUE: 'is blank: enter a value, or clear the field',
   BLANK_KEY: 'has a blank key: name it, or remove the entry',
+  UNSAFE_KEY:
+    "has a key LibreChat can't store yet (\"{{key}}\" contains '.' or starts with '$'); set it in librechat.yaml",
+  RESERVED_KEY:
+    "has a key LibreChat can't store (\"{{key}}\" starts with '$' or is a reserved name); rename it",
+  invalid_value: 'is not a valid value',
+  wrong_type: 'has the wrong type of value',
+  invalid_option: 'is not one of the allowed values',
+  too_small_value: 'is too small',
+  too_big_value: 'is too large',
+  dotted_key: "has a key with a dot where LibreChat expects a setting's name",
+  unknown_section: "isn't a section LibreChat knows",
 };
 
+/**
+ * Codes whose message needs parameters, worded without them: the admin API
+ * reports issue codes only (no minimum, expected type or options).
+ */
+const PARAMLESS_CODES: Readonly<Record<string, string>> = {
+  invalid_type: 'wrong_type',
+  invalid_literal: 'invalid_value',
+  invalid_enum_value: 'invalid_option',
+  too_small: 'too_small_value',
+  too_small_exclusive: 'too_small_value',
+  too_small_length: 'too_small_value',
+  too_small_items: 'too_small_value',
+  too_big: 'too_big_value',
+  too_big_exclusive: 'too_big_value',
+  too_big_length: 'too_big_value',
+  too_big_items: 'too_big_value',
+};
+
+const PLACEHOLDER_RE = /\{\{\w+\}\}/;
+
+/**
+ * The code to show for an issue reported without parameters: one whose
+ * message names them (`too_small`: "must be at least {{minimum}}") becomes
+ * its parameter-free wording ("is too small"); other codes stay.
+ */
+export function paramlessIssueCode(code: string): string {
+  const template = ISSUE_MESSAGES[code];
+  if (!template || !PLACEHOLDER_RE.test(template)) return code;
+  return PARAMLESS_CODES[code] ?? 'invalid_value';
+}
+
 /** Fills `{{param}}` placeholders. */
 export function interpolateIssue(
   template: string,
diff --git a/src/utils/values.ts b/src/utils/values.ts
index 3618e845..59d9c5ed 100644
--- a/src/utils/values.ts
+++ b/src/utils/values.ts
@@ -50,8 +50,10 @@ const BLOCK_SHADOWED_KEYS: ReadonlySet<string> = new Set([
   'titlePromptTemplate',
 ]);
 
-/** Activity and reasoning-label settings where a value in `endpoints.all` wins per field. */
+/** Settings where a value in `endpoints.all` wins per field: title timing, stream rate, activity and reasoning labels. */
 const FIELD_SHADOWED_KEYS: ReadonlySet<string> = new Set([
+  'titleTiming',
+  'streamRate',
   'activityLabel',
   'activityModel',
   'activityEndpoint',

From 332747fa72ddfb46126a0fba17343dc56f5d1537 Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Fri, 23 Oct 2026 11:22:20 -0400
Subject: [PATCH 2/5] =?UTF-8?q?=F0=9F=A7=A9=20fix:=20Keep=20User=20Variabl?=
 =?UTF-8?q?e=20Edits=20Sparse=20Beside=20Dotted=20Names=20and=20Stop=20Rea?=
 =?UTF-8?q?ding=20Dotted=20Keys=20as=20Secrets?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/components/configuration/review/diff.ts   | 31 +++++++--
 .../configuration/review/review.test.ts       | 42 ++++++++++++
 .../configuration/sections/mcp/Editor.tsx     | 34 +++++-----
 .../configuration/sections/mcp/Servers.tsx    |  1 +
 .../sections/mcp/__tests__/Servers.test.tsx   | 68 +++++++++++++++++++
 src/types/mcp.ts                              |  2 +
 6 files changed, 155 insertions(+), 23 deletions(-)

diff --git a/src/components/configuration/review/diff.ts b/src/components/configuration/review/diff.ts
index d89ec8d3..5b1e5dbb 100644
--- a/src/components/configuration/review/diff.ts
+++ b/src/components/configuration/review/diff.ts
@@ -76,6 +76,21 @@ export function isSecretPath(path: string): boolean {
   return getFieldMeta(path)?.secret === true;
 }
 
+/** How the metadata registry names any key of a record. */
+const RECORD_KEY = '{}';
+
+/**
+ * Whether the value at `segments` must never be shown (`isSecretPath`). A
+ * segment with a dot is a record key (a header, an inference profile ID), a
+ * free name rather than a field's, so it is read as any key of its record:
+ * its text (`tenant.apiKey`) never makes the value a secret.
+ */
+function isSecretSegments(segments: readonly string[]): boolean {
+  return isSecretPath(
+    segments.map((segment) => (segment.includes('.') ? RECORD_KEY : segment)).join('.'),
+  );
+}
+
 export function isObjectList(value: t.ConfigValue): value is t.ConfigRecord[] {
   return Array.isArray(value) && value.length > 0 && value.every(isConfigRecord);
 }
@@ -441,18 +456,20 @@ function diffPositionalList(
 /**
  * Items of the value under `key` of the object at `path`. A key with a dot
  * (`us.anthropic.claude-sonnet-4-6`) reads as several keys in a dot-path, so
- * these items carry their path's segments, the key kept whole. Items under a
- * dotted key nested deeper already carry theirs: only the part up to this key
- * is replaced.
+ * these items carry their path's segments, the key kept whole, and a secret
+ * read from the dot-path is checked again by them (`isSecretSegments`). Items
+ * under a dotted key nested deeper already carry theirs: only the part up to
+ * this key is replaced.
  */
 function underKey(items: t.ChangeSummaryItem[], path: string, key: string): t.ChangeSummaryItem[] {
   if (!key.includes('.')) return items;
   const parent = path.split('.');
   const depth = parent.length + key.split('.').length;
-  return items.map((item) => ({
-    ...item,
-    segments: [...parent, key, ...(item.segments ?? item.path.split('.')).slice(depth)],
-  }));
+  return items.map((item) => {
+    const segments = [...parent, key, ...(item.segments ?? item.path.split('.')).slice(depth)];
+    if (!item.secret) return { ...item, segments };
+    return { ...item, segments, secret: isSecretSegments(segments) || undefined };
+  });
 }
 
 /** Entries of a record collection (`mcpServers`) saved as a whole, matched by key. */
diff --git a/src/components/configuration/review/review.test.ts b/src/components/configuration/review/review.test.ts
index af70621c..80f2dd28 100644
--- a/src/components/configuration/review/review.test.ts
+++ b/src/components/configuration/review/review.test.ts
@@ -846,6 +846,48 @@ describe('planRevert', () => {
       });
     });
 
+    it('shows a dotted key whose text ends in a secret name as the value it is', () => {
+      const header = 'tenant.apiKey';
+      const team = { ...moonshot, headers: { [header]: 'acme' } };
+      const tree = { ...baseline, endpoints: { custom: [team, zai, vercel] } };
+      const changed = { ...team, headers: { [header]: 'globex' } };
+      const added = { ...zai, headers: { [header]: 'initech' } };
+      const items = summarizeChanges(
+        makeInput({ baseline: tree, saves: saveList([changed, added, vercel]) }),
+      );
+      expect(items).toHaveLength(2);
+      expect(items[0]).toMatchObject({ kind: 'changed', before: 'acme', after: 'globex' });
+      expect(items[1]).toMatchObject({ kind: 'added', after: 'initech' });
+      for (const item of items) {
+        expect(item.segments?.at(-1)).toBe(header);
+        expect(item.secret).toBeUndefined();
+      }
+      const profiles = summarizeChanges(
+        makeInput({
+          baseline: withProfiles({ 'us.secretKey': 'arn:a' }),
+          saves: [{ fieldPath: PROFILES, value: { 'us.secretKey': 'arn:b' } }],
+          isOwned: () => true,
+        }),
+      );
+      expect(profiles).toEqual([
+        expect.objectContaining({ kind: 'changed', before: 'arn:a', after: 'arn:b' }),
+      ]);
+      expect(profiles[0].secret).toBeUndefined();
+    });
+
+    it('still hides a secret field under a dotted key', () => {
+      const before = { 'team.one': { apiKey: 'sk-old' } };
+      const after = { 'team.one': { apiKey: 'sk-new' } };
+      const [item] = summarizeChanges(
+        makeInput({ baseline: { vaults: before }, saves: [{ fieldPath: 'vaults', value: after }] }),
+      );
+      expect(item).toMatchObject({
+        path: 'vaults.team.one.apiKey',
+        segments: ['vaults', 'team.one', 'apiKey'],
+        secret: true,
+      });
+    });
+
     it('restores a dotted entry name of a record collection saved as a whole', () => {
       const docs = { type: 'http', url: 'https://docs.example/mcp' };
       const tree = { mcpServers: { ...baseline.mcpServers, 'my.server': docs } };
diff --git a/src/components/configuration/sections/mcp/Editor.tsx b/src/components/configuration/sections/mcp/Editor.tsx
index 027398ee..9143fb46 100644
--- a/src/components/configuration/sections/mcp/Editor.tsx
+++ b/src/components/configuration/sections/mcp/Editor.tsx
@@ -8,13 +8,7 @@ import {
   isHttpTransport,
   transportLabelKey,
 } from './transport';
-import {
-  hasDottedKey,
-  isConfigRecord,
-  asConfigRecord,
-  hasConfigValue,
-  isConfigValueEqual,
-} from '@/utils';
+import { isConfigRecord, isConfigValueEqual, asConfigRecord, hasConfigValue } from '@/utils';
 import { renderCollectionEntryFields, renderInlineField, toFieldId } from '../../renderer';
 import { RecordObjectField } from '../../fields/RecordObjectField';
 import { UnknownSettings } from '../../UnknownSettings';
@@ -83,6 +77,7 @@ export function McpServerEditor({
   quiet,
   owned,
   ownKeys,
+  isPendingWhole,
   editSessionId,
 }: t.McpEditorProps) {
   const localize = useLocalize();
@@ -299,6 +294,7 @@ export function McpServerEditor({
             onChange={onChange}
             disabled={disabled}
             editSessionId={editSessionId}
+            wholePending={isPendingWhole?.('customUserVars')}
           />
         </McpFieldGroup>
       )}
@@ -371,12 +367,20 @@ function UrlHint({ transport }: { transport: t.McpTransport }) {
   return <span className="settings-hint">{localize(key)}</span>;
 }
 
+/** Keys added, changed or removed between two records. */
+function changedKeys(current: t.ConfigRecord, next: t.ConfigRecord): string[] {
+  const keys = new Set([...Object.keys(next), ...Object.keys(current)]);
+  return [...keys].filter((key) => !isConfigValueEqual(current[key], next[key]));
+}
+
 /**
  * The values each user enters (customUserVars), as cards keyed by variable
  * name. Only the variables that change are written, so a server's override
  * stays sparse; variables the layer beneath defines can't be removed (D3).
- * While a variable's name has a dot (`dottedKeys`), the variables are
- * written as one record: a dot-path can't name that variable.
+ * A change to a variable whose name has a dot (`dottedKeys`) writes the
+ * variables as one record, since a dot-path can't name that variable; so
+ * does every change while such a write is pending (`wholePending`), which a
+ * write of one variable would replace.
  */
 function UserVariables({
   field,
@@ -386,6 +390,7 @@ function UserVariables({
   onChange,
   disabled,
   editSessionId,
+  wholePending,
 }: {
   field: t.SchemaField;
   entryPath: string;
@@ -394,20 +399,17 @@ function UserVariables({
   onChange: (leaf: string, value: t.ConfigValue) => void;
   disabled?: boolean;
   editSessionId?: number;
+  wholePending?: boolean;
 }) {
   const current = asConfigRecord(value);
   const write = (next: t.ConfigValue) => {
     const nextRecord = asConfigRecord(next);
-    if (hasDottedKey(current) || hasDottedKey(nextRecord)) {
+    const changed = changedKeys(current, nextRecord);
+    if (wholePending || changed.some((key) => key.includes('.'))) {
       onChange(field.key, Object.keys(nextRecord).length > 0 ? nextRecord : undefined);
       return;
     }
-    for (const [key, item] of Object.entries(nextRecord)) {
-      if (!isConfigValueEqual(current[key], item)) onChange(`${field.key}.${key}`, item);
-    }
-    for (const key of Object.keys(current)) {
-      if (!Object.hasOwn(nextRecord, key)) onChange(`${field.key}.${key}`, undefined);
-    }
+    for (const key of changed) onChange(`${field.key}.${key}`, nextRecord[key]);
   };
   return (
     <div className="py-2">
diff --git a/src/components/configuration/sections/mcp/Servers.tsx b/src/components/configuration/sections/mcp/Servers.tsx
index 104af4d4..dfe3a164 100644
--- a/src/components/configuration/sections/mcp/Servers.tsx
+++ b/src/components/configuration/sections/mcp/Servers.tsx
@@ -732,6 +732,7 @@ export function McpServersRenderer({
                   quiet={badges.isNew}
                   owned={!lowerKeys.has(key)}
                   ownKeys={inScope ? ownKeysOf(key) : undefined}
+                  isPendingWhole={(leaf) => edits[`${prefix}${key}.${leaf}`] !== undefined}
                   editSessionId={editSessionId}
                 />
               </ConfiguredOnlyContext.Provider>
diff --git a/src/components/configuration/sections/mcp/__tests__/Servers.test.tsx b/src/components/configuration/sections/mcp/__tests__/Servers.test.tsx
index e5b87874..9308be56 100644
--- a/src/components/configuration/sections/mcp/__tests__/Servers.test.tsx
+++ b/src/components/configuration/sections/mcp/__tests__/Servers.test.tsx
@@ -919,6 +919,74 @@ describe('McpServersRenderer — dotted record keys (dottedKeys)', () => {
     if (!headers) throw new Error('no headers editor');
     expect(within(headers).getByDisplayValue('x.api.version')).toBeInTheDocument();
   });
+
+  describe('user variables of a saved server', () => {
+    const PLAIN: t.ConfigRecord = { title: 'Region', description: 'Your region' };
+    const mixed: t.ConfigRecord = {
+      versioned: {
+        type: 'streamable-http',
+        url: 'https://mcp.versioned.dev/mcp',
+        customUserVars: { ...USER_VARS, REGION: PLAIN },
+      },
+    };
+
+    /** The user variables editor of `versioned`, its group open. */
+    function userVariables(): HTMLElement {
+      expand('versioned');
+      openGroup('versioned', 'com_config_mcp_group_user_vars');
+      const vars = card('versioned').querySelector<HTMLElement>(
+        '#mcpServers-versioned-customUserVars',
+      );
+      if (!vars) throw new Error('no user variables editor');
+      return vars;
+    }
+
+    function retitle(vars: HTMLElement, name: string, title: string) {
+      const entry = vars.querySelector<HTMLElement>(
+        `#section-mcpServers-versioned-customUserVars-${name}`,
+      );
+      if (!entry) throw new Error(`no card for ${name}`);
+      const toggle = entry.querySelector<HTMLButtonElement>('button[aria-expanded]');
+      if (toggle?.getAttribute('aria-expanded') !== 'true') fireEvent.click(toggle!);
+      const input = entry.querySelector<HTMLInputElement>('input[id$="-title"]');
+      if (!input) throw new Error(`no title input for ${name}`);
+      fireEvent.change(input, { target: { value: title } });
+      fireEvent.blur(input);
+    }
+
+    it('writes only the edited variable when a dotted one is inherited from Base', () => {
+      render(<Harness scope contract={dottedContract} extra={mixed} />);
+      expand('versioned');
+      fireEvent.click(
+        within(card('versioned')).getByRole('button', { name: 'com_config_mcp_override_fields' }),
+      );
+      retitle(userVariables(), 'REGION', 'Area');
+      expect(edits.editedValues).toEqual({
+        'mcpServers.versioned.customUserVars.REGION': { ...PLAIN, title: 'Area' },
+      });
+    });
+
+    it('writes only the edited variable of a Base server whose other variable is dotted', () => {
+      render(<Harness extra={mixed} />);
+      retitle(userVariables(), 'REGION', 'Area');
+      expect(edits.editedValues).toEqual({
+        'mcpServers.versioned.customUserVars.REGION': { ...PLAIN, title: 'Area' },
+      });
+    });
+
+    it('keeps the variables one record while removing a dotted one is pending', () => {
+      render(<Harness contract={dottedContract} extra={mixed} />);
+      const vars = userVariables();
+      fireEvent.click(within(vars).getByRole('button', { name: 'com_ui_delete MY.TOKEN' }));
+      expect(edits.editedValues).toEqual({
+        'mcpServers.versioned.customUserVars': { REGION: PLAIN },
+      });
+      retitle(vars, 'REGION', 'Area');
+      expect(edits.editedValues).toEqual({
+        'mcpServers.versioned.customUserVars': { REGION: { ...PLAIN, title: 'Area' } },
+      });
+    });
+  });
 });
 
 describe('McpServersRenderer — profiles (MCP-10)', () => {
diff --git a/src/types/mcp.ts b/src/types/mcp.ts
index 1e042b28..6a4e8cb8 100644
--- a/src/types/mcp.ts
+++ b/src/types/mcp.ts
@@ -174,6 +174,8 @@ export interface McpEditorProps {
   owned?: boolean;
   /** In a profile: the server keys the profile sets or edits, for "Set values only". */
   ownKeys?: ReadonlySet<string>;
+  /** Whether a pending edit writes the server's `leaf` whole (a record such as `customUserVars`). */
+  isPendingWhole?: (leaf: string) => boolean;
   editSessionId?: number;
 }
 

From 696595c7cfdfa9271be50ad5b71ca96fc8d4a137 Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Fri, 23 Oct 2026 12:43:10 -0400
Subject: [PATCH 3/5] =?UTF-8?q?=F0=9F=A7=BE=20feat:=20Write=20Reports,=20P?=
 =?UTF-8?q?rofile=20Priority,=20Pre-Auth=20Sign-In=20and=20Per-Field=20Tit?=
 =?UTF-8?q?les=20from=20the=20Config=20Contract?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Shows what a save skipped or ignored and why, maps issues by segments and params, edits profile
priority and creates profiles create-only, makes the pre-auth Base fields editable, and resolves
titles per field — each gated on the server contract with today's behaviour as the fallback.
---
 src/components/configuration/ConfigPage.tsx   |   1 +
 .../configuration/ConfigTabContent.tsx        |   7 +-
 src/components/configuration/ScopeBar.tsx     |  61 ++++-
 .../configuration/ScopePriority.tsx           | 138 ++++++++++
 .../configuration/ScopeSelector.tsx           |  14 +-
 .../configuration/__tests__/ScopeBar.test.tsx |  85 +++++-
 .../__tests__/ScopeSelector.test.tsx          |  47 +++-
 src/components/configuration/edits.ts         |   2 +-
 src/components/configuration/import.ts        |  13 +-
 .../configuration/renderer/FieldRenderer.tsx  |  24 +-
 .../renderer/__tests__/controls.test.tsx      |  39 ++-
 .../configuration/review/ChangeRow.tsx        |   1 +
 .../sections/__tests__/coverage.test.tsx      |  32 +++
 .../sections/features/Credential.tsx          |   6 +-
 .../features/__tests__/WebSearch.test.tsx     |  14 +
 .../features/__tests__/coverage.test.tsx      |  46 ++++
 .../configuration/sections/providers/Card.tsx |   9 +-
 .../sections/providers/Group.tsx              |   1 +
 .../__tests__/ProvidersRenderer.test.tsx      |  19 +-
 .../sections/providers/layout.ts              |   7 +-
 .../sections/specs/ChipPicker.tsx             |   9 +-
 .../configuration/sections/specs/Settings.tsx |   9 +-
 .../__tests__/ModelSpecsRenderer.test.tsx     |  55 +++-
 .../sections/system/RegistrationRenderer.tsx  | 125 +++++++--
 .../__tests__/RegistrationRenderer.test.tsx   |  40 +++
 .../configuration/values/ProvenanceChip.tsx   |   7 +-
 src/constants/collections.ts                  |  14 +
 src/constants/config.ts                       | 205 ++++++++++----
 src/constants/contract.ts                     |  26 +-
 src/constants/features.ts                     |  21 +-
 src/constants/scope.ts                        |  37 ++-
 src/hooks/config/contract.ts                  |   6 +
 src/hooks/config/field.ts                     |   7 +-
 src/hooks/config/import.ts                    |  11 +-
 src/hooks/config/layers.ts                    |   6 +-
 src/hooks/config/options.test.tsx             |   9 +
 src/hooks/config/options.ts                   |  18 +-
 src/hooks/config/review.test.tsx              |  32 ++-
 src/hooks/config/review.ts                    |  17 +-
 src/hooks/config/save.ts                      |   9 +-
 src/hooks/config/scope.ts                     |   7 +-
 src/hooks/config/sections.ts                  |  16 +-
 src/locales/en/translation.json               |  36 +++
 src/server/config/meta.test.ts                |  30 +++
 src/server/config/meta.ts                     |   3 +
 src/server/config/save.test.ts                | 249 ++++++++++++++++++
 src/server/config/save.ts                     | 166 +++++++++---
 src/server/scopes/read.test.ts                | 126 ++++++++-
 src/server/scopes/read.ts                     | 195 ++++++++++----
 src/server/utils/api.ts                       |  30 ++-
 src/test/admin.ts                             |  27 +-
 src/test/fixtures.ts                          |  17 ++
 src/test/page.tsx                             |  39 +--
 src/test/sections.tsx                         |  56 ++--
 src/types/changes.ts                          |  52 ++++
 src/types/config-ui.ts                        |  15 +-
 src/types/config.ts                           |   7 +-
 src/types/contract.ts                         |  27 +-
 src/types/features.ts                         |   7 +-
 src/types/providers.ts                        |   8 +-
 src/types/scope.ts                            |  18 +-
 src/types/specs.ts                            |   2 +
 src/types/values.ts                           |  14 +-
 src/utils/changes.test.ts                     |  41 +++
 src/utils/changes.ts                          |  36 ++-
 src/utils/collections.ts                      |  10 +
 src/utils/contract.test.ts                    |  96 ++++++-
 src/utils/contract.ts                         |  10 +
 src/utils/errors.ts                           |  16 ++
 src/utils/layers.ts                           |  14 +-
 src/utils/scopes.test.ts                      |  52 ++++
 src/utils/scopes.ts                           |  49 +++-
 src/utils/validation.test.ts                  |  86 ++++++
 src/utils/validation.ts                       |  68 +++++
 src/utils/values.test.ts                      |  50 ++++
 src/utils/values.ts                           |  45 +++-
 src/utils/writes.test.ts                      | 169 ++++++++++++
 src/utils/writes.ts                           |  97 ++++++-
 78 files changed, 2821 insertions(+), 394 deletions(-)
 create mode 100644 src/components/configuration/ScopePriority.tsx
 create mode 100644 src/utils/validation.test.ts
 create mode 100644 src/utils/writes.test.ts

diff --git a/src/components/configuration/ConfigPage.tsx b/src/components/configuration/ConfigPage.tsx
index 8424c8b5..31d79c03 100644
--- a/src/components/configuration/ConfigPage.tsx
+++ b/src/components/configuration/ConfigPage.tsx
@@ -531,6 +531,7 @@ export function ConfigPage({
                 scope={editingScope}
                 onBackToBase={backToBase}
                 onError={notifyError}
+                canEditPriority={canManageConfig}
                 values={layers.scopeOverrideValues}
                 pendingResets={edits.pendingResets}
                 onRevert={
diff --git a/src/components/configuration/ConfigTabContent.tsx b/src/components/configuration/ConfigTabContent.tsx
index ebed52d4..16acd8ec 100644
--- a/src/components/configuration/ConfigTabContent.tsx
+++ b/src/components/configuration/ConfigTabContent.tsx
@@ -27,7 +27,8 @@ import { ConfigSection } from './ConfigSection';
 import { CodeField } from './fields/CodeField';
 import { InfoBanner } from './InfoBanner';
 import { ScopeGate } from './ScopeGate';
-import { useLocalize } from '@/hooks';
+import { useLocalize, useConfigContract } from '@/hooks';
+import { getWriteRules } from '@/constants';
 
 /**
  * Enter in an input of the tab form must never submit it (and so "click" its
@@ -149,8 +150,11 @@ export function ConfigTabContent({
     return map;
   }, [sectionCounts]);
 
+  const contract = useConfigContract();
   const valuesData = useMemo<t.ConfigValuesData>(
     () => ({
+      writeRules: getWriteRules(contract),
+      titleResolution: contract.rules.titleResolution,
       configValues,
       editedValues,
       resolvedValues,
@@ -173,6 +177,7 @@ export function ConfigTabContent({
       isEditingScope,
       valueLayers,
       visibilityEdits,
+      contract,
     ],
   );
 
diff --git a/src/components/configuration/ScopeBar.tsx b/src/components/configuration/ScopeBar.tsx
index f7b4d75f..344511ee 100644
--- a/src/components/configuration/ScopeBar.tsx
+++ b/src/components/configuration/ScopeBar.tsx
@@ -4,9 +4,10 @@ import { useQuery, useQueryClient } from '@tanstack/react-query';
 import type * as t from '@/types';
 import { formatScopeName, isSameScope, findPriorityTies, countScopeOverrides } from '@/utils';
 import { availableScopesOptions, toggleScopeActiveFn } from '@/server';
+import { useLocalize, useConfigFeatures } from '@/hooks';
 import { ScopeOverridesDialog } from './ScopeOverridesDialog';
+import { ScopePriorityEditor } from './ScopePriority';
 import { getScopeTypeConfig } from '@/constants';
-import { useLocalize } from '@/hooks';
 
 const TYPE_LABEL_KEYS: Readonly<Record<string, string>> = {
   role: 'com_scope_type_role',
@@ -16,13 +17,17 @@ const TYPE_LABEL_KEYS: Readonly<Record<string, string>> = {
 
 /**
  * Persistent context bar shown under the tabs while a profile is open: which
- * profile is being edited, its priority (with ties), members, override count,
- * whether it is active, and the way back to Base (WS8: PR-1, PR-2).
+ * profile is being edited, its priority (with ties, and Change where the
+ * server has a priority route, D6), members, override count, whether it is
+ * active, and the way back to Base (WS8: PR-1, PR-2). Ties with profiles
+ * that change the same settings are a warning while LibreChat leaves their
+ * order undefined; with `deterministicPrecedence` the bar says which wins.
  */
 export function ScopeBar({
   scope,
   onBackToBase,
   onError,
+  canEditPriority = false,
   values,
   pendingResets,
   onRevert,
@@ -35,6 +40,7 @@ export function ScopeBar({
 }: t.ScopeBarProps) {
   const localize = useLocalize();
   const queryClient = useQueryClient();
+  const { deterministicPrecedence, priorityRoute } = useConfigFeatures();
   const [toggling, setToggling] = useState(false);
   const [overridesOpen, setOverridesOpen] = useState(false);
   const { data: scopes, isSuccess, isFetching } = useQuery(availableScopesOptions);
@@ -44,6 +50,8 @@ export function ScopeBar({
   const isDeleted = isSuccess && !isFetching && !live;
   const ties = useMemo(() => findPriorityTies(current, scopes ?? []), [current, scopes]);
   const conflicts = ties.filter((tie) => tie.sharedPaths.length > 0);
+  const winsOver = conflicts.filter((tie) => tie.appliesAfter);
+  const losesTo = conflicts.filter((tie) => !tie.appliesAfter);
   const config = getScopeTypeConfig(current.principalType);
   const typeLabel = localize(TYPE_LABEL_KEYS[current.principalType] ?? config.labelKey);
   const overrideCount = countScopeOverrides(current);
@@ -70,8 +78,8 @@ export function ScopeBar({
     }
   };
 
+  const priorityEditable = canEditPriority && priorityRoute && !isDeleted;
   const details = [
-    localize('com_scope_priority', { priority: current.priority }),
     current.memberCount != null &&
       localize('com_scope_member_count', { count: current.memberCount }),
     overrideCount > 0
@@ -102,18 +110,47 @@ export function ScopeBar({
               {localize('com_scope_bar_name', { type: typeLabel, name: formatScopeName(current) })}
             </strong>
           </p>
-          <p
-            className="flex flex-wrap items-center gap-x-1.5 text-xs text-(--cui-color-text-muted)"
-            title={localize('com_scope_priority_help')}
+          <div
+            className="flex flex-wrap items-center gap-x-1.5 gap-y-1 text-xs text-(--cui-color-text-muted)"
+            title={localize(
+              deterministicPrecedence
+                ? 'com_scope_priority_help_ordered'
+                : 'com_scope_priority_help',
+            )}
           >
-            {details.map((item, i) => (
+            {priorityEditable ? (
+              <ScopePriorityEditor scope={current} onError={onError} />
+            ) : (
+              <span>{localize('com_scope_priority', { priority: current.priority })}</span>
+            )}
+            {details.map((item) => (
               <span key={item} className="flex items-center gap-1.5">
-                {i > 0 && <span aria-hidden="true">·</span>}
+                <span aria-hidden="true">·</span>
                 {item}
               </span>
             ))}
-          </p>
-          {conflicts.length > 0 && (
+          </div>
+          {deterministicPrecedence &&
+            [
+              { list: winsOver, key: 'com_scope_tie_order_wins' },
+              { list: losesTo, key: 'com_scope_tie_order_loses' },
+            ].map(
+              ({ list, key }) =>
+                list.length > 0 && (
+                  <p
+                    key={key}
+                    role="status"
+                    className="text-xs text-(--cui-color-text-muted)"
+                    title={localize('com_scope_tie_order_rule')}
+                  >
+                    {localize(key, {
+                      names: tieNames(list),
+                      count: new Set(list.flatMap((tie) => tie.sharedPaths)).size,
+                    })}
+                  </p>
+                ),
+            )}
+          {!deterministicPrecedence && conflicts.length > 0 && (
             <p
               role="status"
               className="flex items-start gap-1 text-xs text-(--cui-color-text-default)"
@@ -129,7 +166,7 @@ export function ScopeBar({
               </span>
             </p>
           )}
-          {conflicts.length === 0 && ties.length > 0 && (
+          {!deterministicPrecedence && conflicts.length === 0 && ties.length > 0 && (
             <p className="text-xs text-(--cui-color-text-muted)">
               {localize('com_scope_tie_note', { names: tieNames(ties) })}
             </p>
diff --git a/src/components/configuration/ScopePriority.tsx b/src/components/configuration/ScopePriority.tsx
new file mode 100644
index 00000000..05300a95
--- /dev/null
+++ b/src/components/configuration/ScopePriority.tsx
@@ -0,0 +1,138 @@
+import { useId, useState } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
+import { Button, NumberField } from '@clickhouse/click-ui';
+import type * as t from '@/types';
+import { MAX_SCOPE_PRIORITY } from '@/constants';
+import { setScopePriorityFn } from '@/server';
+import { useLocalize } from '@/hooks';
+import { errorText } from '@/utils';
+
+const PRIORITY_FORMAT = new Intl.NumberFormat();
+
+/** The problem with a typed priority, or null when it can be saved. */
+function priorityProblem(text: string, localize: t.LocalizeFn): string | null {
+  const value = Number(text);
+  if (text.trim() === '' || !Number.isInteger(value)) {
+    return localize('com_scope_priority_invalid');
+  }
+  if (value < 0 || value > MAX_SCOPE_PRIORITY) {
+    return localize('com_scope_priority_range', {
+      max: PRIORITY_FORMAT.format(MAX_SCOPE_PRIORITY),
+    });
+  }
+  return null;
+}
+
+/**
+ * A profile's priority with Change (D6, `priorityRoute`): an inline number
+ * field that sets only the priority, leaving the profile's settings and
+ * active state as they are. Enter saves, Escape cancels.
+ */
+export function ScopePriorityEditor({ scope, onError }: t.ScopePriorityEditorProps) {
+  const localize = useLocalize();
+  const queryClient = useQueryClient();
+  const inputId = useId();
+  const errorId = useId();
+  const [draft, setDraft] = useState<string | null>(null);
+  const [saving, setSaving] = useState(false);
+  const [problem, setProblem] = useState<string | null>(null);
+
+  const close = () => {
+    setDraft(null);
+    setProblem(null);
+  };
+
+  const save = async () => {
+    if (draft == null || saving) return;
+    const invalid = priorityProblem(draft, localize);
+    if (invalid) {
+      setProblem(invalid);
+      return;
+    }
+    const priority = Number(draft);
+    if (priority === scope.priority) {
+      close();
+      return;
+    }
+    setSaving(true);
+    try {
+      await setScopePriorityFn({
+        data: { principalType: scope.principalType, principalId: scope.principalId, priority },
+      });
+      await queryClient.invalidateQueries({ queryKey: ['availableScopes'] });
+      close();
+    } catch (err) {
+      onError?.(errorText(err, localize('com_scope_priority_error'), localize));
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  if (draft == null) {
+    return (
+      <span className="flex items-center gap-1">
+        {localize('com_scope_priority', { priority: scope.priority })}
+        <button
+          type="button"
+          className="settings-row-action"
+          onClick={() => setDraft(String(scope.priority))}
+          aria-label={localize('com_scope_priority_change_label')}
+        >
+          {localize('com_scope_priority_change')}
+        </button>
+      </span>
+    );
+  }
+
+  return (
+    <span className="flex flex-wrap items-center gap-2">
+      <span className="w-28">
+        <NumberField
+          id={inputId}
+          label={localize('com_scope_priority_label')}
+          orientation="horizontal"
+          value={draft}
+          min={0}
+          max={MAX_SCOPE_PRIORITY}
+          step={1}
+          hideControls
+          autoFocus
+          disabled={saving}
+          aria-invalid={problem ? true : undefined}
+          aria-describedby={problem ? errorId : undefined}
+          onChange={(next) => {
+            setDraft(next);
+            setProblem(null);
+          }}
+          onKeyDown={(event) => {
+            if (event.key === 'Enter') {
+              event.preventDefault();
+              void save();
+            }
+            if (event.key === 'Escape') close();
+          }}
+        />
+      </span>
+      <Button
+        htmlType="button"
+        type="primary"
+        label={localize('com_ui_save')}
+        loading={saving}
+        disabled={saving}
+        onClick={() => void save()}
+      />
+      <Button
+        htmlType="button"
+        type="secondary"
+        label={localize('com_ui_cancel')}
+        disabled={saving}
+        onClick={close}
+      />
+      {problem && (
+        <span id={errorId} role="alert" className="text-xs text-(--cui-color-text-danger)">
+          {problem}
+        </span>
+      )}
+    </span>
+  );
+}
diff --git a/src/components/configuration/ScopeSelector.tsx b/src/components/configuration/ScopeSelector.tsx
index 7c609d2a..b28522f6 100644
--- a/src/components/configuration/ScopeSelector.tsx
+++ b/src/components/configuration/ScopeSelector.tsx
@@ -24,7 +24,7 @@ import {
   isCurrentSelection,
   countScopeOverrides,
 } from '@/utils';
-import { useLocalize, useDebouncedFilter } from '@/hooks';
+import { useLocalize, useConfigFeatures, useDebouncedFilter } from '@/hooks';
 import { DecorativeIcon } from '@/components/shared';
 import { getScopeTypeConfig } from '@/constants';
 
@@ -58,6 +58,10 @@ export function ScopeSelector({
 }: t.ScopeSelectorProps) {
   const localize = useLocalize();
   const queryClient = useQueryClient();
+  const { deterministicPrecedence } = useConfigFeatures();
+  const precedenceKey = deterministicPrecedence
+    ? 'com_scope_precedence_ordered'
+    : 'com_scope_precedence';
   const [search, setSearch] = useState('');
   const [showCreate, setShowCreate] = useState(false);
   const [creatingKey, setCreatingKey] = useState<string | null>(null);
@@ -433,7 +437,7 @@ export function ScopeSelector({
     <Command.Dialog {...dialogProps} label={localize('com_scope_select')}>
       <VisuallyHidden>
         <DialogTitle>{localize('com_scope_select')}</DialogTitle>
-        <DialogDescription>{localize('com_scope_precedence')}</DialogDescription>
+        <DialogDescription>{localize(precedenceKey)}</DialogDescription>
       </VisuallyHidden>
       <div className="flex items-center gap-2 border-b border-(--cui-color-stroke-default) px-4">
         <Command.Input
@@ -526,7 +530,7 @@ export function ScopeSelector({
         )}
       </Command.List>
       <p className="border-t border-(--cui-color-stroke-default) px-4 py-2 text-xs text-(--cui-color-text-muted)">
-        {localize('com_scope_precedence')}
+        {localize(precedenceKey)}
       </p>
     </Command.Dialog>
   );
@@ -543,12 +547,14 @@ function ScopeRow({
   toggling,
 }: t.ScopeRowProps) {
   const localize = useLocalize();
+  const { deterministicPrecedence } = useConfigFeatures();
   const config = getScopeTypeConfig(scope.principalType);
   const name = formatScopeName(scope);
   const overrideCount = countScopeOverrides(scope);
   const conflicts = ties.filter((tie) => tie.sharedPaths.length > 0);
+  /** With a fixed order, a tie decides which profile wins rather than leaving it undefined. */
   const tieText =
-    conflicts.length > 0
+    !deterministicPrecedence && conflicts.length > 0
       ? localize('com_scope_tie_short', {
           names: conflicts.map((tie) => formatScopeName(tie.scope)).join(', '),
         })
diff --git a/src/components/configuration/__tests__/ScopeBar.test.tsx b/src/components/configuration/__tests__/ScopeBar.test.tsx
index 2ed53c72..9983ee84 100644
--- a/src/components/configuration/__tests__/ScopeBar.test.tsx
+++ b/src/components/configuration/__tests__/ScopeBar.test.tsx
@@ -4,7 +4,9 @@ import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { fireEvent, render, screen, waitFor } from '@testing-library/react';
 import type { ReactNode } from 'react';
 import type * as t from '@/types';
-import { availableScopesOptions, toggleScopeActiveFn } from '@/server';
+import { setScopePriorityFn, toggleScopeActiveFn, availableScopesOptions } from '@/server';
+import { ConfigContractContext } from '@/contexts/ContractContext';
+import { createServerContract } from '@/test/fixtures';
 import { ScopeActionsProvider } from '@/contexts/ScopeContext';
 import { ScopeGate } from '../ScopeGate';
 import { ScopeBar } from '../ScopeBar';
@@ -22,10 +24,13 @@ vi.mock('@/hooks', async () => {
     await vi.importActual<typeof import('@/hooks/config/scope')>('@/hooks/config/scope');
   const { useReturnFocus } =
     await vi.importActual<typeof import('@/hooks/dialogs')>('@/hooks/dialogs');
+  const { useConfigFeatures } =
+    await vi.importActual<typeof import('@/hooks/config/contract')>('@/hooks/config/contract');
   return {
     useLocalize: () => localize,
     useScopeActions,
     useReturnFocus,
+    useConfigFeatures,
     useExpandSignal: () => undefined,
   };
 });
@@ -33,6 +38,7 @@ vi.mock('@/hooks', async () => {
 vi.mock('@/server', () => ({
   availableScopesOptions: { queryKey: ['availableScopes'], queryFn: vi.fn() },
   toggleScopeActiveFn: vi.fn(),
+  setScopePriorityFn: vi.fn(),
 }));
 
 const engineering: t.ConfigScope = {
@@ -112,6 +118,83 @@ describe('ScopeBar', () => {
   });
 });
 
