diff --git a/.env.example b/.env.example
index a929584..3eae5c2 100644
--- a/.env.example
+++ b/.env.example
@@ -117,6 +117,20 @@ THINK_KIND_WINDOW_SEC=7200
 QUIET_START_HOUR=23
 QUIET_END_HOUR=7
 
+# ---- 推送出口（D1，主动推送的两级投递）----
+# 主动消息在 WS/IM 投递之外，异步镜像到「主人自建统一推送服务」（主通道）。
+# 该服务不可达/未配时，日志注明「个推(Getui)回退待接入」——当前无 Getui SDK，不伪造投递。
+# 填写自建服务的 webhook 地址并置 ENABLE=true 即启用；token 只走 Authorization 头，不落日志。
+PUSH_EXPORTER_ENABLED=false
+# PUSH_EXPORTER_URL=https://push.example.com/webhook
+# PUSH_EXPORTER_TOKEN=change-me
+# PUSH_EXPORTER_TIMEOUT_SEC=5
+# 个推（Getui）回退字段：预留占位，SDK 未接入，当前不生效。
+# GETUI_APP_ID=
+# GETUI_APP_KEY=
+# GETUI_MASTER_SECRET=
+# GETUI_BASE_URL=
+
 # ---- WebSocket ----
 WS_MAX_CONNECTIONS=1000
 SESSION_IDLE_TIMEOUT_MIN=30
diff --git a/Docs/api-client.md b/Docs/api-client.md
index e98d60f..2299ec0 100644
--- a/Docs/api-client.md
+++ b/Docs/api-client.md
@@ -65,7 +65,7 @@
 | 11 | `/api/v1/admin/backthink` | GET | ✅ | 后台思考记录 |
 | 12 | `/api/v1/admin/rag` | GET | ✅ | 知识库文档列表（分块/嵌入状态）；带 `?query=` 时并入检索结果 |
 | 13 | `/api/v1/admin/rag/query` | POST | ✅ | 知识库检索（真实检索；配置向量增强走语义路径） |
-| 14 | `/api/v1/admin/rag/delete` | POST | 🕐(写) | 删除知识库文档；写操作 M10，当前返回 `501 not_implemented` |
+| 14 | `/api/v1/admin/rag/delete` | POST | ✅(写) | 删除知识库文档（**真实删除**：项目索引条目 + 级联章节）；owner-only，`{id}` → `{id,deleted:true}`，不存在 `404` |
 | 15 | `/api/v1/admin/observability/metrics` | GET | ✅ | 网关请求指标（总数/QPS/延迟/方法·路径·状态计数/LLM·子代理计数） |
 | 16 | `/api/v1/admin/observability/trace` | GET | ✅ | 最近 trace span（环形缓冲，默认 512 条） |
 | 17 | `/api/v1/admin/observability/audit` | GET | ✅ | 审计记录（who/what/when/result，SQLite 持久化） |
@@ -76,16 +76,16 @@
 | 22 | `/api/v1/admin/system/backup` | POST | ✅(写) | 备份数据（owner-only，审计）；用 SQLite `VACUUM INTO` 快照（含已提交 WAL 内容）到 `<dataDir>/backup-<ts>.db` → `{path,size}` |
 | 23 | `/api/v1/admin/system/restore` | POST | ✅(写) | 恢复数据（owner-only，审计）；body `{path}` → 校验路径在 dataDir 内→**先备份当前**→替换 DB 文件→`{restored:true,backup,note:"需重启后生效"}`（运行进程持有 DB 句柄，热替换需重启可见） |
 
-> **M10 前端契约补充（管理面板）**：`GET /api/v1/admin/users` · `GET /api/v1/admin/llm` · `GET /api/v1/admin/automations` · `GET /api/v1/admin/backthink` · `GET /api/v1/admin/rag` · `POST /api/v1/admin/rag/query` · `GET /api/v1/admin/observability/metrics` · `GET /api/v1/admin/observability/trace` · `GET /api/v1/admin/observability/audit` 已实现，返回真实数据；`GET /api/v1/admin/logs` 仍🕐未实现（前端按契约封装、后端 404 时显示"待实现"壳，不报错）。**写操作已补齐**（见下方「管理面板写操作契约」）：人格/API key/设备控制/自动化/LLM 测试/渠道连接与识别测试/记忆检索/会话导出/插件卸载**真实持久化或真实生效**；**系统设置安全与存储类**（吊销 API key / 轮换 JWT 密钥 / 备份 / 恢复）也已**真实实现**（见下方「系统设置契约」）；仍为后置 M10：**新增用户**、**IoT 场景与规则**、**主人档案保存**、**编辑环境变量/重启服务/检查更新**、**知识库删除**——后端如实返回 `501 not_implemented`，不伪造成功。（**插件安装已实现**：v1 为 MCP server 热安装，见下方写操作契约。）
+> **M10 前端契约补充（管理面板）**：`GET /api/v1/admin/users` · `GET /api/v1/admin/llm` · `GET /api/v1/admin/automations` · `GET /api/v1/admin/backthink` · `GET /api/v1/admin/rag` · `POST /api/v1/admin/rag/query` · `GET /api/v1/admin/observability/metrics` · `GET /api/v1/admin/observability/trace` · `GET /api/v1/admin/observability/audit` 已实现，返回真实数据；`GET /api/v1/admin/logs` 仍🕐未实现（前端按契约封装、后端 404 时显示"待实现"壳，不报错）。**写操作已补齐**（见下方「管理面板写操作契约」）：人格/API key/设备控制/自动化/LLM 测试/渠道连接与识别测试/记忆检索/会话导出/插件卸载**真实持久化或真实生效**；**系统设置安全与存储类**（吊销 API key / 轮换 JWT 密钥 / 备份 / 恢复）也已**真实实现**（见下方「系统设置契约」）；仍为后置 M10：**新增用户**、**IoT 场景与规则**、**主人档案保存**、**编辑环境变量/重启服务/检查更新**——后端如实返回 `501 not_implemented`，不伪造成功。（**知识库删除已实现**：`POST /admin/rag/delete` 真实删除，见下方写操作契约；**插件安装已实现**：v1 为 MCP server 热安装。）
 
 **管理面板写操作契约**（`POST/PUT/DELETE /api/v1/admin/*`，均 **owner-only**，读为 owner/admin；写操作经 audit 落 `audit_logs`；成功 `{data}` / 失败 `{error:{code,message}}`）：
 - `POST /admin/personas` body `{id,name,role,systemPrompt?,characterRef?,modes?/mode?,memoryNamespace?}` → `201 {data:{id,name,character,isDefault,mode,memoryNamespace}}`（注册进 persona registry + 持久化到 `configs/personas/<id>.yaml`）；id 已存在回 `409 duplicate`。
 - `PUT /admin/personas/{id}` body 同上（不含 id）→ `200 {data:PersonaSummary}`；不存在回 `404`。
-- `POST /admin/users` → `501 not_implemented`（无持久用户表，当前为单 admin + APIKey 现状）。
+- `POST /admin/users` → `501 not_implemented`（**无用户表**：登录仅用 `.env` 单 admin `ADMIN_USERNAME`/`ADMIN_PASSWORD`，角色为 `owner>admin>viewer` 常量；多用户存储 + 登录接入需先设计——design/11 单用户为主。不做「建了却登不进」的假用户）。
 - `POST /admin/users/apikey` body `{role:"owner|admin|viewer"}` → `201 {data:{id:<掩码>, key:<明文·仅此一次>, role}}`。`key` 仅此响应出现一次。
 - `DELETE /admin/users/apikey/{id}`（`id`=列表掩码）→ `200 {data:{id,revoked:true}}`；未命中 `404`。
 - `POST /admin/iot/{id}/control` body `{action,params?}` → `200 {data:{id,name,type,state,online}}`（真实下发到 IoT provider）；`404` 设备不存在 / `400` 动作不支持或参数错 / `409` 设备离线。
-- `POST /admin/iot/scenarios`、`POST /admin/iot/rules` → `501 not_implemented`（IoT 无场景/规则存储）。
+- `POST /admin/iot/scenarios`、`POST /admin/iot/rules` → `501 not_implemented`（**IoT 无场景/规则模型与存储**：`iot.Provider` 只有设备列表/控制/状态；通用 `automations` 只跑 cron/事件规则，不含设备状态条件 + 设备动作执行器。场景/规则 CRUD 需先新增模型 + 执行器）。
 - `POST /admin/automations` body `{name,kind:"cron|event",expression}` → `201 {data:{id,name,kind}}`（真实注册规则）；无效 cron/规则回 `400 invalid_cron|invalid_rule`。
 - `POST /admin/automations/{id}/run` → `200 {data:{id,output}}`（手动触发）；`404`。
 - `DELETE /admin/automations/{id}` → `200 {data:{id,deleted:true}}`；`404`。
@@ -119,7 +119,7 @@
 - `GET /admin/rag` → `{"data":{"documents":[{id,name,desc?,chunks,embedded}],"hits"?:[{docId,docName,chapter?,text,score,semantic}]}}`。`hits` 仅在携带 `?query=` 时出现；`embedded` 反映部署是否配置向量增强（未配置为待嵌入）。
 - `POST /admin/rag` body `{"name","desc?","content"}` → `201 {"data":{"name"}}`。**导入文档**：后端分块（空行分段，超长段按固定长度切）并落项目索引（项目+章节），立即可被关键词/行上下文检索；未注入 `RagStore` 回 `501`。语义/向量嵌入为优雅降级（知识库 Store 不直属向量索引，导入文档走 keyword/line 路径；语义检索仍对既有 project-linked 记忆生效）。
 - `POST /admin/rag/query` body `{"query":"..."}` → `{"data":{"query":"...","hits":[{docId,docName,chapter?,text,score,semantic}]}}`。检索走项目索引关键词+行上下文；配置 pgvector/向量增强时并入语义/向量命中（`semantic:true`）。
-- `POST /admin/rag/delete` body `{"id":"..."}` → 删除为后置 M10，返回 `501` `{"error":{"code":"not_implemented",...}}`。
+- `POST /admin/rag/delete` body `{"id":"..."}` → `200 {"data":{"id":"...","deleted":true}}`。**真实删除**：从项目索引删除该文档条目并**级联删除其全部章节**（单事务），删除后 `GET /admin/rag` 不再出现、检索不再命中。`id` 缺失/空白回 `400`；文档不存在回 `404 not_found`；未注入 `RagStore` 回 `501`（**owner-only + 审计 `rag.delete`**）。
 
 **可观测性契约**（`GET /api/v1/admin/observability/*`，均需 owner/admin，`?limit=N` 缺省 50、上限 500）：
 - `GET /metrics` → `{"data":{"totalRequests","qps","avgLatencyMs","maxLatencyMs","perMethod{}","perPath{}","statusCounts{}","llmCalls","subagentEvents"}}`。`qps` 为近 1 秒窗口计数；`llmCalls`/`subagentEvents` 由实际观测到的 trace span 按 `kind` 累计（Tracer 未注入时为 0）。**Token/成本后端不统计、不返回**（不伪造指标）。
@@ -185,6 +185,7 @@
 - **载荷**：`{type:"proactive_message", data:{platform?, channelId?, channelType?, content, contentType?, sender?, timestamp?, messageId?}}`（由 `adapter.UnifiedMessage` 脱敏投影：**不含 RawData / 媒体字节 / token**，绝不让凭据漏到前端）。
 - **客户端处理**：仅 owner/admin 收到；渲染成一条「她从某平台主动发来」的气泡（内容 + platform + sender + timestamp）。**与 `message_persisted` 的区别**：`message_persisted` 是你与她的对话回显；`proactive_message` 是**她未经你输入**主动推的消息（如 IoT 完成事件、后台思考结论），两路不同、不要混用去重。
 - **红线**：owner-only；payload 已脱敏；backthink 每次主动推送**只发一个决策平台**（决策渠道→最近活跃→旋转回退），Web 端与 IM 桥为两条投递路，客户端不要据此断言「所有平台都发了」。
+- **推送出口（D1，对客户端无新端点）**：在 WS/IM 投递之外，后端会把主动消息**异步镜像**到「推送出口」——主通道是**主人自建统一推送服务**（`PUSH_EXPORTER_URL` webhook，HTTP POST JSON `{source,title,content,platform,timestamp}`，可带 `Authorization: Bearer <PUSH_EXPORTER_TOKEN>`），回退是**个推 Getui**（字段预留、SDK 未接入）。该出口只影响**出站投递**，不改变 WS 事件契约；未配/不可达时只记日志（注明「个推回退待接入」），**不影响**上面的 WS/IM 投递。移动端接入自建推送服务即可收到主人主动消息。
 
 ## 4. 客户端接入指引（Web / 移动 / 原生 / IM bridge 通用）
 
@@ -221,6 +222,7 @@
 - 语音：上行 `voice_input`（base64 音频或已转写 text），下行 `voice_output`（合成音频 base64 + text）。
 
 ## 5. 变更记录
+- `v0.31`（**Android 协同批次 ③b：B5 剩余 501 + D1 推送出口钩子**）：① **B5-知识库删除由 501 改为真实实现**：`POST /api/v1/admin/rag/delete` body `{"id"}` → `200 {data:{id,deleted:true}}`——从项目索引删除该文档条目并**级联删除全部章节**（单事务）；不存在回 `404 not_found`，`id` 空回 `400`，未注入 store 回 `501`；路由由 admin 收紧为 **owner-only**（与其它 admin 写一致）+ 审计 `rag.delete`。② **B5-新增用户 / IoT 场景 / IoT 规则仍诚实 501**：无用户表（登录仅 `.env` 单 admin）、IoT 无场景/规则模型与存储（`iot.Provider` 只有设备列表/控制/状态），错误消息明确缺什么，**不伪造 store/假成功**。③ **D1 推送出口钩子**：主动消息在 WS/IM 投递之外异步镜像到外部推送出口，**自建统一推送服务优先 → 个推(Getui)兜底**（个推 SDK 未接入，仅预留 `GETUI_*` 字段，不可达时日志注明待接入）；`.env` 新增 `PUSH_EXPORTER_ENABLED/URL/TOKEN/TIMEOUT_SEC`，token 只走 `Authorization` 头、不落日志；**对客户端无新端点**（详见 §3.6）。
 - `v0.30`（**Android 协同批次 ③a：D2 消息搜索 / D3 消息编辑删除 / D5 会话置顶**）：① **D2**：`GET /api/v1/sessions/{id}/messages` 新增可选 **`q`**——**会话内**内容搜索（大小写不敏感 ASCII LIKE，`%`/`_`/`\` 转义为字面量），仍倒序 + `before`/`limit` 游标；`q` 与 `after` 互斥（同传 `400`），空 `q` 走普通分页；**严格限定单会话，不新增跨会话搜索**（避免群聊/陌生人隔离会话外泄，红线）。`HistoryStore` 新增 `Search`。② **D3**：新增 `PATCH /api/v1/messages/{id}`（body `{content}`，非空 ≤4000 rune → `{data:{message}}`，只改 content）与 `DELETE /api/v1/messages/{id}`（→ `{data:{deleted:id}}`）；不存在回 `404 not_found`；`HistoryStore` 新增 `UpdateMessage`/`DeleteMessage` + `ErrMessageNotFound`。**不新增重发端点**（客户端用编辑后的 content 再发）。③ **D5**：`chat_sessions` 新增 `pinned INTEGER NOT NULL DEFAULT 0`（迁移 **0009**，down 可逆）；`GET /sessions` 排序改为 **`pinned DESC` → 主会话优先 → `createdAt ASC`**，会话 DTO 新增恒返回的 **`pinned`** bool；`PATCH /sessions/{id}` 扩展为 body `{title?,pinned?}`（至少一个字段，只回显变更字段，title-only 保持 A4 形状）；`HistoryStore` 新增 `SetPinned`。全部为 owner/admin 写、读消息 owner/admin；未注入 HistoryStore 回 `501`。
 - `v0.29`（**/admin/llm 读-改-写合并**）：`POST /api/v1/admin/llm` 由「全量替换」改为**部分编辑合并**——请求体字段用指针区分「未给」与「显式零值」；`maxTokens` / `apiKey` / `provider` / `baseUrl` / `model` / `fallback` / `multimodal` **省略即保留原值**（不再把省略的 `maxTokens` 重置为 0），新组仍要求 `baseUrl`+`model`、非法 provider / 负 maxTokens 仍 `400`。面板 LLM 页新增每组 `maxTokens` 展示/编辑 + 新增/编辑表单；面板插件页新增「已装插件列表」+「安装 MCP 插件」表单（kind/name/transport/endpoint|command+args/apiKey/env），api.ts 请求体带 `config`（修掉旧 body 400）。`runtimeconfig/models.go` 新增 `Find`。
 - `v0.28`（**MCP 插件热安装/卸载**）：`POST /api/v1/admin/plugins/install`（**由 501 改为真实实现**，owner-only + 审计）body `{kind:"mcp",name,config:{transport,endpoint?|command?,args?,apiKey?,env?}}` → `200 {data:{installed,name,kind,transport,toolCount}}`——真实连接 MCP server、发现并**热注册工具**进 capability registry（下一轮模型请求即注入），配置落盘 `plugins.json`（gitignore、0600）；连接失败回 `502` 且**不落盘**；同名重复 = 刷新。`POST /api/v1/admin/plugins/uninstall` 扩展：MCP 插件走 `Unregister`（移除工具 + close + 删配置），普通能力保持原 `registry.Remove`。新增 `GET /api/v1/admin/plugins/installed`（owner/admin 读）列出已装插件（`apiKey`/敏感 `env` 掩码 + `live`/`toolCount`）。`mcp.MCPConfig` 新增 `APIKey`（http/sse 以 `Authorization: Bearer` 发送）与 `Env`（stdio 子进程环境）；`plugins.json` 于启动时 `Restore` 重新安装。**契约版本 `v0.28`**。
diff --git a/Docs/api-reference.md b/Docs/api-reference.md
index 6b24cbe..964a5de 100644
--- a/Docs/api-reference.md
+++ b/Docs/api-reference.md
@@ -65,6 +65,9 @@
 | 6 | GET | `/api/v1/sessions/{id}/messages` | owner\|admin | 200 | 会话消息热分页 | M16 |
 | 7 | POST | `/api/v1/sessions` | owner\|admin | 201 | 新建次级会话 | M16 |
 | 8 | DELETE | `/api/v1/sessions/{id}` | owner\|admin | 200 | 删除次级会话 | M16 |
+| 9 | PATCH | `/api/v1/sessions/{id}` | owner\|admin | 200 | 会话改名(A4) + 置顶(`pinned`, D5) body `{title?,pinned?}` | M16 |
+| 10 | PATCH | `/api/v1/messages/{id}` | owner\|admin | 200 | 编辑单条消息(D3) body `{content}` | M16 |
+| 11 | DELETE | `/api/v1/messages/{id}` | owner\|admin | 200 | 删除单条消息(D3) | M16 |
 