+describe('ScopeBar on a server with deterministic precedence and a priority route', () => {
+  const contract = createServerContract({ deterministicPrecedence: true, priorityRoute: true });
+  const ordered = (children: ReactNode) =>
+    wrap(
+      <ConfigContractContext.Provider value={contract}>{children}</ConfigContractContext.Provider>,
+    );
+  const older = { ...engineering, _id: '6a00' };
+  const newer = { ...design, _id: '6a01' };
+
+  it('says which of two same-priority profiles wins instead of warning', async () => {
+    vi.mocked(availableScopesOptions.queryFn!).mockResolvedValue([older, newer]);
+    ordered(<ScopeBar scope={older} onBackToBase={vi.fn()} />);
+    expect(
+      await screen.findByText(
+        'com_scope_tie_order_loses(names=Design (com_scope_type_group),count=1)',
+      ),
+    ).toHaveAttribute('title', 'com_scope_tie_order_rule');
+    expect(screen.queryByText(/com_scope_tie_conflict/)).not.toBeInTheDocument();
+  });
+
+  it('says this profile wins over one that applies before it', async () => {
+    vi.mocked(availableScopesOptions.queryFn!).mockResolvedValue([older, newer]);
+    ordered(<ScopeBar scope={newer} onBackToBase={vi.fn()} />);
+    expect(
+      await screen.findByText(
+        'com_scope_tie_order_wins(names=Engineering (com_scope_type_group),count=1)',
+      ),
+    ).toBeInTheDocument();
+  });
+
+  it('offers Change only to an admin who may set priorities', async () => {
+    vi.mocked(availableScopesOptions.queryFn!).mockResolvedValue([engineering]);
+    const { unmount } = ordered(<ScopeBar scope={engineering} onBackToBase={vi.fn()} />);
+    expect(screen.queryByRole('button', { name: 'com_scope_priority_change_label' })).toBeNull();
+    unmount();
+    wrap(<ScopeBar scope={engineering} onBackToBase={vi.fn()} canEditPriority />);
+    expect(screen.queryByRole('button', { name: 'com_scope_priority_change_label' })).toBeNull();
+  });
+
+  it('changes the priority, refusing one that is not a whole number of 0 or more', async () => {
+    vi.mocked(availableScopesOptions.queryFn!).mockResolvedValue([engineering]);
+    vi.mocked(setScopePriorityFn).mockResolvedValue({ priority: 5 });
+    ordered(<ScopeBar scope={engineering} onBackToBase={vi.fn()} canEditPriority />);
+    fireEvent.click(screen.getByRole('button', { name: 'com_scope_priority_change_label' }));
+    const input = screen.getByRole('spinbutton');
+    expect(input).toHaveValue(20);
+    fireEvent.change(input, { target: { value: '2.5' } });
+    fireEvent.keyDown(input, { key: 'Enter' });
+    expect(screen.getByRole('alert')).toHaveTextContent('com_scope_priority_invalid');
+    expect(setScopePriorityFn).not.toHaveBeenCalled();
+    fireEvent.change(input, { target: { value: '5' } });
+    fireEvent.click(screen.getByRole('button', { name: 'com_ui_save' }));
+    await waitFor(() =>
+      expect(setScopePriorityFn).toHaveBeenCalledWith({
+        data: { principalType: PrincipalType.GROUP, principalId: 'g-eng', priority: 5 },
+      }),
+    );
+    await waitFor(() => expect(screen.queryByRole('spinbutton')).toBeNull());
+  });
+
+  it('reports a refused change and keeps the field open', async () => {
+    vi.mocked(availableScopesOptions.queryFn!).mockResolvedValue([engineering]);
+    vi.mocked(setScopePriorityFn).mockRejectedValue(new Error('Config not found'));
+    const onError = vi.fn();
+    ordered(
+      <ScopeBar scope={engineering} onBackToBase={vi.fn()} onError={onError} canEditPriority />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'com_scope_priority_change_label' }));
+    fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '30' } });
+    fireEvent.keyDown(screen.getByRole('spinbutton'), { key: 'Enter' });
+    await waitFor(() => expect(onError).toHaveBeenCalledWith('Config not found'));
+    expect(screen.getByRole('spinbutton')).toBeInTheDocument();
+    fireEvent.keyDown(screen.getByRole('spinbutton'), { key: 'Escape' });
+    expect(screen.queryByRole('spinbutton')).toBeNull();
+  });
+});
+
 describe('ScopeGate', () => {
   it('explains why the section is not per profile and switches to Base', () => {
     vi.mocked(availableScopesOptions.queryFn!).mockResolvedValue([engineering]);
diff --git a/src/components/configuration/__tests__/ScopeSelector.test.tsx b/src/components/configuration/__tests__/ScopeSelector.test.tsx
index 179a1725..921c9574 100644
--- a/src/components/configuration/__tests__/ScopeSelector.test.tsx
+++ b/src/components/configuration/__tests__/ScopeSelector.test.tsx
@@ -12,6 +12,9 @@ import {
   allGroupsQueryOptions,
 } from '@/server';
 import { ScopeSelector } from '../ScopeSelector';
+import { ConfigContractContext } from '@/contexts/ContractContext';
+import { createServerContract } from '@/test/fixtures';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 
 function localize(key: string, options?: Record<string, string | number>): string {
   if (!options) return key;
@@ -25,7 +28,9 @@ vi.mock('@/hooks', async () => {
   const { useDebouncedFilter } = await vi.importActual<typeof import('@/hooks/useDebouncedFilter')>(
     '@/hooks/useDebouncedFilter',
   );
-  return { useLocalize: () => localize, useDebouncedFilter };
+  const { useConfigFeatures } =
+    await vi.importActual<typeof import('@/hooks/config/contract')>('@/hooks/config/contract');
+  return { useLocalize: () => localize, useDebouncedFilter, useConfigFeatures };
 });
 
 const scopes: t.ConfigScope[] = [
@@ -119,24 +124,31 @@ beforeEach(() => {
 interface RenderOptions {
   selection?: t.ScopeSelection;
   isDirty?: boolean;
+  contract?: t.ConfigContract;
 }
 
-function renderSelector({ selection = { type: 'BASE' }, isDirty = false }: RenderOptions = {}) {
+function renderSelector({
+  selection = { type: 'BASE' },
+  isDirty = false,
+  contract = BUNDLED_CONFIG_CONTRACT,
+}: RenderOptions = {}) {
   const onSelect = vi.fn();
   const onOpenChange = vi.fn();
   const onError = vi.fn();
   const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
   render(
     <QueryClientProvider client={queryClient}>
-      <ScopeSelector
-        open
-        onOpenChange={onOpenChange}
-        currentSelection={selection}
-        onSelect={onSelect}
-        permissions={{ canView: true, canEdit: true, canAssign: true }}
-        onError={onError}
-        isDirty={isDirty}
-      />
+      <ConfigContractContext.Provider value={contract}>
+        <ScopeSelector
+          open
+          onOpenChange={onOpenChange}
+          currentSelection={selection}
+          onSelect={onSelect}
+          permissions={{ canView: true, canEdit: true, canAssign: true }}
+          onError={onError}
+          isDirty={isDirty}
+        />
+      </ConfigContractContext.Provider>
     </QueryClientProvider>,
   );
   return { onSelect, onOpenChange, onError };
@@ -173,6 +185,19 @@ describe('ScopeSelector list', () => {
     }
   });
 
+  it('describes the fixed order instead of warning when LibreChat orders ties', async () => {
+    scopes[2].isActive = true;
+    try {
+      renderSelector({ contract: createServerContract({ deterministicPrecedence: true }) });
+      const eng = await row(/^Engineering/);
+      expect(within(eng).queryByText('com_scope_tie_short(names=Design)')).toBeNull();
+      expect(screen.getAllByText('com_scope_precedence_ordered').length).toBeGreaterThan(0);
+      expect(screen.queryByText('com_scope_precedence')).toBeNull();
+    } finally {
+      scopes[2].isActive = false;
+    }
+  });
+
   it('finds a user profile by name or email', async () => {
     renderSelector();
     await row(/^Bob Test/);
diff --git a/src/components/configuration/edits.ts b/src/components/configuration/edits.ts
index 81d57d4f..7f9eda27 100644
--- a/src/components/configuration/edits.ts
+++ b/src/components/configuration/edits.ts
@@ -133,7 +133,7 @@ export function buildSavePayload(
   const skipped: t.SkippedChange[] = [];
   for (const path of touched) {
     const edited = editedValues[path];
-    const reason = getWriteSkipReason(path, edited === undefined);
+    const reason = getWriteSkipReason(path, edited === undefined, context?.writeRules);
     if (reason) {
       skipped.push({ fieldPath: path, reason });
       continue;
diff --git a/src/components/configuration/import.ts b/src/components/configuration/import.ts
index 37557f87..2f0d2199 100644
--- a/src/components/configuration/import.ts
+++ b/src/components/configuration/import.ts
@@ -11,7 +11,7 @@ import {
   secretPathForPreviewPath,
   stripSecretPreviewValues,
 } from '@/utils';
-import { SKIP_REASON_KEYS, BUNDLED_CONFIG_FEATURES } from '@/constants';
+import { SKIP_REASON_KEYS, BUNDLED_WRITE_RULES, BUNDLED_CONFIG_FEATURES } from '@/constants';
 import { findSchemaField } from './controls';
 import { normalizeForSave } from './edits';
 
@@ -98,10 +98,12 @@ function skipReasonOf(
   value: t.ConfigValue,
   isScope: boolean,
   features: t.ConfigFeatures,
+  rules: t.ConfigWriteRules,
 ): t.ImportSkipReason | null {
-  const reason = getWriteSkipReason(path, false) ?? (isScope ? scopeGateSkipReason(path) : null);
+  const reason =
+    getWriteSkipReason(path, false, rules) ?? (isScope ? scopeGateSkipReason(path, rules) : null);
   if (reason) return reason;
-  if (findYamlManagedValues(path, value).length > 0) return 'yamlOnly';
+  if (findYamlManagedValues(path, value, rules).length > 0) return 'yamlOnly';
   if (findUnsafeKeys(value, path, features.dottedKeys).length > 0) {
     return unsafeKeyReason(features);
   }
@@ -122,6 +124,7 @@ export function planImport(
   schemaPathSet: ReadonlySet<string>,
   isScope = false,
   features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
 ): t.ImportPlan {
   const collected = collectImportEntries(appConfig, fields, schemaPathSet, features);
   const entries: t.SaveEntry[] = [];
@@ -136,7 +139,7 @@ export function planImport(
       processServers.add(server);
       continue;
     }
-    const reason = skipReasonOf(entry.fieldPath, entry.value, isScope, features);
+    const reason = skipReasonOf(entry.fieldPath, entry.value, isScope, features, rules);
     if (reason) {
       skipped.push({ fieldPath: entry.fieldPath, reason });
       continue;
@@ -152,7 +155,7 @@ export function planImport(
     if (server && processServers.has(server)) continue;
     const holderReason =
       KEY_SKIP_REASONS.has(skip.reason) && skip.fieldPath
-        ? getWriteSkipReason(skip.fieldPath, false)
+        ? getWriteSkipReason(skip.fieldPath, false, rules)
         : null;
     skipped.push(holderReason ? { fieldPath: skip.fieldPath, reason: holderReason } : skip);
   }
diff --git a/src/components/configuration/renderer/FieldRenderer.tsx b/src/components/configuration/renderer/FieldRenderer.tsx
index 828c1e4b..38b2473b 100644
--- a/src/components/configuration/renderer/FieldRenderer.tsx
+++ b/src/components/configuration/renderer/FieldRenderer.tsx
@@ -12,7 +12,7 @@ import { SingleFieldRenderer } from './SingleField';
 import { ManagedNotice } from '../ManagedNotice';
 import { NestedGroup } from './NestedGroup';
 import { labelForPath } from '../meta';
-import { useLocalize } from '@/hooks';
+import { useLocalize, useConfigWriteRules } from '@/hooks';
 
 const NO_PATHS: ReadonlySet<string> = new Set();
 
@@ -27,9 +27,13 @@ function asEnabled(value: t.ConfigValue): boolean | undefined {
 }
 
 /** The notice a field managed only in librechat.yaml shows at its root, or null below the root or for any other field. */
-function managedNoticeKind(path: string, parentPath: string): t.ManagedNoticeKind | null {
-  if (!isYamlManagedPath(path) || isYamlManagedPath(parentPath)) return null;
-  return isStartupOnlyPath(path) ? 'startup' : 'yaml';
+function managedNoticeKind(
+  path: string,
+  parentPath: string,
+  rules: t.ConfigWriteRules,
+): t.ManagedNoticeKind | null {
+  if (!isYamlManagedPath(path, rules) || isYamlManagedPath(parentPath, rules)) return null;
+  return isStartupOnlyPath(path, rules) ? 'startup' : 'yaml';
 }
 
 /**
@@ -40,12 +44,13 @@ function managedNoticeKind(path: string, parentPath: string): t.ManagedNoticeKin
 function managedNoticeRuns(
   groups: ReadonlyArray<{ type: string; path: string }>,
   parentPath: string,
+  rules: t.ConfigWriteRules,
 ): Map<number, string[]> {
   const runs = new Map<number, string[]>();
   let start = -1;
   let kind: t.ManagedNoticeKind | null = null;
   groups.forEach((group, index) => {
-    const next = group.type === 'nested' ? null : managedNoticeKind(group.path, parentPath);
+    const next = group.type === 'nested' ? null : managedNoticeKind(group.path, parentPath, rules);
     if (next === 'startup' && next === kind) {
       runs.get(start)?.push(group.path);
       return;
@@ -87,6 +92,7 @@ export function FieldRenderer({
   editSessionId,
 }: t.FieldRendererProps) {
   const localize = useLocalize();
+  const writeRules = useConfigWriteRules();
   const values =
     typeof parentValue === 'object' && parentValue !== null
       ? (parentValue as Record<string, t.ConfigValue>)
@@ -132,14 +138,14 @@ export function FieldRenderer({
     }
   }
 
-  const noticeRuns = managedNoticeRuns(groups, parentPath);
+  const noticeRuns = managedNoticeRuns(groups, parentPath, writeRules);
 
   /** The notice of managed fields (`settings`: how many it covers), offering to remove their stale overrides. */
   const managedNotice = (paths: string[], settings = paths.length): ReactNode => {
     const overridden = paths.filter((path) => hasPathOverlap(path, dbOverridePaths ?? NO_PATHS));
     return (
       <ManagedNotice
-        kind={isStartupOnlyPath(paths[0]) ? 'startup' : 'yaml'}
+        kind={isStartupOnlyPath(paths[0], writeRules) ? 'startup' : 'yaml'}
         count={settings}
         hasOverride={overridden.length > 0}
         pendingRemoval={
@@ -157,8 +163,8 @@ export function FieldRenderer({
   return (
     <ConfiguredOnlyContext.Provider value={Boolean(showConfiguredOnly && !previewMode)}>
       {groups.map((group, index) => {
-        const managed = isYamlManagedPath(group.path);
-        const managedRoot = managed && !isYamlManagedPath(parentPath);
+        const managed = isYamlManagedPath(group.path, writeRules);
+        const managedRoot = managed && !isYamlManagedPath(parentPath, writeRules);
         const noticeRun = noticeRuns.get(index);
         const groupDisabled = disabled || managed;
         if (group.type === 'nested') {
diff --git a/src/components/configuration/renderer/__tests__/controls.test.tsx b/src/components/configuration/renderer/__tests__/controls.test.tsx
index 24ddb493..c7bfd360 100644
--- a/src/components/configuration/renderer/__tests__/controls.test.tsx
+++ b/src/components/configuration/renderer/__tests__/controls.test.tsx
@@ -5,7 +5,8 @@ import type * as t from '@/types';
 import { renderInlineField, collectionKeyOf } from '../InlineField';
 import { deriveFieldDefault, layerValueBeneath } from '../defaults';
 import { resolveControl, fieldOptions } from '../kinds';
-import { createField } from '@/test/fixtures';
+import { createField, createServerContract } from '@/test/fixtures';
+import { ConfigContractContext } from '@/contexts/ContractContext';
 import { fitsControl } from '../FieldControl';
 
 vi.mock('@/hooks/useLocalize', () => ({
@@ -566,6 +567,42 @@ describe('YAML-managed notice', () => {
     expect(screen.queryByText('com_config_yaml_managed_field')).not.toBeInTheDocument();
   });
 
+  it("marks the fields a server's rules keep to librechat.yaml, and frees the ones they don't", () => {
+    const contract = createServerContract(
+      {},
+      {
+        baseOnlyPaths: ['endpoints.agents.pullRequests.provider'],
+        deploymentOnlyPaths: { 'endpoints.agents.eventDriven': 'startup' },
+      },
+    );
+    const text = (key: string) => createField({ key, path: `endpoints.agents.${key}` });
+    const fields = [text('eventDriven'), text('subagentActivity'), text('recursionLimit')];
+    render(
+      <ConfigContractContext.Provider value={contract}>
+        <FieldRenderer
+          fields={fields}
+          parentValue={{}}
+          parentPath="endpoints.agents"
+          getValue={getValue}
+          onChange={vi.fn()}
+        />
+        <FieldRenderer
+          fields={[
+            createField({ key: 'provider', path: 'endpoints.agents.pullRequests.provider' }),
+          ]}
+          parentValue={{}}
+          parentPath="endpoints.agents.pullRequests"
+          getValue={getValue}
+          onChange={vi.fn()}
+        />
+      </ConfigContractContext.Provider>,
+    );
+    expect(
+      screen.getAllByText(/^com_config_startup_only_field/).map((el) => el.textContent),
+    ).toEqual(['com_config_startup_only_field:{"count":1}']);
+    expect(screen.getAllByText('com_config_yaml_managed_field')).toHaveLength(1);
+  });
+
   it('shows one notice above consecutive startup-only settings', () => {
     const number = (key: string) =>
       createField({ key, type: 'number', path: `mcpSettings.catalogRecovery.${key}` });
diff --git a/src/components/configuration/review/ChangeRow.tsx b/src/components/configuration/review/ChangeRow.tsx
index 3b7ae67c..8bf870f9 100644
--- a/src/components/configuration/review/ChangeRow.tsx
+++ b/src/components/configuration/review/ChangeRow.tsx
@@ -67,6 +67,7 @@ const WARNING_KEYS: Partial<Record<t.ChangeWarning, string>> = {
   emptySpecs: 'com_config_review_warning_empty_specs',
   shadowed: 'com_config_review_warning_shadowed',
   shadowedBlock: 'com_config_review_warning_shadowed_block',
+  shadowedPair: 'com_config_review_warning_shadowed_pair',
 };
 
 function ActionButton({
diff --git a/src/components/configuration/sections/__tests__/coverage.test.tsx b/src/components/configuration/sections/__tests__/coverage.test.tsx
index b08a31d2..7f6b0793 100644
--- a/src/components/configuration/sections/__tests__/coverage.test.tsx
+++ b/src/components/configuration/sections/__tests__/coverage.test.tsx
@@ -1,5 +1,6 @@
 import '@/locales/i18n';
 import { describe, expect, it, vi } from 'vitest';
+import { fireEvent, screen } from '@testing-library/react';
 import type { HiddenFields } from '@/test/coverage';
 import type * as t from '@/types';
 import {
@@ -23,6 +24,7 @@ import {
 import { READ_ONLY_CONFIG_SECTIONS, YAML_MANAGED_FIELDS } from '@/constants';
 import { SECTION_META } from '@/components/configuration/configMeta';
 import { renderTab, PAGE_TREE, RAW_TREE } from '@/test/page';
+import { createServerContract } from '@/test/fixtures';
 import { setValueAtPath } from '@/utils';
 
 vi.setConfig({ testTimeout: COVERAGE_TEST_TIMEOUT_MS });
@@ -57,6 +59,30 @@ function isReadOnly(path: string): boolean {
 
 const HIDDEN: HiddenFields = {};
 
+/** A server that applies Base overrides before sign-in: the social sign-in buttons are edited in Base. */
+const PRE_AUTH_SERVER = createServerContract({ preAuthBaseOverrides: true });
+
+describe('social sign-in buttons, by the server', () => {
+  const yaml = { registration: { socialLogins: ['openid', 'google'] } };
+  const addOption = () => screen.queryByRole('combobox', { name: /Add sign-in option/ });
+
+  it('are read-only on a server without pre-auth Base overrides', () => {
+    renderTab({ tab: 'system', expandAll: true, yaml });
+    expect(controlAt('registration.socialLogins')).toHaveTextContent(/OpenID Connect.*Google/);
+    expect(addOption()).toBeNull();
+  });
+
+  it('are edited in Base, and saved, on a server with pre-auth Base overrides', () => {
+    const view = renderTab({ tab: 'system', expandAll: true, yaml, contract: PRE_AUTH_SERVER });
+    fireEvent.change(addOption()!, { target: { value: 'github' } });
+    const plan = view.plan();
+    expect(plan.sets).toEqual([
+      { fieldPath: 'registration.socialLogins', value: ['openid', 'google', 'github'] },
+    ]);
+    expect(plan.skipped).toEqual([]);
+  });
+});
+
 describe.each(TABS)('%s tab', (tab) => {
   const roots = rootsOf(tab);
   const sample = sampleOf(roots);
@@ -81,6 +107,12 @@ describe.each(TABS)('%s tab', (tab) => {
     expect(staleHidden(roots, HIDDEN)).toEqual([]);
   });
 
+  it("renders every leaf of its sections under a server's write rules (pre-auth Base overrides)", () => {
+    renderIt({ yaml: sample, contract: PRE_AUTH_SERVER });
+    const shown = roots.flatMap((root) => renderedLeaves(root, sample));
+    expect(roots.flatMap((root) => missingLeaves(root, shown, HIDDEN))).toEqual([]);
+  });
+
   it.each(editable.map((field) => [field.path, field] as const))(
     'settings a newer schema adds under %s get a control, and an edit is saved at their path',
     (_path, field) => {
diff --git a/src/components/configuration/sections/features/Credential.tsx b/src/components/configuration/sections/features/Credential.tsx
index 7d894546..fa38b0d1 100644
--- a/src/components/configuration/sections/features/Credential.tsx
+++ b/src/components/configuration/sections/features/Credential.tsx
@@ -3,6 +3,7 @@ import type * as t from '@/types';
 import { SecretField, SecretInput } from '../../fields/SecretField';
 import { FieldControl } from '../../renderer/FieldControl';
 import { useLocalize, useConfigFeatures } from '@/hooks';
+import { isEncryptedCredential } from '@/constants';
 import { DecorativeIcon } from '@/components/shared';
 import { TextField } from '../../fields/TextField';
 import { credentialState } from './state';
@@ -35,6 +36,7 @@ function statusLine(
   storedKeysUsed: boolean,
   localize: t.LocalizeFn,
 ): t.CredentialStatusLine | null {
+  const encrypted = isEncryptedCredential(credential, { webSearchStoredKeys: storedKeysUsed });
   if (!storedKeysUsed && LITERAL_STATES.has(state.status)) {
     return {
       tone: 'warn',
@@ -44,7 +46,7 @@ function statusLine(
   }
   switch (state.status) {
     case 'pending':
-      return credential.encrypted
+      return encrypted
         ? { tone: 'muted', icon: 'lock', text: localize('com_config_features_cred_pending') }
         : {
             tone: 'warn',
@@ -66,7 +68,7 @@ function statusLine(
         text: localize('com_config_features_cred_default', { env: state.env ?? credential.env }),
       };
     case 'set':
-      return credential.secret && !credential.encrypted
+      return credential.secret && !encrypted
         ? {
             tone: 'warn',
             icon: 'warning',
diff --git a/src/components/configuration/sections/features/__tests__/WebSearch.test.tsx b/src/components/configuration/sections/features/__tests__/WebSearch.test.tsx
index 68845d4d..66801499 100644
--- a/src/components/configuration/sections/features/__tests__/WebSearch.test.tsx
+++ b/src/components/configuration/sections/features/__tests__/WebSearch.test.tsx
@@ -108,6 +108,20 @@ describe('WebSearchRenderer', () => {
     expect(screen.queryByText(/environment variable references/)).not.toBeInTheDocument();
   });
 
+  it('stores a Keenable key encrypted once the server keeps it in its secret registry', () => {
+    renderSection(WebSearchRenderer, {
+      section: 'webSearch',
+      yaml: { webSearch: { searchProvider: 'keenable' } },
+      features: { webSearchStoredKeys: true },
+    });
+    const key = screen.getByLabelText('Keenable API key');
+    fireEvent.change(key, { target: { value: 'kn-secret-1234567890' } });
+    fireEvent.blur(key);
+    expect(key).toHaveAttribute('type', 'password');
+    expect(screen.getByText('Will be stored encrypted when you save.')).toBeInTheDocument();
+    expect(screen.queryByText(/stored as typed|plain text/i)).not.toBeInTheDocument();
+  });
+
   it('shows a stored key only as its masked preview, with Replace', () => {
     renderSection(WebSearchRenderer, {
       section: 'webSearch',
diff --git a/src/components/configuration/sections/features/__tests__/coverage.test.tsx b/src/components/configuration/sections/features/__tests__/coverage.test.tsx
index fbffaec4..4762cd4a 100644
--- a/src/components/configuration/sections/features/__tests__/coverage.test.tsx
+++ b/src/components/configuration/sections/features/__tests__/coverage.test.tsx
@@ -6,6 +6,7 @@ import type * as t from '@/types';
 import {
   COVERAGE_TEST_TIMEOUT_MS,
   turnOn,
+  controlAt,
   typeInto,
   planWrites,
   staleHidden,
@@ -25,6 +26,8 @@ import {
 import { setValueAtPath, isInterfacePermissionPath } from '@/utils';
 import { renderTab, PAGE_TREE, RAW_TREE } from '@/test/page';
 import { labelForPath } from '@/components/configuration';
+import { createServerContract } from '@/test/fixtures';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 
 vi.setConfig({ testTimeout: COVERAGE_TEST_TIMEOUT_MS });
 
@@ -92,6 +95,23 @@ function roots(tree: t.SchemaField[]): t.SchemaField[] {
   });
 }
 
+/** A server that reports its write rules, as LibreChat lists them: the tool filters are deployment-only. */
+const SERVER_RULES = createServerContract(
+  {},
+  {
+    deploymentOnlyPaths: {
+      ...BUNDLED_CONFIG_CONTRACT.rules.deploymentOnlyPaths,
+      includedTools: 'operator',
+      filteredTools: 'operator',
+    },
+  },
+);
+
+const TOOL_FILTERS: CoverageFixture = {
+  name: 'tool filters librechat.yaml sets',
+  yaml: { filteredTools: ['dalle'], includedTools: ['calculator'] },
+};
+
 describe('Features tab: every schema field is reachable', () => {
   it('renders every leaf of its sections, or names why not', () => {
     const shown = renderedAcross(roots(RAW_TREE), FIXTURES, (fixture) =>
@@ -106,6 +126,32 @@ describe('Features tab: every schema field is reachable', () => {
   });
 });
 
+describe("Features tab under a server's write rules", () => {
+  const renderWithRules = (fixture: CoverageFixture) =>
+    renderTab({ tab: 'features', tree: TREE, expandAll: true, contract: SERVER_RULES, ...fixture });
+
+  it('renders every leaf of its sections, or names why not', () => {
+    const shown = renderedAcross(roots(RAW_TREE), [...FIXTURES, TOOL_FILTERS], renderWithRules);
+    const missing = roots(RAW_TREE).flatMap((root) => missingLeaves(root, shown, HIDDEN));
+    expect(missing).toEqual([]);
+  });
+
+  it.each([
+    ['filteredTools', 'dalle'],
+    ['includedTools', 'calculator'],
+  ])('shows %s read-only, with the value librechat.yaml sets', (path, tool) => {
+    renderWithRules(TOOL_FILTERS);
+    const control = controlAt(path);
+    expect(control).toHaveTextContent(tool);
+    expect(control.querySelector('input')).toBeNull();
+  });
+
+  it('keeps the tool filters editable on a server that does not list them', () => {
+    renderTab({ tab: 'features', tree: TREE, expandAll: true, ...TOOL_FILTERS });
+    expect(controlAt('filteredTools').querySelector('input')).toHaveValue('dalle');
+  });
+});
+
 /** Where a newer schema could add settings: each renderer, and the objects and variants inside. */
 const NEW_FIELD_PARENTS: Array<[string, string, t.ConfigRecord]> = [
   ['interface', 'interface', {}],
diff --git a/src/components/configuration/sections/providers/Card.tsx b/src/components/configuration/sections/providers/Card.tsx
index fc1162ba..b4e9615d 100644
--- a/src/components/configuration/sections/providers/Card.tsx
+++ b/src/components/configuration/sections/providers/Card.tsx
@@ -79,6 +79,7 @@ export function ProviderCard({ field, parentPath, parentValue, ...rest }: t.Prov
             configuredPaths,
             editedValues,
             root: values?.configValues ?? null,
+            titleResolution: values?.titleResolution,
           }),
           localize,
         ),
@@ -87,7 +88,11 @@ export function ProviderCard({ field, parentPath, parentValue, ...rest }: t.Prov
 
   const description: ReactNode = isGlobal ? (
     <>
-      {localize('com_config_providers_global_desc')}
+      {localize(
+        values?.titleResolution === 'field'
+          ? 'com_config_providers_global_desc_field'
+          : 'com_config_providers_global_desc',
+      )}
       {summary && (
         <span className="provider-card-summary">
           {localize('com_config_providers_summary_set', { summary })}
@@ -109,7 +114,7 @@ export function ProviderCard({ field, parentPath, parentValue, ...rest }: t.Prov
     const groupSet = group.fields.some((child) =>
       isPathSet(`${path}.${child.key}`, configuredPaths, editedValues),
     );
-    if (key === 'titles' && isGlobal && !groupSet) {
+    if (key === 'titles' && isGlobal && !groupSet && values?.titleResolution !== 'field') {
       return { summaryOverride: localize('com_config_providers_summary_global_titles') };
     }
     if (key === 'groups' && field.key === 'azureOpenAI') {
diff --git a/src/components/configuration/sections/providers/Group.tsx b/src/components/configuration/sections/providers/Group.tsx
index c93432a6..deae0d60 100644
--- a/src/components/configuration/sections/providers/Group.tsx
+++ b/src/components/configuration/sections/providers/Group.tsx
@@ -103,6 +103,7 @@ export function ProviderGroup({
             configuredPaths,
             editedValues,
             root: values?.configValues ?? null,
+            titleResolution: values?.titleResolution,
           }),
           localize,
         ),
diff --git a/src/components/configuration/sections/providers/__tests__/ProvidersRenderer.test.tsx b/src/components/configuration/sections/providers/__tests__/ProvidersRenderer.test.tsx
index 2672d74d..d06d01af 100644
--- a/src/components/configuration/sections/providers/__tests__/ProvidersRenderer.test.tsx
+++ b/src/components/configuration/sections/providers/__tests__/ProvidersRenderer.test.tsx
@@ -54,12 +54,15 @@ const STATUS: t.EndpointStatusMap = {
   agents: { name: 'agents', custom: false, userProvide: false },
 };
 
-function renderProviders(overrides: Partial<t.FieldRendererProps> = {}) {
+function renderProviders(
+  overrides: Partial<t.FieldRendererProps> = {},
+  titleResolution?: t.ConfigRules['titleResolution'],
+) {
   const client = new QueryClient();
   client.setQueryData(['endpointStatus', 0], STATUS);
   client.setQueryData(['endpointModels', 0], { openAI: ['gpt-5-mini', 'gpt-5'] });
   const onChange = vi.fn();
-  const values: t.ConfigValuesData = { configValues: CONFIG, editedValues: {} };
+  const values: t.ConfigValuesData = { configValues: CONFIG, editedValues: {}, titleResolution };
   const wrapper = ({ children }: { children: ReactNode }) => (
     <QueryClientProvider client={client}>
       <ConfigValuesProvider value={values}>{children}</ConfigValuesProvider>
@@ -133,6 +136,18 @@ describe('ProvidersRenderer', () => {
     expect(within(titles).getByText('com_config_providers_summary_ignored')).toBeTruthy();
   });
 
+  it('leaves title settings to each provider on a server that resolves them per field', () => {
+    renderProviders({}, 'field');
+    const summary = card('openAI').querySelector('.settings-help') as HTMLElement;
+    expect(summary.textContent).toContain('gpt-5-mini');
+    expect(summary.textContent).not.toContain('com_config_providers_summary_shadowed_ignored');
+    expect(card('all').textContent).toContain('com_config_providers_global_desc_field');
+    fireEvent.click(trigger('openAI'));
+    const titles = document.getElementById('section-endpoints.openAI-titles') as HTMLElement;
+    expect(within(titles).queryByText(/com_config_providers_global_titles_banner/)).toBeNull();
+    expect(within(titles).queryByText('com_config_providers_summary_ignored')).toBeNull();
+  });
+
   it('opens Agent features first, with capability descriptions and paired limits', () => {
     renderProviders();
     fireEvent.click(trigger('agents'));
diff --git a/src/components/configuration/sections/providers/layout.ts b/src/components/configuration/sections/providers/layout.ts
index f057646f..a5b9eba8 100644
--- a/src/components/configuration/sections/providers/layout.ts
+++ b/src/components/configuration/sections/providers/layout.ts
@@ -21,6 +21,7 @@ const MAX_LIST_PREVIEW = 2;
 const SHADOW_SUMMARY_KEYS = {
   wins: 'com_config_providers_summary_shadowed',
   ignored: 'com_config_providers_summary_shadowed_ignored',
+  paired: 'com_config_providers_summary_shadowed_pair',
 } as const;
 
 /** The purpose groups declared for a provider (the shared endpoint groups for an unknown one). */
@@ -189,15 +190,17 @@ export function createSummaryReader({
   configuredPaths,
   editedValues,
   root,
+  titleResolution,
 }: t.SummaryReaderInput): t.SummaryReader {
   return {
     isSet: (path) => isPathSet(path, configuredPaths, editedValues),
     valueAt: (path) =>
       getValue(path, getValueAtPath(providerValue, path.slice(providerPath.length + 1))),
     shadowOf: (path) => {
-      const shadow = resolveShadowedBy(path, root, editedValues);
+      const shadow = resolveShadowedBy(path, root, editedValues, titleResolution);
       if (!shadow) return null;
-      return shadow.value === undefined ? 'ignored' : 'wins';
+      if (shadow.value !== undefined) return 'wins';
+      return shadow.precedence === 'pair' ? 'paired' : 'ignored';
     },
   };
 }
diff --git a/src/components/configuration/sections/specs/ChipPicker.tsx b/src/components/configuration/sections/specs/ChipPicker.tsx
index dba42268..28958001 100644
--- a/src/components/configuration/sections/specs/ChipPicker.tsx
+++ b/src/components/configuration/sections/specs/ChipPicker.tsx
@@ -13,7 +13,8 @@ const PLACEHOLDER = '\u0000add';
  * A set of values picked from known choices: each as a chip with Remove, and
  * a select of the choices not picked yet. Nothing can be typed, so a blank
  * or unknown value can't be added; one already stored stays visible (marked
- * as not configured) until it is removed.
+ * as not configured) until it is removed. With `matchValue`, a value spelled
+ * another way than its choice (`Ollama` for `ollama`) is that choice.
  */
 export function ChipPicker({
   id,
@@ -24,6 +25,7 @@ export function ChipPicker({
   disabled,
   addLabel,
   unknownLabel,
+  matchValue,
   'aria-label': ariaLabel,
   'aria-describedby': ariaDescribedBy,
 }: t.ChipPickerProps) {
@@ -33,7 +35,8 @@ export function ChipPicker({
   const labels = new Map(
     groups.flatMap((group) => group.options.map((option) => [option.value, option.label])),
   );
-  const picked = new Set(values);
+  const choiceOf = (value: string): string => (matchValue ? matchValue(value) : value);
+  const picked = new Set(values.map(choiceOf));
   const remaining = groups
     .map((group) => ({
       ...group,
@@ -64,7 +67,7 @@ export function ChipPicker({
       {values.length > 0 && (
         <ul aria-label={ariaLabel} className="settings-chip-list">
           {values.map((value) => {
-            const label = labels.get(value);
+            const label = labels.get(choiceOf(value));
             const known = label !== undefined;
             return (
               <li
diff --git a/src/components/configuration/sections/specs/Settings.tsx b/src/components/configuration/sections/specs/Settings.tsx
index 61d05b17..7bf96083 100644
--- a/src/components/configuration/sections/specs/Settings.tsx
+++ b/src/components/configuration/sections/specs/Settings.tsx
@@ -3,8 +3,8 @@ import { useNavigate } from '@tanstack/react-router';
 import { normalizeEndpointName } from 'librechat-data-provider';
 import type { ReactNode } from 'react';
 import type * as t from '@/types';
-import { cn, isRowVisible, isConfigRecord, stringItems } from '@/utils';
-import { useLocalize, useFieldState, useValuesScope } from '@/hooks';
+import { cn, isRowVisible, stringItems, isConfigRecord, foldsEndpointReferences } from '@/utils';
+import { useLocalize, useFieldState, useValuesScope, useConfigContract } from '@/hooks';
 import { DecorativeIcon, StateChip } from '@/components/shared';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
 import { hasPathOrDescendant } from '../../renderer/paths';
@@ -172,6 +172,8 @@ export function SpecsSettings({
   showConfiguredOnly,
 }: t.SpecsSettingsProps) {
   const localize = useLocalize();
+  /** A server that folds endpoint references matches `Ollama` to `ollama`: neither spelling "never matches". */
+  const foldsNames = foldsEndpointReferences(useConfigContract());
   const navigate = useNavigate();
   const scope = useValuesScope();
   const rowFilter = useContext(RowFilterContext);
@@ -353,9 +355,10 @@ export function SpecsSettings({
               return true;
             }}
             addLabel={localize('com_config_specs_added_add')}
+            matchValue={foldsNames ? normalizeEndpointName : undefined}
             unknownLabel={(name) => {
               const served = normalizeEndpointName(name);
-              return served !== name && options.knownEndpoints.has(served)
+              return !foldsNames && served !== name && options.knownEndpoints.has(served)
                 ? localize('com_config_specs_added_served_as', { name, served })
                 : localize('com_config_specs_not_configured', { name });
             }}
diff --git a/src/components/configuration/sections/specs/__tests__/ModelSpecsRenderer.test.tsx b/src/components/configuration/sections/specs/__tests__/ModelSpecsRenderer.test.tsx
index b76e4b93..3abedd2f 100644
--- a/src/components/configuration/sections/specs/__tests__/ModelSpecsRenderer.test.tsx
+++ b/src/components/configuration/sections/specs/__tests__/ModelSpecsRenderer.test.tsx
@@ -11,6 +11,9 @@ import {
   valuesDataFixture,
 } from '@/test/layers';
 import { CollectionEditsContext } from '@/contexts/CollectionEditsContext';
+import { ConfigContractContext } from '@/contexts/ContractContext';
+import { createServerContract } from '@/test/fixtures';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 import { ConfigValuesProvider } from '@/contexts/ConfigValuesContext';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
 import { ModelSpecsRenderer } from '../ModelSpecsRenderer';
@@ -57,22 +60,26 @@ function renderSpecs(
     data,
     collectionEdits = {},
     showConfiguredOnly,
+    contract = BUNDLED_CONFIG_CONTRACT,
   }: {
     onChange?: t.FieldRendererProps['onChange'];
     data?: t.ConfigValuesData;
     collectionEdits?: t.CollectionEdits;
     showConfiguredOnly?: boolean;
+    contract?: t.ConfigContract;
   } = {},
 ) {
   const values = data ?? valuesDataFixture(baseLayersFixture());
   const wrap = (children: ReactNode) => (
-    <CollectionEditsContext.Provider value={collectionEdits}>
-      <ConfigValuesProvider
-        value={{ ...values, configValues: { ...values.configValues, modelSpecs } }}
-      >
-        {children}
-      </ConfigValuesProvider>
-    </CollectionEditsContext.Provider>
+    <ConfigContractContext.Provider value={contract}>
+      <CollectionEditsContext.Provider value={collectionEdits}>
+        <ConfigValuesProvider
+          value={{ ...values, configValues: { ...values.configValues, modelSpecs } }}
+        >
+          {children}
+        </ConfigValuesProvider>
+      </CollectionEditsContext.Provider>
+    </ConfigContractContext.Provider>
   );
   const ui = (
     <ModelSpecsRenderer
@@ -250,6 +257,40 @@ describe('ModelSpecsRenderer', () => {
     expect(onChange).toHaveBeenCalledWith('modelSpecs.addedEndpoints', ['openAI']);
   });
 