 ### 1.3 管理后台（`/api/v1/admin/*`）
 
@@ -86,7 +89,7 @@
 | 20 | GET | `/api/v1/admin/backthink` | owner\|admin | 200 | 后台思考记录 | M9/M10 |
 | 21 | GET | `/api/v1/admin/rag` | owner\|admin | 200 | 知识库文档列表（可带 `?query=` 并入命中） | M10 |
 | 22 | POST | `/api/v1/admin/rag/query` | owner\|admin | 200 | 知识库检索 | M10 |
-| 23 | POST | `/api/v1/admin/rag/delete` | owner\|admin | 501 | 删除文档（写为 M10，当前 501） | M10 |
+| 23 | POST | `/api/v1/admin/rag/delete` | **owner** | 200/404 | 删除知识文档（项目索引条目 + 级联章节，真实删除；不存在 404） | 后 M12 |
 | 24 | GET | `/api/v1/admin/observability/metrics` | owner\|admin | 200 | 网关请求指标 | M10 |
 | 25 | GET | `/api/v1/admin/observability/trace` | owner\|admin | 200 | 最近 trace span | M10 |
 | 26 | GET | `/api/v1/admin/observability/audit` | owner\|admin | 200 | 审计记录 | M10 |
@@ -298,6 +301,7 @@ curl -s http://<host>:8080/api/v1/personas -H "Authorization: Bearer $TOKEN" -H
   | `limit` | int | 否 | 50 | 页大小，需 `>=1`，钳制上限 200（`maxPageLimit`）；非法回 400 |
   | `before` | int64 | 否 | 0 | 游标：上一页最旧消息的 `createdAt`（Unix 毫秒），向更旧翻页 |
   | `after` | int64 | 否 | 0 | **正向增量**（A5）：返回 `created_at > after`，**升序**；与 `before` **互斥**（同传 400）；负数/非数字回 400 |
+  | `q` | string | 否 | - | **会话内搜索**（D2）：`content LIKE` 大小写不敏感，`%`/`_`/`\` 转义为字面量；仍倒序 + before/limit 游标；与 `after` 互斥（同传 400）；空 `q` 走普通分页；**严格限定单会话**（隔离会话不外泄） |
   | `platform` | string | 否 | - | 来源平台过滤（design/16 §4.4）。Web 端不传 = 全量共享主会话；IM 传本平台（如 `telegram`）只拉本渠道消息 |
 - **响应**：`200` `{"data":[<historyMessage>...]}`；**`before` 时按时间倒序**（newest first，需 `reverse()` 渲染）；**`after` 时按时间升序**（最旧在前，可直接顺序渲染/追加）。
 
@@ -1155,8 +1159,8 @@ TOKEN=$(curl -s -X POST http://<host>:8080/api/v1/auth/login \
 
 ### 8.4 里程碑与未实现集合（诚实标注）
 
-- **已真实实现**：登录/健康检查/聊天（同步+流式）/会话（列表/新建/删除/消息分页）/人格/管理读（personas/sessions/memories/plugins/channels/iot/llm/users/automations/backthink/rag/observability×3）/管理写（人格/API key/设备控制/自动化/LLM 保存·测试/渠道连接·断开·身份测试/渠道配置·删除/KOOK 面板/微信扫码/记忆添加·检索/插件卸载/RAG 导入/系统设置 4 项）。
-- **仍为后置 M10（返回 `501 not_implemented`，不伪造）**：新增用户、IoT 场景与规则、插件安装（需源码清单）、RAG 删除、主人档案保存、编辑环境变量/重启服务/检查更新、完整会话转录导出（当前导出身份元数据）。
+- **已真实实现**：登录/健康检查/聊天（同步+流式）/会话（列表/新建/删除/消息分页）/人格/管理读（personas/sessions/memories/plugins/channels/iot/llm/users/automations/backthink/rag/observability×3）/管理写（人格/API key/设备控制/自动化/LLM 保存·测试/渠道连接·断开·身份测试/渠道配置·删除/KOOK 面板/微信扫码/记忆添加·检索/插件安装·卸载/RAG 导入·删除/系统设置 4 项）。
+- **仍为后置 M10（返回 `501 not_implemented`，不伪造）**：新增用户（无用户表/登录）、IoT 场景与规则（无模型/存储）、主人档案保存、编辑环境变量/重启服务/检查更新、完整会话转录导出（当前导出身份元数据）。
 - **语义/向量增强**：`memory.search` 的 `semantic` 恒为 `false`（未接向量器时诚实反映）；RAG `embedded` 反映是否配置向量增强；配置了增强必须真实走语义/向量路径（红线，非空壳）。
 - **API key 认证**：`X-API-Key` 当前未被 `Authorize` 中间件校验（见 §0.1 注）；key 的签发/吊销/列表已真实生效。
 
diff --git a/cmd/cyrene/wire.go b/cmd/cyrene/wire.go
index b91d3bc..8a738e8 100644
--- a/cmd/cyrene/wire.go
+++ b/cmd/cyrene/wire.go
@@ -536,12 +536,13 @@ func (a *app) wireAuxiliary() error {
 	a.automation = automation
 
 	bt, err := backthink.New(backthink.ConfigFromBackground(a.cfg.Background), backthink.Deps{
-		Bus:     a.bus,
-		Thinker: backthink.NewLoopThinker(a.loop, a.history),
-		Recent:  a.history,
-		State:   backthink.NewIoTStateProvider(iotMgr, a.log),
-		DB:      a.db,
-		Log:     logger.WithSource(a.log, "services/backthink"),
+		Bus:      a.bus,
+		Thinker:  backthink.NewLoopThinker(a.loop, a.history),
+		Recent:   a.history,
+		State:    backthink.NewIoTStateProvider(iotMgr, a.log),
+		Exporter: backthink.NewPushOutlet(a.pushOutletConfig()),
+		DB:       a.db,
+		Log:      logger.WithSource(a.log, "services/backthink"),
 	})
 	if err != nil {
 		return fmt.Errorf("backthink: %w", err)
@@ -555,6 +556,21 @@ func (a *app) wireAuxiliary() error {
 	return nil
 }
 
+// pushOutletConfig maps the environment push-outlet block into the backthink
+// exporter config. The Getui credentials are read by config but not consumed:
+// the fallback SDK is not integrated yet, so the outlet logs the pending tier
+// instead of faking a push. The token is passed through and never logged.
+func (a *app) pushOutletConfig() backthink.PushOutletConfig {
+	po := a.cfg.PushOutlet
+	return backthink.PushOutletConfig{
+		Enabled: po.Enabled,
+		URL:     po.URL,
+		Token:   po.Token,
+		Timeout: time.Duration(po.TimeoutSec) * time.Second,
+		Log:     a.log,
+	}
+}
+
 // wireChannels constructs the four IM channel adapters from environment
 // configuration, registers them so the admin API can enumerate them, and wires
 // them into the channel bridge so a configured adapter connects and routes
diff --git a/frontend/web/src/admin/modules/Rag.tsx b/frontend/web/src/admin/modules/Rag.tsx
index 3274727..a689e33 100644
--- a/frontend/web/src/admin/modules/Rag.tsx
+++ b/frontend/web/src/admin/modules/Rag.tsx
@@ -38,12 +38,15 @@ export function RagModule(): React.ReactNode {
   };
 
   const remove = async (d: AdminRagDoc) => {
-    log("rag.delete", "ok");
     setNotice(null);
     try {
       await adminDeleteRag(d.id);
+      log("rag.delete", "ok");
+      reload();
+      setNotice("文档已删除（含其章节）。");
     } catch (err: unknown) {
-      setNotice(err instanceof Error ? err.message : "文档删除为后端 M10 写操作");
+      log("rag.delete", "error");
+      setNotice(err instanceof Error ? err.message : "删除文档失败");
     }
   };
 
@@ -203,7 +206,7 @@ export function RagModule(): React.ReactNode {
 
       <Notice>
         分块/嵌入状态与语义检索：配置了 pgvector / SQLite 向量增强后，后端经真实语义/向量路径返回（非空壳）；
-        未配置时走项目索引关键词 + 行上下文（导入文档即时可查）。文档删除为后端 M10 写操作。
+        未配置时走项目索引关键词 + 行上下文（导入文档即时可查）。文档删除为真实删除（项目索引条目 + 级联章节）。
       </Notice>
     </div>
   );
diff --git a/frontend/web/src/lib/api.ts b/frontend/web/src/lib/api.ts
index 41feff6..bc2ef47 100644
--- a/frontend/web/src/lib/api.ts
+++ b/frontend/web/src/lib/api.ts
@@ -448,10 +448,10 @@ export function adminSearchRag(
     body: JSON.stringify({ query }),
   });
 }
-/** POST /api/v1/admin/rag/delete — deletes a document. The backend returns a
- *  clear 501 until M10 lands the write path (upload/chunk/embed/delete). */
-export function adminDeleteRag(id: string): Promise<{ id: string }> {
-  return request<{ id: string }>("/admin/rag/delete", {
+/** POST /api/v1/admin/rag/delete — really deletes a document (project entry +
+ *  cascaded chapters). 404 when the id does not exist. */
+export function adminDeleteRag(id: string): Promise<{ id: string; deleted: boolean }> {
+  return request<{ id: string; deleted: boolean }>("/admin/rag/delete", {
     method: "POST",
     body: JSON.stringify({ id }),
   });
diff --git a/internal/config/config.go b/internal/config/config.go
index 4768a17..99cf349 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -30,6 +30,7 @@ type Config struct {
 	IoT         IoTConfig
 	Voice       VoiceConfig
 	Background  BackgroundConfig
+	PushOutlet  PushOutletConfig
 	WSHub       WSHubConfig
 	ExecSandbox ExecSandbox
 	MCP         MCPConfig
@@ -177,6 +178,31 @@ type BackgroundConfig struct {
 	KindWindowSec         int  `env:"THINK_KIND_WINDOW_SEC" default:"7200"`
 }
 
+// PushOutletConfig configures the proactive push outlet (D1, design/12 §4/§6).
+// Proactive messages are mirrored to the owner's self-hosted unified push
+// service (primary); Getui (个推) is the deferred fallback for when that service
+// is unavailable. The Getui* fields are reserved placeholders — the SDK is not
+// integrated, so an unavailable primary logs the pending fallback rather than
+// pretending to push.
+type PushOutletConfig struct {
+	// Enabled turns the outlet hook on. When false no export is attempted.
+	Enabled bool `env:"PUSH_EXPORTER_ENABLED" default:"false"`
+	// URL is the self-hosted unified push service endpoint (HTTP POST JSON).
+	// Empty leaves the primary tier unconfigured.
+	URL string `env:"PUSH_EXPORTER_URL"`
+	// Token is sent as "Authorization: Bearer <token>"; it is never logged.
+	Token string `env:"PUSH_EXPORTER_TOKEN"`
+	// TimeoutSec bounds one export attempt. Zero uses the service default (5s).
+	TimeoutSec int `env:"PUSH_EXPORTER_TIMEOUT_SEC" default:"5"`
+
+	// Getui* are reserved for the fallback tier; the SDK is not integrated yet,
+	// so these values are read but unused (kept so the env contract is stable).
+	GetuiAppID        string `env:"GETUI_APP_ID"`
+	GetuiAppKey       string `env:"GETUI_APP_KEY"`
+	GetuiMasterSecret string `env:"GETUI_MASTER_SECRET"`
+	GetuiBaseURL      string `env:"GETUI_BASE_URL"`
+}
+
 // WSHubConfig holds the WebSocket hub limits.
 type WSHubConfig struct {
 	MaxConnections     int `env:"WS_MAX_CONNECTIONS" default:"1000"`
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 1edc9bd..35db90b 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -66,6 +66,35 @@ func TestLoad_EnvOverridesDefault(t *testing.T) {
 	}
 }
 
+func TestLoad_PushOutletEnv(t *testing.T) {
+	t.Setenv("JWT_SECRET", strings.Repeat("s", 40))
+	t.Setenv("PUSH_EXPORTER_ENABLED", "true")
+	t.Setenv("PUSH_EXPORTER_URL", "https://push.example.com/hook")
+	t.Setenv("PUSH_EXPORTER_TOKEN", "tok")
+	t.Setenv("PUSH_EXPORTER_TIMEOUT_SEC", "9")
+	t.Setenv("GETUI_APP_ID", "app-id")
+
+	cfg, err := Load("")
+	if err != nil {
+		t.Fatalf("Load() error: %v", err)
+	}
+	if !cfg.PushOutlet.Enabled {
+		t.Error("PushOutlet.Enabled = false, want true")
+	}
+	if cfg.PushOutlet.URL != "https://push.example.com/hook" {
+		t.Errorf("PushOutlet.URL = %q, want the configured endpoint", cfg.PushOutlet.URL)
+	}
+	if cfg.PushOutlet.Token != "tok" {
+		t.Errorf("PushOutlet.Token = %q, want tok", cfg.PushOutlet.Token)
+	}
+	if cfg.PushOutlet.TimeoutSec != 9 {
+		t.Errorf("PushOutlet.TimeoutSec = %d, want 9", cfg.PushOutlet.TimeoutSec)
+	}
+	if cfg.PushOutlet.GetuiAppID != "app-id" {
+		t.Errorf("PushOutlet.GetuiAppID = %q, want app-id", cfg.PushOutlet.GetuiAppID)
+	}
+}
+
 func TestLoad_DotEnvThenProcessEnv(t *testing.T) {
 	path := writeEnvFile(t, `PORT=7000
 LOG_LEVEL=error
diff --git a/internal/runtime/knowledge/store.go b/internal/runtime/knowledge/store.go
index 66a05eb..884142c 100644
--- a/internal/runtime/knowledge/store.go
+++ b/internal/runtime/knowledge/store.go
@@ -15,9 +15,9 @@
 // stores it as a project plus its chapters, making it text/keyword-searchable
 // immediately. Semantic/vector embedding of an imported document is a graceful
 // no-op here (this data source holds no vector index); the existing semantic path
-// still ranks project-linked memories via the retriever. Deletion remains
-// unimplemented (M10) and returns ErrWriteUnsupported so the admin handler
-// answers honestly instead of fabricating a success.
+// still ranks project-linked memories via the retriever. DeleteDocument removes a
+// document (its project entry and, in one transaction, every chapter that
+// references it) so the import/delete pair is a real round-trip.
 package knowledge
 
 import (
@@ -36,10 +36,15 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/memory/projectindex"
 )
 
-// ErrWriteUnsupported is returned by DeleteDocument. Deletion is milestone M10;
-// the admin handler maps it to a clear 501 so the frontend can explain rather
-// than show a placeholder alert.
-var ErrWriteUnsupported = errors.New("knowledge: delete is not implemented in this milestone")
+// ErrWriteUnsupported is returned by a knowledge store implementation that does
+// not support document deletion. *Store implements DeleteDocument, so it never
+// returns this; it remains for alternate/degraded implementations the admin
+// handler maps to a clear 501 rather than a fabricated success.
+var ErrWriteUnsupported = errors.New("knowledge: delete is not supported by this store")
+
+// ErrDocumentNotFound is returned by DeleteDocument when the id is blank or no
+// knowledge document (project-index entry) carries it.
+var ErrDocumentNotFound = errors.New("knowledge: document not found")
 
 // defaultTopK bounds the semantic retrieval path.
 const defaultTopK = 8
@@ -322,10 +327,27 @@ func (s *Store) IndexDocument(ctx context.Context, doc Doc) error {
 	return nil
 }
 
-// DeleteDocument is not implemented in this milestone. It returns
-// ErrWriteUnsupported so the handler answers honestly (delete = M10).
-func (s *Store) DeleteDocument(_ context.Context, _ string) error {
-	return ErrWriteUnsupported
+// DeleteDocument removes a knowledge document: the project-index entry and, in
+// the same transaction, every chapter that references it (projectindex.DeleteProject
+// cascades the chunk cleanup). It returns ErrDocumentNotFound for a blank id or
+// one with no project entry, and an error when no project index is wired (there
+// is nowhere to delete from, so a fabricated success is never returned).
+func (s *Store) DeleteDocument(ctx context.Context, id string) error {
+	docID := strings.TrimSpace(id)
+	if docID == "" {
+		return fmt.Errorf("knowledge: delete document: %w", ErrDocumentNotFound)
+	}
+	if s.projects == nil {
+		return errors.New("knowledge: delete document: project index store is not configured")
+	}
+	if err := s.projects.DeleteProject(ctx, docID); err != nil {
+		if errors.Is(err, projectindex.ErrProjectNotFound) {
+			return fmt.Errorf("knowledge: delete document %q: %w", docID, ErrDocumentNotFound)
+		}
+		return fmt.Errorf("knowledge: delete document %q: %w", docID, err)
+	}
+	s.log.Info("deleted document", "project", docID)
+	return nil
 }
 
 // maxChapterRunes bounds a single chapter's content length. Paragraphs longer
diff --git a/internal/runtime/knowledge/store_test.go b/internal/runtime/knowledge/store_test.go
index 733ed51..e603ddb 100644
--- a/internal/runtime/knowledge/store_test.go
+++ b/internal/runtime/knowledge/store_test.go
@@ -99,10 +99,56 @@ func TestIndexDocumentRequiresProjectStore(t *testing.T) {
 	}
 }
 