+  it('matches an endpoint spelled as written once the server folds endpoint names', () => {
+    const values = valuesDataFixture(baseLayersFixture());
+    const data: t.ConfigValuesData = {
+      ...values,
+      configValues: {
+        ...values.configValues,
+        endpoints: { custom: [{ name: 'Ollama', baseURL: 'http://127.0.0.1:11434/v1' }] },
+      },
+    };
+    const optionsOf = () =>
+      [
+        ...(
+          document.getElementById('modelSpecs-addedEndpoints-add') as HTMLSelectElement
+        ).querySelectorAll('option'),
+      ].map((option) => [option.value, option.textContent]);
+    const before = renderSpecs({ list: SPECS, addedEndpoints: ['Ollama'] }, { data });
+    expect(
+      screen.getByText('com_config_specs_added_served_as {"name":"Ollama","served":"ollama"}'),
+    ).toBeInTheDocument();
+    expect(optionsOf()).toContainEqual(['ollama', 'Ollama (ollama)']);
+    before.unmount();
+    renderSpecs(
+      { list: SPECS, addedEndpoints: ['Ollama'] },
+      { data, contract: createServerContract({}, { titleResolution: 'field' }) },
+    );
+    expect(screen.queryByText(/com_config_specs_added_served_as/)).not.toBeInTheDocument();
+    const chip = screen.getByRole('button', {
+      name: 'com_config_specs_chip_remove {"name":"Ollama"}',
+    }).parentElement;
+    expect(chip).toHaveTextContent('Ollama');
+    expect(chip).toHaveAttribute('title', 'Ollama');
+    expect(optionsOf().map(([value]) => value)).not.toContain('ollama');
+  });
+
   it('flags spec problems on the row and at the field', () => {
     renderSpecs({
       list: [...SPECS, { name: 'gpt', label: 'Copy', preset: { endpoint: 'Nope', model: 'm' } }],
diff --git a/src/components/configuration/sections/system/RegistrationRenderer.tsx b/src/components/configuration/sections/system/RegistrationRenderer.tsx
index 1bc18cb1..1ebd69a4 100644
--- a/src/components/configuration/sections/system/RegistrationRenderer.tsx
+++ b/src/components/configuration/sections/system/RegistrationRenderer.tsx
@@ -1,14 +1,15 @@
 import { useContext, useState } from 'react';
 import type * as t from '@/types';
 import { getValueAtPath, isConfigValueEqual, stringItems } from '@/utils';
-import { useLocalize, useOwnedField, useYamlConfig } from '@/hooks';
+import { useLocalize, useOwnedField, useYamlConfig, useConfigFeatures } from '@/hooks';
 import { ConfirmChoiceDialog } from '../../fields/ConfirmChoice';
 import { RowFilterContext } from '@/contexts/RowFilterContext';
 import { EmailDomainListField } from './EmailDomainListField';
 import { UnknownSettings } from '../../UnknownSettings';
 import { ReadOnlySection } from '../../ReadOnlySection';
 import { FieldRenderer, toFieldId } from '../../renderer';
-import { SOCIAL_LOGIN_PROVIDERS } from '@/constants';
+import { SOCIAL_LOGIN_PROVIDERS, SOCIAL_LOGINS_PATH } from '@/constants';
+import { ChipPicker } from '../specs/ChipPicker';
 import { isRowShown } from '../files/FieldRow';
 import { SettingsRow } from '../../SettingsRow';
 import { hasPathOverlap } from '../../counts';
@@ -18,15 +19,91 @@ import { YamlRows } from './Yaml';
 
 const SECTION = 'registration';
 const NO_PATHS: ReadonlySet<string> = new Set();
-const SOCIAL = 'registration.socialLogins';
+const SOCIAL = SOCIAL_LOGINS_PATH;
 const DOMAINS = 'registration.allowedDomains';
 const CUSTOM_ROWS: ReadonlySet<string> = new Set(['socialLogins', 'allowedDomains']);
 /** Set up once at startup from librechat.yaml (`configureSocialLogins`): shown read-only. */
 const STARTUP_KEYS: ReadonlySet<string> = new Set(['oauthStateTtlMs', 'openidDiscovery']);
 
+/** A sign-in option's name ("Google"), or the stored value marked as not an option. */
+function providerLabel(provider: string, localize: t.LocalizeFn): string {
+  const labelKey = SOCIAL_LOGIN_PROVIDERS[provider];
+  return labelKey
+    ? localize(labelKey)
+    : localize('com_config_registration_provider_unknown', { name: provider });
+}
+
+/**
+ * Social sign-in buttons on a server that applies Base overrides before
+ * sign-in (`preAuthBaseOverrides`): picked from the sign-in options as chips,
+ * in the order the sign-in page shows them. The list beneath is librechat.yaml's
+ * (else LibreChat's default list); choosing it again removes the override.
+ */
+function EditableSocialLoginsRow({ fieldProps }: { fieldProps: t.FieldRendererProps }) {
+  const localize = useLocalize();
+  const rowFilter = useContext(RowFilterContext);
+  const social = useOwnedField(SOCIAL, fieldProps);
+  if (!isRowShown(rowFilter, SOCIAL, fieldProps)) return null;
+  const id = toFieldId(SOCIAL);
+  const providers = stringItems(social.state.value ?? fieldProps.schemaDefaults?.[SOCIAL]);
+  const lower = stringItems(social.fallback ?? fieldProps.schemaDefaults?.[SOCIAL]);
+  const change = (next: string[]) => {
+    if (isConfigValueEqual(next, lower) && social.own !== undefined) {
+      social.set(undefined);
+      return;
+    }
+    social.set(next);
+  };
+  const label = labelForPath(SOCIAL, localize);
+  return (
+    <ConfigRow
+      title={label}
+      description={localize('com_config_registration_social_desc')}
+      fieldId={`${id}-add`}
+      fieldPath={SOCIAL}
+      disabled={fieldProps.disabled}
+      permissions={fieldProps.permissions}
+      previewScope={fieldProps.previewScope}
+      previewChangedPaths={fieldProps.previewChangedPaths}
+      onResetField={fieldProps.onResetField}
+      onDiscardField={fieldProps.onDiscardField}
+      isConfigured={fieldProps.configuredPaths?.has(SOCIAL) ?? false}
+      isDbOverride={fieldProps.dbOverridePaths?.has(SOCIAL) ?? false}
+      isPendingReset={fieldProps.pendingResets?.has(SOCIAL) ?? false}
+      controlWidth="L"
+    >
+      <div className="flex w-full flex-col gap-2">
+        <ChipPicker
+          id={id}
+          values={providers}
+          groups={[
+            {
+              label: localize('com_config_registration_social_options'),
+              options: Object.keys(SOCIAL_LOGIN_PROVIDERS).map((provider) => ({
+                value: provider,
+                label: providerLabel(provider, localize),
+              })),
+            },
+          ]}
+          disabled={fieldProps.disabled}
+          onChange={change}
+          addLabel={localize('com_config_registration_social_add')}
+          unknownLabel={(provider) => providerLabel(provider, localize)}
+          aria-label={label}
+        />
+        {providers.length === 0 && !fieldProps.disabled && (
+          <span className="text-xs text-(--cui-color-text-muted)">
+            {localize('com_config_registration_social_none')}
+          </span>
+        )}
+      </div>
+    </ConfigRow>
+  );
+}
+
 /**
- * Social sign-in buttons (FX-9, FX-10): the sign-in page reads them from
- * librechat.yaml only (else LibreChat's default list), so they are shown
+ * Social sign-in buttons (FX-9, FX-10) on a server that reads them before
+ * sign-in from librechat.yaml only (else LibreChat's default list): shown
  * read-only by provider name from there, never from an override (in a
  * profile, Base's), with a way to remove an override saved before (it never
  * took effect).
@@ -56,16 +133,11 @@ function SocialLoginsRow({ fieldProps }: { fieldProps: t.FieldRendererProps }) {
         <div className="flex flex-col gap-2">
           {providers.length > 0 ? (
             <ul id={id} className="static-value-list">
-              {providers.map((provider) => {
-                const labelKey = SOCIAL_LOGIN_PROVIDERS[provider];
-                return (
-                  <li key={provider} className="static-value-chip">
-                    {labelKey
-                      ? localize(labelKey)
-                      : localize('com_config_registration_provider_unknown', { name: provider })}
-                  </li>
-                );
-              })}
+              {providers.map((provider) => (
+                <li key={provider} className="static-value-chip">
+                  {providerLabel(provider, localize)}
+                </li>
+              ))}
             </ul>
           ) : (
             <span id={id} className="static-value">
@@ -101,10 +173,13 @@ function SocialLoginsRow({ fieldProps }: { fieldProps: t.FieldRendererProps }) {
 
 /**
  * Allowed sign-up domains as validated chips (FX-9). An empty list lets
- * anyone sign up, so emptying a restricted list asks first.
+ * anyone sign up, so emptying a restricted list asks first. Before
+ * `preAuthBaseOverrides`, social and SSO sign-ins and password resets check
+ * librechat.yaml's list instead; after it, they check this one.
  */
 function AllowedDomainsRow({ fieldProps }: { fieldProps: t.FieldRendererProps }) {
   const localize = useLocalize();
+  const { preAuthBaseOverrides } = useConfigFeatures();
   const rowFilter = useContext(RowFilterContext);
   const yaml = useYamlConfig();
   const field = useOwnedField(DOMAINS, fieldProps);
@@ -177,7 +252,12 @@ function AllowedDomainsRow({ fieldProps }: { fieldProps: t.FieldRendererProps })
             aria-label={label}
             aria-describedby={fieldProps.disabled ? undefined : `${id}-status`}
           />
-          {differsFromYaml && (
+          {preAuthBaseOverrides && (
+            <span className="text-xs text-(--cui-color-text-muted)">
+              {localize('com_config_registration_domains_all_note')}
+            </span>
+          )}
+          {!preAuthBaseOverrides && differsFromYaml && (
             <span className="text-xs text-(--cui-color-text-muted)">
               {localize('com_config_registration_domains_yaml_note')}
             </span>
@@ -250,12 +330,14 @@ function StartupSettings({
 }
 
 /**
- * Registration (FX-9, FX-10): social sign-in providers (read only from
+ * Registration (FX-9, FX-10): social sign-in providers (editable in Base once
+ * LibreChat applies Base overrides before sign-in, else read only from
  * librechat.yaml), allowed sign-up domains as chips, any other setting as a
  * generic row, and the startup-only sign-in settings read-only.
  */
 export function RegistrationRenderer(props: t.FieldRendererProps) {
   const rowFilter = useContext(RowFilterContext);
+  const { preAuthBaseOverrides } = useConfigFeatures();
   const keys = new Set(props.fields.map((field) => field.key));
   const startup = props.fields.filter((field) => STARTUP_KEYS.has(field.key));
   const others = props.fields.filter(
@@ -263,7 +345,12 @@ export function RegistrationRenderer(props: t.FieldRendererProps) {
   );
   return (
     <>
-      {keys.has('socialLogins') && <SocialLoginsRow fieldProps={props} />}
+      {keys.has('socialLogins') &&
+        (preAuthBaseOverrides ? (
+          <EditableSocialLoginsRow fieldProps={props} />
+        ) : (
+          <SocialLoginsRow fieldProps={props} />
+        ))}
       {keys.has('allowedDomains') && <AllowedDomainsRow fieldProps={props} />}
       {others.length > 0 && <FieldRenderer {...props} fields={others} />}
       <StartupSettings fields={startup} fieldProps={props} />
diff --git a/src/components/configuration/sections/system/__tests__/RegistrationRenderer.test.tsx b/src/components/configuration/sections/system/__tests__/RegistrationRenderer.test.tsx
index 8f149f79..e5c769e2 100644
--- a/src/components/configuration/sections/system/__tests__/RegistrationRenderer.test.tsx
+++ b/src/components/configuration/sections/system/__tests__/RegistrationRenderer.test.tsx
@@ -1,6 +1,7 @@
 import '@/locales/i18n';
 import { describe, expect, it, vi } from 'vitest';
 import { fireEvent, screen, within } from '@testing-library/react';
+import { createServerContract } from '@/test/fixtures';
 import { renderSections } from '@/test/sections';
 
 const YAML = {
@@ -25,6 +26,45 @@ describe('RegistrationRenderer', () => {
     expect(screen.queryByRole('button', { name: /Remove openid/i })).not.toBeInTheDocument();
   });
 
+  it('edits the providers in Base once Base overrides apply before sign-in', () => {
+    const onChange = vi.fn();
+    renderSections({
+      sections: ['registration'],
+      yaml: YAML,
+      onChange,
+      contract: createServerContract({ preAuthBaseOverrides: true }),
+    });
+    expect(screen.queryByText(/reads this list from librechat.yaml only/)).toBeNull();
+    fireEvent.change(screen.getByRole('combobox', { name: /Add sign-in option/ }), {
+      target: { value: 'github' },
+    });
+    expect(onChange).toHaveBeenLastCalledWith('registration.socialLogins', [
+      'openid',
+      'google',
+      'github',
+    ]);
+    fireEvent.click(screen.getByRole('button', { name: 'Remove Google' }));
+    expect(onChange).toHaveBeenLastCalledWith('registration.socialLogins', ['openid', 'github']);
+    expect(
+      screen.getByText('Social, SSO and LDAP sign-ins and password resets check this list too.'),
+    ).toBeInTheDocument();
+  });
+
+  it('removes the Base list when it matches librechat.yaml again', () => {
+    const onChange = vi.fn();
+    renderSections({
+      sections: ['registration'],
+      yaml: YAML,
+      overrides: { registration: { socialLogins: ['openid'] } },
+      onChange,
+      contract: createServerContract({ preAuthBaseOverrides: true }),
+    });
+    fireEvent.change(screen.getByRole('combobox', { name: /Add sign-in option/ }), {
+      target: { value: 'google' },
+    });
+    expect(onChange).toHaveBeenLastCalledWith('registration.socialLogins', undefined);
+  });
+
   it('in a profile, lists the librechat.yaml providers, not a stale Base override', () => {
     renderSections({
       sections: ['registration'],
diff --git a/src/components/configuration/values/ProvenanceChip.tsx b/src/components/configuration/values/ProvenanceChip.tsx
index f2882189..a1353f4b 100644
--- a/src/components/configuration/values/ProvenanceChip.tsx
+++ b/src/components/configuration/values/ProvenanceChip.tsx
@@ -53,7 +53,12 @@ export function shadowedSourceLabel(
 function shadowReason(shadowedBy: t.ShadowedBy, source: string, localize: t.LocalizeFn): string {
   const field = labelForPath(shadowedBy.path, localize);
   if (shadowedBy.value === undefined) {
-    return localize('com_config_providers_shadow_block_unset', { field, source });
+    return localize(
+      shadowedBy.precedence === 'pair'
+        ? 'com_config_providers_shadow_pair'
+        : 'com_config_providers_shadow_block_unset',
+      { field, source },
+    );
   }
   const value = formatConfigValue(shadowedBy.value, localize, shadowedBy.path);
   return localize(
diff --git a/src/constants/collections.ts b/src/constants/collections.ts
index 59afbbb9..e8c40606 100644
--- a/src/constants/collections.ts
+++ b/src/constants/collections.ts
@@ -27,3 +27,17 @@ export const KEYED_COLLECTIONS: ReadonlyMap<string, t.KeyedCollection> = new Map
     ] satisfies t.KeyedCollection[]
   ).map((collection): [string, t.KeyedCollection] => [collection.path, collection]),
 );
+
+/**
+ * Records of named entries that each hold a credential beside the destination
+ * it is sent to, where LibreChat drops a credential whose destination changed
+ * (`secretRebinding`): the record it reports an entry in → the one the panel
+ * edits it in (Azure groups are reported in the `groupMap` that `groups`
+ * resolves to). Elsewhere a credential is bound to the object holding it
+ * (`ocr.apiKey` to `ocr.baseURL`).
+ */
+export const CREDENTIAL_ENTRY_RECORDS: ReadonlyMap<string, string> = new Map([
+  ['endpoints.custom', 'endpoints.custom'],
+  ['mcpServers', 'mcpServers'],
+  ['endpoints.azureOpenAI.groupMap', 'endpoints.azureOpenAI.groups'],
+]);
diff --git a/src/constants/config.ts b/src/constants/config.ts
index 8daf6ec7..1b1c62d1 100644
--- a/src/constants/config.ts
+++ b/src/constants/config.ts
@@ -28,11 +28,55 @@ export const TERMS_NOT_ACCEPTED_ISSUE = 'TERMS_NOT_ACCEPTED';
  */
 const INTERIM_BASE_ONLY_SECTIONS = ['mcpAppSandbox'];
 
+/**
+ * Sections LibreChat reads from librechat.yaml before sign-in (Turnstile),
+ * read-only on every server: one that reports its rules lists them as
+ * base-only, an older one reads them from the raw file.
+ */
+const PRE_AUTH_YAML_SECTIONS: readonly string[] = ['turnstile'];
+
+/**
+ * Sections and fields only librechat.yaml sets, as the panel knew them before
+ * servers reported `rules.deploymentOnlyPaths`: sections read at startup or
+ * from the raw librechat.yaml, and settings read once at startup.
+ */
+export const BUNDLED_DEPLOYMENT_ONLY_PATHS: Readonly<Record<string, t.DeploymentOnlyReason>> = {
+  cloudfront: 'operator',
+  rateLimits: 'operator',
+  /** Read as `req.config.config.permissions`: the raw librechat.yaml, never the merged overrides. */
+  permissions: 'operator',
+  /** The docs gate reads `getAppConfig({ baseOnly: true }).config.openapi`. */
+  openapi: 'operator',
+  /** Only librechat.yaml's own loader knows it; AppService never carries it into the app config. */
+  cache: 'unused',
+  /** Social sign-in and OpenID discovery are set up once at startup from librechat.yaml. */
+  'registration.oauthStateTtlMs': 'startup',
+  'registration.openidDiscovery': 'startup',
+  /**
+   * Read once at startup, from librechat.yaml alone (`getAppConfig({ baseOnly:
+   * true })` while the server boots): the agents' background, event and
+   * approval hook runtime, and MCP catalog recovery's state limits and fence
+   * retry worker. `catalogRecovery.authorizationFenceTimeoutMs` is not one:
+   * requests read it from the merged config too.
+   */
+  'endpoints.agents.eventDriven': 'startup',
+  'endpoints.agents.subagentActivity': 'startup',
+  'endpoints.agents.toolApproval.hooks': 'startup',
+  'endpoints.agents.backgroundTasks.shutdownInterruptGraceMs': 'startup',
+  'endpoints.agents.backgroundTasks.completionResultBatchSize': 'startup',
+  'endpoints.agents.backgroundTasks.completionReceiptBatching': 'startup',
+  'mcpSettings.catalogRecovery.maxStateEntries': 'startup',
+  'mcpSettings.catalogRecovery.maxDetachedDiscoveries': 'startup',
+  'mcpSettings.catalogRecovery.authorizationFenceRetryIntervalMs': 'startup',
+  'mcpSettings.catalogRecovery.authorizationFenceRetryBatchSize': 'startup',
+};
+
 /**
  * Top-level sections the panel must never write, with the reason shown in the
- * UI. Base-only sections are stripped by the admin API for every principal;
- * the YAML-only ones are read from the raw librechat.yaml at startup or before
- * login, so overrides have no effect.
+ * UI, on a server that does not report its rules. Base-only sections are
+ * stripped by the admin API for every principal; the YAML-only ones are read
+ * from the raw librechat.yaml at startup or before login, so overrides have
+ * no effect. A server that reports its rules decides them (`getWriteRules`).
  */
 export const READ_ONLY_CONFIG_SECTIONS: ReadonlyMap<string, t.ReadOnlyReason> = new Map<
   string,
@@ -41,15 +85,10 @@ export const READ_ONLY_CONFIG_SECTIONS: ReadonlyMap<string, t.ReadOnlyReason> =
   ...[...BASE_ONLY_CONFIG_SECTIONS, ...INTERIM_BASE_ONLY_SECTIONS].map(
     (section): [string, t.ReadOnlyReason] => [section, 'baseOnly'],
   ),
-  ['cloudfront', 'yamlOnly'],
-  ['rateLimits', 'yamlOnly'],
-  ['turnstile', 'yamlOnly'],
-  /** Read as `req.config.config.permissions`: the raw librechat.yaml, never the merged overrides. */
-  ['permissions', 'yamlOnly'],
-  /** The docs gate reads `getAppConfig({ baseOnly: true }).config.openapi`. */
-  ['openapi', 'yamlOnly'],
-  /** Only librechat.yaml's own loader knows it; AppService never carries it into the app config. */
-  ['cache', 'yamlOnly'],
+  ...Object.keys(BUNDLED_DEPLOYMENT_ONLY_PATHS)
+    .filter((path) => !path.includes('.'))
+    .map((section): [string, t.ReadOnlyReason] => [section, 'yamlOnly']),
+  ...PRE_AUTH_YAML_SECTIONS.map((section): [string, t.ReadOnlyReason] => [section, 'yamlOnly']),
 ]);
 
 /**
@@ -67,43 +106,81 @@ export const APP_SERVICE_KEY_ALIASES: Readonly<Record<string, string>> = {
   mcpConfig: 'mcpServers',
 };
 
-/**
- * Settings LibreChat reads once at startup, from librechat.yaml alone
- * (`getAppConfig({ baseOnly: true })` while the server boots), so an admin
- * override never takes effect: the agents' background, event and approval
- * hook runtime, and MCP catalog recovery's state limits and fence retry
- * worker. `catalogRecovery.authorizationFenceTimeoutMs` is not one: requests
- * read it from the merged config too.
- */
-export const STARTUP_ONLY_FIELDS: ReadonlySet<string> = new Set([
-  'endpoints.agents.eventDriven',
-  'endpoints.agents.subagentActivity',
-  'endpoints.agents.toolApproval.hooks',
-  'endpoints.agents.backgroundTasks.shutdownInterruptGraceMs',
-  'endpoints.agents.backgroundTasks.completionResultBatchSize',
-  'endpoints.agents.backgroundTasks.completionReceiptBatching',
-  'mcpSettings.catalogRecovery.maxStateEntries',
-  'mcpSettings.catalogRecovery.maxDetachedDiscoveries',
-  'mcpSettings.catalogRecovery.authorizationFenceRetryIntervalMs',
-  'mcpSettings.catalogRecovery.authorizationFenceRetryBatchSize',
-]);
+/** Social sign-in buttons: read before sign-in, from librechat.yaml until `preAuthBaseOverrides`. */
+export const SOCIAL_LOGINS_PATH = 'registration.socialLogins';
 
 /**
- * Fields LibreChat only processes from librechat.yaml (overrides are merged
- * after `azureConfigSetup`/`vertexConfigSetup` run, or read only at startup),
- * so edits would be silent no-ops. Rendered read-only until the backend
- * re-processes overrides.
+ * Fields LibreChat only processes from librechat.yaml: overrides are merged
+ * after `azureConfigSetup`/`vertexConfigSetup` run, so edits would be silent
+ * no-ops. Rendered read-only until the backend re-processes overrides.
  */
-export const YAML_MANAGED_FIELDS: ReadonlySet<string> = new Set([
+const YAML_PROCESSED_FIELDS: readonly string[] = [
   'endpoints.azureOpenAI.groups',
   'endpoints.anthropic.vertex',
-  /** The sign-in page reads it before login, from librechat.yaml only (unauthenticated `/api/config`). */
-  'registration.socialLogins',
-  /** Social sign-in and OpenID discovery are set up once at startup from librechat.yaml. */
-  'registration.oauthStateTtlMs',
-  'registration.openidDiscovery',
-  ...STARTUP_ONLY_FIELDS,
-]);
+];
+
+/**
+ * The fields of `rules`' deployment-only paths inside writable sections, and
+ * which of them are read only at startup.
+ */
+function deploymentOnlyFields(paths: Readonly<Record<string, t.DeploymentOnlyReason>>): {
+  fields: string[];
+  startup: string[];
+} {
+  const nested = Object.entries(paths).filter(([path]) => path.includes('.'));
+  return {
+    fields: nested.map(([path]) => path),
+    startup: nested.filter(([, reason]) => reason === 'startup').map(([path]) => path),
+  };
+}
+
+/**
+ * Where the panel may write on a server with these rules and features:
+ * base-only sections, deployment-only sections and fields, base-only fields,
+ * the fields LibreChat only processes from librechat.yaml, and, until Base
+ * overrides apply before sign-in (`preAuthBaseOverrides`), the social
+ * sign-in buttons.
+ */
+export function resolveWriteRules(
+  rules: Pick<t.ConfigRules, 'baseOnlySections' | 'baseOnlyPaths' | 'deploymentOnlyPaths'>,
+  preAuthBaseOverrides: boolean,
+): t.ConfigWriteRules {
+  const readOnlySections = new Map<string, t.ReadOnlyReason>();
+  for (const section of rules.baseOnlySections) readOnlySections.set(section, 'baseOnly');
+  for (const path of Object.keys(rules.deploymentOnlyPaths)) {
+    if (!path.includes('.')) readOnlySections.set(path, 'yamlOnly');
+  }
+  for (const section of PRE_AUTH_YAML_SECTIONS) readOnlySections.set(section, 'yamlOnly');
+  const { fields, startup } = deploymentOnlyFields(rules.deploymentOnlyPaths);
+  return {
+    readOnlySections,
+    yamlManagedFields: new Set([
+      ...YAML_PROCESSED_FIELDS,
+      ...(preAuthBaseOverrides ? [] : [SOCIAL_LOGINS_PATH]),
+      ...fields,
+      ...rules.baseOnlyPaths,
+    ]),
+    startupOnlyFields: new Set(startup),
+  };
+}
+
+/** The write rules of a server that reports none: every section and field as before servers did. */
+export const BUNDLED_WRITE_RULES: t.ConfigWriteRules = resolveWriteRules(
+  {
+    baseOnlySections: [...READ_ONLY_CONFIG_SECTIONS]
+      .filter(([, reason]) => reason === 'baseOnly')
+      .map(([section]) => section),
+    baseOnlyPaths: [],
+    deploymentOnlyPaths: BUNDLED_DEPLOYMENT_ONLY_PATHS,
+  },
+  false,
+);
+
+/** Fields LibreChat reads once at startup, from librechat.yaml alone, as the panel knew them. */
+export const STARTUP_ONLY_FIELDS: ReadonlySet<string> = BUNDLED_WRITE_RULES.startupOnlyFields;
+
+/** Fields only librechat.yaml sets, as the panel knew them before servers reported their rules. */
+export const YAML_MANAGED_FIELDS: ReadonlySet<string> = BUNDLED_WRITE_RULES.yamlManagedFields;
 
 /** Config keys for values that must never be displayed in plain text. */
 export const SECRET_CONFIG_KEYS: ReadonlySet<string> = new Set([
@@ -128,6 +205,23 @@ export const SKIP_REASON_KEYS: Readonly<Record<t.SkipReason, string>> = {
   baseScope: 'com_scope_skip_base_scope',
   inheritedValue: 'com_scope_skip_inherited_value',
   inheritedMerged: 'com_scope_skip_inherited_merged',
+  processServer: 'com_config_skip_process_server',
+  secretRebinding: 'com_config_skip_secret_rebinding',
+};
+
+/**
+ * The panel's skip reason for each reason the admin API reports a write did
+ * not store (`skipped`, with `writeReport`) or stores without effect
+ * (`ignored`). A reason a newer server adds reads as not stored or not applied.
+ */
+export const REPORTED_SKIP_REASONS: Readonly<Record<string, t.SkipReason>> = {
+  base_only_section: 'baseOnly',
+  base_only_path: 'baseOnly',
+  deployment_only_path: 'yamlOnly',
+  dedicated_section: 'dedicated',
+  interface_permission: 'permission',
+  process_mcp_server: 'processServer',
+  secret_rebinding: 'secretRebinding',
 };
 
 /** Why a lower-layer key comes back after a write: LibreChat merges it in, so it is reported but not lost. */
@@ -143,8 +237,11 @@ export function getConfigSection(path: string): string {
 }
 
 /** The top-level section a dot-path belongs to, when that section is read-only. */
-export function getReadOnlyReason(path: string): t.ReadOnlyReason | undefined {
-  return READ_ONLY_CONFIG_SECTIONS.get(getConfigSection(path));
+export function getReadOnlyReason(
+  path: string,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
+): t.ReadOnlyReason | undefined {
+  return rules.readOnlySections.get(getConfigSection(path));
 }
 
 function isAtOrUnderAny(path: string, fields: ReadonlySet<string>): boolean {
@@ -155,11 +252,17 @@ function isAtOrUnderAny(path: string, fields: ReadonlySet<string>): boolean {
 }
 
 /** Whether `path` is, or is inside, a field managed only in librechat.yaml. */
-export function isYamlManagedPath(path: string): boolean {
-  return isAtOrUnderAny(path, YAML_MANAGED_FIELDS);
+export function isYamlManagedPath(
+  path: string,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
+): boolean {
+  return isAtOrUnderAny(path, rules.yamlManagedFields);
 }
 
-/** Whether `path` is, or is inside, a setting LibreChat reads only at startup (`STARTUP_ONLY_FIELDS`). */
-export function isStartupOnlyPath(path: string): boolean {
-  return isAtOrUnderAny(path, STARTUP_ONLY_FIELDS);
+/** Whether `path` is, or is inside, a setting LibreChat reads only at startup. */
+export function isStartupOnlyPath(
+  path: string,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
+): boolean {
+  return isAtOrUnderAny(path, rules.startupOnlyFields);
 }
diff --git a/src/constants/contract.ts b/src/constants/contract.ts
index c0a4214d..6016fe0c 100644
--- a/src/constants/contract.ts
+++ b/src/constants/contract.ts
@@ -6,7 +6,13 @@ import {
   RUNTIME_CONFIG_INTERFACE_FIELDS,
 } from 'librechat-data-provider';
 import type * as t from '@/types';
-import { APP_SERVICE_KEY_ALIASES, READ_ONLY_CONFIG_SECTIONS } from './config';
+import {
+  resolveWriteRules,
+  BUNDLED_WRITE_RULES,
+  APP_SERVICE_KEY_ALIASES,
+  READ_ONLY_CONFIG_SECTIONS,
+  BUNDLED_DEPLOYMENT_ONLY_PATHS,
+} from './config';
 import { KEYED_COLLECTIONS } from './collections';
 
 /** Every flag of the admin config contract the panel reads. */
@@ -30,6 +36,8 @@ export const CONFIG_FEATURE_FLAGS: readonly t.ConfigFeatureFlag[] = [
   'yamlSecretPreview',
   'envAllowlist',
   'secretRebinding',
+  'writeReport',
+  'issueParams',
 ];
 
 /** A server without the meta route (or one that leaves a flag out) has none of these behaviours. */
@@ -81,6 +89,7 @@ export const BUNDLED_CONFIG_RULES: t.ConfigRules = {
     .map(([section]) => section),
   basePrincipalSections: [...BASE_PRINCIPAL_CONFIG_SECTIONS],
   baseOnlyPaths: [],
+  deploymentOnlyPaths: BUNDLED_DEPLOYMENT_ONLY_PATHS,
   arrayMergeKeys: Object.fromEntries(
     keyedCollections
       .filter((collection) => collection.merge === 'byKey')
@@ -125,3 +134,18 @@ export const BUNDLED_CONFIG_CONTRACT: t.ConfigContract = {
   limits: BUNDLED_CONFIG_LIMITS,
   rules: BUNDLED_CONFIG_RULES,
 };
+
+const WRITE_RULES_CACHE = new WeakMap<t.ConfigContract, t.ConfigWriteRules>();
+
+/**
+ * Where the panel may write on the contract's server (`resolveWriteRules`),
+ * built once per contract. The bundled contract keeps the panel's own lists.
+ */
+export function getWriteRules(contract: t.ConfigContract): t.ConfigWriteRules {
+  if (contract === BUNDLED_CONFIG_CONTRACT) return BUNDLED_WRITE_RULES;
+  const cached = WRITE_RULES_CACHE.get(contract);
+  if (cached) return cached;
+  const rules = resolveWriteRules(contract.rules, contract.features.preAuthBaseOverrides);
+  WRITE_RULES_CACHE.set(contract, rules);
+  return rules;
+}
diff --git a/src/constants/features.ts b/src/constants/features.ts
index 50c50a04..6f39e322 100644
--- a/src/constants/features.ts
+++ b/src/constants/features.ts
@@ -34,12 +34,29 @@ export function getDomainListPolicy(path: string): t.DomainListPolicy {
   return DOMAIN_LIST_POLICIES[path] ?? DEFAULT_DOMAIN_POLICY;
 }
 
-/** Keys LibreChat's admin API stores as typed: they are not in its secret registry. */
+/** Keys LibreChat's admin API stores as typed until `webSearchStoredKeys` adds them to its secret registry. */
 const PLAINTEXT_KEYS: ReadonlySet<string> = new Set(['keenableApiKey']);
 
 function credential(key: string, env: string, required: boolean): t.WebSearchCredential {
   const secret = /ApiKey$/.test(key);
-  return { key, env, required, secret, encrypted: secret && !PLAINTEXT_KEYS.has(key) };
+  return {
+    key,
+    env,
+    required,
+    secret,
+    ...(secret && PLAINTEXT_KEYS.has(key) && { encryptedSince: 'webSearchStoredKeys' as const }),
+  };
+}
+
+/**
+ * Whether LibreChat stores the credential encrypted, with a masked preview:
+ * every web search key, and Keenable's only on a server with `webSearchStoredKeys`.
+ */
+export function isEncryptedCredential(
+  { secret, encryptedSince }: t.WebSearchCredential,
+  features: Pick<t.ConfigFeatures, 'webSearchStoredKeys'>,
+): boolean {
+  return secret && (encryptedSince === undefined || features[encryptedSince]);
 }
 
 const SERPER_KEY = credential('serperApiKey', 'SERPER_API_KEY', true);
diff --git a/src/constants/scope.ts b/src/constants/scope.ts
index 7f13b62f..1693dbfd 100644
--- a/src/constants/scope.ts
+++ b/src/constants/scope.ts
@@ -1,6 +1,6 @@
 import { PrincipalType } from 'librechat-data-provider';
 import type * as t from '@/types';
-import { DEDICATED_CONFIG_SECTIONS, READ_ONLY_CONFIG_SECTIONS, getConfigSection } from './config';
+import { BUNDLED_WRITE_RULES, DEDICATED_CONFIG_SECTIONS, getConfigSection } from './config';
 
 export const SCOPE_TYPE_CONFIG: Record<t.ScopePrincipalType | 'BASE', t.ScopeTypeConfigEntry> = {
   BASE: {
@@ -44,27 +44,24 @@ export const DEFAULT_SCOPE_PRIORITY: Readonly<Record<t.ScopePrincipalType, numbe
   [PrincipalType.USER]: 100,
 };
 
+/** The highest priority the panel sets (the admin API takes any number of 0 or more). */
+export const MAX_SCOPE_PRIORITY = 1_000_000;
+
 /** Sections LibreChat reads before sign-in, when no role, group or user profile can apply. */
-const PRE_AUTH_SECTIONS = ['registration'];
+const PRE_AUTH_SECTIONS: ReadonlySet<string> = new Set(['registration']);
 
 /**
- * Top-level sections that cannot be set per profile, with the reason (WS8).
- * In a profile they render as an "Applies to everyone — edit in Base" card and
- * their paths are never sent.
+ * Why `path` (or its section) cannot be set per profile, if it can't (WS8):
+ * a section read before sign-in, a tenant-wide one, or one read-only
+ * everywhere (by the server's write `rules`). In a profile they render as an
+ * "Applies to everyone — edit in Base" card and their paths are never sent.
  */
-export const SCOPE_GATED_SECTIONS: ReadonlyMap<string, t.ScopeGateReason> = new Map<
-  string,
-  t.ScopeGateReason
->([
-  ...READ_ONLY_CONFIG_SECTIONS,
-  ...[...DEDICATED_CONFIG_SECTIONS].map((section): [string, t.ScopeGateReason] => [
-    section,
-    'tenantWide',
-  ]),
-  ...PRE_AUTH_SECTIONS.map((section): [string, t.ScopeGateReason] => [section, 'preAuth']),
-]);
-
-/** Why `path` (or its section) cannot be set per profile, if it can't. */
-export function getScopeGateReason(path: string): t.ScopeGateReason | undefined {
-  return SCOPE_GATED_SECTIONS.get(getConfigSection(path));
+export function getScopeGateReason(
+  path: string,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
+): t.ScopeGateReason | undefined {
+  const section = getConfigSection(path);
+  if (PRE_AUTH_SECTIONS.has(section)) return 'preAuth';
+  if (DEDICATED_CONFIG_SECTIONS.has(section)) return 'tenantWide';
+  return rules.readOnlySections.get(section);
 }
diff --git a/src/hooks/config/contract.ts b/src/hooks/config/contract.ts
index aa7bee95..ebf95608 100644
--- a/src/hooks/config/contract.ts
+++ b/src/hooks/config/contract.ts
@@ -2,6 +2,7 @@ import { useContext, useCallback } from 'react';
 import type * as t from '@/types';
 import { ConfigContractContext } from '@/contexts/ContractContext';
 import { useLocalize } from '../useLocalize';
+import { getWriteRules } from '@/constants';
 import { isUnsafeConfigKey } from '@/utils';
 
 /** The connected server's admin config contract (the bundled one until it loads, or without one). */
@@ -14,6 +15,11 @@ export function useConfigFeatures(): t.ConfigFeatures {
   return useContext(ConfigContractContext).features;
 }
 
+/** Where the panel may write on the connected server: read-only sections and librechat.yaml-only fields. */
+export function useConfigWriteRules(): t.ConfigWriteRules {
+  return getWriteRules(useContext(ConfigContractContext));
+}
+
 /**
  * Why a record key can't be saved, or null: a key the admin API would drop
  * (`$`-prefixed, a prototype name, and before `dottedKeys` any key with a dot).
diff --git a/src/hooks/config/field.ts b/src/hooks/config/field.ts
index e4fb2f83..ddbd22ab 100644
--- a/src/hooks/config/field.ts
+++ b/src/hooks/config/field.ts
@@ -157,9 +157,14 @@ export function useRecordEntryOverrides(
   }, [layers, recordPath]);
 }
 
-/** Whether `endpoints.all` exists, so LibreChat reads title settings only from it (D11). */
+/**
+ * Whether `endpoints.all` exists on a server that reads title settings from
+ * it as one block (D11), so it is the only place they apply. A server that
+ * resolves them per field (`titleResolution: 'field'`) has no such block.
+ */
 export function useGlobalTitleBlock(): boolean {
   const data = useContext(ConfigValuesContext);
+  if (data?.titleResolution === 'field') return false;
   const root = data?.configValues ?? data?.layers?.effective ?? null;
   return isConfigRecord(getValueAtPath(root, 'endpoints.all'));
 }
diff --git a/src/hooks/config/import.ts b/src/hooks/config/import.ts
index 86db70af..ff58990b 100644
--- a/src/hooks/config/import.ts
+++ b/src/hooks/config/import.ts
@@ -40,7 +40,7 @@ import { findSchemaField } from '@/components/configuration/controls';
 import { describeIssues } from '@/components/configuration/issues';
 import { resolvedConfigOptions, runtimeDefaultAt } from './layers';
 import { MERGED_BACK_REASONS } from '@/constants';
-import { useConfigFeatures } from './contract';
+import { useConfigFeatures, useConfigWriteRules } from './contract';
 import { useLocalize } from '../useLocalize';
 
 /** Lists LibreChat merges with librechat.yaml by name; an import upserts their entries by name. */
@@ -229,6 +229,7 @@ export function useImportPreview({
 }: t.ImportPreviewOptions): t.ImportPreviewState {
   const localize = useLocalize();
   const features = useConfigFeatures();
+  const writeRules = useConfigWriteRules();
   const { data: base, isLoading: baseLoading } = useQuery(baseConfigOptions);
   const existingScope = target?.type === 'scope' && target.exists ? target.scope : undefined;
   const { data: scopeData, isLoading: scopeLoading } = useQuery(
@@ -241,9 +242,9 @@ export function useImportPreview({
   const plan = useMemo(
     () =>
       appConfig
-        ? planImport(appConfig, schemaTree, schemaPathSet, isScopeTarget, features)
+        ? planImport(appConfig, schemaTree, schemaPathSet, isScopeTarget, features, writeRules)
         : undefined,
-    [appConfig, schemaTree, schemaPathSet, isScopeTarget, features],
+    [appConfig, schemaTree, schemaPathSet, isScopeTarget, features, writeRules],
   );
 
   /** librechat.yaml and the base overrides as layers, so a value is labelled by the layer that sets it. */
@@ -437,10 +438,10 @@ export function useImportPreview({
         ({ fieldPath, value }): t.ConfigChange => ({ op: 'set', path: fieldPath, value }),
       );
       if (ops.length === 0) return [];
-      const { issues } = planConfigChanges(ops, snapshot, features);
+      const { issues } = planConfigChanges(ops, snapshot, features, writeRules);
       return describeIssues(issues, [], localize).summaries;
     },
-    [snapshot, entriesFor, features, localize],
+    [snapshot, entriesFor, features, writeRules, localize],
   );
 
   return {
diff --git a/src/hooks/config/layers.ts b/src/hooks/config/layers.ts
index bc38037d..4e77426b 100644
--- a/src/hooks/config/layers.ts
+++ b/src/hooks/config/layers.ts
@@ -16,6 +16,7 @@ import {
   overriddenEntryKeys,
 } from '@/utils';
 import { KEYED_COLLECTIONS } from '@/constants';
+import { useConfigWriteRules } from './contract';
 import { collectFieldPaths, withLangfuseConfiguredPath } from '@/components/configuration/counts';
 import { mergeIndexedArrayEdits } from '@/components/configuration/edits';
 import { getFieldMeta } from '@/components/configuration/meta';
@@ -101,13 +102,14 @@ export function useConfigLayers({
 
   const scopeQuery = useQuery(resolvedConfigOptions(selectedScope));
   const scopeData = isEditingScope ? scopeQuery.data : undefined;
+  const writeRules = useConfigWriteRules();
 
   /** Profile mode: Base merged with the profile's overrides, minus its tombstones (null until both load). */
   const valueLayers = useMemo((): t.ValueLayers | null => {
     if (!baseLayers || !isEditingScope) return baseLayers;
     if (!openScope || !scopeData) return null;
-    return withScopeLayer(baseLayers, openScope, scopeData, schemaPathSet);
-  }, [baseLayers, isEditingScope, openScope, scopeData, schemaPathSet]);
+    return withScopeLayer(baseLayers, openScope, scopeData, schemaPathSet, writeRules);
+  }, [baseLayers, isEditingScope, openScope, scopeData, schemaPathSet, writeRules]);
 
   /**
    * Overridden entries of each keyed list, by the edit target: Base's
diff --git a/src/hooks/config/options.test.tsx b/src/hooks/config/options.test.tsx
index 1a55cec1..52b640d9 100644
--- a/src/hooks/config/options.test.tsx
+++ b/src/hooks/config/options.test.tsx
@@ -164,6 +164,15 @@ describe('buildEndpointOptions', () => {
     expect(options[0].value).toBe('ollama');
   });
 
+  it('offers it as written on a server that folds endpoint references', () => {
+    const status: t.EndpointStatusMap = {
+      ollama: { name: 'ollama', custom: true, userProvide: false },
+    };
+    const root = { endpoints: { custom: [{ name: 'Ollama' }] } };
+    const options = buildEndpointOptions(status, root, (key) => key, false, true);
+    expect(options[0]).toEqual({ value: 'ollama', label: 'Ollama' });
+  });
+
   it('keeps endpoints whose names differ only in letter case apart (LibreChat serves both)', () => {
     const status: t.EndpointStatusMap = {
       Perplexity: { name: 'Perplexity', custom: true, userProvide: false },
diff --git a/src/hooks/config/options.ts b/src/hooks/config/options.ts
index b8d195da..b7e11bcf 100644
--- a/src/hooks/config/options.ts
+++ b/src/hooks/config/options.ts
@@ -10,7 +10,8 @@ import {
 } from '@/server';
 import { ConfigValuesContext } from '@/contexts/ConfigValuesContext';
 import { MODEL_PROVIDERS, BUILT_IN_PROVIDERS } from '@/constants';
-import { getValueAtPath, isConfigRecord } from '@/utils';
+import { getValueAtPath, isConfigRecord, foldsEndpointReferences } from '@/utils';
+import { useConfigContract } from './contract';
 import { useLocalize } from '../useLocalize';
 import { useFieldState } from './field';
 
@@ -105,8 +106,10 @@ export function useCustomEndpointNames(): string[] {
  * saved yet), so a reference to any of them is recognized. Each value is the
  * name LibreChat serves the endpoint under, since `addedEndpoints` and
  * `allowedProviders` are matched against it exactly: a custom endpoint
- * written "Ollama" is offered as "Ollama (ollama)". Names that differ only
- * in letter case are distinct endpoints and are both offered. With
+ * written "Ollama" is offered as "Ollama (ollama)". A server that folds
+ * references to the served name (`foldsNames`) matches either spelling, so
+ * the endpoint is offered as written ("Ollama"). Names that differ only in
+ * letter case are distinct endpoints and are both offered. With
  * `providersOnly`, endpoints that delegate to a provider (agents, Assistants)
  * are left out.
  */
@@ -115,6 +118,7 @@ export function buildEndpointOptions(
   root: t.ConfigValue,
   localize: t.LocalizeFn,
   providersOnly = false,
+  foldsNames = false,
 ): t.SelectOption[] {
   const configured = customEndpointNames(getValueAtPath(root, 'endpoints.custom'));
   const spelling = new Map<string, string>();
@@ -131,7 +135,8 @@ export function buildEndpointOptions(
     const label = BUILT_IN_SET.has(served)
       ? localize(`com_config_field_${served}`)
       : (spelling.get(served) ?? served);
-    options.push({ value: served, label: label === served ? served : `${label} (${served})` });
+    const shownLabel = label === served || foldsNames ? label : `${label} (${served})`;
+    options.push({ value: served, label: shownLabel });
   };
   for (const name of Object.keys(status ?? {})) add(name);
   for (const name of BUILT_IN_PROVIDERS) add(name);
@@ -181,6 +186,7 @@ function toOptions(values: string[]): t.SelectOption[] {
  */
 export function useOptionSources(source?: t.OptionSource): t.OptionSourceResult {
   const localize = useLocalize();
+  const foldsNames = foldsEndpointReferences(useConfigContract());
   const root = useShownConfig();
   const { client, live } = useClient();
   const version = useConfigVersion(client, live);
@@ -208,14 +214,14 @@ export function useOptionSources(source?: t.OptionSource): t.OptionSourceResult
   const options = useMemo((): t.SelectOption[] => {
     if (!source) return NO_OPTIONS;
     if (source === 'endpoints' || source === 'providers') {
-      return buildEndpointOptions(status.data, root, localize, source === 'providers');
+      return buildEndpointOptions(status.data, root, localize, source === 'providers', foldsNames);
     }
     if (source === 'mcpServers') return toOptions(recordKeys(root, 'mcpServers'));
     if (source === 'specGroups') return toOptions(specGroups(root));
     if (source === 'tools') return tools.data ?? NO_OPTIONS;
     const endpoint = source.slice(MODELS_PREFIX.length);
     return toOptions(modelsOf(models.data, endpoint) ?? []);
-  }, [source, status.data, models.data, tools.data, root, localize]);
+  }, [source, status.data, models.data, tools.data, root, localize, foldsNames]);
 
   const isLoading =
     live &&
diff --git a/src/hooks/config/review.test.tsx b/src/hooks/config/review.test.tsx
index ac0de4dc..62286478 100644
--- a/src/hooks/config/review.test.tsx
+++ b/src/hooks/config/review.test.tsx
@@ -8,6 +8,9 @@ import { extractSchemaTree, getSchemaPathSet } from '@/server/config';
 import { useChangeReview } from './review';
 import { useConfigEdits } from './edits';
 import { flattenObject } from '@/utils';
+import { ConfigContractContext } from '@/contexts/ContractContext';
+import { createServerContract } from '@/test/fixtures';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 import { useConfigSave } from './save';
 import '@/locales/i18n';
 
@@ -33,10 +36,13 @@ function renderPage(
   config: t.ConfigRecord = yaml,
   dbOverrides: t.ConfigRecord = {},
   yamlConfig: t.ConfigRecord = config,
+  contract: t.ConfigContract = BUNDLED_CONFIG_CONTRACT,
 ) {
   const client = new QueryClient();
   const wrapper = ({ children }: { children: ReactNode }) => (
-    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+    <QueryClientProvider client={client}>
+      <ConfigContractContext.Provider value={contract}>{children}</ConfigContractContext.Provider>
+    </QueryClientProvider>
   );
   return renderHook(
     () => {
@@ -126,6 +132,30 @@ describe('the change review over the save pipeline (WS1 × WS7)', () => {
     ]);
   });
 
+  it('warns per field on a server that resolves titles per field, the endpoint and model together', () => {
+    const config = {
+      ...yaml,
+      endpoints: { ...(yaml.endpoints as t.ConfigRecord), all: { titleEndpoint: 'anthropic' } },
+    };
+    const { result } = renderPage(
+      config,
+      {},
+      config,
+      createServerContract({}, { titleResolution: 'field' }),
+    );
+    act(() => {
+      result.current.edits.handleFieldChange('endpoints.openAI.titleModel', 'gpt-x');
+      result.current.edits.handleFieldChange('endpoints.openAI.titleMethod', 'completion');
+    });
+    const rows = result.current.review.model.tabs.flatMap((tab) =>
+      tab.sections.flatMap((section) => section.rows),
+    );
+    expect(rows.map((row) => [row.item.path, row.item.warnings])).toEqual([
+      ['endpoints.openAI.titleModel', ['shadowedPair']],
+      ['endpoints.openAI.titleMethod', undefined],
+    ]);
+  });
+
   it("blocks Save on the pipeline's issue when a librechat.yaml entry is removed (D1)", () => {
     const { result } = renderPage();
     act(() => result.current.edits.handleFieldChange('endpoints.custom', [moonshot]));
diff --git a/src/hooks/config/review.ts b/src/hooks/config/review.ts
index 424237e4..e336a481 100644
--- a/src/hooks/config/review.ts
+++ b/src/hooks/config/review.ts
@@ -29,10 +29,19 @@ import { overrideCountUnit } from '@/components/configuration/counts';
 import { planRevert } from '@/components/configuration/review/revert';
 import { findSchemaField } from '@/components/configuration/controls';
 import { normalizeForSave } from '@/components/configuration/edits';
+import { useConfigContract } from './contract';
 import { useLocalize } from '../useLocalize';
 
 const NO_ISSUES: t.ReviewIssue[] = [];
 
+/** The review warning of a change Global overrides take precedence over, by how they win. */
+const SHADOW_WARNINGS: Readonly<Record<NonNullable<t.ShadowedBy['precedence']>, t.ChangeWarning>> =
+  {
+    block: 'shadowedBlock',
+    field: 'shadowed',
+    pair: 'shadowedPair',
+  };
+
 /** Where Go to field lands: a removed entry is no longer on the page, so its list. */
 function goToPath(item: t.ChangeSummaryItem): string {
   if (item.kind === 'removed' && item.entryPath === item.path && item.collectionPath) {
@@ -65,6 +74,7 @@ export function useChangeReview({
   onTabChange,
 }: t.ChangeReviewOptions): t.ChangeReviewState {
   const localize = useLocalize();
+  const { titleResolution } = useConfigContract().rules;
   const isScope = editingScope !== undefined;
   const { savePlan, fieldErrors, changes, confirmSaveOpen: open } = save;
   const {
@@ -157,18 +167,17 @@ export function useChangeReview({
       const found = drift.get(item.path);
       const shadowedBy =
         item.after !== undefined
-          ? resolveShadowedBy(item.path, baseline, edits.editedValues)
+          ? resolveShadowedBy(item.path, baseline, edits.editedValues, titleResolution)
           : undefined;
       if (!found && !shadowedBy) return item;
-      const shadowed: t.ChangeWarning =
-        shadowedBy?.precedence === 'block' ? 'shadowedBlock' : 'shadowed';
+      const shadowed = SHADOW_WARNINGS[shadowedBy?.precedence ?? 'field'];
       return {
         ...item,
         ...(found && { drift: found }),
         ...(shadowedBy && { warnings: [...(item.warnings ?? []), shadowed] }),
       };
     });
-  }, [input, changes, visibilityItems, baseline, edits.editedValues]);
+  }, [input, changes, visibilityItems, baseline, edits.editedValues, titleResolution]);
 
   const labelContext = useMemo<t.ReviewLabelContext>(
     () => ({ localize, fields: schemaTree, tree: applySaves(baseline, savePlan.saves) }),
diff --git a/src/hooks/config/save.ts b/src/hooks/config/save.ts
index f47a476f..512a94e2 100644
--- a/src/hooks/config/save.ts
+++ b/src/hooks/config/save.ts
@@ -25,7 +25,7 @@ import { applyConfigChangesFn, resetBaseConfigFn } from '@/server';
 import { describeIssues } from '@/components/configuration/issues';
 import { hasPathOverlap } from '@/components/configuration/counts';
 import { labelForPath } from '@/components/configuration/meta';
-import { useConfigFeatures } from './contract';
+import { useConfigFeatures, useConfigWriteRules } from './contract';
 import { useLocalize } from '../useLocalize';
 
 function toTargetRef(target: t.WriteTarget): t.WriteTargetRef {
@@ -82,6 +82,7 @@ export function useConfigSave({
   const localize = useLocalize();
   const queryClient = useQueryClient();
   const features = useConfigFeatures();
+  const writeRules = useConfigWriteRules();
   const {
     configValues,
     dbOverrides,
@@ -228,6 +229,7 @@ export function useConfigSave({
       root: baseActiveConfigValues,
       collections: collectionEdits,
       visibility: visibilityEdits,
+      writeRules,
     }),
     [
       schemaTree,
@@ -236,6 +238,7 @@ export function useConfigSave({
       isEditingScope,
       collectionEdits,
       visibilityEdits,
+      writeRules,
     ],
   );
 
@@ -263,8 +266,8 @@ export function useConfigSave({
   }, [isEditingScope, valueLayers, configValues, dbOverrides, yamlConfig]);
 
   const plan = useMemo(
-    () => planConfigChanges(changeSet.ops, snapshot, features),
-    [changeSet, snapshot, features],
+    () => planConfigChanges(changeSet.ops, snapshot, features, writeRules),
+    [changeSet, snapshot, features, writeRules],
   );
 
   const clientIssues = useMemo(
diff --git a/src/hooks/config/scope.ts b/src/hooks/config/scope.ts
index 5cff29f8..fa923f90 100644
--- a/src/hooks/config/scope.ts
+++ b/src/hooks/config/scope.ts
@@ -11,6 +11,7 @@ import {
 } from '@/utils';
 import { ScopeActionsContext } from '@/contexts/ScopeContext';
 import { availableScopesOptions } from '@/server';
+import { useConfigWriteRules } from './contract';
 
 const EMPTY_SCOPES: t.ConfigScope[] = [];
 
@@ -132,5 +133,9 @@ export function useScopeGatedSections(
   sections: t.ConfigSectionConfig[],
   isEditingScope: boolean,
 ): t.ConfigSectionConfig[] {
-  return useMemo(() => applyScopeGates(sections, isEditingScope), [sections, isEditingScope]);
+  const writeRules = useConfigWriteRules();
+  return useMemo(
+    () => applyScopeGates(sections, isEditingScope, writeRules),
+    [sections, isEditingScope, writeRules],
+  );
 }
diff --git a/src/hooks/config/sections.ts b/src/hooks/config/sections.ts
index 31381922..322d62cf 100644
--- a/src/hooks/config/sections.ts
+++ b/src/hooks/config/sections.ts
@@ -9,7 +9,8 @@ import {
 } from '@/components/configuration/configMeta';
 import { providerTocItems } from '@/components/configuration/sections/providers';
 import { webSearchTocItems } from '@/components/configuration/sections/features';
-import { INTERFACE_GROUPS, READ_ONLY_CONFIG_SECTIONS } from '@/constants';
+import { useConfigWriteRules } from './contract';
+import { INTERFACE_GROUPS } from '@/constants';
 import { getValueAtPath, isConfigRecord } from '@/utils';
 import { useLocalize } from '../useLocalize';
 
@@ -126,6 +127,7 @@ export function useTabSections({
   editedValues,
 }: t.TabSectionsOptions): t.ConfigSectionConfig[] {
   const localize = useLocalize();
+  const writeRules = useConfigWriteRules();
 
   return useMemo((): t.ConfigSectionConfig[] => {
     // Collect virtual section entries (those with schemaKey) that target this tab
@@ -144,7 +146,7 @@ export function useTabSections({
         const children = section.children ?? [];
         const hasStructuredChildren =
           (section.isObject || section.type === 'record') && children.length > 0;
-        const readOnlyReason = READ_ONLY_CONFIG_SECTIONS.get(section.key);
+        const readOnlyReason = writeRules.readOnlySections.get(section.key);
         return {
           id: section.key,
           titleKey: meta?.titleKey ?? `com_config_section_${section.key}`,
@@ -204,5 +206,13 @@ export function useTabSections({
     }
 
     return allSections;
-  }, [schemaTree, activeTab, activeConfigValues, editedValues, localize, sectionPermissions]);
+  }, [
+    schemaTree,
+    activeTab,
+    activeConfigValues,
+    editedValues,
+    localize,
+    sectionPermissions,
+    writeRules,
+  ]);
 }
diff --git a/src/locales/en/translation.json b/src/locales/en/translation.json
index 20b0a33b..ffbe4ae5 100644
--- a/src/locales/en/translation.json
+++ b/src/locales/en/translation.json
@@ -634,6 +634,7 @@
   "com_config_review_warning_empty_allowlist": "An empty list allows nothing. Remove the override instead to go back to the default.",
   "com_config_review_warning_open_allowlist": "An empty list sets no limit, so everything this list restricts is allowed. Remove the override instead to go back to the list beneath.",
   "com_config_review_warning_shadowed": "Global overrides set this and take precedence, so this change has no effect while they do",
+  "com_config_review_warning_shadowed_pair": "Global overrides choose the title endpoint and model together and set the other one, so this change has no effect while they do",
   "com_config_review_warning_shadowed_block": "While Global overrides exist, LibreChat reads title settings only from them, so this change has no effect",
   "com_config_review_warning_ownership": "This list will now be managed in the admin panel: changes to it in librechat.yaml won't apply until you revert it.",
   "com_config_review_warning_ownership_scope": "This list replaces the whole list these users inherit from Base.",
@@ -646,6 +647,17 @@
   "com_config_skip_not_stored": "LibreChat did not store it; configure it in librechat.yaml",
   "com_config_skip_not_applied": "saved, but LibreChat still uses the librechat.yaml value",
   "com_config_skip_yaml_merged": "LibreChat merges this librechat.yaml value back in; it can't be removed here",
+  "com_config_skip_process_server": "this MCP server runs a local process from librechat.yaml, so LibreChat applies no overrides to it",
+  "com_config_skip_secret_rebinding": "not sent: where it goes changed without the credential being entered again. Enter it again to use it",
+  "com_config_api_error_auth_required": "Your admin session expired. Sign in again.",
+  "com_config_api_error_config_key_not_storable": "LibreChat's database can't store a key that contains a dot. Rename the key, or set it in librechat.yaml.",
+  "com_config_api_error_config_not_found": "This profile no longer exists. It may have been deleted.",
+  "com_config_api_error_config_version_conflict": "The configuration changed while saving. Reload the page and try again.",
+  "com_config_api_error_forbidden": "You don't have permission to make this change.",
+  "com_config_api_error_forbidden_section": "You don't have permission to change the {{section}} settings.",
+  "com_config_api_error_invalid_priority": "The priority must be a number of 0 or more.",
+  "com_config_api_error_principal_not_found": "The role, group or user this profile is for doesn't exist (it may have been deleted or renamed).",
+  "com_config_api_error_process_mcp_server_override": "This MCP server runs a local process defined in librechat.yaml, so LibreChat applies no overrides to it.",
   "com_config_apply_failed": "Save failed and nothing was changed",
   "com_config_apply_not_effective_one": "Saved, but {{count}} change did not take effect",
   "com_config_apply_not_effective_other": "Saved, but {{count}} changes did not take effect",
@@ -691,6 +703,11 @@
   "com_config_issue_reserved_key": "has a key LibreChat can't store (\"{{key}}\" starts with '$' or is a reserved name); rename it",
   "com_config_issue_dotted_key": "has a key with a dot where LibreChat expects a setting's name",
   "com_config_issue_unknown_section": "isn't a section LibreChat knows",
+  "com_config_issue_not_multiple_of": "must be a multiple of {{multipleOf}}",
+  "com_config_issue_custom_empty": "is empty: enter a host and a port",
+  "com_config_issue_custom_format": "must be only host:port, without http:// or a path",
+  "com_config_issue_custom_missing_port": "must include a port, for example localhost:11434",
+  "com_config_issue_custom_public_ip": "is a public IP address: enter a private address, or a hostname that resolves to one",
   "com_config_issue_invalid_value": "is not a valid value",
   "com_config_issue_wrong_type": "has the wrong type of value",
   "com_config_issue_invalid_option": "is not one of the allowed values",
@@ -1041,6 +1058,7 @@
   "com_config_providers_desc_unused_baseURL": "Not used for built-in providers: LibreChat reads the base URL from the server environment (for example OPENAI_REVERSE_PROXY).",
   "com_config_providers_desc_unused_models": "Not used: LibreChat lists the models the Assistants API returns.",
   "com_config_providers_desc_vertex": "Run Anthropic models through Google Vertex AI.",
+  "com_config_providers_global_desc_field": "Applies to every provider and custom endpoint. A title, activity or reasoning label setting set here takes precedence over each endpoint's own; the title endpoint and model are chosen together.",
   "com_config_providers_global_desc": "Applies to every provider and custom endpoint. Activity and reasoning label settings set here take precedence over each endpoint's own. While this block exists, LibreChat reads title settings only from here.",
   "com_config_providers_global_short": "Global overrides",
   "com_config_providers_global_title": "Global overrides (all endpoints)",
@@ -1099,6 +1117,7 @@
   "com_config_providers_recursion_capped": "Max recursion limit ({{max}}) is below the recursion limit ({{limit}}), so agents get at most {{max}} steps per run.",
   "com_config_providers_shadow_block": "While Global overrides exist, LibreChat reads title settings only from them (Global {{field}}: {{value}}). This value ({{source}}) is ignored.",
   "com_config_providers_shadow_block_unset": "While Global overrides exist, LibreChat reads title settings only from them. Global doesn't set {{field}}, so LibreChat's default applies and this value ({{source}}) is ignored.",
+  "com_config_providers_shadow_pair": "Global overrides choose the title endpoint and model together. They set the other one and leave {{field}} unset, so LibreChat's default applies and this value ({{source}}) is ignored.",
   "com_config_providers_shadow_field": "Global overrides set {{field}} to {{value}}, which takes precedence. This value ({{source}}) is ignored.",
   "com_config_providers_shadow_go": "Go to {{field}} in Global overrides",
   "com_config_providers_shadow_label": "Overridden by Global",
@@ -1128,6 +1147,7 @@
   "com_config_providers_summary_set": "Set here: {{summary}}",
   "com_config_providers_summary_shadowed": "{{value}} (Global wins)",
   "com_config_providers_summary_shadowed_ignored": "{{value}} (ignored while Global exists)",
+  "com_config_providers_summary_shadowed_pair": "{{value}} (ignored: Global sets the title endpoint or model)",
   "com_config_providers_vertex_none": "Vertex AI is not configured. Configure it in librechat.yaml.",
   "com_config_providers_vertex_readonly": "Vertex AI settings are managed in librechat.yaml and shown read-only.",
   "com_config_section_memory": "Memory",
@@ -2561,6 +2581,7 @@
   "com_config_registration_domain_remove": "Remove {{domain}}",
   "com_config_registration_domains_desc": "Only email addresses at these domains can sign up. Leave the list empty to let anyone sign up.",
   "com_config_registration_domains_yaml_note": "Social and SSO sign-ins and password resets also have to pass the librechat.yaml list.",
+  "com_config_registration_domains_all_note": "Social, SSO and LDAP sign-ins and password resets check this list too.",
   "com_config_registration_open_body": "With no allowed domains, anyone with an email address can create an account.",
   "com_config_registration_open_confirm": "Let anyone sign up",
   "com_config_registration_open_title": "Let anyone sign up?",
@@ -2574,6 +2595,8 @@
   "com_config_registration_provider_unknown": "{{name}} (not a sign-in option)",
   "com_config_registration_restricted_one": "Sign-up is limited to {{count}} domain.",
   "com_config_registration_restricted_other": "Sign-up is limited to {{count}} domains.",
+  "com_config_registration_social_add": "Add sign-in option",
+  "com_config_registration_social_options": "Sign-in options",
   "com_config_registration_social_desc": "Social sign-in buttons on the sign-in page, in this order. Each one also needs its credentials in the server's .env.",
   "com_config_registration_social_none": "No social sign-in buttons",
   "com_config_registration_social_yaml": "The sign-in page reads this list from librechat.yaml only, so it can't be changed here.",
@@ -2813,7 +2836,15 @@
   "com_scope_overrides_revert_hint": "Removing an override marks it like the field's Reset: review and save to apply it, and the setting falls back to Base.",
   "com_scope_overrides_title": "Overrides in {{name}}",
   "com_scope_precedence": "Higher priority wins: by default users (100) override groups (20), which override roles (10), which override Base.",
+  "com_scope_precedence_ordered": "Base applies first. Then higher priority wins: by default users (100) override groups (20), which override roles (10). On equal priority, users win over groups and groups over roles.",
   "com_scope_priority_help": "Higher priority wins. By default users (100) override groups (20), groups override roles (10), and every profile overrides Base.",
+  "com_scope_priority_help_ordered": "Base applies first, whatever its priority. Profiles then apply from lowest to highest priority, so higher priority wins; on equal priority, roles apply before groups and groups before users. By default users (100) override groups (20), which override roles (10).",
+  "com_scope_priority_change": "Change",
+  "com_scope_priority_change_label": "Change priority",
+  "com_scope_priority_label": "Priority",
+  "com_scope_priority_invalid": "Enter a whole number.",
+  "com_scope_priority_range": "Enter a priority from 0 to {{max}}.",
+  "com_scope_priority_error": "Failed to change the priority",
   "com_scope_search_profiles": "Search profiles…",
   "com_scope_skip_base_scope": "applies to everyone, so it can only be set in the Base configuration",
   "com_scope_skip_inherited_value": "set in Base; a profile can only remove its own override",
@@ -2822,6 +2853,11 @@
   "com_scope_tie_conflict_other": "Same priority as {{names}}, and both change {{count}} settings. For users in both, which value applies is not defined.",
   "com_scope_tie_note": "Same priority as {{names}}; they don't change the same settings.",
   "com_scope_tie_short": "Same priority as {{names}}, and both change the same settings",
+  "com_scope_tie_order_wins_one": "Same priority as {{names}}, and both change {{count}} setting. For users in both, this profile applies last, so its value wins.",
+  "com_scope_tie_order_wins_other": "Same priority as {{names}}, and both change {{count}} settings. For users in both, this profile applies last, so its values win.",
+  "com_scope_tie_order_loses_one": "Same priority as {{names}}, and both change {{count}} setting. For users in both, they apply after this profile, so their value wins.",
+  "com_scope_tie_order_loses_other": "Same priority as {{names}}, and both change {{count}} settings. For users in both, they apply after this profile, so their values win.",
+  "com_scope_tie_order_rule": "On equal priority, LibreChat applies roles, then groups, then users; profiles of the same kind apply in the order they were created.",
   "com_scope_active_option": "Active: {{name}}",
   "com_scope_toggle_error": "Failed to change whether the profile is active",
   "com_scope_type_group": "Group",
diff --git a/src/server/config/meta.test.ts b/src/server/config/meta.test.ts
index 169731bd..bbe87042 100644
--- a/src/server/config/meta.test.ts
+++ b/src/server/config/meta.test.ts
@@ -87,6 +87,36 @@ describe('readConfigContract', () => {
     expect(contract.rules.arrayMergeKeys).toEqual(BUNDLED_CONFIG_RULES.arrayMergeKeys);
   });
 
+  it('reads deployment-only paths, an unknown reason as an operator boundary', async () => {
+    apiFetchMock.mockResolvedValue(
+      reply(200, {
+        features: { writeReport: true, issueParams: true },
+        rules: {
+          deploymentOnlyPaths: {
+            rateLimits: 'operator',
+            'endpoints.agents.eventDriven': 'startup',
+            cache: 'unused',
+            futurePath: 'scheduled',
+          },
+        },
+      }),
+    );
+    const contract = await readConfigContract();
+    expect(contract.features).toMatchObject({ writeReport: true, issueParams: true });
+    expect(contract.rules.deploymentOnlyPaths).toEqual({
+      rateLimits: 'operator',
+      'endpoints.agents.eventDriven': 'startup',
+      cache: 'unused',
+      futurePath: 'operator',
+    });
+  });
+
+  it('keeps the bundled deployment-only paths for a server that does not list them', async () => {
+    apiFetchMock.mockResolvedValue(reply(200, META));
+    const contract = await readConfigContract();
+    expect(contract.rules.deploymentOnlyPaths).toBe(BUNDLED_CONFIG_RULES.deploymentOnlyPaths);
+  });
+
   it('treats a reply that is not an object as no contract', async () => {
     apiFetchMock.mockResolvedValue(new Response('"ok"', { status: 200 }));
     await expect(readConfigContract()).resolves.toBe(BUNDLED_CONFIG_CONTRACT);
diff --git a/src/server/config/meta.ts b/src/server/config/meta.ts
index 8be121a1..3f0f9713 100644
--- a/src/server/config/meta.ts
+++ b/src/server/config/meta.ts
@@ -14,12 +14,15 @@ const text = z.string();
 const names = z.array(z.string());
 const count = z.number().int().nonnegative();
 const nameMap = z.record(z.string(), z.string());
+/** A reason a newer server adds reads as an operator boundary: only librechat.yaml sets the path. */
+const deploymentReason = z.enum(['startup', 'operator', 'unused']).catch('operator');
 
 const rulesSchema = z.object({
   acceptedSections: lenient(names),
   baseOnlySections: lenient(names),
   basePrincipalSections: lenient(names),
   baseOnlyPaths: lenient(names),
+  deploymentOnlyPaths: lenient(z.record(z.string(), deploymentReason)),
   arrayMergeKeys: lenient(nameMap),
   atomicMergePaths: lenient(names),
   overrideKeyMap: lenient(nameMap),
diff --git a/src/server/config/save.test.ts b/src/server/config/save.test.ts
index f9e21637..2662c23a 100644
--- a/src/server/config/save.test.ts
+++ b/src/server/config/save.test.ts
@@ -518,3 +518,252 @@ describe('applyConfigChanges — the server contract (GET /api/admin/config/meta
     expect(api.current!.writes().map((request) => request.body?.entries?.length)).toEqual([2, 1]);
   });
 });
+
+describe('applyConfigChanges — write reports, structured issues and codes', () => {
+  const skippedPart = {
+    path: 'interface.prompts',
+    segments: ['interface', 'prompts'],
+    reason: 'interface_permission',
+  };
+  const skippedWhole = {
+    path: 'balance.refillAmount',
+    segments: ['balance', 'refillAmount'],
+    reason: 'deployment_only_path',
+  };
+
+  it('reports what the server did not store, counting only whole changes as not applied', async () => {
+    api.current!.reportMeta({ features: { writeReport: true } });
+    api.current!.reportWrites(() => ({ applied: [], skipped: [skippedWhole, skippedPart] }));
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'balance.startBalance', value: 5 },
+      { op: 'set', path: 'balance.refillAmount', value: 6 },
+    ]);
+    expect(result).toMatchObject({ issues: [], failed: [], applied: 1 });
+    expect(result.skipped).toEqual([
+      { fieldPath: 'balance.refillAmount', reason: 'yamlOnly' },
+      { fieldPath: 'interface.prompts', reason: 'permission' },
+    ]);
+  });
+
+  it('leaves the report alone on a server without writeReport', async () => {
+    api.current!.reportWrites(() => ({ skipped: [skippedWhole] }));
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'balance.refillAmount', value: 6 },
+    ]);
+    expect(result).toMatchObject({ applied: 1, skipped: [] });
+  });
+
+  it('reports a whole PATCH the server skipped, without a second not-stored finding', async () => {
+    api.current!.reportMeta({ features: { writeReport: true } });
+    api.current!.stripSection('balance');
+    api.current!.reportWrites((request) =>
+      request.method === 'PATCH' ? { applied: [], skipped: [skippedWhole] } : {},
+    );
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'balance.refillAmount', value: 6 },
+    ]);
+    expect(result).toMatchObject({ applied: 0 });
+    expect(result.skipped).toEqual([{ fieldPath: 'balance.refillAmount', reason: 'yamlOnly' }]);
+  });
+
+  it('reports a tombstone the server skipped', async () => {
+    api.current!.reportMeta({ features: { writeReport: true } });
+    api.current!.reportWrites((request) =>
+      request.path.endsWith('/tombstone')
+        ? { skipped: [{ path: 'balance.refillAmount', reason: 'deployment_only_path' }] }
+        : {},
+    );
+    const result = await applyConfigChanges(base, [
+      { op: 'tombstone', path: 'balance.refillAmount' },
+    ]);
+    expect(result.skipped).toEqual([{ fieldPath: 'balance.refillAmount', reason: 'yamlOnly' }]);
+    expect(result.applied).toBe(0);
+  });
+
+  it('reports a credential the merge leaves out once the server rebinds credentials', async () => {
+    const ignored = [
+      {
+        path: 'endpoints.custom.Moonshot.apiKey',
+        segments: ['endpoints', 'custom', 'Moonshot', 'apiKey'],
+        reason: 'secret_rebinding',
+      },
+    ];
+    api.current!.reportWrites(() => ({ ignored }));
+    const moonshot = customEntries[0];
+    const change = upsert(
+      'Moonshot',
+      'Moonshot',
+      { ...moonshot, baseURL: 'https://proxy.example.com/v1' },
+      moonshot,
+    );
+    expect((await applyConfigChanges(base, [change])).skipped).toEqual([]);
+    api.current = createFakeAdminApi(yaml);
+    api.current.reportMeta({ features: { secretRebinding: true } });
+    api.current.reportWrites(() => ({ ignored }));
+    const result = await applyConfigChanges(base, [change]);
+    expect(result).toMatchObject({ applied: 1, failed: [] });
+    expect(result.skipped).toEqual([
+      { fieldPath: 'endpoints.custom.Moonshot.apiKey', reason: 'secretRebinding' },
+    ]);
+    const unrelated = await applyConfigChanges(base, [
+      { op: 'set', path: 'balance.startBalance', value: 5 },
+    ]);
+    expect(unrelated).toMatchObject({ applied: 1, skipped: [] });
+  });
+
+  it("does not repeat a dropped credential on a later save of another endpoint's settings", async () => {
+    api.current!.reportMeta({ features: { secretRebinding: true } });
+    api.current!.reportWrites(() => ({
+      ignored: [
+        {
+          path: 'endpoints.custom.Moonshot.apiKey',
+          segments: ['endpoints', 'custom', 'Moonshot', 'apiKey'],
+          reason: 'secret_rebinding',
+        },
+      ],
+    }));
+    const [moonshot, gpt] = customEntries;
+    const title = await applyConfigChanges(base, [
+      { op: 'set', path: 'endpoints.openAI.titleModel', value: 'gpt-5-nano' },
+    ]);
+    expect(title).toMatchObject({ applied: 1, failed: [], skipped: [] });
+    const other = await applyConfigChanges(base, [
+      upsert('GPT', 'GPT', { ...gpt, titleModel: 'gpt-4o-mini' }, gpt),
+    ]);
+    expect(other).toMatchObject({ applied: 1, failed: [], skipped: [] });
+    expect(api.current!.writes().at(-1)).toMatchObject({
+      body: { entries: [{ fieldPath: 'endpoints.custom' }] },
+    });
+    const same = await applyConfigChanges(base, [
+      upsert('Moonshot', 'Moonshot', { ...moonshot, titleModel: 'kimi-k2' }, moonshot),
+    ]);
+    expect(same.skipped).toEqual([
+      { fieldPath: 'endpoints.custom.Moonshot.apiKey', reason: 'secretRebinding' },
+    ]);
+  });
+
+  it('words a backend issue by its params on a server with issueParams', async () => {
+    const issue = {
+      path: 'balance.startBalance',
+      segments: ['balance', 'startBalance'],
+      code: 'too_small',
+      params: { minimum: 1, inclusive: true, exact: false, type: 'number' },
+    };
+    const refuse = (request: { method: string }) =>
+      request.method === 'PATCH'
+        ? { status: 400, body: { code: 'CONFIG_OVERRIDE_INVALID', issues: [issue] } }
+        : undefined;
+    api.current!.setOverride(refuse);
+    const before = await applyConfigChanges(base, [
+      { op: 'set', path: 'balance.startBalance', value: 0 },
+    ]);
+    expect(before.failed).toEqual([
+      { path: 'balance.startBalance', code: 'too_small', message: 'is too small' },
+    ]);
+    api.current!.reportMeta({ features: { issueParams: true } });
+    const after = await applyConfigChanges(base, [
+      { op: 'set', path: 'balance.startBalance', value: 0 },
+    ]);
+    expect(after.failed).toEqual([
+      {
+        path: 'balance.startBalance',
+        code: 'too_small',
+        message: 'must be at least 1',
+        params: { minimum: 1 },
+      },
+    ]);
+  });
+
+  it('locates an issue by its segments: a dotted record key stays one key', async () => {
+    const profiles = { 'us.anthropic.claude-sonnet-4-6': 'arn' };
+    api.current!.reportMeta({ features: { dottedKeys: true, issueParams: true } });
+    api.current!.setOverride((request) =>
+      request.method === 'PATCH'
+        ? {
+            status: 400,
+            body: {
+              code: 'CONFIG_OVERRIDE_INVALID',
+              issues: [
+                {
+                  path: 'endpoints.bedrock.inferenceProfiles.us.anthropic.claude-sonnet-4-6',
+                  segments: [
+                    'endpoints',
+                    'bedrock',
+                    'inferenceProfiles',
+                    'us.anthropic.claude-sonnet-4-6',
+                  ],
+                  code: 'too_small',
+                  params: { minimum: 20, inclusive: true, exact: false, type: 'string' },
+                },
+              ],
+            },
+          }
+        : undefined,
+    );
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'endpoints.bedrock.inferenceProfiles', value: profiles },
+    ]);
+    expect(result.issues).toEqual([]);
+    expect(result.failed).toEqual([
+      {
+        path: 'endpoints.bedrock.inferenceProfiles',
+        code: 'too_small_length',
+        message: 'must be at least 20 characters',
+        params: { minimum: 20 },
+      },
+    ]);
+  });
+
+  it('maps an entry issue by segments to the entry name', async () => {
+    api.current!.reportMeta({ features: { dottedKeys: true } });
+    api.current!.setOverride((request) =>
+      request.method === 'PATCH'
+        ? {
+            status: 400,
+            body: {
+              code: 'CONFIG_OVERRIDE_INVALID',
+              issues: [
+                {
+                  path: 'endpoints.custom.0.headers.x-portkey.config',
+                  segments: ['endpoints', 'custom', '0', 'headers', 'x-portkey.config'],
+                  code: 'invalid_type',
+                },
+              ],
+            },
+          }
+        : undefined,
+    );
+    const gpt = customEntries[1];
+    const result = await applyConfigChanges(base, [
+      upsert('GPT', 'GPT', { ...gpt, headers: { 'x-portkey.config': 'x' } }, gpt),
+    ]);
+    expect(result.failed).toEqual([
+      expect.objectContaining({ entryIdentity: 'GPT', entryPath: 'headers' }),
+    ]);
+  });
+
+  it("words a refused write by the admin API's code", async () => {
+    api.current!.setOverride((request) =>
+      request.method === 'PATCH'
+        ? {
+            status: 400,
+            body: {
+              error: 'Process-backed MCP servers are configured in librechat.yaml',
+              code: 'PROCESS_MCP_SERVER_OVERRIDE',
+            },
+          }
+        : undefined,
+    );
+    const result = await applyConfigChanges(base, [
+      { op: 'set', path: 'mcpServers.cloudflare.title', value: 'Cloudflare' },
+    ]);
+    expect(result.failed).toEqual([
+      {
+        path: 'mcpServers.cloudflare.title',
+        code: 'WRITE_FAILED',
+        message:
+          'This MCP server runs a local process defined in librechat.yaml, so LibreChat applies no overrides to it.',
+      },
+    ]);
+  });
+});
diff --git a/src/server/config/save.ts b/src/server/config/save.ts
index 7f0bcd79..51278e71 100644
--- a/src/server/config/save.ts
+++ b/src/server/config/save.ts
@@ -6,16 +6,21 @@ import type * as t from '@/types';
 import {
   verifyWrite,
   getEntryKey,
+  reportedPath,
   isConfigRecord,
   getValueAtPath,
+  readWriteReport,
+  createPathIndex,
+  describeApiError,
   planConfigChanges,
+  describeIssueCode,
   getKeyedCollection,
   getWriteSkipReason,
-  describeIssueCode,
-  paramlessIssueCode,
+  classifyReportedIssue,
   stripSecretPreviewValues,
 } from '@/utils';
 import {
+  getWriteRules,
   getConfigSection,
   MERGED_BACK_REASONS,
   TERMS_NOT_ACCEPTED_CODE,
@@ -110,7 +115,11 @@ async function readWriteSnapshot(target: t.WriteTargetRef): Promise<t.WriteSnaps
   return { ...own, lower, lowerKind: isBase ? 'yaml' : 'inherited' };
 }
 