-func TestDeleteDocumentStillUnsupported(t *testing.T) {
+// TestDeleteDocumentRemovesProjectAndChapters proves delete is a real round-trip:
+// the document disappears from the list and the search, and deleting it again is
+// a not-found rather than a silent success.
+func TestDeleteDocumentRemovesProjectAndChapters(t *testing.T) {
 	t.Parallel()
-	s := New(Deps{Log: testLogger()})
-	if err := s.DeleteDocument(context.Background(), "any"); !errors.Is(err, ErrWriteUnsupported) {
-		t.Fatalf("DeleteDocument err = %v, want ErrWriteUnsupported", err)
+	ctx := context.Background()
+	s := newTestStore(t)
+	if err := s.IndexDocument(ctx, Doc{
+		ID:      "doc-1",
+		Name:    "Cyrene 设计",
+		Content: "第一段：项目描述。\n\n第二段：内部实现要点。",
+	}); err != nil {
+		t.Fatalf("IndexDocument: %v", err)
+	}
+
+	if err := s.DeleteDocument(ctx, "doc-1"); err != nil {
+		t.Fatalf("DeleteDocument: %v", err)
+	}
+	docs, err := s.ListDocuments(ctx)
+	if err != nil {
+		t.Fatalf("ListDocuments: %v", err)
+	}
+	if len(docs) != 0 {
+		t.Fatalf("documents = %+v, want empty after delete", docs)
+	}
+	hits, err := s.Search(ctx, "内部实现")
+	if err != nil {
+		t.Fatalf("Search: %v", err)
+	}
+	if len(hits) != 0 {
+		t.Fatalf("hits = %+v, want none after delete", hits)
+	}
+
+	if err := s.DeleteDocument(ctx, "doc-1"); !errors.Is(err, ErrDocumentNotFound) {
+		t.Fatalf("second DeleteDocument err = %v, want ErrDocumentNotFound", err)
+	}
+}
+
+func TestDeleteDocumentBlankIDNotFound(t *testing.T) {
+	t.Parallel()
+	s := newTestStore(t)
+	if err := s.DeleteDocument(context.Background(), "  "); !errors.Is(err, ErrDocumentNotFound) {
+		t.Fatalf("DeleteDocument blank id err = %v, want ErrDocumentNotFound", err)
+	}
+}
+
+func TestDeleteDocumentRequiresProjectStore(t *testing.T) {
+	t.Parallel()
+	s := New(Deps{Log: testLogger()}) // projects == nil
+	if err := s.DeleteDocument(context.Background(), "doc-1"); err == nil {
+		t.Fatal("DeleteDocument without a project index should error")
 	}
 }
diff --git a/internal/services/backthink/backthink.go b/internal/services/backthink/backthink.go
index cc8b543..7b7eaed 100644
--- a/internal/services/backthink/backthink.go
+++ b/internal/services/backthink/backthink.go
@@ -82,6 +82,10 @@ type Deps struct {
 	Active ActiveClient
 	// IM is the IM bridge sink, used as the fallback when no active client is up.
 	IM IMAdapter
+	// Exporter mirrors a proactive message to the external push outlet (the
+	// owner's self-hosted unified push service, then Getui). Optional: nil
+	// disables the hook. It never blocks or breaks the Active/IM delivery.
+	Exporter PushExporter
 	// Gate is the proactive-push rate limiter. Nil builds a default from Config.
 	Gate PushGate
 	// DB is the SQLite handle for the think store. Required.
@@ -146,7 +150,7 @@ func New(cfg Config, deps Deps) (*Backthink, error) {
 	}
 	pusher := deps.Pusher
 	if pusher == nil {
-		pusher = newPusher(deps.Active, deps.IM, gate, log)
+		pusher = newPusher(deps.Active, deps.IM, gate, log).withExporter(deps.Exporter)
 	}
 
 	now := deps.Now
diff --git a/internal/services/backthink/push.go b/internal/services/backthink/push.go
index d3b5398..43b9c36 100644
--- a/internal/services/backthink/push.go
+++ b/internal/services/backthink/push.go
@@ -128,20 +128,34 @@ type Pusher interface {
 
 // pusher is the concrete Pusher: it consults the gate, then routes the message to
 // exactly one target — the active client for a "web" hint, otherwise the IM bridge.
+// After the local delivery it mirrors the message to the optional push outlet
+// (self-hosted service → Getui fallback) without blocking that delivery.
 type pusher struct {
-	active ActiveClient
-	im     IMAdapter
-	gate   PushGate
-	log    *slog.Logger
+	active   ActiveClient
+	im       IMAdapter
+	gate     PushGate
+	exporter PushExporter
+	log      *slog.Logger
+	// exportDone, when non-nil, receives one value after each asynchronous export
+	// completes. It exists so tests can deterministically observe the hook; the
+	// send is non-blocking, so a full channel never stalls the exporter.
+	exportDone chan struct{}
 }
 
 // newPusher builds a Pusher from the optional active-client sink, IM sink and
 // rate gate. Any of them may be nil; a nil target simply makes that route
-// unavailable.
+// unavailable. The push outlet is attached separately with withExporter.
 func newPusher(active ActiveClient, im IMAdapter, gate PushGate, log *slog.Logger) *pusher {
 	return &pusher{active: active, im: im, gate: gate, log: log}
 }
 
+// withExporter attaches the push outlet hook and returns the pusher for fluent
+// use. A nil exporter leaves the hook disabled.
+func (p *pusher) withExporter(exporter PushExporter) *pusher {
+	p.exporter = exporter
+	return p
+}
+
 // Push implements Pusher: it applies the rate gate, then routes the message to a
 // single target. A "web" hint reaches the active web/native client; every other
 // hint ("im", "auto", or a concrete platform) goes over the IM bridge once, where
@@ -192,6 +206,11 @@ func (p *pusher) Push(ctx context.Context, req PushRequest) PushResult {
 	if res.Pushed && p.gate != nil && !eventDriven {
 		p.gate.RecordPush(kind)
 	}
+	// D1: mirror the proactive message to the external push outlet (self-hosted
+	// unified push service → Getui fallback). Fire-and-forget: a slow or failing
+	// outlet never delays or breaks the local delivery above, and a rate-limited
+	// push returned before reaching here.
+	p.exportAsync(msg)
 	res = annotateHint(res, req.ChannelHint)
 	if eventDriven {
 		res.Bypassed = true
@@ -200,6 +219,33 @@ func (p *pusher) Push(ctx context.Context, req PushRequest) PushResult {
 	return res
 }
 