-async function authorizeWrite(target: t.WriteTargetRef, ops: t.ConfigChange[]): Promise<void> {
+async function authorizeWrite(
+  target: t.WriteTargetRef,
+  ops: t.ConfigChange[],
+  rules: t.ConfigWriteRules,
+): Promise<void> {
   if (target.type === 'scope') {
     await requireAnyCapability([
       SystemCapabilities.ASSIGN_CONFIGS,
@@ -121,7 +130,7 @@ async function authorizeWrite(target: t.WriteTargetRef, ops: t.ConfigChange[]):
   const sections = [
     ...new Set(
       ops
-        .filter((op) => !getWriteSkipReason(op.path, op.op === 'reset'))
+        .filter((op) => !getWriteSkipReason(op.path, op.op === 'reset', rules))
         .map((op) => getConfigSection(op.path)),
     ),
   ];
@@ -147,35 +156,59 @@ function sanitizeOps(ops: t.ConfigChange[]): t.ConfigChange[] {
   });
 }
 
+/** Whether `segments` start with `prefix`. */
+function startsWith(segments: readonly string[], prefix: readonly string[]): boolean {
+  return prefix.length <= segments.length && prefix.every((segment, i) => segments[i] === segment);
+}
+
 /**
- * A rejected value the admin API reported by path. Paths index into the
- * array that was sent, so an index inside a keyed collection is mapped to the
- * identity of that sent entry. The admin API reports codes without their
- * parameters, so a code whose message needs one (`too_small`'s minimum) is
- * worded without it.
+ * A rejected value the admin API reported. Its location is read key by key
+ * where the server reports `segments` (`dottedKeys`), so a record key that
+ * holds a dot stays one key; the issue shows on that key's record. An index
+ * inside a keyed collection is mapped to the identity of that sent entry,
+ * since it indexes the array that was sent. With `issueParams` the issue's
+ * bounds and options word it ("must be at least 1"); without them a code
+ * whose message needs one (`too_small`'s minimum) is worded without it.
  */
-function attributeBackendIssue(path: string, code: string, batch: t.SaveEntry[]): t.ConfigIssue {
-  const message = describeIssueCode(paramlessIssueCode(code), undefined, 'is not a valid value');
-  const sent = batch.find(
-    ({ fieldPath }) => path === fieldPath || path.startsWith(`${fieldPath}.`),
-  );
+function attributeBackendIssue(
+  issue: t.ReportedIssue,
+  batch: t.SaveEntry[],
+  features: t.ConfigFeatures,
+): t.ConfigIssue {
+  const segments =
+    features.dottedKeys && Array.isArray(issue.segments)
+      ? issue.segments
+      : (issue.path ?? '').split('.');
+  const path = reportedPath({ path: issue.path, segments });
+  const params = features.issueParams ? issue.params : undefined;
+  const described = classifyReportedIssue(issue.code, params);
+  const message = describeIssueCode(described.code, described.params, 'is not a valid value');
+  const reported: t.ConfigIssue = {
+    path,
+    code: params ? described.code : issue.code,
+    message,
+    ...(described.params && { params: described.params }),
+  };
+  const sent = batch.find(({ fieldPath }) => startsWith(segments, fieldPath.split('.')));
   const collection = sent ? getKeyedCollection(sent.fieldPath) : undefined;
-  if (!sent || !collection || !Array.isArray(sent.value) || path === sent.fieldPath) {
-    return { path, code, message };
+  const depth = sent ? sent.fieldPath.split('.').length : 0;
+  if (!sent || !collection || !Array.isArray(sent.value) || segments.length === depth) {
+    return reported;
   }
-  const [index, ...rest] = path.slice(sent.fieldPath.length + 1).split('.');
+  const [index, ...rest] = segments.slice(depth);
   const identity = getEntryKey(sent.value[Number(index)], collection.key);
-  return { path, code, message, entryIdentity: identity, entryPath: rest.join('.') };
+  return { ...reported, entryIdentity: identity, entryPath: reportedPath({ segments: rest }) };
 }
 
 async function failureIssues(
   response: Response,
   path: string,
+  features: t.ConfigFeatures,
   batch: t.SaveEntry[] = [],
 ): Promise<t.ConfigIssue[]> {
-  const body = await readJson<t.PatchFieldsResponse>(response);
+  const body = await readJson<t.PatchFieldsResponse & { section?: string }>(response);
   if (Array.isArray(body.issues) && body.issues.length > 0) {
-    return body.issues.map((issue) => attributeBackendIssue(issue.path, issue.code, batch));
+    return body.issues.map((issue) => attributeBackendIssue(issue, batch, features));
   }
   if (body.code === TERMS_NOT_ACCEPTED_CODE) {
     return [
@@ -188,23 +221,51 @@ async function failureIssues(
     ];
   }
   const message =
-    body.error ?? body.message ?? `The admin API rejected the change (${response.status})`;
+    describeApiError(body) ??
+    body.error ??
+    body.message ??
+    `The admin API rejected the change (${response.status})`;
   return [{ path, code: 'WRITE_FAILED', message }];
 }
 
 interface WriteOutcome {
   writes: t.AppliedWrite[];
+  /** Writes that did not take effect: they are not counted as applied. */
   dropped: t.SkippedChange[];
+  /** Parts of an applied write the server reported it did not store, or stores without effect. */
+  reported: t.SkippedChange[];
   failure?: t.ConfigIssue[];
 }
 
+/**
+ * Files what a write's reply reports (`readWriteReport`, for the locations
+ * the save changes): a location the write addressed as a whole is `dropped`,
+ * a part of it only `reported`. Before `writeReport`, a PATCH's dropped
+ * entries are read from the stored sections (`findDroppedEntries`).
+ */
+function fileWriteReport(
+  outcome: WriteOutcome,
+  body: t.PatchFieldsResponse,
+  written: readonly string[],
+  features: t.ConfigFeatures,
+  changed: t.PathIndex,
+): void {
+  const whole = new Set(written);
+  for (const item of readWriteReport(body, features, changed)) {
+    (whole.has(item.fieldPath) ? outcome.dropped : outcome.reported).push(item);
+  }
+}
+
 /** Sets in PATCHes of at most the server's `maxPatchEntries` entries each. */
 async function patchFields(
   target: t.WriteTargetRef,
   entries: t.SaveEntry[],
   outcome: WriteOutcome,
-  maxEntries: number,
+  contract: t.ConfigContract,
+  changed: t.PathIndex,
 ): Promise<boolean> {
+  const { features } = contract;
+  const maxEntries = contract.limits.maxPatchEntries;
   const priority = target.type === 'base' ? { priority: 0 } : {};
   for (let i = 0; i < entries.length; i += maxEntries) {
     const batch = entries.slice(i, i + maxEntries);
@@ -213,19 +274,21 @@ async function patchFields(
       body: JSON.stringify({ entries: batch, ...priority }),
     });
     if (!response.ok) {
-      outcome.failure = await failureIssues(response, batch[0].fieldPath, batch);
+      outcome.failure = await failureIssues(response, batch[0].fieldPath, features, batch);
       return false;
     }
     const body = await readJson<t.PatchFieldsResponse>(response);
-    outcome.writes.push(
-      ...batch.map(({ fieldPath }) => ({ kind: 'set' as const, path: fieldPath })),
-    );
-    outcome.dropped.push(
-      ...findDroppedEntries(batch, body).map((fieldPath) => ({
-        fieldPath,
-        reason: 'notStored' as const,
-      })),
-    );
+    const paths = batch.map(({ fieldPath }) => fieldPath);
+    outcome.writes.push(...paths.map((path) => ({ kind: 'set' as const, path })));
+    if (!features.writeReport) {
+      outcome.dropped.push(
+        ...findDroppedEntries(batch, body).map((fieldPath) => ({
+          fieldPath,
+          reason: 'notStored' as const,
+        })),
+      );
+    }
+    fileWriteReport(outcome, body, paths, features, changed);
   }
   return true;
 }
@@ -251,14 +314,20 @@ async function writeFieldOps(
   kind: Exclude<t.AppliedWrite['kind'], 'set'>,
   paths: string[],
   outcome: WriteOutcome,
+  features: t.ConfigFeatures,
+  changed: t.PathIndex,
 ): Promise<boolean> {
   for (const path of paths) {
     const response = await fieldRequest(target, kind, path);
     if (!response.ok && !(response.status === 404 && kind !== 'tombstone')) {
-      outcome.failure = await failureIssues(response, path);
+      outcome.failure = await failureIssues(response, path, features);
       return false;
     }
     outcome.writes.push({ kind, path });
+    if (response.ok) {
+      const body = await readJson<t.PatchFieldsResponse>(response);
+      fileWriteReport(outcome, body, [path], features, changed);
+    }
   }
   return true;
 }
@@ -277,12 +346,14 @@ async function executePlan(
   plan: t.WritePlan,
   contract: t.ConfigContract,
 ): Promise<WriteOutcome> {
-  const outcome: WriteOutcome = { writes: [], dropped: [] };
+  const outcome: WriteOutcome = { writes: [], dropped: [], reported: [] };
+  const { features } = contract;
+  const changed = createPathIndex(plan.changed);
   const steps = [
-    () => writeFieldOps(target, 'tombstone', plan.tombstones, outcome),
-    () => patchFields(target, plan.sets, outcome, contract.limits.maxPatchEntries),
-    () => writeFieldOps(target, 'reset', plan.resets, outcome),
-    () => writeFieldOps(target, 'untombstone', plan.untombstones, outcome),
+    () => writeFieldOps(target, 'tombstone', plan.tombstones, outcome, features, changed),
+    () => patchFields(target, plan.sets, outcome, contract, changed),
+    () => writeFieldOps(target, 'reset', plan.resets, outcome, features, changed),
+    () => writeFieldOps(target, 'untombstone', plan.untombstones, outcome, features, changed),
   ];
   try {
     for (const step of steps) {
@@ -392,9 +463,11 @@ export async function applyConfigChanges(
   target: t.WriteTargetRef,
   ops: t.ConfigChange[],
 ): Promise<t.ApplyConfigChangesResult> {
-  await authorizeWrite(target, ops);
-  const [snapshot, contract] = await Promise.all([readWriteSnapshot(target), readConfigContract()]);
-  const plan = planConfigChanges(sanitizeOps(ops), snapshot, contract.features);
+  const contract = await readConfigContract();
+  const rules = getWriteRules(contract);
+  await authorizeWrite(target, ops, rules);
+  const snapshot = await readWriteSnapshot(target);
+  const plan = planConfigChanges(sanitizeOps(ops), snapshot, contract.features, rules);
   const result: t.ApplyConfigChangesResult = {
     applied: 0,
     failed: [],
@@ -408,7 +481,14 @@ export async function applyConfigChanges(
     const compensated = await compensate(target, outcome.writes, snapshot.stored);
     return { ...result, failed: outcome.failure, compensated };
   }
-  const notEffective = [...outcome.dropped, ...(await verifyTarget(target, plan, snapshot))];
+  const reportedPaths = new Set(
+    [...outcome.dropped, ...outcome.reported].map((item) => item.fieldPath),
+  );
+  /** What the server reported is worded by its reasons; a read-back finding at the same path is the same change. */
+  const verified = (await verifyTarget(target, plan, snapshot)).filter(
+    (item) => !reportedPaths.has(item.fieldPath),
+  );
+  const notEffective = [...outcome.dropped, ...verified];
   const lost = new Set(
     notEffective
       .filter((item) => !MERGED_BACK_REASONS.has(item.reason))
@@ -417,7 +497,7 @@ export async function applyConfigChanges(
   return {
     ...result,
     applied: Math.max(0, plan.effective - lost.size),
-    skipped: [...plan.skipped, ...notEffective],
+    skipped: [...plan.skipped, ...notEffective, ...outcome.reported],
   };
 }
 
diff --git a/src/server/scopes/read.test.ts b/src/server/scopes/read.test.ts
index 24a42f7e..dcfa0264 100644
--- a/src/server/scopes/read.test.ts
+++ b/src/server/scopes/read.test.ts
@@ -1,5 +1,12 @@
 import { PrincipalType } from 'librechat-data-provider';
 import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type * as t from '@/types';
+import { describeApiError } from '@/utils';
+
+/** The API client's error wording, without its session layer. */
+function apiErrorBodyMessage(body: t.ApiErrorBody, status: number, fallback: string): string {
+  return describeApiError(body) ?? body.error ?? body.message ?? `${fallback}: ${status}`;
+}
 
 interface FakeResponse {
   ok: boolean;
@@ -20,7 +27,10 @@ function reply(status: number, body: object): FakeResponse {
   return { ok: status >= 200 && status < 300, status, json: async () => body };
 }
 
-vi.mock('../utils/api', () => ({
+vi.mock('../utils/api', async () => ({
+  apiErrorMessage: async (response: Response, fallback: string) =>
+    apiErrorBodyMessage(await response.json(), response.status, fallback),
+  apiErrorBodyMessage,
   apiFetch: vi.fn(async (url: string, init?: { method?: string; body?: string }) => {
     const call = { url, method: init?.method ?? 'GET', body: init?.body };
     calls.push(call);
@@ -45,7 +55,7 @@ vi.mock('@tanstack/react-start', () => ({
   }),
 }));
 
-import { createScopeFn, getAvailableScopesFn } from './read';
+import { createScopeFn, setScopePriorityFn, getAvailableScopesFn } from './read';
 
 const BOB = '6ac3e10890468262c2267093';
 const ENG = '6ac3e10d90468262c22670b0';
@@ -238,3 +248,115 @@ describe('createScopeFn', () => {
     expect(scope).toMatchObject({ _id: 'c-eng', priority: 20, isActive: false });
   });
 });
+
+describe('createScopeFn with expectedRevision', () => {
+  const created = (call: FakeCall): [number, object] => [
+    201,
+    {
+      config: {
+        _id: 'new',
+        principalType: 'role',
+        principalId: 'EDITORS',
+        priority: JSON.parse(call.body ?? '{}').priority,
+        isActive: true,
+        overrides: {},
+      },
+    },
+  ];
+  const meta = (features: Record<string, boolean>) =>
+    routes.push([/^GET \/api\/admin\/config\/meta$/, () => [200, { features }]]);
+
+  it('creates the profile with one create-only PUT, without reading it or the role first', async () => {
+    meta({ expectedRevision: true, principalCheck: true });
+    routes.push([/^PUT \/api\/admin\/config\/role\/EDITORS$/, created]);
+    const { scope } = await createScopeFn({
+      data: { principalType: PrincipalType.ROLE, principalId: 'EDITORS', name: 'EDITORS' },
+    });
+    expect(scope).toMatchObject({ _id: 'new', priority: 10 });
+    expect(calls.map((c) => `${c.method} ${c.url}`)).toEqual([
+      'GET /api/admin/config/meta',
+      'PUT /api/admin/config/role/EDITORS',
+    ]);
+    expect(JSON.parse(calls[1].body ?? '{}')).toEqual({
+      overrides: {},
+      priority: 10,
+      expectedRevision: 'absent',
+    });
+  });
+
+  it('opens the profile someone created meanwhile instead of replacing it (409)', async () => {
+    meta({ expectedRevision: true, principalCheck: true });
+    routes.push([
+      /^PUT /,
+      () => [409, { code: 'CONFIG_VERSION_CONFLICT', currentRevision: 'c-eng:3' }],
+    ]);
+    routes.push([/^GET \/api\/admin\/config\/group\//, () => [200, { config: configs[2] }]]);
+    const { scope } = await createScopeFn({
+      data: { principalType: PrincipalType.GROUP, principalId: ENG, name: 'Engineering' },
+    });
+    expect(scope).toMatchObject({ _id: 'c-eng', priority: 20 });
+    expect(calls.filter((c) => c.method === 'PUT')).toHaveLength(1);
+  });
+
+  it('says the role does not exist when the server refuses the principal', async () => {
+    meta({ expectedRevision: true, principalCheck: true });
+    routes.push([
+      /^PUT /,
+      () => [404, { error: 'Principal not found', code: 'PRINCIPAL_NOT_FOUND' }],
+    ]);
+    await expect(
+      createScopeFn({
+        data: { principalType: PrincipalType.ROLE, principalId: 'GONE', name: 'GONE' },
+      }),
+    ).rejects.toThrow('There is no role named "GONE"');
+    await expect(
+      createScopeFn({ data: { principalType: PrincipalType.GROUP, principalId: ENG, name: 'E' } }),
+    ).rejects.toThrow(/doesn't exist/);
+  });
+
+  it('still looks the role up first on a server without the principal check', async () => {
+    meta({ expectedRevision: true });
+    await expect(
+      createScopeFn({
+        data: { principalType: PrincipalType.ROLE, principalId: 'NO_SUCH_ROLE', name: 'X' },
+      }),
+    ).rejects.toThrow('There is no role named "NO_SUCH_ROLE"');
+    expect(calls.some((c) => c.method === 'PUT')).toBe(false);
+  });
+});
+
+describe('setScopePriorityFn', () => {
+  it('sets only the priority through the priority route', async () => {
+    routes.push([
+      /^PATCH \/api\/admin\/config\/group\/[^/]+\/priority$/,
+      (call) => [
+        200,
+        { config: { ...configs[2], priority: JSON.parse(call.body ?? '{}').priority } },
+      ],
+    ]);
+    await expect(
+      setScopePriorityFn({
+        data: { principalType: PrincipalType.GROUP, principalId: ENG, priority: 15 },
+      }),
+    ).resolves.toEqual({ priority: 15 });
+    expect(calls).toEqual([
+      {
+        url: `/api/admin/config/group/${ENG}/priority`,
+        method: 'PATCH',
+        body: JSON.stringify({ priority: 15 }),
+      },
+    ]);
+  });
+
+  it("words the server's refusal", async () => {
+    routes.push([
+      /^PATCH /,
+      () => [400, { error: 'priority must be a non-negative number', code: 'INVALID_PRIORITY' }],
+    ]);
+    await expect(
+      setScopePriorityFn({
+        data: { principalType: PrincipalType.GROUP, principalId: ENG, priority: 15 },
+      }),
+    ).rejects.toThrow('The priority must be a number of 0 or more.');
+  });
+});
diff --git a/src/server/scopes/read.ts b/src/server/scopes/read.ts
index 49617787..d0d6b270 100644
--- a/src/server/scopes/read.ts
+++ b/src/server/scopes/read.ts
@@ -11,11 +11,12 @@ import type {
 import type * as t from '@/types';
 import { collectOverridePaths, scopeOverrideEntries, stripSecretPreviewValues } from '@/utils';
 import { normalizeAppServiceKeys } from '../config/normalize';
-import { apiErrorMessage, apiFetch } from '../utils/api';
+import { apiErrorBodyMessage, apiErrorMessage, apiFetch } from '../utils/api';
 import { BASE_CONFIG_PRINCIPAL_ID } from '../constants';
-import { requireAnyCapability } from '../capabilities';
-import { DEFAULT_SCOPE_PRIORITY } from '@/constants';
+import { requireCapability, requireAnyCapability } from '../capabilities';
+import { MAX_SCOPE_PRIORITY, DEFAULT_SCOPE_PRIORITY } from '@/constants';
 import { getSchemaPathSet } from '../config/schema';
+import { readConfigContract } from '../config/meta';
 import { deepGet } from './paths';
 
 /** The admin list endpoints return at most this many items per page. */
@@ -238,10 +239,96 @@ export const fieldProfileValuesOptions = (fieldPath: string) =>
     queryFn: () => getFieldProfileValuesFn({ data: { fieldPath } }).then((r) => r.values),
   });
 
+/** `expectedRevision` that makes a PUT create the profile only when the principal has none. */
+const ABSENT_REVISION = 'absent';
+
+/** The admin API's codes for a create-only PUT the principal already has a profile for, or has none. */
+const VERSION_CONFLICT_CODE = 'CONFIG_VERSION_CONFLICT';
+const PRINCIPAL_NOT_FOUND_CODE = 'PRINCIPAL_NOT_FOUND';
+
+function missingRoleMessage(principalId: string): string {
+  return `There is no role named "${principalId}"`;
+}
+
+/** A created or existing profile's document from a reply, or an error when it carries none. */
+async function readConfigDoc(response: Response): Promise<t.ScopeConfigDoc> {
+  const body = (await response.json()) as AdminConfigResponse | { message?: string };
+  const config = 'config' in body ? body.config : undefined;
+  if (!config?._id) {
+    throw new Error(
+      'Backend did not return a config document. The scope may not have been created.',
+    );
+  }
+  return config;
+}
+
+/**
+ * Before `expectedRevision`: reads the principal's profile and returns it
+ * when there is one, else checks that a role exists (the admin API would
+ * create a profile for any name) and creates the profile with a PUT. A
+ * profile created by someone else between the read and the PUT is
+ * overwritten with an empty one.
+ */
+async function createScopeLegacy(
+  url: string,
+  data: t.CreateScopeInput,
+  principalId: string,
+  priority: number,
+): Promise<t.ScopeConfigDoc> {
+  const existing = await apiFetch(url);
+  if (existing.ok) return ((await existing.json()) as AdminConfigResponse).config;
+  if (data.principalType === PrincipalType.ROLE) {
+    const role = await apiFetch(`/api/admin/roles/${encodeURIComponent(principalId)}`);
+    if (role.status === 404) throw new Error(missingRoleMessage(principalId));
+  }
+  const response = await apiFetch(url, {
+    method: 'PUT',
+    body: JSON.stringify({ overrides: {}, priority }),
+  });
+  if (!response.ok) throw new Error(await apiErrorMessage(response, 'Failed to create scope'));
+  return readConfigDoc(response);
+}
+
+/**
+ * With `expectedRevision`: one create-only PUT (`expectedRevision: 'absent'`),
+ * so a profile created meanwhile is never overwritten; when one exists
+ * (409) it is read and returned. With `principalCheck` the admin API refuses
+ * a principal that doesn't exist (404 `PRINCIPAL_NOT_FOUND`), so the role
+ * is not looked up first.
+ */
+async function createScopeOnce(
+  url: string,
+  data: t.CreateScopeInput,
+  principalId: string,
+  priority: number,
+  principalCheck: boolean,
+): Promise<t.ScopeConfigDoc> {
+  if (!principalCheck && data.principalType === PrincipalType.ROLE) {
+    const role = await apiFetch(`/api/admin/roles/${encodeURIComponent(principalId)}`);
+    if (role.status === 404) throw new Error(missingRoleMessage(principalId));
+  }
+  const response = await apiFetch(url, {
+    method: 'PUT',
+    body: JSON.stringify({ overrides: {}, priority, expectedRevision: ABSENT_REVISION }),
+  });
+  if (response.ok) return readConfigDoc(response);
+  const body = (await response.json().catch(() => ({}))) as t.ApiErrorBody;
+  if (response.status === 409 && body.code === VERSION_CONFLICT_CODE) {
+    const existing = await apiFetch(url);
+    if (existing.ok) return ((await existing.json()) as AdminConfigResponse).config;
+  }
+  if (body.code === PRINCIPAL_NOT_FOUND_CODE && data.principalType === PrincipalType.ROLE) {
+    throw new Error(missingRoleMessage(principalId));
+  }
+  throw new Error(apiErrorBodyMessage(body, response.status, 'Failed to create scope'));
+}
+
 /**
  * Create a profile for a role, group or user. The priority defaults to
  * `DEFAULT_SCOPE_PRIORITY` for the principal type. When the principal already
- * has a profile it is returned as is, so creating never replaces overrides.
+ * has a profile it is returned as is, so creating never replaces overrides:
+ * atomically on a server with `expectedRevision` (`createScopeOnce`), else
+ * by reading first (`createScopeLegacy`).
  */
 export const createScopeFn = createServerFn({ method: 'POST' })
   .inputValidator(
@@ -262,64 +349,62 @@ export const createScopeFn = createServerFn({ method: 'POST' })
         path: ['principalId'],
       }),
   )
-  .handler(
-    async ({
-      data,
-    }: {
-      data: {
-        principalType: PrincipalType;
-        name: string;
-        priority?: number;
-        principalId?: string;
-        email?: string;
-      };
-    }) => {
-      await requireAnyCapability([
-        SystemCapabilities.ASSIGN_CONFIGS,
-        SystemCapabilities.MANAGE_CONFIGS,
-      ]);
-      const principalId =
-        data.principalId ??
-        (data.principalType === PrincipalType.ROLE
-          ? data.name.toLowerCase().replace(/\s+/g, '_')
-          : `grp_${data.name.toLowerCase().replace(/\s+/g, '_')}`);
-      const url = `/api/admin/config/${data.principalType}/${encodeURIComponent(principalId)}`;
-      const toScope = (config: t.ScopeConfigDoc): t.ConfigScope => ({
+  .handler(async ({ data }: { data: t.CreateScopeInput }) => {
+    await requireAnyCapability([
+      SystemCapabilities.ASSIGN_CONFIGS,
+      SystemCapabilities.MANAGE_CONFIGS,
+    ]);
+    const principalId =
+      data.principalId ??
+      (data.principalType === PrincipalType.ROLE
+        ? data.name.toLowerCase().replace(/\s+/g, '_')
+        : `grp_${data.name.toLowerCase().replace(/\s+/g, '_')}`);
+    const url = `/api/admin/config/${data.principalType}/${encodeURIComponent(principalId)}`;
+    const priority =
+      data.priority ?? DEFAULT_SCOPE_PRIORITY[data.principalType as t.ScopePrincipalType];
+    const { features } = await readConfigContract();
+    const config = features.expectedRevision
+      ? await createScopeOnce(url, data, principalId, priority, features.principalCheck)
+      : await createScopeLegacy(url, data, principalId, priority);
+    return {
+      scope: {
         ...apiConfigToScope(config),
         name: data.name,
         ...(data.email && { email: data.email }),
         ...(data.principalType === PrincipalType.GROUP && { memberCount: 0 }),
-      });
-
-      const existing = await apiFetch(url);
-      if (existing.ok) {
-        const { config } = (await existing.json()) as AdminConfigResponse;
-        return { scope: toScope(config) };
-      }
-      if (data.principalType === PrincipalType.ROLE) {
-        const role = await apiFetch(`/api/admin/roles/${encodeURIComponent(principalId)}`);
-        if (role.status === 404) throw new Error(`There is no role named "${principalId}"`);
-      }
-
-      const priority =
-        data.priority ?? DEFAULT_SCOPE_PRIORITY[data.principalType as t.ScopePrincipalType];
-      const response = await apiFetch(url, {
-        method: 'PUT',
-        body: JSON.stringify({ overrides: {}, priority }),
-      });
+      },
+    };
+  });
 
+/**
+ * Sets only a profile's priority (`priorityRoute`, D6): its overrides,
+ * hidden settings and active state stay as stored. Broad `manage:configs`
+ * only, like every priority change.
+ */
+export const setScopePriorityFn = createServerFn({ method: 'POST' })
+  .inputValidator(
+    z.object({
+      principalType: z.nativeEnum(PrincipalType),
+      principalId: z.string().min(1),
+      priority: z.number().int().min(0).max(MAX_SCOPE_PRIORITY),
+    }),
+  )
+  .handler(
+    async ({
+      data,
+    }: {
+      data: { principalType: PrincipalType; principalId: string; priority: number };
+    }) => {
+      await requireCapability(SystemCapabilities.MANAGE_CONFIGS);
+      const response = await apiFetch(
+        `/api/admin/config/${data.principalType}/${encodeURIComponent(data.principalId)}/priority`,
+        { method: 'PATCH', body: JSON.stringify({ priority: data.priority }) },
+      );
       if (!response.ok) {
-        throw new Error(await apiErrorMessage(response, 'Failed to create scope'));
-      }
-
-      const body = (await response.json()) as AdminConfigResponse | { message?: string };
-      const config = 'config' in body ? body.config : undefined;
-      if (!config?._id) {
-        throw new Error(
-          'Backend did not return a config document. The scope may not have been created.',
-        );
+        throw new Error(await apiErrorMessage(response, 'Failed to change the priority'));
       }
-      return { scope: toScope(config) };
+      const config = await readConfigDoc(response);
+      return { priority: config.priority };
     },
   );
 
diff --git a/src/server/utils/api.ts b/src/server/utils/api.ts
index 135e61ab..504bcd06 100644
--- a/src/server/utils/api.ts
+++ b/src/server/utils/api.ts
@@ -1,6 +1,8 @@
+import type * as t from '@/types';
 import { ensureFreshBearer, refreshOn401 } from './refresh';
 import { getApiBaseUrl, getServerApiUrl } from './url';
 import { TERMS_NOT_ACCEPTED_CODE } from '@/constants';
+import { describeApiError } from '@/utils';
 
 /** Skew window: refresh proactively when the bearer is within this of expiry. */
 const PROACTIVE_REFRESH_SKEW_MS = 30_000;
@@ -46,19 +48,27 @@ export async function apiFetch(path: string, init?: RequestInit): Promise<Respon
 }
 
 /**
- * The message of a failed API response: its `{ error }` or `{ message }`, else
- * `fallback` with the status. LibreChat's refusal until the admin accepts its
- * terms of service becomes `terms_not_accepted <LibreChat URL>`, which the
- * panel explains (with where to accept them) instead of a bare 403.
+ * The message of a failed API response: the panel's wording of its stable
+ * `code` (`describeApiError`: a missing principal, a version conflict, a
+ * section the admin may not manage, …), else its `{ error }` or
+ * `{ message }`, else `fallback` with the status. LibreChat's refusal until
+ * the admin accepts its terms of service becomes `terms_not_accepted
+ * <LibreChat URL>`, which the panel explains (with where to accept them)
+ * instead of a bare 403.
  */
 export async function apiErrorMessage(response: Response, fallback: string): Promise<string> {
-  const body = (await response.json().catch(() => ({}))) as {
-    error?: string;
-    message?: string;
-    code?: string;
-  };
+  const body = (await response.json().catch(() => ({}))) as t.ApiErrorBody;
+  return apiErrorBodyMessage(body, response.status, fallback);
+}
+
+/** `apiErrorMessage` for a reply whose body was already read. */
+export function apiErrorBodyMessage(
+  body: t.ApiErrorBody,
+  status: number,
+  fallback: string,
+): string {
   if (body.code === TERMS_NOT_ACCEPTED_CODE) return `${TERMS_NOT_ACCEPTED_CODE} ${getApiBaseUrl()}`;
-  return body.error ?? body.message ?? `${fallback}: ${response.status}`;
+  return describeApiError(body) ?? body.error ?? body.message ?? `${fallback}: ${status}`;
 }
 
 /** Throws the message of a failed API response (see `apiErrorMessage`). */
diff --git a/src/test/admin.ts b/src/test/admin.ts
index 38388135..a3270b84 100644
--- a/src/test/admin.ts
+++ b/src/test/admin.ts
@@ -19,6 +19,9 @@ interface FakeDoc {
   tombstones: string[];
 }
 
+/** What a write's reply adds to the stored document (a write report, ignored credentials). */
+export type FakeWriteReport = (request: FakeAdminRequest) => Partial<t.PatchFieldsResponse>;
+
 /** Replies the test wants instead of the default behaviour (return undefined to fall through). */
 export type FakeAdminOverride = (
   request: FakeAdminRequest,
@@ -57,6 +60,7 @@ export function createFakeAdminApi(yaml: t.ConfigRecord) {
   const requests: FakeAdminRequest[] = [];
   const strippedSections = new Set<string>();
   let override: FakeAdminOverride | undefined;
+  let report: FakeWriteReport | undefined;
   let meta: t.AdminConfigMetaBody | undefined;
 
   const docKey = (principalType: string, principalId: string) =>
@@ -65,6 +69,10 @@ export function createFakeAdminApi(yaml: t.ConfigRecord) {
   const reply = (status: number, body: unknown) =>
     ({ ok: status >= 200 && status < 300, status, json: async () => body }) as Response;
 
+  /** A successful write's reply, with what the test's write report adds. */
+  const written = (request: FakeAdminRequest, body: object) =>
+    reply(200, { ...body, ...report?.(request) });
+
   function encryptSecrets(value: t.ConfigValue, existing: t.ConfigValue): t.ConfigValue {
     if (Array.isArray(value)) {
       const previous = Array.isArray(existing) ? existing : [];
@@ -135,7 +143,7 @@ export function createFakeAdminApi(yaml: t.ConfigRecord) {
         overrides: removeValueAtPath(current.overrides, fieldPath),
         tombstones: [...new Set([...current.tombstones, fieldPath])],
       });
-      return reply(200, { config: docs.get(key) });
+      return written(request, { config: docs.get(key) });
     }
     if (method === 'DELETE') {
       if (!doc) return reply(404, { error: 'Config not found' });
@@ -144,24 +152,25 @@ export function createFakeAdminApi(yaml: t.ConfigRecord) {
         overrides: removeValueAtPath(doc.overrides, fieldPath),
         tombstones: doc.tombstones.filter((p) => p !== fieldPath && !p.startsWith(`${fieldPath}.`)),
       });
-      return reply(200, { config: redact(docs.get(key)!.overrides) });
+      return written(request, { config: redact(docs.get(key)!.overrides) });
     }
     let overrides = current.overrides;
     const entries = (body?.entries ?? []).filter(
       (entry: t.SaveEntry) => !strippedSections.has(entry.fieldPath.split('.')[0]),
     );
-    if (entries.length === 0)
-      return reply(200, { message: 'No actionable field entries provided' });
+    if (entries.length === 0) {
+      return written(request, { message: 'No actionable field entries provided' });
+    }
     for (const entry of entries) {
       const existing = getValueAtPath(current.overrides, entry.fieldPath);
       overrides = setValueAtPath(overrides, entry.fieldPath, encryptSecrets(entry.value, existing));
     }
-    const written = (body?.entries ?? []).map((e: t.SaveEntry) => e.fieldPath);
+    const paths = (body?.entries ?? []).map((e: t.SaveEntry) => e.fieldPath);
     docs.set(key, {
       overrides,
-      tombstones: current.tombstones.filter((p) => !written.includes(p)),
+      tombstones: current.tombstones.filter((p) => !paths.includes(p)),
     });
-    return reply(200, { config: { overrides: redact(overrides) } });
+    return written(request, { config: { overrides: redact(overrides) } });
   }
 
   return {
@@ -177,6 +186,10 @@ export function createFakeAdminApi(yaml: t.ConfigRecord) {
     setOverride: (next?: FakeAdminOverride) => {
       override = next;
     },
+    /** Adds a write report (`applied`, `skipped`, `ignored`) to each successful write's reply. */
+    reportWrites: (next?: FakeWriteReport) => {
+      report = next;
+    },
     /** Serves `GET /api/admin/config/meta` (a server with the contract); unset, it answers 404 like an older server. */
     reportMeta: (body?: t.AdminConfigMetaBody) => {
       meta = body;
diff --git a/src/test/fixtures.ts b/src/test/fixtures.ts
index 09ff5a53..ff1b0cb2 100644
--- a/src/test/fixtures.ts
+++ b/src/test/fixtures.ts
@@ -1,4 +1,5 @@
 import type * as t from '@/types';
+import { BUNDLED_CONFIG_CONTRACT } from '@/constants';
 
 export function createField(overrides: Partial<t.SchemaField> & { key: string }): t.SchemaField {
   return {
@@ -12,3 +13,19 @@ export function createField(overrides: Partial<t.SchemaField> & { key: string })
     ...overrides,
   };
 }
+
+/**
+ * The contract of a server that reports `GET /api/admin/config/meta`, with
+ * the given features on and rules changed; every other part is the bundled one.
+ */
+export function createServerContract(
+  features: Partial<t.ConfigFeatures> = {},
+  rules: Partial<t.ConfigRules> = {},
+): t.ConfigContract {
+  return {
+    source: 'server',
+    features: { ...BUNDLED_CONFIG_CONTRACT.features, ...features },
+    limits: BUNDLED_CONFIG_CONTRACT.limits,
+    rules: { ...BUNDLED_CONFIG_CONTRACT.rules, ...rules },
+  };
+}
diff --git a/src/test/page.tsx b/src/test/page.tsx
index 5115c9cd..5901f7a9 100644
--- a/src/test/page.tsx
+++ b/src/test/page.tsx
@@ -16,6 +16,8 @@ import { extractSchemaTree, extractSchemaDefaults } from '@/server/config';
 import { CollectionEditsContext } from '@/contexts/CollectionEditsContext';
 import { buildConfigChanges } from '@/components/configuration/edits';
 import { collectFieldPaths } from '@/components/configuration/counts';
+import { BUNDLED_CONFIG_CONTRACT, getWriteRules } from '@/constants';
+import { ConfigContractContext } from '@/contexts/ContractContext';
 import { ConfigTabContent } from '@/components/configuration';
 import { ExpandContext } from '@/contexts/ExpandContext';
 
@@ -54,6 +56,8 @@ export interface TabHarnessOptions {
   overrides?: t.ConfigRecord;
   /** Press "Expand all" once rendered: every collapsible opens, lazily mounted ones too. */
   expandAll?: boolean;
+  /** The connected server's admin config contract; the bundled one (an older server) by default. */
+  contract?: t.ConfigContract;
 }
 
 export interface TabHarness {
@@ -68,7 +72,7 @@ interface HarnessProps extends Required<Omit<TabHarnessOptions, 'expandAll'>> {
   state: { edits: t.ConfigEditsState | null; plan: (() => t.WritePlan) | null };
 }
 
-function TabPage({ tab, tree, yaml, overrides, expandAll, state }: HarnessProps) {
+function TabPage({ tab, tree, yaml, overrides, expandAll, contract, state }: HarnessProps) {
   const schemaPathSet = useMemo(() => new Set(collectFieldPaths(tree)), [tree]);
   const config = useMemo(() => mergeScopeLayer(yaml, overrides), [yaml, overrides]);
   const layers = useMemo(
@@ -130,13 +134,14 @@ function TabPage({ tab, tree, yaml, overrides, expandAll, state }: HarnessProps)
       root: config,
       collections: edits.collectionEdits,
       visibility: edits.visibilityEdits,
+      writeRules: getWriteRules(contract),
     });
-    return planConfigChanges(changes.ops, {
-      stored: overrides,
-      tombstones: [],
-      lower: yaml,
-      lowerKind: 'yaml',
-    });
+    return planConfigChanges(
+      changes.ops,
+      { stored: overrides, tombstones: [], lower: yaml, lowerKind: 'yaml' },
+      contract.features,
+      getWriteRules(contract),
+    );
   };
 
   return (
@@ -181,17 +186,21 @@ export function renderTab({
   yaml = {},
   overrides = {},
   expandAll = false,
+  contract = BUNDLED_CONFIG_CONTRACT,
 }: TabHarnessOptions): TabHarness & ReturnType<typeof render> {
   const state: HarnessProps['state'] = { edits: null, plan: null };
   const result = render(
-    <TabPage
-      tab={tab}
-      tree={tree}
-      yaml={yaml}
-      overrides={overrides}
-      expandAll={expandAll}
-      state={state}
-    />,
+    <ConfigContractContext.Provider value={contract}>
+      <TabPage
+        tab={tab}
+        tree={tree}
+        yaml={yaml}
+        overrides={overrides}
+        expandAll={expandAll}
+        contract={contract}
+        state={state}
+      />
+    </ConfigContractContext.Provider>,
   );
   return {
     ...result,
diff --git a/src/test/sections.tsx b/src/test/sections.tsx
index 66b15b91..dd832168 100644
--- a/src/test/sections.tsx
+++ b/src/test/sections.tsx
@@ -15,7 +15,8 @@ import { extractSchemaTree, extractSchemaDefaults, getSchemaPathSet } from '@/se
 import { SECTION_META } from '@/components/configuration/configMeta';
 import { ConfigTabContent } from '@/components/configuration';
 import { runtimeDefaultAt } from '@/hooks/config/layers';
-import { READ_ONLY_CONFIG_SECTIONS } from '@/constants';
+import { ConfigContractContext } from '@/contexts/ContractContext';
+import { BUNDLED_CONFIG_CONTRACT, getWriteRules } from '@/constants';
 
 const TREE = extractSchemaTree(configSchema as t.ZodSchemaLike);
 const SCHEMA_DEFAULTS = flattenObject(
@@ -27,13 +28,15 @@ const SCHEMA_PATHS = getSchemaPathSet();
 export function tabSections(
   keys: string[],
   extraFields: Readonly<Record<string, t.SchemaField[]>> = {},
+  contract: t.ConfigContract = BUNDLED_CONFIG_CONTRACT,
 ): t.ConfigSectionConfig[] {
+  const { readOnlySections } = getWriteRules(contract);
   return keys.flatMap((key) => {
     const field = TREE.find((section) => section.key === key);
     if (!field) return [];
     const children = [...(field.children ?? []), ...(extraFields[key] ?? [])];
     const structured = (field.isObject || field.type === 'record') && children.length > 0;
-    const readOnlyReason = READ_ONLY_CONFIG_SECTIONS.get(key);
+    const readOnlyReason = readOnlySections.get(key);
     return [
       {
         id: key,
@@ -63,6 +66,8 @@ export interface SectionsHarnessOptions {
   showConfiguredOnly?: boolean;
   /** Fields a newer schema adds to a section, by section key. */
   extraFields?: Readonly<Record<string, t.SchemaField[]>>;
+  /** The server's admin config contract (the bundled one: an older server). */
+  contract?: t.ConfigContract;
 }
 
 /** Profile-mode (USER role) value layers over Base, built by the page's own code. */
@@ -108,6 +113,7 @@ export function SectionsHarness({
   profile,
   showConfiguredOnly,
   extraFields,
+  contract = BUNDLED_CONFIG_CONTRACT,
 }: SectionsHarnessOptions) {
   const base = baseLayers(yaml, overrides);
   const layers = profile ? profileLayers(base, profile) : base;
@@ -137,28 +143,30 @@ export function SectionsHarness({
     sections.map((key) => [key, { canView: true, canEdit: true }]),
   );
   return (
-    <ConfigTabContent
-      sections={tabSections(sections, extraFields)}
-      configValues={values}
-      editedValues={edited}
-      onFieldChange={stage}
-      onResetField={(path) => {
-        onReset?.(path);
-        stage(path, undefined);
-      }}
-      onDiscardField={discard}
-      readOnly={readOnly}
-      permissions={{ canView: true, canEdit: !readOnly }}
-      sectionPermissions={permissions}
-      configuredPaths={configured}
-      dbOverridePaths={new Set(collectLeafPaths(overrides))}
-      touchedPaths={new Set(Object.keys(edited))}
-      pendingResets={new Set()}
-      schemaDefaults={SCHEMA_DEFAULTS}
-      valueLayers={layers}
-      isEditingScope={profile != null}
-      showConfiguredOnly={showConfiguredOnly}
-    />
+    <ConfigContractContext.Provider value={contract}>
+      <ConfigTabContent
+        sections={tabSections(sections, extraFields, contract)}
+        configValues={values}
+        editedValues={edited}
+        onFieldChange={stage}
+        onResetField={(path) => {
+          onReset?.(path);
+          stage(path, undefined);
+        }}
+        onDiscardField={discard}
+        readOnly={readOnly}
+        permissions={{ canView: true, canEdit: !readOnly }}
+        sectionPermissions={permissions}
+        configuredPaths={configured}
+        dbOverridePaths={new Set(collectLeafPaths(overrides))}
+        touchedPaths={new Set(Object.keys(edited))}
+        pendingResets={new Set()}
+        schemaDefaults={SCHEMA_DEFAULTS}
+        valueLayers={layers}
+        isEditingScope={profile != null}
+        showConfiguredOnly={showConfiguredOnly}
+      />
+    </ConfigContractContext.Provider>
   );
 }
 
diff --git a/src/types/changes.ts b/src/types/changes.ts
index 66f8a069..4dc8f72d 100644
--- a/src/types/changes.ts
+++ b/src/types/changes.ts
@@ -47,6 +47,50 @@ export interface ConfigIssue {
   params?: Record<string, string | number>;
 }
 
+/** A location in a config document as the admin API reports it. */
+export interface ReportedLocation {
+  /** Absent where the report names the location by `segments` only (a `/changes` op). */
+  path?: string;
+  /** The same location key by key: unambiguous where a record key holds a dot (`dottedKeys`). */
+  segments?: string[];
+}
+
+/** Bounds and options of an issue the admin API reports (`issueParams`); never a submitted value. */
+export interface ReportedIssueParams {
+  expected?: string | number | boolean | null;
+  received?: string;
+  options?: Array<string | number | boolean | null>;
+  minimum?: number;
+  maximum?: number;
+  inclusive?: boolean;
+  exact?: boolean;
+  type?: string;
+  validation?: string;
+  multipleOf?: number;
+  /** A refinement's stable reason (`missing_port`). */
+  reason?: string;
+}
+
+/** A rejected value the admin API reports: where, a stable code, and (`issueParams`) its bounds. */
+export interface ReportedIssue extends ReportedLocation {
+  code: string;
+  params?: ReportedIssueParams;
+}
+
+/** A location a write did not store (`skipped`) or stores without effect (`ignored`), and why. */
+export interface ReportedSkip extends ReportedLocation {
+  reason: string;
+}
+
+/** An admin API error reply: its text, and the stable `code` (and route details) newer servers add. */
+export interface ApiErrorBody {
+  error?: string;
+  message?: string;
+  code?: string;
+  /** `FORBIDDEN_SECTION`: the section the caller may not manage. */
+  section?: string;
+}
+
 /** Input of `applyConfigChangesFn` (WS1). */
 export interface ApplyConfigChangesRequest {
   target: WriteTarget;
@@ -72,6 +116,8 @@ export type ChangeWarning =
   | 'shadowed'
   /** Sets a provider title setting while Global exists, so LibreChat ignores it (D11). */
   | 'shadowedBlock'
+  /** Global sets the other half of the title endpoint and model, chosen together (`titleResolution: 'field'`). */
+  | 'shadowedPair'
   /** Turns on required acceptance of the terms, which also gates this admin's own changes (FX-5). */
   | 'requireTerms'
   /** Empties the model spec list: no specs, and Specs only has no effect (MS-1). */
@@ -197,6 +243,12 @@ export interface WritePlan {
   storedAfter: ConfigRecord;
   /** Input changes that produce at least one write. */
   effective: number;
+  /**
+   * Where the writes change the target: their paths, a keyed collection's by
+   * the entries the changes touch (`endpoints.custom.Moonshot`, `entryLocation`)
+   * rather than the whole list a write sends.
+   */
+  changed: string[];
 }
 
 /** The parts of a zod (v3) issue the save pipeline reads (WS1). */
diff --git a/src/types/config-ui.ts b/src/types/config-ui.ts
index 66fae118..4a1954af 100644
--- a/src/types/config-ui.ts
+++ b/src/types/config-ui.ts
@@ -14,7 +14,8 @@ import type { TocEntry, JumpTarget, ConfigSearchHit, ConfigSearchItem } from './
 import type { BaseOverridesState, ImportSkippedKey, ImportRequest } from './review';
 import type { TabBadge, PathIndex, ValueLayers } from './values';
 import type { FieldControlProps } from './controls';
-import type { VisibilityEdit } from './changes';
+import type { ReportedIssue, ReportedLocation, ReportedSkip, VisibilityEdit } from './changes';
+import type { ConfigWriteRules } from './contract';
 
 export interface ConfigTab {
   id: string;
@@ -528,6 +529,8 @@ export interface SaveContext {
   hasOverride: (path: string) => boolean;
   /** Whether the edit target is a profile, whose values beneath come from Base (not librechat.yaml). */
   isScope?: boolean;
+  /** The server's write rules (`getWriteRules`); the bundled ones when absent. */
+  writeRules?: ConfigWriteRules;
 }
 
 /** Result of the server-side pre-flight that runs before any write. */
@@ -540,11 +543,17 @@ export interface ConfigCheckResult {
 export interface PatchFieldsResponse {
   error?: string;
   message?: string;
-  /** `CONFIG_OVERRIDE_INVALID` when the admin API rejected the values (see `issues`). */
+  /** `CONFIG_OVERRIDE_INVALID` when the admin API rejected the values (see `issues`), or why it refused the write. */
   code?: string;
   /** Paths (YAML keys, array indices of the sent value) and stable codes of rejected values. */
-  issues?: Array<{ path: string; code: string }>;
+  issues?: ReportedIssue[];
   config?: { overrides?: ConfigRecord; tombstones?: string[] } | null;
+  /** `writeReport`: the locations the write stored or removed. */
+  applied?: ReportedLocation[];
+  /** `writeReport`: the locations, or parts of a written value, the write did not store. */
+  skipped?: ReportedSkip[];
+  /** Stored values the runtime merge leaves out (`secret_rebinding`, …). */
+  ignored?: ReportedSkip[];
 }
 
 /** Outcome of a save call: how many entries the backend applied and which were dropped. */
diff --git a/src/types/config.ts b/src/types/config.ts
index ee4fbc50..f6559264 100644
--- a/src/types/config.ts
+++ b/src/types/config.ts
@@ -187,6 +187,9 @@ export type ReadOnlyReason = 'baseOnly' | 'yamlOnly';
  * - `notApplied`: stored, but the effective configuration still shows the lower layer's value
  * - `yamlMerged`: a key removed in the panel that LibreChat merges back from the layer beneath
  * - `baseScope`: applies to everyone, so it can only be set in Base, not in a profile
+ * - `processServer`: inside an MCP server librechat.yaml runs as a local process (no overrides apply)
+ * - `secretRebinding`: a stored credential LibreChat leaves out, since its destination changed
+ *   without the credential being entered again
  */
 export type SkipReason =
   | ReadOnlyReason
@@ -199,7 +202,9 @@ export type SkipReason =
   | 'yamlMerged'
   | 'baseScope'
   | 'inheritedValue'
-  | 'inheritedMerged';
+  | 'inheritedMerged'
+  | 'processServer'
+  | 'secretRebinding';
 
 /** A record key the admin API cannot store, and the dot-path of the object holding it. */
 export interface UnsafeConfigKey {
diff --git a/src/types/contract.ts b/src/types/contract.ts
index 1be7a882..41949bdc 100644
--- a/src/types/contract.ts
+++ b/src/types/contract.ts
@@ -1,4 +1,5 @@
 import type { ReactNode } from 'react';
+import type { ReadOnlyReason } from './config';
 
 /**
  * A behaviour of the admin config API that a LibreChat server reports in
@@ -24,7 +25,9 @@ export type ConfigFeatureFlag =
   | 'azureGroupSecrets'
   | 'yamlSecretPreview'
   | 'envAllowlist'
-  | 'secretRebinding';
+  | 'secretRebinding'
+  | 'writeReport'
+  | 'issueParams';
 
 /** Which admin config behaviours the server has; a flag it does not report is `false`. */
 export type ConfigFeatures = Readonly<Record<ConfigFeatureFlag, boolean>>;
@@ -71,6 +74,13 @@ export interface ConfigInterfaceRules {
   permissionSubKeys: string[];
 }
 
+/**
+ * Why only librechat.yaml sets a path: LibreChat reads it once at startup
+ * (`startup`), it is a boundary only the operator sets (`operator`), or
+ * nothing reads it (`unused`).
+ */
+export type DeploymentOnlyReason = 'startup' | 'operator' | 'unused';
+
 /** The write rules a server enforces, in `librechat.yaml` key names. */
 export interface ConfigRules {
   /** Top-level sections the server's config schema defines. */
@@ -81,6 +91,8 @@ export interface ConfigRules {
   basePrincipalSections: string[];
   /** Fields inside overridable sections that only `librechat.yaml` sets. */
   baseOnlyPaths: string[];
+  /** Sections and fields only `librechat.yaml` sets, with why; writes to them are skipped. */
+  deploymentOnlyPaths: Readonly<Record<string, DeploymentOnlyReason>>;
   /** Arrays merged item by item on a key field instead of replaced. */
   arrayMergeKeys: Readonly<Record<string, string>>;
   /** Objects an override replaces whole instead of merging into. */
@@ -119,6 +131,19 @@ export interface ConfigContract {
   rules: ConfigRules;
 }
 
+/**
+ * Where the panel may write, from a contract's rules and features: what it
+ * renders read-only and leaves out of saves (see `getWriteRules`).
+ */
+export interface ConfigWriteRules {
+  /** Top-level sections the panel never writes, with why. */
+  readOnlySections: ReadonlyMap<string, ReadOnlyReason>;
+  /** Fields inside writable sections that only librechat.yaml sets. */
+  yamlManagedFields: ReadonlySet<string>;
+  /** Of `yamlManagedFields`, those LibreChat reads only once, at startup. */
+  startupOnlyFields: ReadonlySet<string>;
+}
+
 /** `GET /api/admin/config/meta` as parsed: every part optional, since forks and older servers differ. */
 export interface AdminConfigMetaBody {
   versions?: Partial<ConfigVersions>;
diff --git a/src/types/features.ts b/src/types/features.ts
index 5f8f6bfb..08b723f3 100644
--- a/src/types/features.ts
+++ b/src/types/features.ts
@@ -49,8 +49,11 @@ export interface WebSearchCredential {
   required: boolean;
   /** A key: typed into a masked input. */
   secret: boolean;
-  /** LibreChat stores it encrypted and returns a masked preview (`<key>Preview`). */
-  encrypted: boolean;
+  /**
+   * LibreChat stores it encrypted and returns a masked preview (`<key>Preview`)
+   * only once it reports `webSearchStoredKeys` (Keenable); otherwise always, when `secret`.
+   */
+  encryptedSince?: 'webSearchStoredKeys';
   /** The environment variable LibreChat reads when the key is not set (`SERPER_API_KEY`). */
   env: string;
 }
diff --git a/src/types/providers.ts b/src/types/providers.ts
index 7df993d9..c3d490b3 100644
--- a/src/types/providers.ts
+++ b/src/types/providers.ts
@@ -1,6 +1,7 @@
 import type { ReactNode, RefObject } from 'react';
 import type { ConfigValue, ConfigRecord, FlatConfigMap, SchemaField, SelectOption } from './config';
 import type { FieldRendererProps } from './config-ui';
+import type { ConfigRules } from './contract';
 import type { ShadowedBy } from './values';
 
 /** One endpoint LibreChat serves to the signed-in admin (`GET /api/endpoints`). */
@@ -222,9 +223,10 @@ export interface SummaryReader {
   /**
    * How Global overrides shadow the value (D11): `wins` when Global sets the
    * key, `ignored` when its title block exists without it (LibreChat's
-   * default applies), else null.
+   * default applies), `paired` when it sets the other half of the title
+   * endpoint and model (`titleResolution: 'field'`), else null.
    */
-  shadowOf?: (path: string) => 'wins' | 'ignored' | null;
+  shadowOf?: (path: string) => 'wins' | 'ignored' | 'paired' | null;
 }
 
 export interface SummaryReaderInput {
@@ -234,6 +236,8 @@ export interface SummaryReaderInput {
   configuredPaths?: ReadonlySet<string>;
   editedValues?: FlatConfigMap;
   root: ConfigValue;
+  /** How the server applies `endpoints.all` title settings (`block` when absent). */
+  titleResolution?: ConfigRules['titleResolution'];
 }
 
 export interface StaleOverrideProps {
diff --git a/src/types/scope.ts b/src/types/scope.ts
index 3e52affc..fcad6d57 100644
--- a/src/types/scope.ts
+++ b/src/types/scope.ts
@@ -70,8 +70,13 @@ export type ScopeGateReason = 'baseOnly' | 'yamlOnly' | 'tenantWide' | 'preAuth'
 /** Another profile with the same priority that can apply to the same user. */
 export interface ScopePriorityTie {
   scope: ConfigScope;
-  /** Paths both profiles set; when non-empty, users in both get an undefined value. */
+  /**
+   * Paths both profiles set. Where they overlap, users in both get the value
+   * of the profile that applies last: undefined before `deterministicPrecedence`.
+   */
   sharedPaths: string[];
+  /** Whether this profile applies after the one it ties with, so its values win (`deterministicPrecedence`). */
+  appliesAfter: boolean;
 }
 
 /** Profile lookups shared by the selector, the context bar and the field cascade. */
@@ -114,6 +119,13 @@ export interface ScopeBarProps extends Pick<
   /** Switches to Base through the page's unsaved-changes guard. */
   onBackToBase: () => void;
   onError?: (message: string) => void;
+  /** Whether the admin may change profile priorities (broad `manage:configs`). */
+  canEditPriority?: boolean;
+}
+
+export interface ScopePriorityEditorProps {
+  scope: ConfigScope;
+  onError?: (message: string) => void;
 }
 
 export interface ScopeNotFoundProps {
@@ -157,6 +169,10 @@ export interface ScopeCandidate {
   description?: string;
 }
 
+/** What `createScopeFn` creates a profile for: the principal, its name and, optionally, a priority. */
+export type CreateScopeInput = Pick<ConfigScope, 'principalType' | 'name' | 'email'> &
+  Partial<Pick<ConfigScope, 'principalId' | 'priority'>>;
+
 /** The "Overridden by …" link on a settings row in Base, opening the field's cascade. */
 export interface ScopeCascadeProps {
   fieldPath: string;
diff --git a/src/types/specs.ts b/src/types/specs.ts
index 770384ea..28942a7e 100644
--- a/src/types/specs.ts
+++ b/src/types/specs.ts
@@ -186,6 +186,8 @@ export interface ChipPickerProps {
   addLabel: string;
   /** Text of a chip whose value matches no choice ("Foo (not configured)"). */
   unknownLabel: (value: string) => string;
+  /** The choice a value names, where several spellings name one (`Ollama` is `ollama`). */
+  matchValue?: (value: string) => string;
   'aria-label': string;
   'aria-describedby'?: string;
 }
diff --git a/src/types/values.ts b/src/types/values.ts
index 75ed5708..363ed60a 100644
--- a/src/types/values.ts
+++ b/src/types/values.ts
@@ -3,6 +3,7 @@ import type { PrincipalType } from 'librechat-data-provider';
 import type { ReactNode } from 'react';
 import type { ConfigValue, ConfigRecord, FlatConfigMap } from './config';
 import type { VisibilityEdit } from './changes';
+import type { ConfigRules, ConfigWriteRules } from './contract';
 
 /**
  * Where a field's value comes from (WS4):
@@ -39,8 +40,13 @@ export interface FieldLayer {
 export interface ShadowedBy {
   path: string;
   value: ConfigValue;
-  /** `block`: the whole other block wins, even where it leaves this field unset (titles); `field`: only a value it sets wins. */
-  precedence?: 'block' | 'field';
+  /**
+   * `block`: the whole other block wins, even where it leaves this field unset
+   * (titles, `titleResolution: 'block'`); `field`: only a value it sets wins;
+   * `pair`: it sets the other half of a choice made together (the title
+   * endpoint and model, `titleResolution: 'field'`), so it wins here too.
+   */
+  precedence?: 'block' | 'field' | 'pair';
 }
 
 /** Everything a field row needs to render its value and state (WS4; `error` from WS1). */
@@ -132,6 +138,10 @@ export interface ConfigValuesData {
   layers?: ValueLayers | null;
   /** Pending profile Hide/Unhide by path: a row shows what Save will do. */
   visibilityEdits?: Readonly<Record<string, VisibilityEdit>>;
+  /** The server's write rules: which sections it reads only from librechat.yaml. */
+  writeRules?: ConfigWriteRules;
+  /** How the server applies `endpoints.all` title settings (`block` when absent). */
+  titleResolution?: ConfigRules['titleResolution'];
 }
 
 /** Props of `ConfigValuesProvider` (WS4). */
diff --git a/src/utils/changes.test.ts b/src/utils/changes.test.ts
index 45acf2fb..95b2c79c 100644
--- a/src/utils/changes.test.ts
+++ b/src/utils/changes.test.ts
@@ -145,6 +145,47 @@ describe('planConfigChanges', () => {
       },
     ]);
     expect(plan.effective).toBe(1);
+    expect(plan.changed).toEqual(['endpoints.custom.GPT']);
+  });
+
+  it('names what it changes by path, and a keyed collection by the entries its changes touch', () => {
+    const models = { default: ['m'] };
+    const adminA = { name: 'AdminA', apiKey: 'user_provided', baseURL: 'https://a', models };
+    const ollama = { ...adminA, name: 'Ollama', baseURL: 'http://ollama:11434/v1' };
+    const plan = planConfigChanges(
+      [
+        { op: 'set', path: 'mcpServers.github.url', value: 'https://mcp.example.com/' },
+        { op: 'reset', path: 'balance.refillAmount' },
+        { op: 'tombstone', path: 'endpoints.openAI.titleModel' },
+        {
+          op: 'upsertEntry',
+          path: 'endpoints.custom',
+          key: 'Ollama',
+          identity: null,
+          value: ollama,
+        },
+        {
+          op: 'upsertEntry',
+          path: 'endpoints.custom',
+          key: 'AdminB',
+          identity: 'AdminA',
+          value: { ...adminA, name: 'AdminB' },
+        },
+      ],
+      snapshot({
+        balance: { refillAmount: 5 },
+        endpoints: { custom: [adminA] },
+      }),
+    );
+    expect(plan.issues).toEqual([]);
+    expect(plan.changed).toEqual([
+      'mcpServers.github.url',
+      'endpoints.custom.ollama',
+      'endpoints.custom.AdminB',
+      'endpoints.custom.AdminA',
+      'balance',
+      'endpoints.openAI.titleModel',
+    ]);
   });
 
   it('blocks the whole batch on an invalid entry, naming the entry and field', () => {
diff --git a/src/utils/changes.ts b/src/utils/changes.ts
index dfb87a77..191826fa 100644
--- a/src/utils/changes.ts
+++ b/src/utils/changes.ts
@@ -7,6 +7,7 @@ import type * as t from '@/types';
 import {
   getEntryKey,
   diffOverride,
+  entryLocation,
   hasHiddenSecret,
   mergeConfigLayers,
   getKeyedCollection,
@@ -32,6 +33,7 @@ import {
   getConfigSection,
   getReadOnlyReason,
   SECRET_CONFIG_KEYS,
+  BUNDLED_WRITE_RULES,
   BUNDLED_CONFIG_FEATURES,
 } from '@/constants';
 import { isSecretKey, toSecretPreviewKey, valueOrSecretPreview } from './secrets';
@@ -61,8 +63,9 @@ export function findWriteRuleIssues(
   path: string,
   value: t.ConfigValue,
   features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
 ): t.ConfigIssue[] {
-  const issues = findValueRuleIssues(path, value, features);
+  const issues = findValueRuleIssues(path, value, features, rules);
   const collection = getKeyedCollection(path);
   if (!collection || !Array.isArray(value) || issues.length === 0) return issues;
   return issues.map((issue) => withEntryOf(issue, collection, value));
@@ -84,8 +87,9 @@ function findValueRuleIssues(
   path: string,
   value: t.ConfigValue,
   features: t.ConfigFeatures,
+  rules: t.ConfigWriteRules,
 ): t.ConfigIssue[] {
-  const managed = findYamlManagedValues(path, value);
+  const managed = findYamlManagedValues(path, value, rules);
   if (managed.length > 0) {
     return managed.map((managedPath) => ({
       path: managedPath,
@@ -139,6 +143,7 @@ function blankTextIssue({ path, key }: t.BlankConfigText): t.ConfigIssue {
 interface PlanState {
   snapshot: t.WriteSnapshot;
   features: t.ConfigFeatures;
+  rules: t.ConfigWriteRules;
   sets: Map<string, t.ConfigValue>;
   resets: string[];
   tombstones: string[];
@@ -267,8 +272,8 @@ function collectOps(state: PlanState, ops: t.ConfigChange[]): void {
   for (const op of ops) {
     const isRemoval = op.op === 'reset' || op.op === 'untombstone' || op.op === 'removeEntry';
     const reason =
-      getWriteSkipReason(op.path, isRemoval) ??
-      (isProfile && !isRemoval ? scopeGateSkipReason(op.path) : undefined);
+      getWriteSkipReason(op.path, isRemoval, state.rules) ??
+      (isProfile && !isRemoval ? scopeGateSkipReason(op.path, state.rules) : undefined);
     if (reason) {
       state.skipped.push({ fieldPath: op.path, reason });
       continue;
@@ -541,8 +546,8 @@ function isIntroducedIssue(state: PlanState, path: string, issue: t.ConfigIssue)
 function validateSets(state: PlanState): Set<string> {
   const blocked = new Set<string>();
   for (const [path, value] of state.sets) {
-    const ruleIssues = findWriteRuleIssues(path, value, state.features).filter((issue) =>
-      isIntroducedIssue(state, path, issue),
+    const ruleIssues = findWriteRuleIssues(path, value, state.features, state.rules).filter(
+      (issue) => isIntroducedIssue(state, path, issue),
     );
     if (ruleIssues.length > 0) {
       state.issues.push(...ruleIssues);
@@ -585,7 +590,9 @@ function validateSections(state: PlanState, blocked: ReadonlySet<string>): void
   ];
   /** LibreChat reads librechat.yaml-only sections from the file alone: removing an override there can't break them. */
   const sections = new Set(
-    written.filter((path) => getReadOnlyReason(path) !== 'yamlOnly').map(getConfigSection),
+    written
+      .filter((path) => getReadOnlyReason(path, state.rules) !== 'yamlOnly')
+      .map(getConfigSection),
   );
   const reported = new Set(state.issues.map(issueKey));
   const { lower, stored } = state.snapshot;
@@ -636,10 +643,20 @@ function findMergedBackKeys(state: PlanState): void {
   }
 }
 
+/** The plan's write paths, a keyed collection's by the entries its changes touch. */
+function changedLocations(state: PlanState): string[] {
+  const paths = [...state.sets.keys(), ...state.resets, ...state.tombstones, ...state.untombstones];
+  return paths.flatMap((path) => {
+    const entries = state.touchedEntries.get(path);
+    return entries ? [...entries].map((name) => entryLocation(path, name)) : [path];
+  });
+}
+
 /**
  * Resolves a batch of changes against the target's stored overrides and the
  * layer beneath it, into the admin API writes that implement it, by the
- * server's contract `features` (the bundled ones: an older server). Everything
+ * server's contract `features` and write `rules` (the bundled ones: an older
+ * server). Everything
  * is checked before anything may be written: write rules (read-only and
  * YAML-managed paths, process-backed MCP fields, unsafe keys), field and
  * entry schemas, whole sections, and the keyed collection rules. The client
@@ -650,10 +667,12 @@ export function planConfigChanges(
   ops: t.ConfigChange[],
   snapshot: t.WriteSnapshot,
   features: t.ConfigFeatures = BUNDLED_CONFIG_FEATURES,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
 ): t.WritePlan {
   const state: PlanState = {
     snapshot,
     features,
+    rules,
     sets: new Map(),
     resets: [],
     tombstones: [],
@@ -684,6 +703,7 @@ export function planConfigChanges(
     warnings: state.warnings,
     storedAfter,
     effective: state.effective,
+    changed: changedLocations(state),
   };
 }
 
diff --git a/src/utils/collections.ts b/src/utils/collections.ts
index 697850a8..d07c7a33 100644
--- a/src/utils/collections.ts
+++ b/src/utils/collections.ts
@@ -13,6 +13,16 @@ export function getKeyedCollection(path: string): t.KeyedCollection | undefined
   return KEYED_COLLECTIONS.get(path);
 }
 
+/**
+ * The location of a named entry (`mcpServers.github`, `endpoints.custom.Moonshot`),
+ * by the name LibreChat serves a keyed collection's entry under, so two
+ * spellings of one entry are one location (`endpoints.custom.ollama` for `Ollama`).
+ */
+export function entryLocation(path: string, name: string): string {
+  const servedName = KEYED_COLLECTIONS.get(path)?.servedName;
+  return `${path}.${servedName ? servedName(name) : name}`;
+}
+
 /**
  * The keyed collection `path` is an entry of, or a field inside an entry of
  * (`endpoints.custom.3.baseURL` → `endpoints.custom`, index 3, rest `baseURL`).
diff --git a/src/utils/contract.test.ts b/src/utils/contract.test.ts
index cdf8f46f..85e54c20 100644
--- a/src/utils/contract.test.ts
+++ b/src/utils/contract.test.ts
@@ -1,11 +1,22 @@
 import { describe, it, expect } from 'vitest';
+import type * as t from '@/types';
 import {
+  getWriteRules,
+  resolveWriteRules,
+  getReadOnlyReason,
+  isYamlManagedPath,
+  isStartupOnlyPath,
+  BUNDLED_WRITE_RULES,
+  YAML_MANAGED_FIELDS,
+  STARTUP_ONLY_FIELDS,
   CONFIG_FEATURE_FLAGS,
   BUNDLED_CONFIG_RULES,
   BUNDLED_CONFIG_LIMITS,
   BUNDLED_CONFIG_CONTRACT,
+  READ_ONLY_CONFIG_SECTIONS,
 } from '@/constants';
-import { resolveConfigContract } from './contract';
+import { createServerContract } from '@/test/fixtures';
+import { resolveConfigContract, foldsEndpointReferences } from './contract';
 
 describe('resolveConfigContract', () => {
   it('is the bundled contract, every feature off, for a server without the meta route', () => {
@@ -78,3 +89,86 @@ describe('BUNDLED_CONFIG_RULES', () => {
     });
   });
 });
+
+/** `rules.deploymentOnlyPaths` as LibreChat with the write report publishes it (abridged). */
+const DEPLOYMENT_ONLY: t.ConfigRules['deploymentOnlyPaths'] = {
+  rateLimits: 'operator',
+  cloudfront: 'operator',
+  includedTools: 'operator',
+  skillDeletion: 'startup',
+  cache: 'unused',
+  'registration.oauthStateTtlMs': 'startup',
+  'endpoints.agents.eventDriven': 'startup',
+  'endpoints.agents.toolApproval.hooks': 'operator',
+};
+
+describe('write rules', () => {
+  it('keeps the read-only sections and fields the panel knew for a server without rules', () => {
+    expect(getWriteRules(BUNDLED_CONFIG_CONTRACT)).toBe(BUNDLED_WRITE_RULES);
+    expect([...BUNDLED_WRITE_RULES.readOnlySections].sort()).toEqual(
+      [...READ_ONLY_CONFIG_SECTIONS].sort(),
+    );
+    expect(Object.fromEntries(READ_ONLY_CONFIG_SECTIONS)).toEqual({
+      filters: 'baseOnly',
+      mcpAppSandbox: 'baseOnly',
+      cloudfront: 'yamlOnly',
+      rateLimits: 'yamlOnly',
+      turnstile: 'yamlOnly',
+      permissions: 'yamlOnly',
+      openapi: 'yamlOnly',
+      cache: 'yamlOnly',
+    });
+    expect(YAML_MANAGED_FIELDS).toEqual(BUNDLED_WRITE_RULES.yamlManagedFields);
+    expect(isYamlManagedPath('registration.socialLogins')).toBe(true);
+    expect(isYamlManagedPath('endpoints.azureOpenAI.groups.0.apiKey')).toBe(true);
+    expect(isStartupOnlyPath('mcpSettings.catalogRecovery.maxStateEntries')).toBe(true);
+    expect(STARTUP_ONLY_FIELDS.has('mcpSettings.catalogRecovery.authorizationFenceTimeoutMs')).toBe(
+      false,
+    );
+  });
+
+  it("reads sections and fields from a server's base-only and deployment-only lists", () => {
+    const rules = resolveWriteRules(
+      {
+        baseOnlySections: ['filters', 'mcpAppSandbox', 'turnstile'],
+        baseOnlyPaths: ['endpoints.agents.pullRequests.provider'],
+        deploymentOnlyPaths: DEPLOYMENT_ONLY,
+      },
+      false,
+    );
+    expect(getReadOnlyReason('includedTools', rules)).toBe('yamlOnly');
+    expect(getReadOnlyReason('skillDeletion.intervalMs', rules)).toBe('yamlOnly');
+    expect(getReadOnlyReason('filters.pii', rules)).toBe('baseOnly');
+    expect(getReadOnlyReason('turnstile.siteKey', rules)).toBe('yamlOnly');
+    expect(getReadOnlyReason('permissions', rules)).toBeUndefined();
+    expect(isYamlManagedPath('endpoints.agents.pullRequests.provider', rules)).toBe(true);
+    expect(isYamlManagedPath('endpoints.agents.pullRequests.host', rules)).toBe(false);
+    expect(isYamlManagedPath('endpoints.agents.toolApproval.hooks.0', rules)).toBe(true);
+    expect(isStartupOnlyPath('endpoints.agents.eventDriven', rules)).toBe(true);
+    expect(isStartupOnlyPath('endpoints.agents.toolApproval.hooks', rules)).toBe(false);
+    expect(isStartupOnlyPath('mcpSettings.catalogRecovery.maxStateEntries', rules)).toBe(false);
+  });
+
+  it('lets Base set the social sign-in buttons once Base overrides apply before sign-in', () => {
+    const before = getWriteRules(createServerContract());
+    const after = getWriteRules(createServerContract({ preAuthBaseOverrides: true }));
+    expect(isYamlManagedPath('registration.socialLogins', before)).toBe(true);
+    expect(isYamlManagedPath('registration.socialLogins', after)).toBe(false);
+    expect(isYamlManagedPath('registration.oauthStateTtlMs', after)).toBe(true);
+    expect(isYamlManagedPath('endpoints.anthropic.vertex.region', after)).toBe(true);
+  });
+
+  it('builds the rules once per contract', () => {
+    const contract = createServerContract({ preAuthBaseOverrides: true });
+    expect(getWriteRules(contract)).toBe(getWriteRules(contract));
+  });
+});
+
+describe('foldsEndpointReferences', () => {
+  it('is reported by per-field title resolution, which shipped with it', () => {
+    expect(foldsEndpointReferences(BUNDLED_CONFIG_CONTRACT)).toBe(false);
+    expect(foldsEndpointReferences(createServerContract({}, { titleResolution: 'field' }))).toBe(
+      true,
+    );
+  });
+});
diff --git a/src/utils/contract.ts b/src/utils/contract.ts
index 46ac0c53..27a8d238 100644
--- a/src/utils/contract.ts
+++ b/src/utils/contract.ts
@@ -35,6 +35,16 @@ export function resolveConfigContract(body: t.AdminConfigMetaBody | null): t.Con
   };
 }
 
+/**
+ * Whether LibreChat folds endpoint references to the names it serves
+ * (`Ollama` and `ollama` are one endpoint in `addedEndpoints`, a spec's
+ * endpoint and `allowedProviders`). It shipped with per-field title
+ * resolution and has no flag of its own, so `titleResolution: 'field'` reports it.
+ */
+export function foldsEndpointReferences(contract: t.ConfigContract): boolean {
+  return contract.rules.titleResolution === 'field';
+}
+
 /** A copy without the keys whose value is `undefined`, so they don't hide the fallback's. */
 function definedOnly<T extends object>(value: T | undefined): Partial<T> {
   if (!value) return {};
diff --git a/src/utils/errors.ts b/src/utils/errors.ts
index 510ca3c7..848b185c 100644
--- a/src/utils/errors.ts
+++ b/src/utils/errors.ts
@@ -1,5 +1,7 @@
 import type * as t from '@/types';
 import { TERMS_NOT_ACCEPTED_CODE } from '@/constants';
+import translation from '@/locales/en/translation.json';
+import { interpolateIssue } from './validation';
 
 const TERMS_PREFIX = `${TERMS_NOT_ACCEPTED_CODE} `;
 