+// exportAsync reports msg to the push outlet on a detached, bounded goroutine so
+// the proactive path never blocks on the outlet. A nil exporter (hook disabled)
+// or a nil outlet result is a no-op; a delivery miss or error is only logged.
+func (p *pusher) exportAsync(msg adapter.UnifiedMessage) {
+	if p.exporter == nil {
+		return
+	}
+	timeout := defaultExportTimeout
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), timeout)
+		defer cancel()
+		delivered, err := p.exporter.Export(ctx, msg)
+		switch {
+		case err != nil:
+			p.log.Warn("push outlet export failed", "error", err)
+		case !delivered:
+			p.log.Info("push outlet did not deliver", "hint", "getui fallback not integrated")
+		}
+		if p.exportDone != nil {
+			select {
+			case p.exportDone <- struct{}{}:
+			default:
+			}
+		}
+	}()
+}
+
 // pushActive delivers only to the active web/native client.
 func (p *pusher) pushActive(ctx context.Context, msg adapter.UnifiedMessage) PushResult {
 	if p.active != nil {
diff --git a/internal/services/backthink/push_outlet.go b/internal/services/backthink/push_outlet.go
new file mode 100644
index 0000000..20d6f94
--- /dev/null
+++ b/internal/services/backthink/push_outlet.go
@@ -0,0 +1,193 @@
+package backthink
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/adapter"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
+)
+
+// The push outlet (D1, design/12 §4/§6): proactive messages are mirrored to an
+// external push service so the owner's mobile client is reached even when no
+// WebSocket client or IM channel is live. Delivery is two-tier by design:
+//
+//  1. the owner's self-hosted unified push service (primary; PUSH_EXPORTER_URL),
+//  2. Getui (个推) as the fallback for when the self-hosted service is down.
+//
+// Tier 2 has no SDK integration yet, so an unavailable primary logs an explicit
+// "Getui fallback not integrated" note and reports not-delivered instead of
+// pretending the message went out. The hook is fire-and-forget: it never delays
+// or breaks the existing active-client / IM delivery.
+
+// defaultExportTimeout bounds one export attempt so a hung endpoint cannot pin a
+// goroutine forever.
+const defaultExportTimeout = 5 * time.Second
+
+// maxExportResponseBytes caps how much of the outlet's response body is drained
+// before the connection is reused, so a hostile/buggy endpoint cannot stream an
+// unbounded body into memory.
+const maxExportResponseBytes = 4 << 10
+
+// PushExporter reports one proactive message to an external push outlet. Export
+// must be safe for concurrent use and must honor ctx. A nil error with
+// delivered=false means the outlet could not deliver (for example the fallback
+// tier is not wired); the caller treats that as a logged miss, never a failure
+// of the local push path.
+type PushExporter interface {
+	Export(ctx context.Context, msg adapter.UnifiedMessage) (delivered bool, err error)
+}
+
+// PushOutletConfig carries the push-outlet wiring. Enabled=false disables the
+// hook entirely (NewPushOutlet returns nil). URL/Token/Timeout describe the
+// self-hosted primary service; the Getui* fields are reserved for the deferred
+// fallback and are not consumed yet.
+type PushOutletConfig struct {
+	// Enabled turns the outlet hook on.
+	Enabled bool
+	// URL is the self-hosted unified push service endpoint (HTTP POST JSON).
+	// Empty leaves the primary tier unconfigured.
+	URL string
+	// Token is sent as "Authorization: Bearer <token>". It is never logged.
+	Token string
+	// Timeout bounds one export attempt. Zero uses defaultExportTimeout.
+	Timeout time.Duration
+	// Log is the base logger. Nil uses a discard logger.
+	Log *slog.Logger
+}
+
+// NewPushOutlet builds the two-tier push outlet from cfg. It returns nil when
+// the hook is disabled, so the pusher simply skips the export step. When it is
+// enabled the primary tier is the self-hosted HTTP endpoint (present only when
+// URL is set) and the fallback tier is Getui, which is not integrated yet.
+func NewPushOutlet(cfg PushOutletConfig) PushExporter {
+	if !cfg.Enabled {
+		return nil
+	}
+	log := logger.WithSource(baseLog(cfg.Log), "services/backthink/push_outlet")
+	timeout := cfg.Timeout
+	if timeout <= 0 {
+		timeout = defaultExportTimeout
+	}
+	var primary PushExporter
+	if url := strings.TrimSpace(cfg.URL); url != "" {
+		primary = &httpPushExporter{
+			url:    url,
+			token:  cfg.Token,
+			client: &http.Client{Timeout: timeout},
+		}
+	} else {
+		log.Warn("push outlet enabled but PUSH_EXPORTER_URL is empty; only the (unwired) Getui fallback remains")
+	}
+	log.Info("push outlet configured", "primary", primary != nil, "fallback", "getui (not integrated)")
+	return &pushOutlet{primary: primary, log: log}
+}
+
+// pushOutlet is the two-tier exporter: self-hosted service first, Getui second.
+// The fallback is nil until the Getui SDK is integrated, so a primary miss is
+// logged and reported as not delivered rather than silently dropped.
+type pushOutlet struct {
+	primary  PushExporter
+	fallback PushExporter
+	log      *slog.Logger
+}
+
+// Export implements PushExporter. It tries the primary tier and, when that does
+// not deliver, the fallback tier. With no fallback wired it logs the pending
+// integration and returns (false, nil): the caller treats that as a miss, never
+// as a reason to fail the proactive push.
+func (o *pushOutlet) Export(ctx context.Context, msg adapter.UnifiedMessage) (bool, error) {
+	if o.primary != nil {
+		delivered, err := o.primary.Export(ctx, msg)
+		if err == nil && delivered {
+			return true, nil
+		}
+		if err != nil {
+			o.log.Warn("push outlet primary failed", "error", err)
+		} else {
+			o.log.Warn("push outlet primary did not deliver")
+		}
+	}
+	if o.fallback != nil {
+		return o.fallback.Export(ctx, msg)
+	}
+	o.log.Info("push outlet not delivered; getui fallback not integrated",
+		"hint", "wire the Getui SDK + GETUI_* credentials to enable the fallback tier")
+	return false, nil
+}
+
+// pushExportPayload is the JSON body POSTed to the self-hosted push service. It
+// is deliberately small and stable: the service owns device targeting, the
+// message carries only what is needed to render and de-duplicate it.
+type pushExportPayload struct {
+	// Source identifies the producer so the service can route/filter.
+	Source string `json:"source"`
+	// Title is a short display title (the persona name).
+	Title string `json:"title"`
+	// Content is the proactive message body (already stripped of internal
+	// decision markers by buildProactiveMessage).
+	Content string `json:"content"`
+	// Platform is the outbound platform tag (cyrene-backthink or a concrete IM
+	// platform).
+	Platform string `json:"platform"`
+	// Timestamp is the message time in Unix milliseconds.
+	Timestamp int64 `json:"timestamp"`
+}
+
+// httpPushExporter posts the message to the self-hosted push service. A 2xx
+// response means delivered; any other status or transport error is an error.
+// The token travels only in the Authorization header and never reaches a log.
+type httpPushExporter struct {
+	url    string
+	token  string
+	client *http.Client
+}
+
+// Export implements PushExporter over HTTP POST JSON.
+func (e *httpPushExporter) Export(ctx context.Context, msg adapter.UnifiedMessage) (bool, error) {
+	body, err := json.Marshal(pushExportPayload{
+		Source:    "cyrene/backthink",
+		Title:     msg.Sender.DisplayName,
+		Content:   msg.Content,
+		Platform:  msg.Platform,
+		Timestamp: msg.Timestamp.UnixMilli(),
+	})
+	if err != nil {
+		return false, fmt.Errorf("push outlet: marshal payload: %w", err)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, e.url, bytes.NewReader(body))
+	if err != nil {
+		return false, fmt.Errorf("push outlet: build request: %w", e.redact(err))
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if e.token != "" {
+		req.Header.Set("Authorization", "Bearer "+e.token)
+	}
+	resp, err := e.client.Do(req)
+	if err != nil {
+		return false, fmt.Errorf("push outlet: post: %w", e.redact(err))
+	}
+	defer func() { _ = resp.Body.Close() }()
+	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, maxExportResponseBytes))
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return false, fmt.Errorf("push outlet: unexpected status %d", resp.StatusCode)
+	}
+	return true, nil
+}
+
+// redact removes the endpoint URL from a transport error so a secret embedded in
+// the URL (for example a query token) never reaches a log line.
+func (e *httpPushExporter) redact(err error) error {
+	if err == nil || e.url == "" {
+		return err
+	}
+	msg := strings.ReplaceAll(err.Error(), e.url, "[push-outlet-url]")
+	return fmt.Errorf("%s", msg)
+}
diff --git a/internal/services/backthink/push_outlet_test.go b/internal/services/backthink/push_outlet_test.go
new file mode 100644
index 0000000..f6093ad
--- /dev/null
+++ b/internal/services/backthink/push_outlet_test.go
@@ -0,0 +1,261 @@
+package backthink
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/adapter"
+)
+
+// mockExporter records exported messages and can block or fail on demand so the
+// pusher hook's non-blocking / failure-tolerant behaviour is testable.
+type mockExporter struct {
+	mu        sync.Mutex
+	msgs      []adapter.UnifiedMessage
+	delivered bool
+	err       error
+	started   chan struct{}
+	startOnce sync.Once
+	release   chan struct{}
+}
+
+func (m *mockExporter) Export(ctx context.Context, msg adapter.UnifiedMessage) (bool, error) {
+	m.startOnce.Do(func() {
+		if m.started != nil {
+			close(m.started)
+		}
+	})
+	if m.release != nil {
+		<-m.release
+	}
+	m.mu.Lock()
+	m.msgs = append(m.msgs, msg)
+	m.mu.Unlock()
+	return m.delivered, m.err
+}
+
+func (m *mockExporter) messages() []adapter.UnifiedMessage {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return append([]adapter.UnifiedMessage(nil), m.msgs...)
+}
+
+// TestPushOutletHTTPPrimaryDelivers proves the self-hosted service is the
+// primary tier: the payload is POSTed with the bearer token and a 2xx response
+// is reported as delivered.
+func TestPushOutletHTTPPrimaryDelivers(t *testing.T) {
+	t.Parallel()
+	type payload struct {
+		Source    string `json:"source"`
+		Title     string `json:"title"`
+		Content   string `json:"content"`
+		Platform  string `json:"platform"`
+		Timestamp int64  `json:"timestamp"`
+	}
+	var (
+		got  payload
+		auth string
+		ct   string
+	)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		auth = r.Header.Get("Authorization")
+		ct = r.Header.Get("Content-Type")
+		if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
+			t.Errorf("decode payload: %v", err)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer srv.Close()
+
+	exp := NewPushOutlet(PushOutletConfig{
+		Enabled: true,
+		URL:     srv.URL,
+		Token:   "s3cret-token",
+		Timeout: 2 * time.Second,
+		Log:     discardLog(),
+	})
+	if exp == nil {
+		t.Fatal("NewPushOutlet returned nil for an enabled outlet")
+	}
+	delivered, err := exp.Export(context.Background(), adapter.UnifiedMessage{
+		Platform:  "cyrene-backthink",
+		Content:   "晚安，早点睡。",
+		Sender:    adapter.Actor{DisplayName: "Cyrene"},
+		Timestamp: time.UnixMilli(1700000000000),
+	})
+	if err != nil || !delivered {
+		t.Fatalf("Export = (%v, %v), want (true, nil)", delivered, err)
+	}
+	if got.Source != "cyrene/backthink" || got.Title != "Cyrene" || got.Content != "晚安，早点睡。" || got.Platform != "cyrene-backthink" {
+		t.Fatalf("payload = %+v, want source/title/content/platform set", got)
+	}
+	if got.Timestamp != 1700000000000 {
+		t.Fatalf("timestamp = %d, want 1700000000000", got.Timestamp)
+	}
+	if auth != "Bearer s3cret-token" {
+		t.Fatalf("Authorization = %q, want the bearer token", auth)
+	}
+	if ct != "application/json" {
+		t.Fatalf("Content-Type = %q, want application/json", ct)
+	}
+}
+
+// TestPushOutletUnreachableLogsGetuiFallback asserts an unreachable primary is a
+// logged miss (not an error), names the pending Getui fallback, and never logs
+// the token.
+func TestPushOutletUnreachableLogsGetuiFallback(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+	url := srv.URL
+	srv.Close() // now unreachable
+
+	var buf bytes.Buffer
+	log := slog.New(slog.NewTextHandler(&buf, nil))
+	exp := NewPushOutlet(PushOutletConfig{Enabled: true, URL: url, Token: "s3cret-token", Timeout: 300 * time.Millisecond, Log: log})
+
+	delivered, err := exp.Export(context.Background(), adapter.UnifiedMessage{Content: "hi"})
+	if err != nil {
+		t.Fatalf("Export err = %v, want nil (logged miss)", err)
+	}
+	if delivered {
+		t.Fatal("Export delivered = true, want false for an unreachable primary")
+	}
+	if !strings.Contains(buf.String(), "getui") {
+		t.Fatalf("log = %q, want the pending Getui fallback note", buf.String())
+	}
+	if strings.Contains(buf.String(), "s3cret-token") {
+		t.Fatalf("log leaked the token: %q", buf.String())
+	}
+}
+
+// TestPushOutletHTTPErrorReportsMiss asserts a non-2xx primary response is a miss.
+func TestPushOutletHTTPErrorReportsMiss(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "nope", http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	exp := NewPushOutlet(PushOutletConfig{Enabled: true, URL: srv.URL, Timeout: 2 * time.Second, Log: discardLog()})
+	delivered, err := exp.Export(context.Background(), adapter.UnifiedMessage{Content: "hi"})
+	if err != nil {
+		t.Fatalf("Export err = %v, want nil (logged miss)", err)
+	}
+	if delivered {
+		t.Fatal("Export delivered = true, want false for a 500 response")
+	}
+}
+
+// TestNewPushOutletDisabledOrUnconfigured covers the two degraded shapes: the
+// hook off (nil) and enabled without a primary URL (miss + Getui note).
+func TestNewPushOutletDisabledOrUnconfigured(t *testing.T) {
+	t.Parallel()
+	if exp := NewPushOutlet(PushOutletConfig{Enabled: false, URL: "http://example.invalid"}); exp != nil {
+		t.Fatalf("NewPushOutlet disabled = %v, want nil", exp)
+	}
+
+	var buf bytes.Buffer
+	log := slog.New(slog.NewTextHandler(&buf, nil))
+	exp := NewPushOutlet(PushOutletConfig{Enabled: true, Log: log})
+	if exp == nil {
+		t.Fatal("NewPushOutlet enabled without a URL = nil, want a fallback-only outlet")
+	}
+	delivered, err := exp.Export(context.Background(), adapter.UnifiedMessage{Content: "hi"})
+	if err != nil || delivered {
+		t.Fatalf("Export = (%v, %v), want (false, nil)", delivered, err)
+	}
+	if !strings.Contains(buf.String(), "getui") {
+		t.Fatalf("log = %q, want the Getui fallback note", buf.String())
+	}
+}
+
+// TestPusherExportsProactiveToOutlet asserts the hook mirrors the delivered
+// proactive message to the outlet after the IM delivery.
+func TestPusherExportsProactiveToOutlet(t *testing.T) {
+	t.Parallel()
+	exp := &mockExporter{delivered: true}
+	im := &mockIMAdapter{}
+	p := newPusher(nil, im, &mockGate{allow: true}, discardLog()).withExporter(exp)
+	p.exportDone = make(chan struct{}, 1)
+
+	res := p.Push(context.Background(), PushRequest{Message: adapter.UnifiedMessage{Content: "在吗"}})
+	if !res.Pushed || res.Route != RouteIMBridge {
+		t.Fatalf("push = %+v, want pushed via IM bridge", res)
+	}
+	if im.count() != 1 {
+		t.Fatalf("im calls = %d, want 1", im.count())
+	}
+	select {
+	case <-p.exportDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("export hook did not run")
+	}
+	msgs := exp.messages()
+	if len(msgs) != 1 || msgs[0].Content != "在吗" {
+		t.Fatalf("exported = %+v, want the proactive content", msgs)
+	}
+}
+
+// TestPusherExportHookNonBlockingAndFailureTolerant asserts a hung/failing outlet
+// never delays the push and never turns a delivered proactive message into a
+// failure.
+func TestPusherExportHookNonBlockingAndFailureTolerant(t *testing.T) {
+	t.Parallel()
+	started := make(chan struct{})
+	release := make(chan struct{})
+	exp := &mockExporter{delivered: false, err: errors.New("outlet down"), started: started, release: release}
+	im := &mockIMAdapter{}
+	p := newPusher(nil, im, &mockGate{allow: true}, discardLog()).withExporter(exp)
+	p.exportDone = make(chan struct{}, 1)
+
+	begin := time.Now()
+	res := p.Push(context.Background(), PushRequest{Message: adapter.UnifiedMessage{Content: "hi"}})
+	if elapsed := time.Since(begin); elapsed > 100*time.Millisecond {
+		t.Fatalf("Push blocked on the outlet for %v, want non-blocking", elapsed)
+	}
+	if !res.Pushed || res.Route != RouteIMBridge {
+		t.Fatalf("push = %+v, want pushed via IM bridge despite the outlet failure", res)
+	}
+	select {
+	case <-started:
+	case <-time.After(2 * time.Second):
+		t.Fatal("exporter was never invoked")
+	}
+	close(release)
+	select {
+	case <-p.exportDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("export hook did not finish")
+	}
+}
+
+// TestPusherRateLimitedPushIsNotExported asserts a rate-limited push never
+// reaches the outlet: the hook mirrors real proactive sends only.
+func TestPusherRateLimitedPushIsNotExported(t *testing.T) {
+	t.Parallel()
+	exp := &mockExporter{delivered: true}
+	p := newPusher(nil, &mockIMAdapter{}, &mockGate{allow: false}, discardLog()).withExporter(exp)
+	p.exportDone = make(chan struct{}, 1)
+
+	res := p.Push(context.Background(), PushRequest{Message: adapter.UnifiedMessage{Content: "hi"}})
+	if res.Route != RouteRateLimited {
+		t.Fatalf("route = %q, want rate_limited", res.Route)
+	}
+	select {
+	case <-p.exportDone:
+		t.Fatal("rate-limited push should not be exported")
+	case <-time.After(50 * time.Millisecond):
+	}
+	if len(exp.messages()) != 0 {
+		t.Fatalf("exported = %+v, want none", exp.messages())
+	}
+}
diff --git a/internal/services/backthink/sinks.go b/internal/services/backthink/sinks.go
index bbd8cd8..e0ef9c3 100644
--- a/internal/services/backthink/sinks.go
+++ b/internal/services/backthink/sinks.go
@@ -25,10 +25,10 @@ func (b *Backthink) SetIMSink(im IMAdapter) {
 	b.rebuildPusherLocked()
 }
 