@@ -30,3 +32,17 @@ export function errorText(error: unknown, fallback: string, localize: t.Localize
   if (termsUrl === '') return localize('com_config_terms_refused');
   return messageOf(error) || fallback;
 }
+
+/**
+ * English text for a stable admin API error code the panel words itself
+ * (`com_config_api_error_<code>`), with the section a `FORBIDDEN_SECTION`
+ * names; null for a code it does not word, whose own text is kept. Error
+ * replies are read on the server, before the page localizes them.
+ */
+export function describeApiError(body: t.ApiErrorBody): string | null {
+  if (!body.code) return null;
+  const key = `com_config_api_error_${body.code.toLowerCase()}` as keyof typeof translation;
+  const template = translation[key];
+  if (typeof template !== 'string') return null;
+  return interpolateIssue(template, { section: body.section ?? '' });
+}
diff --git a/src/utils/layers.ts b/src/utils/layers.ts
index 5e62460f..cc8eadc7 100644
--- a/src/utils/layers.ts
+++ b/src/utils/layers.ts
@@ -1,5 +1,5 @@
 import type * as t from '@/types';
-import { DEDICATED_CONFIG_SECTIONS, READ_ONLY_CONFIG_SECTIONS } from '@/constants';
+import { BUNDLED_WRITE_RULES, DEDICATED_CONFIG_SECTIONS } from '@/constants';
 import { deepSerializeKVPairs, getValueAtPath, isConfigRecord } from './format';
 import { collectLeafPaths, createPathIndex } from './paths';
 import { mapSecretPreviewPaths } from './secrets';
@@ -136,21 +136,24 @@ export function setConfigPath(
  * (librechat.yaml plus base overrides) with the profile's overrides merged the
  * way LibreChat merges them (objects deep-merge, `endpoints.custom` merges by
  * name, other arrays are replaced) and its tombstoned paths removed. Sections a
- * profile cannot override keep their Base values.
+ * profile cannot override (read-only by the server's write `rules`) keep their
+ * Base values.
  */
 export function mergeScopeLayer(
   base: t.ConfigRecord,
   overrides: t.ConfigRecord,
   tombstones: Iterable<string> = [],
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
 ): t.ConfigRecord {
+  const readOnly = rules.readOnlySections;
   const applicable: t.ConfigRecord = {};
   for (const [section, value] of Object.entries(overrides)) {
-    if (READ_ONLY_CONFIG_SECTIONS.has(section) || DEDICATED_CONFIG_SECTIONS.has(section)) continue;
+    if (readOnly.has(section) || DEDICATED_CONFIG_SECTIONS.has(section)) continue;
     applicable[section] = value;
   }
   let merged = mergeRecords(base, applicable, '');
   for (const path of tombstones) {
-    if (READ_ONLY_CONFIG_SECTIONS.has(path.split('.')[0])) continue;
+    if (readOnly.has(path.split('.')[0])) continue;
     merged = removeConfigPath(merged, path);
   }
   return merged;
@@ -218,6 +221,7 @@ export function withScopeLayer(
   scope: Pick<t.ScopeLayer, 'principalType' | 'name'>,
   data: t.ResolvedConfigData,
   schemaPaths: ReadonlySet<string>,
+  rules?: t.ConfigWriteRules,
 ): t.ValueLayers {
   return {
     ...layers,
@@ -228,6 +232,6 @@ export function withScopeLayer(
       overridePaths: createPathIndex(mapSecretPreviewPaths(data.changedPaths, schemaPaths)),
       tombstones: new Set(data.tombstones),
     },
-    effective: mergeScopeLayer(layers.base ?? {}, data.overrides, data.tombstones),
+    effective: mergeScopeLayer(layers.base ?? {}, data.overrides, data.tombstones, rules),
   };
 }
diff --git a/src/utils/scopes.test.ts b/src/utils/scopes.test.ts
index 46123de1..543cb568 100644
--- a/src/utils/scopes.test.ts
+++ b/src/utils/scopes.test.ts
@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest';
 import { PrincipalType } from 'librechat-data-provider';
 import type * as t from '@/types';
+import { resolveWriteRules } from '@/constants';
 import {
   isSameScope,
   applyScopeGates,
@@ -11,6 +12,7 @@ import {
   isCurrentSelection,
   countScopeOverrides,
   collectOverridePaths,
+  compareScopePrecedence,
   scopeGateSkipReason,
   scopeOverrideEntries,
   listScopeOverrideItems,
@@ -149,6 +151,41 @@ describe('findPriorityTies', () => {
   it('reports nothing for an inactive profile', () => {
     expect(findPriorityTies(off, [eng, design, off])).toEqual([]);
   });
+
+  it('says which profile applies last on equal priority (deterministicPrecedence)', () => {
+    const role = scope({
+      _id: 'b',
+      principalType: PrincipalType.ROLE,
+      principalId: 'USER',
+      overridePaths: ['interface.parameters'],
+    });
+    const older = scope({ _id: 'a', principalId: 'older', overridePaths: ['interface'] });
+    const newer = scope({ _id: 'c', principalId: 'newer', overridePaths: ['interface'] });
+    const ties = findPriorityTies(older, [role, older, newer]);
+    expect(ties.map((tie) => [tie.scope.principalId, tie.appliesAfter])).toEqual([
+      ['USER', true],
+      ['newer', false],
+    ]);
+    expect(findPriorityTies(role, [role, older])[0].appliesAfter).toBe(false);
+  });
+});
+
+describe('compareScopePrecedence', () => {
+  it('orders by priority, then roles before groups before users, then the older profile first', () => {
+    const user = scope({ _id: 'a', principalType: PrincipalType.USER, principalId: 'u1' });
+    const role = scope({ _id: 'z', principalType: PrincipalType.ROLE, principalId: 'USER' });
+    const groupOld = scope({ _id: '6a00', principalId: 'old' });
+    const groupNew = scope({ _id: '6a01', principalId: 'new' });
+    const low = scope({
+      _id: 'zz',
+      principalType: PrincipalType.USER,
+      principalId: 'u2',
+      priority: 5,
+    });
+    const ordered = [user, groupNew, role, low, groupOld].sort(compareScopePrecedence);
+    expect(ordered.map((s) => s.principalId)).toEqual(['u2', 'USER', 'old', 'new', 'u1']);
+    expect(compareScopePrecedence(groupOld, { ...groupOld })).toBe(0);
+  });
 });
 
 describe('buildScopeIndex', () => {
@@ -220,4 +257,19 @@ describe('scopeGateSkipReason', () => {
     expect(scopeGateSkipReason('langfuse.baseUrl')).toBe('dedicated');
     expect(scopeGateSkipReason('balance.startBalance')).toBeUndefined();
   });
+
+  it("gates the sections the server's rules make read-only", () => {
+    const rules = resolveWriteRules(
+      {
+        baseOnlySections: ['filters', 'turnstile'],
+        baseOnlyPaths: [],
+        deploymentOnlyPaths: { includedTools: 'operator' },
+      },
+      true,
+    );
+    expect(scopeGateSkipReason('includedTools', rules)).toBe('yamlOnly');
+    expect(scopeGateSkipReason('rateLimits.fileUploads.ipMax', rules)).toBeUndefined();
+    expect(scopeGateSkipReason('turnstile.siteKey', rules)).toBe('yamlOnly');
+    expect(scopeGateSkipReason('registration.socialLogins', rules)).toBe('baseScope');
+  });
 });
diff --git a/src/utils/scopes.ts b/src/utils/scopes.ts
index f7cf6b2a..654af885 100644
--- a/src/utils/scopes.ts
+++ b/src/utils/scopes.ts
@@ -12,6 +12,28 @@ const GATE_SKIP_REASONS: Readonly<Record<t.ScopeGateReason, t.SkipReason>> = {
   preAuth: 'baseScope',
 };
 
+/** Order of profile kinds on equal priority under `deterministicPrecedence`: roles, then groups, then users. */
+const TYPE_RANK: Readonly<Record<string, number>> = {
+  [PrincipalType.ROLE]: 0,
+  [PrincipalType.GROUP]: 1,
+  [PrincipalType.USER]: 2,
+};
+
+/**
+ * The order LibreChat applies profiles in with `deterministicPrecedence`,
+ * the last winning: ascending priority, then roles before groups before
+ * users, then the older profile first (document id, roughly creation order).
+ * Base always applies before every profile.
+ */
+export function compareScopePrecedence(a: t.ConfigScope, b: t.ConfigScope): number {
+  if (a.priority !== b.priority) return a.priority - b.priority;
+  const rank = (TYPE_RANK[a.principalType] ?? 0) - (TYPE_RANK[b.principalType] ?? 0);
+  if (rank !== 0) return rank;
+  const [idA, idB] = [a._id ?? '', b._id ?? ''];
+  if (idA === idB) return 0;
+  return idA < idB ? -1 : 1;
+}
+
 /** Profile kinds a user can only belong to once, so two of them never apply together. */
 const SINGLE_MEMBERSHIP_TYPES: ReadonlySet<PrincipalType> = new Set([
   PrincipalType.ROLE,
@@ -122,8 +144,10 @@ function canCoApply(a: t.ConfigScope, b: t.ConfigScope): boolean {
 
 /**
  * Active profiles with the same priority as `scope` that can apply to the same
- * user. LibreChat orders profiles by priority only, so for a user both apply
- * to, which value of a setting they both change wins is undefined.
+ * user, with whether `scope` applies after each (`compareScopePrecedence`).
+ * Before `deterministicPrecedence` LibreChat orders profiles by priority
+ * only, so for a user both apply to, which value of a setting they both
+ * change wins is undefined; with it, the one that applies last wins.
  */
 export function findPriorityTies(
   scope: t.ConfigScope,
@@ -142,7 +166,11 @@ export function findPriorityTies(
     .map((other) => {
       const otherPaths = scopePaths(other);
       const shared = own.filter((path) => otherPaths.some((p) => pathsOverlap(path, p)));
-      return { scope: other, sharedPaths: shared };
+      return {
+        scope: other,
+        sharedPaths: shared,
+        appliesAfter: compareScopePrecedence(scope, other) > 0,
+      };
     });
 }
 
@@ -155,10 +183,11 @@ function pathPrefixes(path: string): string[] {
 /**
  * Indexes profiles by every path they override or hide and each ancestor of
  * it, so a settings row finds the profiles that change it (or something inside
- * it) with one lookup. Profiles are listed in priority order, lowest first.
+ * it) with one lookup. Profiles are listed in the order they apply, lowest
+ * priority first (`compareScopePrecedence`).
  */
 export function buildScopeIndex(scopes: t.ConfigScope[]): t.ScopeIndex {
-  const ordered = [...scopes].sort((a, b) => a.priority - b.priority);
+  const ordered = [...scopes].sort(compareScopePrecedence);
   const byPath = new Map<string, t.ConfigScope[]>();
   for (const scope of ordered) {
     const seen = new Set<string>();
@@ -194,16 +223,20 @@ export function getScopeIndex(scopes: t.ConfigScope[]): t.ScopeIndex {
 export function applyScopeGates(
   sections: t.ConfigSectionConfig[],
   isEditingScope: boolean,
+  rules?: t.ConfigWriteRules,
 ): t.ConfigSectionConfig[] {
   if (!isEditingScope) return sections;
   return sections.map((section) => {
-    const scopeGate = getScopeGateReason(section.schemaKey ?? section.id);
+    const scopeGate = getScopeGateReason(section.schemaKey ?? section.id, rules);
     return scopeGate ? { ...section, scopeGate, tocItems: [] } : section;
   });
 }
 
 /** Why a change to `path` is not sent to a profile: its section applies to everyone (PR-7). */
-export function scopeGateSkipReason(path: string): t.SkipReason | undefined {
-  const gate = getScopeGateReason(path);
+export function scopeGateSkipReason(
+  path: string,
+  rules?: t.ConfigWriteRules,
+): t.SkipReason | undefined {
+  const gate = getScopeGateReason(path, rules);
   return gate ? GATE_SKIP_REASONS[gate] : undefined;
 }
diff --git a/src/utils/validation.test.ts b/src/utils/validation.test.ts
new file mode 100644
index 00000000..4c31cee9
--- /dev/null
+++ b/src/utils/validation.test.ts
@@ -0,0 +1,86 @@
+import { describe, it, expect } from 'vitest';
+import { classifyReportedIssue, describeIssueCode, paramlessIssueCode } from './validation';
+import { describeApiError, errorText } from './errors';
+
+function wording(code: string, params?: Parameters<typeof classifyReportedIssue>[1]): string {
+  const issue = classifyReportedIssue(code, params);
+  return describeIssueCode(issue.code, issue.params, 'is not a valid value');
+}
+
+describe('classifyReportedIssue', () => {
+  it('words a code without its parameters when the server reports none', () => {
+    expect(classifyReportedIssue('too_small', undefined)).toEqual({ code: 'too_small_value' });
+    expect(classifyReportedIssue('custom', undefined)).toEqual({ code: 'custom' });
+    expect(paramlessIssueCode('dotted_key')).toBe('dotted_key');
+  });
+
+  it('words bounds by what they bound and whether they are inclusive', () => {
+    expect(
+      wording('too_small', { minimum: 1, inclusive: true, exact: false, type: 'number' }),
+    ).toBe('must be at least 1');
+    expect(
+      wording('too_big', { maximum: 100, inclusive: false, exact: false, type: 'number' }),
+    ).toBe('must be less than 100');
+    expect(wording('too_small', { minimum: 3, inclusive: true, type: 'string' })).toBe(
+      'must be at least 3 characters',
+    );
+    expect(wording('too_big', { maximum: 5, inclusive: true, type: 'array' })).toBe(
+      'must have at most 5 items',
+    );
+    expect(classifyReportedIssue('too_small', { inclusive: true, type: 'date' })).toEqual({
+      code: 'too_small_value',
+    });
+  });
+
+  it('words expected types, literals and options', () => {
+    expect(wording('invalid_type', { expected: 'integer', received: 'number' })).toBe(
+      'must be a whole number',
+    );
+    expect(wording('invalid_type', { expected: 'string', received: 'undefined' })).toBe(
+      'is required',
+    );
+    expect(wording('invalid_literal', { expected: 'stdio' })).toBe('must be "stdio"');
+    expect(wording('invalid_enum_value', { options: ['low', 'high'] })).toBe(
+      'must be one of "low", "high"',
+    );
+    expect(wording('invalid_union_discriminator', { options: ['sse', 'http'] })).toBe(
+      'must be one of "sse", "http"',
+    );
+    expect(wording('invalid_enum_value', { options: [] })).toBe('is not one of the allowed values');
+  });
+
+  it('words string checks, multiples and a refinement by its reason', () => {
+    expect(wording('invalid_string', { validation: 'url' })).toBe('must be a valid URL');
+    expect(wording('invalid_string', { validation: 'regex' })).toBe('is not a valid value');
+    expect(wording('not_multiple_of', { multipleOf: 5 })).toBe('must be a multiple of 5');
+    expect(wording('custom', { reason: 'missing_port' })).toBe(
+      'must include a port, for example localhost:11434',
+    );
+    expect(wording('custom', { reason: 'public_ip' })).toBe(
+      'is a public IP address: enter a private address, or a hostname that resolves to one',
+    );
+    expect(classifyReportedIssue('custom', { reason: 'some_new_rule' })).toEqual({
+      code: 'custom',
+    });
+  });
+});
+
+describe('describeApiError', () => {
+  it("words the admin API's stable codes, and leaves others to the server's text", () => {
+    expect(describeApiError({ code: 'PRINCIPAL_NOT_FOUND' })).toMatch(/doesn't exist/);
+    expect(describeApiError({ code: 'FORBIDDEN_SECTION', section: 'memory' })).toBe(
+      "You don't have permission to change the memory settings.",
+    );
+    expect(describeApiError({ code: 'CONFIG_VERSION_CONFLICT' })).toMatch(/Reload the page/);
+    expect(describeApiError({ code: 'AUTH_REQUIRED' })).toMatch(/session expired/);
+    expect(describeApiError({ code: 'SOME_FUTURE_CODE', error: 'Text' })).toBeNull();
+    expect(describeApiError({ error: 'Text' })).toBeNull();
+  });
+
+  it('keeps an error text as it is', () => {
+    const localize = (key: string) => key;
+    expect(errorText(new Error('There is no role named "X"'), 'fallback', localize)).toBe(
+      'There is no role named "X"',
+    );
+  });
+});
diff --git a/src/utils/validation.ts b/src/utils/validation.ts
index 96d58f5a..59293720 100644
--- a/src/utils/validation.ts
+++ b/src/utils/validation.ts
@@ -135,6 +135,12 @@ const ISSUE_MESSAGES: Readonly<Record<string, string>> = {
   too_big_value: 'is too large',
   dotted_key: "has a key with a dot where LibreChat expects a setting's name",
   unknown_section: "isn't a section LibreChat knows",
+  not_multiple_of: 'must be a multiple of {{multipleOf}}',
+  custom_empty: 'is empty: enter a host and a port',
+  custom_format: 'must be only host:port, without http:// or a path',
+  custom_missing_port: 'must include a port, for example localhost:11434',
+  custom_public_ip:
+    'is a public IP address: enter a private address, or a hostname that resolves to one',
 };
 
 /**
@@ -231,6 +237,68 @@ function classifySchemaIssue(issue: t.SchemaIssue): {
   }
 }
 
+/** A bound the admin API reported as a number, or undefined (dates and bigints are not sent). */
+function numberBound(value: number | undefined): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+
+/**
+ * The issue code and message parameters of an issue the admin API reported
+ * with `params` (`issueParams`): its bounds, options and expected type, read
+ * the way the panel reads its own schema issues; a refinement's `reason`
+ * becomes `custom_<reason>` where the panel words it. Without params, or
+ * without the parameter a code's message needs, the code is worded without
+ * it (`paramlessIssueCode`).
+ */
+export function classifyReportedIssue(
+  code: string,
+  params: t.ReportedIssueParams | undefined,
+): { code: string; params?: Record<string, string | number> } {
+  if (!params) return { code: paramlessIssueCode(code) };
+  const bound = numberBound(code === 'too_big' ? params.maximum : params.minimum);
+  switch (code) {
+    case 'too_small':
+    case 'too_big':
+      if (bound === undefined) return { code: paramlessIssueCode(code) };
+      break;
+    case 'invalid_type':
+    case 'invalid_literal':
+      if (params.expected === undefined) return { code: paramlessIssueCode(code) };
+      break;
+    case 'invalid_enum_value':
+    case 'invalid_union_discriminator':
+      if (!params.options?.length) return { code: paramlessIssueCode('invalid_enum_value') };
+      return {
+        code: 'invalid_enum_value',
+        params: { options: params.options.map((option) => JSON.stringify(option)).join(', ') },
+      };
+    case 'not_multiple_of': {
+      const step = numberBound(params.multipleOf);
+      return step === undefined
+        ? { code: 'invalid_value' }
+        : { code, params: { multipleOf: step } };
+    }
+    case 'custom': {
+      const reasonCode = params.reason ? `custom_${params.reason}` : undefined;
+      return { code: reasonCode && reasonCode in ISSUE_MESSAGES ? reasonCode : code };
+    }
+    default:
+      break;
+  }
+  return classifySchemaIssue({
+    code,
+    path: [],
+    message: '',
+    expected: params.expected,
+    received: params.received,
+    minimum: bound,
+    maximum: bound,
+    inclusive: params.inclusive,
+    type: params.type,
+    validation: params.validation,
+  });
+}
+
 /** Config issues (stable codes, English messages) for schema issues relative to `basePath`. */
 export function toConfigIssues(issues: t.SchemaIssue[], basePath: string): t.ConfigIssue[] {
   return expandUnionIssues(issues)
diff --git a/src/utils/values.test.ts b/src/utils/values.test.ts
index 989d4746..88bd9207 100644
--- a/src/utils/values.test.ts
+++ b/src/utils/values.test.ts
@@ -318,6 +318,56 @@ describe('resolveShadowedBy (endpoints.all precedence)', () => {
       'gpt-5.6-luna',
     );
   });
+
+  describe("on a server that resolves titles per field (titleResolution: 'field')", () => {
+    const withTitles = (all: t.ConfigRecord): t.ConfigRecord => ({
+      endpoints: { all, openAI: { titleModel: 'gpt-5-mini', titleMethod: 'structured' } },
+    });
+
+    it('shadows a title setting only where `all` sets it', () => {
+      const tree = withTitles({ activityLabel: true, titleMethod: 'completion' });
+      expect(resolveShadowedBy('endpoints.openAI.titleModel', tree, {}, 'field')).toBeUndefined();
+      expect(resolveShadowedBy('endpoints.openAI.titleMethod', tree, {}, 'field')).toEqual({
+        path: 'endpoints.all.titleMethod',
+        value: 'completion',
+        precedence: 'field',
+      });
+      expect(resolveShadowedBy('endpoints.openAI.titleMethod', tree)?.precedence).toBe('block');
+    });
+
+    it('treats the title endpoint and model as one choice', () => {
+      const tree = withTitles({ titleEndpoint: 'anthropic' });
+      expect(resolveShadowedBy('endpoints.openAI.titleModel', tree, {}, 'field')).toEqual({
+        path: 'endpoints.all.titleModel',
+        value: undefined,
+        precedence: 'pair',
+      });
+      expect(
+        resolveShadowedBy(
+          'endpoints.custom.0.titleEndpoint',
+          withTitles({ titleModel: 'm' }),
+          {},
+          'field',
+        ),
+      ).toEqual({ path: 'endpoints.all.titleEndpoint', value: undefined, precedence: 'pair' });
+      expect(
+        resolveShadowedBy(
+          'endpoints.openAI.titleModel',
+          tree,
+          { 'endpoints.all.titleEndpoint': undefined },
+          'field',
+        ),
+      ).toBeUndefined();
+    });
+
+    it('is reported on the field state with the contract of the values', () => {
+      const data = valuesDataFixture(baseLayersFixture());
+      const state = (titleResolution?: t.ConfigRules['titleResolution']) =>
+        deriveFieldState('endpoints.openAI.titleModel', { ...data, titleResolution }).shadowedBy;
+      expect(state()?.precedence).toBe('block');
+      expect(state('field')).toBeUndefined();
+    });
+  });
 });
 
 describe('deriveFieldValue', () => {
diff --git a/src/utils/values.ts b/src/utils/values.ts
index 59d9c5ed..e806e807 100644
--- a/src/utils/values.ts
+++ b/src/utils/values.ts
@@ -40,8 +40,12 @@ const NO_VALUES_STATE: t.FieldState = {
   isHidden: false,
 };
 
-/** Title settings LibreChat reads from `endpoints.all` as a whole block whenever one exists. */
-const BLOCK_SHADOWED_KEYS: ReadonlySet<string> = new Set([
+/**
+ * Title settings. LibreChat reads them from `endpoints.all` as a whole block
+ * whenever one exists (`titleResolution: 'block'`), or per field like the
+ * settings below (`'field'`), with the title endpoint and model as one choice.
+ */
+const TITLE_KEYS: ReadonlySet<string> = new Set([
   'titleConvo',
   'titleModel',
   'titleMethod',
@@ -50,6 +54,9 @@ const BLOCK_SHADOWED_KEYS: ReadonlySet<string> = new Set([
   'titlePromptTemplate',
 ]);
 
+/** With `titleResolution: 'field'`, both come from the first layer that sets either. */
+const TITLE_ROUTING_KEYS: readonly string[] = ['titleEndpoint', 'titleModel'];
+
 /** Settings where a value in `endpoints.all` wins per field: title timing, stream rate, activity and reasoning labels. */
 const FIELD_SHADOWED_KEYS: ReadonlySet<string> = new Set([
   'titleTiming',
@@ -86,15 +93,20 @@ function sameValue(a: t.ConfigValue, b: t.ConfigValue): boolean {
 
 /**
  * The `endpoints.all` setting that takes precedence over a provider or custom
- * endpoint field (EV-8). Titles read the whole `all` block whenever one exists
- * (`endpoints.all ?? endpoints[x]`), so every per-endpoint title setting is
- * ignored, even one that `all` leaves unset. Activity and reasoning-label
- * settings resolve per field (`all[key] ?? endpoint[key]`).
+ * endpoint field (EV-8). Activity and reasoning-label settings resolve per
+ * field (`all[key] ?? endpoint[key]`). Titles, on a server that resolves them
+ * as a block (`titleResolution: 'block'`), read the whole `all` block
+ * whenever one exists (`endpoints.all ?? endpoints[x]`), so every
+ * per-endpoint title setting is ignored, even one that `all` leaves unset;
+ * on one that resolves them per field (`'field'`), only a title setting `all`
+ * sets wins, and the title endpoint and model are one choice: both come from
+ * `all` when it sets either.
  */
 export function resolveShadowedBy(
   path: string,
   root: t.ConfigValue,
   editedValues: t.FlatConfigMap = {},
+  titleResolution: t.ConfigRules['titleResolution'] = 'block',
 ): t.ShadowedBy | undefined {
   const segments = path.split('.');
   if (segments[0] !== 'endpoints') return undefined;
@@ -104,14 +116,21 @@ export function resolveShadowedBy(
   const isCustomField =
     segments.length === 4 && segments[1] === 'custom' && INDEX_SEGMENT.test(segments[2]);
   if (!isProviderField && !isCustomField) return undefined;
-  const isBlock = BLOCK_SHADOWED_KEYS.has(key);
-  if (!isBlock && !FIELD_SHADOWED_KEYS.has(key)) return undefined;
+  const isTitle = TITLE_KEYS.has(key);
+  if (!isTitle && !FIELD_SHADOWED_KEYS.has(key)) return undefined;
   const all = getValueAtPath(root, 'endpoints.all');
   if (!isConfigRecord(all)) return undefined;
+  const valueOf = (name: string): t.ConfigValue => {
+    const allPath = `endpoints.all.${name}`;
+    return allPath in editedValues ? editedValues[allPath] : all[name];
+  };
   const allPath = `endpoints.all.${key}`;
-  const value = allPath in editedValues ? editedValues[allPath] : all[key];
-  if (isBlock) return { path: allPath, value, precedence: 'block' };
-  return value === undefined ? undefined : { path: allPath, value, precedence: 'field' };
+  const value = valueOf(key);
+  if (isTitle && titleResolution === 'block') return { path: allPath, value, precedence: 'block' };
+  if (value !== undefined) return { path: allPath, value, precedence: 'field' };
+  if (!isTitle || !TITLE_ROUTING_KEYS.includes(key)) return undefined;
+  const other = TITLE_ROUTING_KEYS.find((name) => name !== key && valueOf(name) !== undefined);
+  return other ? { path: allPath, value, precedence: 'pair' } : undefined;
 }
 
 interface BaseReadout {
@@ -323,7 +342,7 @@ function deriveBaseModeState(
   const revertValue = revertTarget ? revertTarget.value : base.effective;
   const pending = readPending(path, data.editedValues, revertValue);
   /** D5: LibreChat reads this section only from librechat.yaml, so a stored override has no effect. */
-  if (base.isOverride && getReadOnlyReason(path) === 'yamlOnly') {
+  if (base.isOverride && getReadOnlyReason(path, data.writeRules) === 'yamlOnly') {
     return {
       value: pending.isEdited ? pending.value : base.lower.value,
       effective: base.lower.value,
@@ -343,6 +362,7 @@ function deriveBaseModeState(
     path,
     data.configValues ?? layers.effective,
     data.editedValues,
+    data.titleResolution,
   );
   return {
     value: pending.isEdited ? pending.value : (shown ?? base.effective),
@@ -392,6 +412,7 @@ function deriveScopeModeState(
     path,
     data.configValues ?? layers.effective,
     data.editedValues,
+    data.titleResolution,
   );
   return {
     value: pending.isEdited ? pending.value : (shown ?? effective),
diff --git a/src/utils/writes.test.ts b/src/utils/writes.test.ts
new file mode 100644
index 00000000..fec7a451
--- /dev/null
+++ b/src/utils/writes.test.ts
@@ -0,0 +1,169 @@
+import { describe, it, expect } from 'vitest';
+import type * as t from '@/types';
+import { BUNDLED_CONFIG_FEATURES, getWriteRules } from '@/constants';
+import { reportedPath, readWriteReport, getWriteSkipReason } from './writes';
+import { createServerContract } from '@/test/fixtures';
+import { entryLocation } from './collections';
+import { createPathIndex } from './paths';
+
+const REPORT: t.PatchFieldsResponse = {
+  config: { overrides: { interface: { modelSelect: true } } },
+  applied: [{ path: 'interface', segments: ['interface'] }],
+  skipped: [
+    {
+      path: 'interface.prompts',
+      segments: ['interface', 'prompts'],
+      reason: 'interface_permission',
+    },
+    { path: 'rateLimits', segments: ['rateLimits'], reason: 'deployment_only_path' },
+    {
+      path: 'endpoints.agents.pullRequests.provider',
+      segments: ['endpoints', 'agents', 'pullRequests', 'provider'],
+      reason: 'base_only_path',
+    },
+    { path: 'mcpServers.linear', segments: ['mcpServers', 'linear'], reason: 'process_mcp_server' },
+    { path: 'futureSection', segments: ['futureSection'], reason: 'some_future_reason' },
+  ],
+  ignored: [
+    {
+      path: 'endpoints.custom.Moonshot.apiKey',
+      segments: ['endpoints', 'custom', 'Moonshot', 'apiKey'],
+      reason: 'secret_rebinding',
+    },
+  ],
+};
+
+describe('readWriteReport', () => {
+  it('reads nothing from a server without a write report or credential rebinding', () => {
+    expect(readWriteReport(REPORT, BUNDLED_CONFIG_FEATURES)).toEqual([]);
+  });
+
+  it("words each location the server did not store, and each it leaves out, by the panel's reasons", () => {
+    const features = { ...BUNDLED_CONFIG_FEATURES, writeReport: true };
+    expect(readWriteReport(REPORT, features)).toEqual([
+      { fieldPath: 'interface.prompts', reason: 'permission' },
+      { fieldPath: 'rateLimits', reason: 'yamlOnly' },
+      { fieldPath: 'endpoints.agents.pullRequests.provider', reason: 'baseOnly' },
+      { fieldPath: 'mcpServers.linear', reason: 'processServer' },
+      { fieldPath: 'futureSection', reason: 'notStored' },
+      { fieldPath: 'endpoints.custom.Moonshot.apiKey', reason: 'secretRebinding' },
+    ]);
+  });
+
+  it('reads only the dropped credentials on a server that rebinds them without a write report', () => {
+    const features = { ...BUNDLED_CONFIG_FEATURES, secretRebinding: true };
+    expect(readWriteReport(REPORT, features)).toEqual([
+      { fieldPath: 'endpoints.custom.Moonshot.apiKey', reason: 'secretRebinding' },
+    ]);
+  });
+
+  describe('a dropped credential, for the changes a save made', () => {
+    const features = { ...BUNDLED_CONFIG_FEATURES, secretRebinding: true };
+    const dropped = (path: string, segments = path.split('.')) => ({
+      path,
+      segments,
+      reason: 'secret_rebinding',
+    });
+    const body: t.PatchFieldsResponse = {
+      ignored: [
+        dropped('endpoints.custom.Moonshot.apiKey'),
+        dropped('endpoints.custom.ollama.apiKey'),
+        dropped('endpoints.custom.Proxy.Two.apiKey', [
+          'endpoints',
+          'custom',
+          'Proxy.Two',
+          'apiKey',
+        ]),
+        dropped('mcpServers.github.apiKey.key'),
+        dropped('mcpServers.linear.oauth.client_secret'),
+        dropped('endpoints.azureOpenAI.groupMap.eastus.apiKey'),
+        dropped('ocr.apiKey'),
+        dropped('speech.tts.openai.apiKey'),
+      ],
+    };
+    const shownFor = (changed: string[]) =>
+      readWriteReport(body, features, createPathIndex(changed)).map(({ fieldPath }) => fieldPath);
+
+    it('is shown when the save changed its entry or the object holding it', () => {
+      expect(shownFor(['endpoints.custom.Moonshot'])).toEqual(['endpoints.custom.Moonshot.apiKey']);
+      expect(shownFor(['mcpServers.github.url'])).toEqual(['mcpServers.github.apiKey.key']);
+      expect(shownFor(['mcpServers.linear'])).toEqual(['mcpServers.linear.oauth.client_secret']);
+      expect(shownFor(['ocr.baseURL'])).toEqual(['ocr.apiKey']);
+      expect(shownFor(['speech.tts.openai.url'])).toEqual(['speech.tts.openai.apiKey']);
+    });
+
+    it('matches an entry by its served name, a dotted name whole, and Azure groups by their list', () => {
+      expect(shownFor([entryLocation('endpoints.custom', 'Ollama')])).toEqual([
+        'endpoints.custom.ollama.apiKey',
+      ]);
+      expect(shownFor(['endpoints.custom.Proxy.Two'])).toEqual(['endpoints.custom']);
+      expect(shownFor(['endpoints.azureOpenAI.groups'])).toEqual([
+        'endpoints.azureOpenAI.groupMap.eastus.apiKey',
+      ]);
+    });
+
+    it('is shown for a whole section the save wrote', () => {
+      expect(shownFor(['mcpServers'])).toEqual([
+        'mcpServers.github.apiKey.key',
+        'mcpServers.linear.oauth.client_secret',
+      ]);
+    });
+
+    it('is not repeated by a save elsewhere, even in the same section or record', () => {
+      expect(shownFor(['balance.startBalance'])).toEqual([]);
+      expect(shownFor(['endpoints.openAI.titleModel', 'endpoints.custom.GPT'])).toEqual([]);
+      expect(shownFor(['mcpServers.cloudflare.url', 'speech.tts.elevenlabs.url'])).toEqual([]);
+      expect(shownFor(['endpoints.azureOpenAI.titleModel', 'speech.stt.openai.url'])).toEqual([]);
+    });
+  });
+
+  it('ignores a reply without the lists, and a location it cannot name', () => {
+    const features = { ...BUNDLED_CONFIG_FEATURES, writeReport: true };
+    expect(readWriteReport({ config: null }, features)).toEqual([]);
+    expect(readWriteReport({ skipped: [{ reason: 'base_only_path' }] }, features)).toEqual([]);
+  });
+});
+
+describe('reportedPath', () => {
+  it('names a dotted record key by its record, and a location by its segments', () => {
+    expect(
+      reportedPath({
+        path: 'endpoints.bedrock.inferenceProfiles.us.anthropic.claude-sonnet-4-6',
+        segments: ['endpoints', 'bedrock', 'inferenceProfiles', 'us.anthropic.claude-sonnet-4-6'],
+      }),
+    ).toBe('endpoints.bedrock.inferenceProfiles');
+    expect(reportedPath({ segments: ['mcpServers', 'docs', 'url'] })).toBe('mcpServers.docs.url');
+    expect(reportedPath({ path: 'balance.startBalance' })).toBe('balance.startBalance');
+    expect(reportedPath({ segments: ['a.b'] })).toBe('a.b');
+  });
+});
+
+describe('getWriteSkipReason', () => {
+  const rules = getWriteRules(
+    createServerContract(
+      { preAuthBaseOverrides: true },
+      {
+        baseOnlySections: ['filters', 'turnstile'],
+        baseOnlyPaths: ['endpoints.agents.pullRequests.provider'],
+        deploymentOnlyPaths: {
+          includedTools: 'operator',
+          'endpoints.agents.eventDriven': 'startup',
+        },
+      },
+    ),
+  );
+
+  it("follows the server's rules: what it reads only from librechat.yaml, and what Base may now set", () => {
+    expect(getWriteSkipReason('registration.socialLogins', false)).toBe('yamlOnly');
+    expect(getWriteSkipReason('registration.socialLogins', false, rules)).toBeNull();
+    expect(getWriteSkipReason('includedTools', false, rules)).toBe('yamlOnly');
+    expect(getWriteSkipReason('includedTools', true, rules)).toBeNull();
+    expect(getWriteSkipReason('endpoints.agents.pullRequests.provider', false, rules)).toBe(
+      'yamlOnly',
+    );
+    expect(getWriteSkipReason('endpoints.agents.eventDriven', false, rules)).toBe('yamlOnly');
+    expect(getWriteSkipReason('filters.pii', true, rules)).toBe('baseOnly');
+    expect(getWriteSkipReason('rateLimits.fileUploads.ipMax', false, rules)).toBeNull();
+    expect(getWriteSkipReason('rateLimits.fileUploads.ipMax', false)).toBe('yamlOnly');
+  });
+});
diff --git a/src/utils/writes.ts b/src/utils/writes.ts
index 61c33f90..5742a21a 100644
--- a/src/utils/writes.ts
+++ b/src/utils/writes.ts
@@ -1,7 +1,9 @@
 import type * as t from '@/types';
 import {
   SKIP_REASON_KEYS,
-  YAML_MANAGED_FIELDS,
+  BUNDLED_WRITE_RULES,
+  REPORTED_SKIP_REASONS,
+  CREDENTIAL_ENTRY_RECORDS,
   DEDICATED_CONFIG_SECTIONS,
   getConfigSection,
   getReadOnlyReason,
@@ -9,6 +11,8 @@ import {
 } from '@/constants';
 import { isInterfacePermissionPath } from './interfacePermissions';
 import translation from '@/locales/en/translation.json';
+import { pathIndexOverlaps } from './paths';
+import { entryLocation } from './collections';
 import { getValueAtPath } from './format';
 
 /** English text for a skip reason, for server-side errors (the UI localizes `SKIP_REASON_KEYS`). */
@@ -23,21 +27,102 @@ export function describeSkipReason(reason: t.SkipReason): string {
  * pre-flight and every write path (save, import, profile saves). Removing a
  * stale override of a YAML-managed field, or of a section LibreChat only reads
  * from librechat.yaml, is allowed (it only removes data); writing one is not.
+ * `rules` are the server's (`getWriteRules`); the bundled ones by default.
  */
-export function getWriteSkipReason(path: string, isReset: boolean): t.SkipReason | null {
+export function getWriteSkipReason(
+  path: string,
+  isReset: boolean,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
+): t.SkipReason | null {
   if (isInterfacePermissionPath(path)) return 'permission';
-  const readOnly = getReadOnlyReason(path);
+  const readOnly = getReadOnlyReason(path, rules);
   if (readOnly && !(isReset && readOnly === 'yamlOnly')) return readOnly;
   if (DEDICATED_CONFIG_SECTIONS.has(getConfigSection(path))) return 'dedicated';
-  if (!isReset && isYamlManagedPath(path)) return 'yamlOnly';
+  if (!isReset && isYamlManagedPath(path, rules)) return 'yamlOnly';
   return null;
 }
 