-// rebuildPusherLocked replaces the pusher from the current sinks and gate. The
-// caller must hold b.mu.
+// rebuildPusherLocked replaces the pusher from the current sinks, gate and push
+// outlet. The caller must hold b.mu.
 func (b *Backthink) rebuildPusherLocked() {
-	b.pusher = newPusher(b.deps.Active, b.deps.IM, b.gate, b.log)
+	b.pusher = newPusher(b.deps.Active, b.deps.IM, b.gate, b.log).withExporter(b.deps.Exporter)
 }
 
 // currentPusher returns the active pusher under the lifecycle lock, so a sink
diff --git a/internal/services/gateway/admin.go b/internal/services/gateway/admin.go
index 1474cff..b23ff6c 100644
--- a/internal/services/gateway/admin.go
+++ b/internal/services/gateway/admin.go
@@ -496,11 +496,6 @@ type ragQueryRequest struct {
 	Query string `json:"query"`
 }
 
-// ragDeleteRequest is the POST /api/v1/admin/rag/delete body.
-type ragDeleteRequest struct {
-	ID string `json:"id"`
-}
-
 // adminListRag lists the knowledge-base documents and, when ?query= is present,
 // returns the matching hits too. Without a wired RagStore it degrades to an empty
 // list (backward compatible — never a 500).
@@ -555,33 +550,6 @@ func (s *Server) adminSearchRag(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]any{"query": req.Query, "hits": ragHitsFrom(hits)})
 }
 