 /** YAML-managed fields carried inside a value saved at an ancestor path (e.g. `endpoints.azureOpenAI`). */
-export function findYamlManagedValues(path: string, value: t.ConfigValue): string[] {
+export function findYamlManagedValues(
+  path: string,
+  value: t.ConfigValue,
+  rules: t.ConfigWriteRules = BUNDLED_WRITE_RULES,
+): string[] {
   const prefix = `${path}.`;
-  return [...YAML_MANAGED_FIELDS].filter(
+  return [...rules.yamlManagedFields].filter(
     (managed) =>
       managed.startsWith(prefix) && getValueAtPath(value, managed.slice(prefix.length)) != null,
   );
 }
+
+/**
+ * The path of a location the admin API reports, as the page shows it: a
+ * record key that holds a dot (`us.anthropic.claude-sonnet-4-6`) can't be
+ * told apart in a dotted path, so the location is its record's.
+ */
+export function reportedPath(location: t.ReportedLocation): string {
+  const { segments } = location;
+  if (!Array.isArray(segments) || segments.length === 0) return location.path ?? '';
+  const dotted = segments.findIndex((segment) => segment.includes('.'));
+  return (dotted === -1 ? segments : segments.slice(0, Math.max(dotted, 1))).join('.');
+}
+
+function toSkippedChanges(
+  items: t.ReportedSkip[] | undefined,
+  fallback: t.SkipReason,
+): t.SkippedChange[] {
+  if (!Array.isArray(items)) return [];
+  return items
+    .map((item) => ({
+      fieldPath: reportedPath(item),
+      reason: REPORTED_SKIP_REASONS[item.reason] ?? fallback,
+    }))
+    .filter((item) => item.fieldPath !== '');
+}
+
+/** A reported location key by key: its `segments`, else its dotted `path`. */
+function segmentsOf(location: t.ReportedLocation): string[] {
+  const { segments } = location;
+  if (Array.isArray(segments) && segments.length > 0) return segments;
+  return (location.path ?? '').split('.');
+}
+
+/**
+ * Where a credential the merge leaves out is set together with the destination
+ * it is sent to (`secretRebinding`): its entry in a record of named entries
+ * (`mcpServers.github` for `mcpServers.github.apiKey.key`, `CREDENTIAL_ENTRY_RECORDS`),
+ * else the object that holds it (`ocr` for `ocr.apiKey`).
+ */
+function credentialOwner(segments: readonly string[]): string {
+  for (let depth = 1; depth < segments.length; depth++) {
+    const edited = CREDENTIAL_ENTRY_RECORDS.get(segments.slice(0, depth).join('.'));
+    if (edited) return entryLocation(edited, segments[depth]);
+  }
+  return segments.slice(0, Math.max(segments.length - 1, 1)).join('.');
+}
+
+/**
+ * What a write's reply says did not take effect, with the panel's reasons:
+ * each location it did not store (`skipped`, from a server with
+ * `writeReport`), then each stored value the runtime merge leaves out
+ * (`ignored`: with `writeReport`, or a credential `secretRebinding` drops).
+ * A server without them reports neither, and nothing is read. `ignored`
+ * describes the whole stored document, so with the locations the save
+ * changes (`changed`, `WritePlan.changed`) only an entry whose owner the save
+ * changed is kept (`credentialOwner`: the custom endpoint, MCP server or
+ * object it is set in). A save elsewhere, even in the same section, does not
+ * repeat it, and one that no longer applies is not reported.
+ */
+export function readWriteReport(
+  body: t.PatchFieldsResponse,
+  features: t.ConfigFeatures,
+  changed?: t.PathIndex,
+): t.SkippedChange[] {
+  const skipped = features.writeReport ? toSkippedChanges(body.skipped, 'notStored') : [];
+  const readsIgnored = features.writeReport || features.secretRebinding;
+  if (!readsIgnored || !Array.isArray(body.ignored)) return skipped;
+  const ignored = changed
+    ? body.ignored.filter((item) => pathIndexOverlaps(changed, credentialOwner(segmentsOf(item))))
+    : body.ignored;
+  return [...skipped, ...toSkippedChanges(ignored, 'notApplied')];
+}

From 3e0743ef3aa66a7477ac31073c693ee7c11d5aac Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Fri, 23 Oct 2026 13:06:44 -0400
Subject: [PATCH 4/5] =?UTF-8?q?=F0=9F=8E=AF=20fix:=20Point=20Paired=20Shad?=
 =?UTF-8?q?ows=20to=20the=20Set=20Global=20Field,=20Keep=20YAML-Only=20Pat?=
 =?UTF-8?q?hs=20in=20Profile=20Merges,=20Count=20Partial=20Reports=20Apart?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../configuration/values/values.test.tsx      | 25 ++++++++-
 src/contexts/GlobalRevealContext.ts           |  2 +-
 src/hooks/config/import.test.tsx              | 37 ++++++++++++-
 src/hooks/config/import.ts                    | 14 +++--
 src/hooks/config/save.ts                      | 16 ++----
 src/locales/en/translation.json               |  2 +-
 src/server/config/save.test.ts                | 46 ++++++++++++----
 src/server/config/save.ts                     |  5 +-
 src/test/sections.tsx                         | 25 ++++++---
 src/types/changes.ts                          |  5 ++
 src/types/hooks.ts                            |  7 ++-
 src/types/values.ts                           |  2 +
 src/utils/layers.test.ts                      | 53 +++++++++++++++++++
 src/utils/layers.ts                           | 25 +++++++--
 src/utils/values.test.ts                      | 16 ++++--
 src/utils/values.ts                           |  5 +-
 src/utils/writes.ts                           | 11 ++++
 17 files changed, 244 insertions(+), 52 deletions(-)

diff --git a/src/components/configuration/values/values.test.tsx b/src/components/configuration/values/values.test.tsx
index ad584bf0..6bec4843 100644
--- a/src/components/configuration/values/values.test.tsx
+++ b/src/components/configuration/values/values.test.tsx
@@ -4,12 +4,14 @@ import { render, screen, renderHook, fireEvent } from '@testing-library/react';
 import type { ReactNode } from 'react';
 import type * as t from '@/types';
 import { baseLayersFixture, scopeLayersFixture, valuesDataFixture } from '@/test/layers';
+import { ProvenanceChip, FieldProvenance, ShadowBadge } from './ProvenanceChip';
 import { formatConfigValue, getRevertLabels, sourceLabel } from './labels';
 import { ConfigValuesProvider } from '@/contexts/ConfigValuesContext';
-import { ProvenanceChip, FieldProvenance } from './ProvenanceChip';
+import { GlobalRevealContext } from '@/contexts/GlobalRevealContext';
+import { deriveFieldState, resolveShadowedBy } from '@/utils';
 import { useFieldState, useRevertLabels } from '@/hooks';
 import { TabCountBadge } from './TabCountBadge';
-import { deriveFieldState } from '@/utils';
+import { labelForPath } from '../meta';
 
 vi.mock('@/hooks/useLocalize', () => ({
   useLocalize: () => (key: string, options?: Record<string, string | number>) =>
@@ -113,6 +115,25 @@ describe('ProvenanceChip', () => {
     expect(reason).toBeVisible();
   });
 
+  it('points a title model Global pairs away to the title endpoint Global sets', () => {
+    const tree = {
+      endpoints: { all: { titleEndpoint: 'anthropic' }, openAI: { titleModel: 'x' } },
+    };
+    const shadowedBy = resolveShadowedBy('endpoints.openAI.titleModel', tree, {}, 'field')!;
+    const reveal = vi.fn();
+    const { container } = render(
+      <GlobalRevealContext.Provider value={reveal}>
+        <ShadowBadge shadowedBy={shadowedBy} source="librechat.yaml" />
+      </GlobalRevealContext.Provider>,
+    );
+    const field = labelForPath('endpoints.all.titleEndpoint', localize);
+    expect(container.querySelector('.state-chip-reason')?.textContent).toBe(
+      `com_config_providers_shadow_pair${JSON.stringify({ field, source: 'librechat.yaml' })}`,
+    );
+    fireEvent.click(screen.getByRole('button', { name: /com_config_providers_shadow_go/ }));
+    expect(reveal).toHaveBeenCalledWith('endpoints.all.titleEndpoint');
+  });
+
   it('renders nothing for a plain default when asked to', () => {
     const state = deriveFieldState(
       'balance.autoRefillEnabled',
diff --git a/src/contexts/GlobalRevealContext.ts b/src/contexts/GlobalRevealContext.ts
index ca1cc9a2..79801af7 100644
--- a/src/contexts/GlobalRevealContext.ts
+++ b/src/contexts/GlobalRevealContext.ts
@@ -3,7 +3,7 @@ import { createContext } from 'react';
 /**
  * Opens a Global overrides (`endpoints.all`) setting: the configuration page
  * provides it, so an "Overridden by Global" chip on any tab (a provider card,
- * a custom endpoint) links to the value that wins (D11). Without a provider
+ * a custom endpoint) links to the setting that wins (D11). Without a provider
  * the chip has no link.
  */
 export const GlobalRevealContext = createContext<((path: string) => void) | null>(null);
diff --git a/src/hooks/config/import.test.tsx b/src/hooks/config/import.test.tsx
index e8772fc5..a40b8429 100644
--- a/src/hooks/config/import.test.tsx
+++ b/src/hooks/config/import.test.tsx
@@ -306,9 +306,9 @@ describe('useImportPreview', () => {
 });
 
 describe('useConfigImport', () => {
-  function renderImport(skipped: t.SkippedChange[]) {
+  function renderImport(skipped: t.SkippedChange[], reported: t.SkippedChange[] = []) {
     const client = new QueryClient();
-    const writeChanges = vi.fn<t.WriteChangesFn>().mockResolvedValue(skipped);
+    const writeChanges = vi.fn<t.WriteChangesFn>().mockResolvedValue({ skipped, reported });
     const describeSkipped = (items: t.SkippedChange[]) =>
       items.map((item) => item.fieldPath).join(', ');
     const wrapper = ({ children }: { children: ReactNode }) => (
@@ -354,4 +354,37 @@ describe('useConfigImport', () => {
       }),
     );
   });
+
+  it('counts an entry whose credential the server left out as imported, noting the credential', async () => {
+    const toast = vi.mocked(createToast);
+    toast.mockClear();
+    const credential = {
+      fieldPath: 'mcpServers.github.headers.Authorization',
+      reason: 'secretRebinding',
+    } as const;
+    const { result } = renderImport([], [credential]);
+    await act(() => result.current.handleImport({ target: { type: 'base' }, entries }));
+    expect(toast).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: 'warning',
+        title: 'Imported 2 values into the base configuration',
+        description: 'mcpServers.github.headers.Authorization',
+      }),
+    );
+  });
+
+  it('counts a change reported twice once', async () => {
+    const toast = vi.mocked(createToast);
+    toast.mockClear();
+    const notStored = { fieldPath: 'balance.startBalance', reason: 'notStored' } as const;
+    const { result } = renderImport([notStored, notStored]);
+    await act(() => result.current.handleImport({ target: { type: 'base' }, entries }));
+    expect(toast).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: 'warning',
+        title: 'Imported 1 value into the base configuration',
+        description: 'balance.startBalance',
+      }),
+    );
+  });
 });
diff --git a/src/hooks/config/import.ts b/src/hooks/config/import.ts
index ff58990b..85d46dde 100644
--- a/src/hooks/config/import.ts
+++ b/src/hooks/config/import.ts
@@ -4,6 +4,7 @@ import { useQuery, useQueryClient } from '@tanstack/react-query';
 import type * as t from '@/types';
 import {
   hasDottedKey,
+  uniqueSkipped,
   notifySuccess,
   notifyWarning,
   flattenObject,
@@ -497,11 +498,14 @@ export function useConfigImport({
           queryClient.invalidateQueries({ queryKey: ['groups'] }),
         ]);
       }
+      const result = await writeChanges(writeTarget, entries, []);
       /** Keys LibreChat merges back from the layer beneath are the merge an import asks for (D4), not a loss. */
-      const skipped = (await writeChanges(writeTarget, entries, [])).filter(
+      const lost = uniqueSkipped(result.skipped).filter(
         (item) => !MERGED_BACK_REASONS.has(item.reason),
       );
-      const written = Math.max(0, entries.length - skipped.length);
+      /** A part of an entry the server left out (a dropped credential) is noted; the entry is still written. */
+      const notes = [...lost, ...result.reported];
+      const written = Math.max(0, entries.length - lost.length);
       const message =
         writeTarget.type === 'scope'
           ? localize('com_config_import_profile_success', {
@@ -509,13 +513,13 @@ export function useConfigImport({
               name: `${scopeTypeLabel(writeTarget.scope, localize)}: ${writeTarget.scope.name}`,
             })
           : localize('com_config_import_base_success', { count: written });
-      if (skipped.length === 0) {
+      if (notes.length === 0) {
         notifySuccess(message);
         return;
       }
       const title =
-        written > 0 ? message : localize('com_config_nothing_stored', { count: skipped.length });
-      notifyWarning(title, describeSkipped(skipped));
+        written > 0 ? message : localize('com_config_nothing_stored', { count: lost.length });
+      notifyWarning(title, describeSkipped(notes));
     },
     [localize, queryClient, resolveTarget, writeChanges, describeSkipped],
   );
diff --git a/src/hooks/config/save.ts b/src/hooks/config/save.ts
index 512a94e2..60747e07 100644
--- a/src/hooks/config/save.ts
+++ b/src/hooks/config/save.ts
@@ -5,6 +5,7 @@ import {
   errorText,
   notifyInfo,
   notifyError,
+  uniqueSkipped,
   notifyWarning,
   notifySuccess,
   getValueAtPath,
@@ -54,17 +55,6 @@ function termsUrlOf(result: t.ApplyConfigChangesResult): string | null {
   return typeof issue.params?.url === 'string' ? issue.params.url : '';
 }
 
-/** Skipped changes without repeats (the client and the server can report the same path). */
-function uniqueSkipped(skipped: t.SkippedChange[]): t.SkippedChange[] {
-  const seen = new Set<string>();
-  return skipped.filter(({ fieldPath, reason }) => {
-    const key = `${fieldPath}|${reason}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}
-
 /**
  * The save pipeline of the configuration page (WS1). Pending edits become
  * `ConfigChange` ops (keyed collection entries by identity), which are
@@ -215,7 +205,7 @@ export function useConfigSave({
       if (result.issues.length > 0 || result.failed.length > 0) {
         throw new Error(describeFailure(result, []));
       }
-      return result.skipped;
+      return { skipped: result.skipped, reported: result.reported };
     },
     [applyChanges, describeFailure],
   );
@@ -446,7 +436,7 @@ export function useConfigSave({
       }
       clearEdits();
       announceWrite(
-        [...changeSet.payload.skipped, ...result.skipped],
+        [...changeSet.payload.skipped, ...result.skipped, ...result.reported],
         result.applied,
         localize('com_config_saved'),
       );
diff --git a/src/locales/en/translation.json b/src/locales/en/translation.json
index ffbe4ae5..a75f456a 100644
--- a/src/locales/en/translation.json
+++ b/src/locales/en/translation.json
@@ -1117,7 +1117,7 @@
   "com_config_providers_recursion_capped": "Max recursion limit ({{max}}) is below the recursion limit ({{limit}}), so agents get at most {{max}} steps per run.",
   "com_config_providers_shadow_block": "While Global overrides exist, LibreChat reads title settings only from them (Global {{field}}: {{value}}). This value ({{source}}) is ignored.",
   "com_config_providers_shadow_block_unset": "While Global overrides exist, LibreChat reads title settings only from them. Global doesn't set {{field}}, so LibreChat's default applies and this value ({{source}}) is ignored.",
-  "com_config_providers_shadow_pair": "Global overrides choose the title endpoint and model together. They set the other one and leave {{field}} unset, so LibreChat's default applies and this value ({{source}}) is ignored.",
+  "com_config_providers_shadow_pair": "Global overrides choose the title endpoint and model together. They set {{field}} and leave this one unset, so LibreChat's default applies and this value ({{source}}) is ignored.",
   "com_config_providers_shadow_field": "Global overrides set {{field}} to {{value}}, which takes precedence. This value ({{source}}) is ignored.",
   "com_config_providers_shadow_go": "Go to {{field}} in Global overrides",
   "com_config_providers_shadow_label": "Overridden by Global",
diff --git a/src/server/config/save.test.ts b/src/server/config/save.test.ts
index 2662c23a..f8c13fae 100644
--- a/src/server/config/save.test.ts
+++ b/src/server/config/save.test.ts
@@ -539,10 +539,8 @@ describe('applyConfigChanges — write reports, structured issues and codes', ()
       { op: 'set', path: 'balance.refillAmount', value: 6 },
     ]);
     expect(result).toMatchObject({ issues: [], failed: [], applied: 1 });
-    expect(result.skipped).toEqual([
-      { fieldPath: 'balance.refillAmount', reason: 'yamlOnly' },
-      { fieldPath: 'interface.prompts', reason: 'permission' },
-    ]);
+    expect(result.skipped).toEqual([{ fieldPath: 'balance.refillAmount', reason: 'yamlOnly' }]);
+    expect(result.reported).toEqual([{ fieldPath: 'interface.prompts', reason: 'permission' }]);
   });
 
   it('leaves the report alone on a server without writeReport', async () => {
@@ -596,19 +594,45 @@ describe('applyConfigChanges — write reports, structured issues and codes', ()
       { ...moonshot, baseURL: 'https://proxy.example.com/v1' },
       moonshot,
     );
-    expect((await applyConfigChanges(base, [change])).skipped).toEqual([]);
+    expect(await applyConfigChanges(base, [change])).toMatchObject({ skipped: [], reported: [] });
     api.current = createFakeAdminApi(yaml);
     api.current.reportMeta({ features: { secretRebinding: true } });
     api.current.reportWrites(() => ({ ignored }));
     const result = await applyConfigChanges(base, [change]);
-    expect(result).toMatchObject({ applied: 1, failed: [] });
-    expect(result.skipped).toEqual([
+    expect(result).toMatchObject({ applied: 1, failed: [], skipped: [] });
+    expect(result.reported).toEqual([
       { fieldPath: 'endpoints.custom.Moonshot.apiKey', reason: 'secretRebinding' },
     ]);
     const unrelated = await applyConfigChanges(base, [
       { op: 'set', path: 'balance.startBalance', value: 5 },
     ]);
-    expect(unrelated).toMatchObject({ applied: 1, skipped: [] });
+    expect(unrelated).toMatchObject({ applied: 1, skipped: [], reported: [] });
+  });
+
+  it('notes a dropped credential once, apart from the changes, however many PATCHes repeat it', async () => {
+    api.current!.reportMeta({
+      features: { secretRebinding: true },
+      limits: { maxPatchEntries: 1 },
+    });
+    api.current!.reportWrites(() => ({
+      ignored: [
+        {
+          path: 'endpoints.custom.Moonshot.apiKey',
+          segments: ['endpoints', 'custom', 'Moonshot', 'apiKey'],
+          reason: 'secret_rebinding',
+        },
+      ],
+    }));
+    const moonshot = customEntries[0];
+    const result = await applyConfigChanges(base, [
+      upsert('Moonshot', 'Moonshot', { ...moonshot, titleModel: 'kimi-k2' }, moonshot),
+      { op: 'set', path: 'balance.startBalance', value: 5 },
+    ]);
+    expect(api.current!.writes()).toHaveLength(2);
+    expect(result).toMatchObject({ applied: 2, failed: [], skipped: [] });
+    expect(result.reported).toEqual([
+      { fieldPath: 'endpoints.custom.Moonshot.apiKey', reason: 'secretRebinding' },
+    ]);
   });
 
   it("does not repeat a dropped credential on a later save of another endpoint's settings", async () => {
@@ -626,18 +650,18 @@ describe('applyConfigChanges — write reports, structured issues and codes', ()
     const title = await applyConfigChanges(base, [
       { op: 'set', path: 'endpoints.openAI.titleModel', value: 'gpt-5-nano' },
     ]);
-    expect(title).toMatchObject({ applied: 1, failed: [], skipped: [] });
+    expect(title).toMatchObject({ applied: 1, failed: [], skipped: [], reported: [] });
     const other = await applyConfigChanges(base, [
       upsert('GPT', 'GPT', { ...gpt, titleModel: 'gpt-4o-mini' }, gpt),
     ]);
-    expect(other).toMatchObject({ applied: 1, failed: [], skipped: [] });
+    expect(other).toMatchObject({ applied: 1, failed: [], skipped: [], reported: [] });
     expect(api.current!.writes().at(-1)).toMatchObject({
       body: { entries: [{ fieldPath: 'endpoints.custom' }] },
     });
     const same = await applyConfigChanges(base, [
       upsert('Moonshot', 'Moonshot', { ...moonshot, titleModel: 'kimi-k2' }, moonshot),
     ]);
-    expect(same.skipped).toEqual([
+    expect(same.reported).toEqual([
       { fieldPath: 'endpoints.custom.Moonshot.apiKey', reason: 'secretRebinding' },
     ]);
   });
diff --git a/src/server/config/save.ts b/src/server/config/save.ts
index 51278e71..c6c7122c 100644
--- a/src/server/config/save.ts
+++ b/src/server/config/save.ts
@@ -7,6 +7,7 @@ import {
   verifyWrite,
   getEntryKey,
   reportedPath,
+  uniqueSkipped,
   isConfigRecord,
   getValueAtPath,
   readWriteReport,
@@ -474,6 +475,7 @@ export async function applyConfigChanges(
     warnings: plan.warnings,
     issues: plan.issues,
     skipped: plan.skipped,
+    reported: [],
   };
   if (plan.issues.length > 0 || !hasWrites(plan)) return result;
   const outcome = await executePlan(target, plan, contract);
@@ -497,7 +499,8 @@ export async function applyConfigChanges(
   return {
     ...result,
     applied: Math.max(0, plan.effective - lost.size),
-    skipped: [...plan.skipped, ...notEffective, ...outcome.reported],
+    skipped: [...plan.skipped, ...notEffective],
+    reported: uniqueSkipped(outcome.reported),
   };
 }
 
diff --git a/src/test/sections.tsx b/src/test/sections.tsx
index dd832168..64a6d39a 100644
--- a/src/test/sections.tsx
+++ b/src/test/sections.tsx
@@ -71,7 +71,11 @@ export interface SectionsHarnessOptions {
 }
 
 /** Profile-mode (USER role) value layers over Base, built by the page's own code. */
-function profileLayers(base: t.ValueLayers, profile: t.ConfigRecord): t.ValueLayers {
+function profileLayers(
+  base: t.ValueLayers,
+  profile: t.ConfigRecord,
+  rules: t.ConfigWriteRules,
+): t.ValueLayers {
   const paths = collectLeafPaths(profile);
   return withScopeLayer(
     base,
@@ -83,14 +87,22 @@ function profileLayers(base: t.ValueLayers, profile: t.ConfigRecord): t.ValueLay
       tombstones: [],
     },
     SCHEMA_PATHS,
+    rules,
   );
 }
 
-/** Base-mode value layers from a librechat.yaml and base overrides, built by the page's own code. */
-export function baseLayers(yaml: t.ConfigRecord, overrides: t.ConfigRecord): t.ValueLayers {
+/**
+ * Base-mode value layers from a librechat.yaml and base overrides, built by
+ * the page's own code under a server's write `rules` (the bundled ones by default).
+ */
+export function baseLayers(
+  yaml: t.ConfigRecord,
+  overrides: t.ConfigRecord,
+  rules?: t.ConfigWriteRules,
+): t.ValueLayers {
   return createBaseLayers(
     {
-      config: mergeScopeLayer(yaml, overrides),
+      config: mergeScopeLayer(yaml, overrides, [], rules),
       yamlConfig: yaml,
       yamlPaths: collectLeafPaths(yaml),
       dbOverrides: overrides,
@@ -115,8 +127,9 @@ export function SectionsHarness({
   extraFields,
   contract = BUNDLED_CONFIG_CONTRACT,
 }: SectionsHarnessOptions) {
-  const base = baseLayers(yaml, overrides);
-  const layers = profile ? profileLayers(base, profile) : base;
+  const rules = getWriteRules(contract);
+  const base = baseLayers(yaml, overrides, rules);
+  const layers = profile ? profileLayers(base, profile, rules) : base;
   const [edited, setEdited] = useState<t.FlatConfigMap>({});
   const [values, setValues] = useState<t.ConfigRecord>(layers.effective ?? {});
   const configured = new Set(
diff --git a/src/types/changes.ts b/src/types/changes.ts
index 4dc8f72d..4d329cb3 100644
--- a/src/types/changes.ts
+++ b/src/types/changes.ts
@@ -143,6 +143,11 @@ export interface ApplyConfigChangesResult {
   issues: ConfigIssue[];
   /** Changes not sent (read-only, permission, …), not stored, or without effect, and why. */
   skipped: SkippedChange[];
+  /**
+   * Parts of written changes the server reported it did not store, or stores
+   * without effect (a credential it drops): the change itself is written.
+   */
+  reported: SkippedChange[];
   /** A failed write was rolled back to the overrides captured before it. */
   compensated?: boolean;
 }
diff --git a/src/types/hooks.ts b/src/types/hooks.ts
index df326f81..b214f7b4 100644
--- a/src/types/hooks.ts
+++ b/src/types/hooks.ts
@@ -12,6 +12,7 @@ import type {
   CollectionEdits,
   ConfigWarning,
   ChangeSummaryItem,
+  ApplyConfigChangesResult,
 } from './changes';
 import type {
   ConfigValue,
@@ -220,13 +221,15 @@ export interface ConfigEditsState {
 /**
  * Writes saves and resets to a target through the validated, all-or-nothing
  * apply; rejects with a readable summary when anything is invalid, and
- * resolves to the changes that were not stored or did not take effect.
+ * resolves to the changes that were not stored or did not take effect
+ * (`skipped`), apart from the parts of written ones the server reported
+ * (`reported`).
  */
 export type WriteChangesFn = (
   target: WriteTarget,
   saves: SaveEntry[],
   resets: string[],
-) => Promise<SkippedChange[]>;
+) => Promise<Pick<ApplyConfigChangesResult, 'skipped' | 'reported'>>;
 
 /** Toast for a finished write, listing anything that was not stored. */
 export type AnnounceWriteFn = (
diff --git a/src/types/values.ts b/src/types/values.ts
index 363ed60a..b1229cd5 100644
--- a/src/types/values.ts
+++ b/src/types/values.ts
@@ -38,7 +38,9 @@ export interface FieldLayer {
 
 /** A field whose own value is ignored because another path takes precedence (WS4, EV-8). */
 export interface ShadowedBy {
+  /** The setting that wins: Global's own field, or for `pair` the other half, which Global sets. */
   path: string;
+  /** What this field gets from Global (`undefined` where Global leaves it unset). */
   value: ConfigValue;
   /**
    * `block`: the whole other block wins, even where it leaves this field unset
diff --git a/src/utils/layers.test.ts b/src/utils/layers.test.ts
index 1cc53844..793f8e67 100644
--- a/src/utils/layers.test.ts
+++ b/src/utils/layers.test.ts
@@ -10,6 +10,7 @@ import {
 import { applyConfigEdit, buildSavePayload } from '@/components/configuration/edits';
 import { scopeLayersFixture, baseConfigFixture } from '@/test/layers';
 import { flattenObject, getValueAtPath } from './format';
+import { resolveWriteRules } from '@/constants';
 
 describe('mergeScopeLayer', () => {
   const base: t.ConfigRecord = {
@@ -67,6 +68,58 @@ describe('mergeScopeLayer', () => {
     expect(Object.keys(merged.mcpServers as t.ConfigRecord)).toEqual(['github']);
     expect(base.mcpServers).toHaveProperty('docs');
   });
+
+  it("keeps Base's value at the base-only and deployment-only paths a server reports, at any depth", () => {
+    const rules = resolveWriteRules(
+      {
+        baseOnlySections: [],
+        baseOnlyPaths: ['endpoints.agents.pullRequests.provider'],
+        deploymentOnlyPaths: {
+          'endpoints.agents.eventDriven': 'startup',
+          'mcpSettings.catalogRecovery.maxStateEntries': 'startup',
+        },
+      },
+      true,
+    );
+    const yaml: t.ConfigRecord = {
+      endpoints: {
+        agents: {
+          pullRequests: { provider: 'github', host: 'github.com' },
+          eventDriven: { enabled: true },
+        },
+      },
+      mcpSettings: { catalogRecovery: { maxStateEntries: 100, retryMs: 5 } },
+    };
+    const overridden = mergeScopeLayer(
+      yaml,
+      {
+        endpoints: { agents: { pullRequests: { provider: 'gitlab' }, eventDriven: { x: 1 } } },
+        mcpSettings: { catalogRecovery: { retryMs: 9 } },
+      },
+      ['mcpSettings.catalogRecovery.maxStateEntries'],
+      rules,
+    );
+    expect(overridden).toEqual({
+      endpoints: {
+        agents: {
+          pullRequests: { provider: 'github', host: 'github.com' },
+          eventDriven: { enabled: true },
+        },
+      },
+      mcpSettings: { catalogRecovery: { maxStateEntries: 100, retryMs: 9 } },
+    });
+    const hidden = mergeScopeLayer(yaml, {}, ['endpoints.agents'], rules);
+    expect(hidden.endpoints).toEqual({
+      agents: { pullRequests: { provider: 'github' }, eventDriven: { enabled: true } },
+    });
+    const added = mergeScopeLayer(
+      {},
+      { endpoints: { agents: { eventDriven: { x: 1 } } } },
+      [],
+      rules,
+    );
+    expect(getValueAtPath(added, 'endpoints.agents.eventDriven')).toBeUndefined();
+  });
 });
 
 describe('removeConfigPath / setConfigPath', () => {
diff --git a/src/utils/layers.ts b/src/utils/layers.ts
index cc8eadc7..df19741c 100644
--- a/src/utils/layers.ts
+++ b/src/utils/layers.ts
@@ -131,13 +131,32 @@ export function setConfigPath(
   return root;
 }
 
+/**
+ * `merged` with Base's value put back at each of `paths`, whatever an override
+ * or tombstone did there, inside it or at an ancestor (as LibreChat keeps its
+ * base-only paths).
+ */
+function keepBaseValues(
+  base: t.ConfigRecord,
+  merged: t.ConfigRecord,
+  paths: ReadonlySet<string>,
+): t.ConfigRecord {
+  let result = merged;
+  for (const path of paths) {
+    const value = getValueAtPath(base, path);
+    if (getValueAtPath(result, path) !== value) result = setConfigPath(result, path, value);
+  }
+  return result;
+}
+
 /**
  * The config a profile's members get, as far as one profile can tell: Base
  * (librechat.yaml plus base overrides) with the profile's overrides merged the
  * way LibreChat merges them (objects deep-merge, `endpoints.custom` merges by
  * name, other arrays are replaced) and its tombstoned paths removed. Sections a
- * profile cannot override (read-only by the server's write `rules`) keep their
- * Base values.
+ * profile cannot override (read-only by the server's write `rules`) and the
+ * fields only librechat.yaml sets inside the others (`yamlManagedFields`: the
+ * server's base-only and deployment-only paths) keep their Base values.
  */
 export function mergeScopeLayer(
   base: t.ConfigRecord,
@@ -156,7 +175,7 @@ export function mergeScopeLayer(
     if (readOnly.has(path.split('.')[0])) continue;
     merged = removeConfigPath(merged, path);
   }
-  return merged;
+  return keepBaseValues(base, merged, rules.yamlManagedFields);
 }
 
 function isStructuralEdit(value: t.ConfigValue): boolean {
diff --git a/src/utils/values.test.ts b/src/utils/values.test.ts
index 88bd9207..16f7bdf3 100644
--- a/src/utils/values.test.ts
+++ b/src/utils/values.test.ts
@@ -335,10 +335,10 @@ describe('resolveShadowedBy (endpoints.all precedence)', () => {
       expect(resolveShadowedBy('endpoints.openAI.titleMethod', tree)?.precedence).toBe('block');
     });
 
-    it('treats the title endpoint and model as one choice', () => {
+    it('treats the title endpoint and model as one choice, pointing to the half `all` sets', () => {
       const tree = withTitles({ titleEndpoint: 'anthropic' });
       expect(resolveShadowedBy('endpoints.openAI.titleModel', tree, {}, 'field')).toEqual({
-        path: 'endpoints.all.titleModel',
+        path: 'endpoints.all.titleEndpoint',
         value: undefined,
         precedence: 'pair',
       });
@@ -349,7 +349,17 @@ describe('resolveShadowedBy (endpoints.all precedence)', () => {
           {},
           'field',
         ),
-      ).toEqual({ path: 'endpoints.all.titleEndpoint', value: undefined, precedence: 'pair' });
+      ).toEqual({ path: 'endpoints.all.titleModel', value: undefined, precedence: 'pair' });
+      expect(
+        resolveShadowedBy(
+          'endpoints.openAI.titleModel',
+          withTitles({}),
+          {
+            'endpoints.all.titleEndpoint': 'anthropic',
+          },
+          'field',
+        )?.path,
+      ).toBe('endpoints.all.titleEndpoint');
       expect(
         resolveShadowedBy(
           'endpoints.openAI.titleModel',
diff --git a/src/utils/values.ts b/src/utils/values.ts
index e806e807..ed2b4220 100644
--- a/src/utils/values.ts
+++ b/src/utils/values.ts
@@ -100,7 +100,8 @@ function sameValue(a: t.ConfigValue, b: t.ConfigValue): boolean {
  * per-endpoint title setting is ignored, even one that `all` leaves unset;
  * on one that resolves them per field (`'field'`), only a title setting `all`
  * sets wins, and the title endpoint and model are one choice: both come from
- * `all` when it sets either.
+ * `all` when it sets either, so the half `all` leaves unset points to the
+ * half it sets.
  */
 export function resolveShadowedBy(
   path: string,
@@ -130,7 +131,7 @@ export function resolveShadowedBy(
   if (value !== undefined) return { path: allPath, value, precedence: 'field' };
   if (!isTitle || !TITLE_ROUTING_KEYS.includes(key)) return undefined;
   const other = TITLE_ROUTING_KEYS.find((name) => name !== key && valueOf(name) !== undefined);
-  return other ? { path: allPath, value, precedence: 'pair' } : undefined;
+  return other ? { path: `endpoints.all.${other}`, value, precedence: 'pair' } : undefined;
 }
 
 interface BaseReadout {
diff --git a/src/utils/writes.ts b/src/utils/writes.ts
index 5742a21a..95fa4192 100644
--- a/src/utils/writes.ts
+++ b/src/utils/writes.ts
@@ -15,6 +15,17 @@ import { pathIndexOverlaps } from './paths';
 import { entryLocation } from './collections';
 import { getValueAtPath } from './format';
 
+/** Skipped changes without repeats (the client, the server and each PATCH can report the same path). */
+export function uniqueSkipped(skipped: t.SkippedChange[]): t.SkippedChange[] {
+  const seen = new Set<string>();
+  return skipped.filter(({ fieldPath, reason }) => {
+    const key = `${fieldPath}|${reason}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
 /** English text for a skip reason, for server-side errors (the UI localizes `SKIP_REASON_KEYS`). */
 export function describeSkipReason(reason: t.SkipReason): string {
   const key = SKIP_REASON_KEYS[reason] as keyof typeof translation;

From 13fa47c9141c29ada6d68d1cd5cd9ddf08facc35 Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Fri, 23 Oct 2026 15:21:42 -0400
Subject: [PATCH 5/5] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20fix:=20Leave=20Rese?=
 =?UTF-8?q?rved=20Keys=20Out=20of=20an=20Imported=20Record=20Written=20Who?=
 =?UTF-8?q?le=20and=20Import=20the=20Rest?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/components/configuration/import.test.ts | 44 +++++++++++++++++++--
 src/utils/leaves.ts                         | 35 +++++++++++-----
 2 files changed, 66 insertions(+), 13 deletions(-)

diff --git a/src/components/configuration/import.test.ts b/src/components/configuration/import.test.ts
index 9594656f..d74bb30b 100644
--- a/src/components/configuration/import.test.ts
+++ b/src/components/configuration/import.test.ts
@@ -148,17 +148,53 @@ describe('planImport on a server that keeps dotted keys', () => {
     ]);
   });
 
-  it('still leaves out a record holding a $ key, as reserved', () => {
+  it('leaves a $ key out of a record written whole and imports the rest', () => {
     const plan = planImport(
-      { endpoints: { bedrock: { inferenceProfiles: { 'us.a.b': 'arn', $where: 'x' } } } },
+      {
+        endpoints: {
+          bedrock: { inferenceProfiles: { 'us.a.b': 'arn', $where: 'x', plain: 'arn:y' } },
+        },
+      },
       tree,
       paths,
       false,
       DOTTED,
     );
-    expect(plan.entries).toEqual([]);
+    expect(plan.entries).toEqual([
+      {
+        fieldPath: 'endpoints.bedrock.inferenceProfiles',
+        value: { 'us.a.b': 'arn', plain: 'arn:y' },
+      },
+    ]);
+    expect(plan.skipped).toEqual([
+      { fieldPath: 'endpoints.bedrock.inferenceProfiles', reason: 'reservedKey', key: '$where' },
+    ]);
+  });
+
+  it('leaves the reserved keys out of MCP headers written whole, each with its reason', () => {
+    const headers = JSON.parse(
+      '{"x.api.version": "1", "$where": "bad", "__proto__": "p", "prototype": "q"}',
+    ) as t.ConfigRecord;
+    const plan = planImport({ mcpServers: { github: { headers } } }, tree, paths, false, DOTTED);
+    expect(plan.entries).toEqual([
+      { fieldPath: 'mcpServers.github.headers', value: { 'x.api.version': '1' } },
+    ]);
+    expect(Object.getPrototypeOf(plan.entries[0].value)).toBe(Object.prototype);
+    expect(plan.skipped).toEqual(
+      ['$where', '__proto__', 'prototype'].map((key) => ({
+        fieldPath: 'mcpServers.github.headers',
+        reason: 'reservedKey',
+        key,
+      })),
+    );
+  });
+
+  it('reports a prototype name where a setting name belongs, as reserved', () => {
+    const balance = JSON.parse('{"constructor": 1, "refillAmount": 2}') as t.ConfigRecord;
+    const plan = planImport({ balance }, tree, paths, false, DOTTED);
+    expect(plan.entries).toEqual([{ fieldPath: 'balance.refillAmount', value: 2 }]);
     expect(plan.skipped).toEqual([
-      { fieldPath: 'endpoints.bedrock.inferenceProfiles', reason: 'reservedKey' },
+      { fieldPath: 'balance', reason: 'reservedKey', key: 'constructor' },
     ]);
   });
 
diff --git a/src/utils/leaves.ts b/src/utils/leaves.ts
index 7794b60e..040fb5ea 100644
--- a/src/utils/leaves.ts
+++ b/src/utils/leaves.ts
@@ -51,15 +51,34 @@ function holdsGroups(path: string, value: t.ConfigRecord): boolean {
   return names.length > 0 && names.every((name) => GROUP_TYPES.has(name));
 }
 
+/**
+ * Whether `key` of the object at `prefix` can be imported. A key the admin
+ * API can't store (`isUnsafeConfigKey`) is reported in `unsafe`; a prototype
+ * name it would store is dropped.
+ */
+function isImportableKey(
+  key: string,
+  prefix: string,
+  out: t.ImportLeaves,
+  allowDots: boolean,
+): boolean {
+  if (isUnsafeConfigKey(key, allowDots)) {
+    out.unsafe.push({ path: prefix, key });
+    return false;
+  }
+  return !DANGEROUS_KEYS.has(key);
+}
+
 /**
  * Leaves of `value` by dot-path, like `flattenObject`, except that a key the
  * admin API can't store (`isUnsafeConfigKey`) is never split into a nested
  * path: it is reported in `unsafe` and its value is left out. With
  * `allowDots` (the server's `dottedKeys`), a record of plain values that
  * holds a dotted key is one leaf at its own path (a dot-path can't address
- * the key); a dotted name in a record of setting groups is reported in
- * `dottedNames` (its fields are written one by one, by path), and a dotted
- * key where the schema expects a setting name in `dotted`.
+ * the key), without its reserved keys (reported in `unsafe`, so the rest
+ * is still imported); a dotted name in a record of setting groups is
+ * reported in `dottedNames` (its fields are written one by one, by path),
+ * and a dotted key where the schema expects a setting name in `dotted`.
  */
 function collectLeaves(
   value: t.ConfigRecord,
@@ -69,15 +88,13 @@ function collectLeaves(
 ): void {
   const freeKeys = allowDots && hasDottedKey(value) && holdsFreeKeys(prefix);
   if (freeKeys && !holdsGroups(prefix, value)) {
-    out.leaves[prefix] = value;
+    out.leaves[prefix] = Object.fromEntries(
+      Object.entries(value).filter(([key]) => isImportableKey(key, prefix, out, allowDots)),
+    );
     return;
   }
   for (const [key, child] of Object.entries(value)) {
-    if (DANGEROUS_KEYS.has(key)) continue;
-    if (isUnsafeConfigKey(key, allowDots)) {
-      out.unsafe.push({ path: prefix, key });
-      continue;
-    }
+    if (!isImportableKey(key, prefix, out, allowDots)) continue;
     if (key.includes('.')) {
       (freeKeys ? out.dottedNames : out.dotted).push({ path: prefix, key });
       continue;