-// adminDeleteRag answers the document delete honestly: write operations
-// (upload/chunk/embed/delete) are milestone M10, so it returns a clear 501 rather
-// than a fabricated success. The route is audited as an admin write.
-func (s *Server) adminDeleteRag(w http.ResponseWriter, r *http.Request) {
-	if s.rag == nil {
-		s.auditClaims(r, "rag.delete", "error")
-		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "知识库 RAG 服务未配置（未注入 RagStore）", HTTPCode: http.StatusNotImplemented})
-		return
-	}
-	var req ragDeleteRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
-		return
-	}
-	if strings.TrimSpace(req.ID) == "" {
-		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "id is required"))
-		return
-	}
-	if err := s.rag.DeleteDocument(r.Context(), req.ID); err != nil {
-		s.auditClaims(r, "rag.delete", "error")
-		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "知识库写操作（上传/分块/嵌入/删除）由 M10 后端提供", HTTPCode: http.StatusNotImplemented})
-		return
-	}
-	s.auditClaims(r, "rag.delete", "ok")
-	writeJSON(w, http.StatusOK, map[string]any{"id": req.ID})
-}
-
 // ragDocsFrom maps knowledge docs to their admin wire shape.
 func ragDocsFrom(docs []knowledge.Doc) []AdminRagDoc {
 	out := make([]AdminRagDoc, 0, len(docs))
diff --git a/internal/services/gateway/admin_honest501_test.go b/internal/services/gateway/admin_honest501_test.go
new file mode 100644
index 0000000..aa7ab6a
--- /dev/null
+++ b/internal/services/gateway/admin_honest501_test.go
@@ -0,0 +1,36 @@
+package gateway
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
+)
+
+// TestAdminMissingStoreWritesHonest501 locks the B5 red line for the endpoints
+// whose backing store does not exist yet: they must answer 501 not_implemented
+// with an explanatory message, never a fabricated success. User creation has no
+// user table/login to persist into, and IoT has no scenario/rule model or store.
+func TestAdminMissingStoreWritesHonest501(t *testing.T) {
+	t.Parallel()
+	srv, ts, jwt := buildEnv(t, cfgDefault(), Deps{})
+	_ = srv
+	tok := signAny(t, jwt, "acct", auth.RoleOwner)
+
+	cases := []string{
+		"/api/v1/admin/users",
+		"/api/v1/admin/iot/scenarios",
+		"/api/v1/admin/iot/rules",
+	}
+	for _, path := range cases {
+		resp, body := doReq(t, http.MethodPost, ts.URL+path, map[string]any{"name": "x"}, tok)
+		if resp.StatusCode != http.StatusNotImplemented {
+			t.Fatalf("%s status = %d, want 501 (body=%s)", path, resp.StatusCode, body)
+		}
+		wantErrorShape(t, body)
+		if !strings.Contains(string(body), "not_implemented") {
+			t.Fatalf("%s body = %s, want not_implemented code", path, body)
+		}
+	}
+}
diff --git a/internal/services/gateway/admin_rag_delete_test.go b/internal/services/gateway/admin_rag_delete_test.go
new file mode 100644
index 0000000..0586599
--- /dev/null
+++ b/internal/services/gateway/admin_rag_delete_test.go
@@ -0,0 +1,96 @@
+package gateway
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/knowledge"
+)
+
+// TestAdminRagDeleteRemovesDocument proves the delete write path is real: the
+// indexed document (project entry + its chapters) is gone from the list and the
+// search, and deleting it again answers 404 rather than a fabricated success.
+func TestAdminRagDeleteRemovesDocument(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+	rag := newRagStoreForGateway(t)
+	if err := rag.IndexDocument(ctx, knowledge.Doc{
+		ID:      "doc-1",
+		Name:    "Cyrene 设计",
+		Desc:    "v2 设计文档",
+		Content: "第一段：项目描述。\n\n第二段：内部实现要点。",
+	}); err != nil {
+		t.Fatalf("IndexDocument: %v", err)
+	}
+
+	srv, ts, jwt := buildEnv(t, cfgDefault(), Deps{RAG: rag})
+	_ = srv
+	tok := signAny(t, jwt, "acct", auth.RoleOwner)
+
+	resp, body := doReq(t, http.MethodPost, ts.URL+"/api/v1/admin/rag/delete", map[string]any{"id": "doc-1"}, tok)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("delete status = %d, want 200 (body=%s)", resp.StatusCode, body)
+	}
+	var res struct {
+		ID      string `json:"id"`
+		Deleted bool   `json:"deleted"`
+	}
+	if err := json.Unmarshal(decodeBody(t, body)["data"], &res); err != nil {
+		t.Fatalf("decode: %v (body=%s)", err, body)
+	}
+	if res.ID != "doc-1" || !res.Deleted {
+		t.Fatalf("response = %+v, want id=doc-1 deleted=true", res)
+	}
+
+	docs, err := rag.ListDocuments(ctx)
+	if err != nil {
+		t.Fatalf("ListDocuments: %v", err)
+	}
+	if len(docs) != 0 {
+		t.Fatalf("documents = %+v, want empty after delete", docs)
+	}
+	hits, err := rag.Search(ctx, "内部实现")
+	if err != nil {
+		t.Fatalf("Search: %v", err)
+	}
+	if len(hits) != 0 {
+		t.Fatalf("hits = %+v, want none after delete", hits)
+	}
+
+	resp2, body2 := doReq(t, http.MethodPost, ts.URL+"/api/v1/admin/rag/delete", map[string]any{"id": "doc-1"}, tok)
+	if resp2.StatusCode != http.StatusNotFound {
+		t.Fatalf("second delete status = %d, want 404 (body=%s)", resp2.StatusCode, body2)
+	}
+	wantErrorShape(t, body2)
+}
+
+// TestAdminRagDeleteUnwired501 asserts an unconfigured RAG service still answers
+// honestly instead of pretending the document was removed.
+func TestAdminRagDeleteUnwired501(t *testing.T) {
+	t.Parallel()
+	srv, ts, jwt := buildEnv(t, cfgDefault(), Deps{})
+	_ = srv
+	tok := signAny(t, jwt, "acct", auth.RoleOwner)
+
+	resp, body := doReq(t, http.MethodPost, ts.URL+"/api/v1/admin/rag/delete", map[string]any{"id": "doc-1"}, tok)
+	if resp.StatusCode != http.StatusNotImplemented {
+		t.Fatalf("status = %d, want 501 (body=%s)", resp.StatusCode, body)
+	}
+	wantErrorShape(t, body)
+}
+
+// TestAdminRagDeleteRequiresOwner asserts the write route stays owner-gated.
+func TestAdminRagDeleteRequiresOwner(t *testing.T) {
+	t.Parallel()
+	srv, ts, jwt := buildEnv(t, cfgDefault(), Deps{RAG: newRagStoreForGateway(t)})
+	_ = srv
+	tok := signAny(t, jwt, "acct", auth.RoleAdmin)
+
+	resp, _ := doReq(t, http.MethodPost, ts.URL+"/api/v1/admin/rag/delete", map[string]any{"id": "doc-1"}, tok)
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", resp.StatusCode)
+	}
+}
diff --git a/internal/services/gateway/admin_write_iot_automations.go b/internal/services/gateway/admin_write_iot_automations.go
index d9f748e..f787691 100644
--- a/internal/services/gateway/admin_write_iot_automations.go
+++ b/internal/services/gateway/admin_write_iot_automations.go
@@ -56,17 +56,29 @@ func (s *Server) adminIoTControl(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, iotDeviceSummary{ID: dev.ID, Name: dev.Name, Type: dev.Type, State: dev.State, Online: dev.Online})
 }
 
-// adminIoTScenario answers honestly: the IoT subsystem has no scenario store yet
-// (it owns device list/control/status only), so scenario write lands in M10.
+// adminIoTScenario answers honestly: the IoT subsystem owns device
+// list/control/status only (the Provider interface has no scenario model or
+// store), so there is nothing to persist a scenario into. It reports the missing
+// store rather than fabricating one.
 func (s *Server) adminIoTScenario(w http.ResponseWriter, r *http.Request) {
 	s.auditClaims(r, "iot.scenario", "error")
-	writeError(w, &apperr.AppError{Code: "not_implemented", Message: "IoT 场景存储为 M10 提供（当前 IoT 仅有设备列表/控制/状态）", HTTPCode: http.StatusNotImplemented})
+	writeError(w, &apperr.AppError{
+		Code:     "not_implemented",
+		Message:  "IoT 场景未实现：IoT 子系统仅有设备列表/控制/状态（Provider 接口无场景模型与存储）；场景 CRUD 需先新增模型 + 执行器",
+		HTTPCode: http.StatusNotImplemented,
+	})
 }
 
-// adminIoTRule answers honestly: no IoT automation-rule store exists yet.
+// adminIoTRule answers honestly: no IoT automation-rule model or store exists
+// (the generic automations service runs cron/event rules, not device-state
+// conditions with device actions), so a rule cannot be persisted or executed.
 func (s *Server) adminIoTRule(w http.ResponseWriter, r *http.Request) {
 	s.auditClaims(r, "iot.rule", "error")
-	writeError(w, &apperr.AppError{Code: "not_implemented", Message: "IoT 自动化规则存储为 M10 提供（当前 IoT 仅有设备列表/控制/状态）", HTTPCode: http.StatusNotImplemented})
+	writeError(w, &apperr.AppError{
+		Code:     "not_implemented",
+		Message:  "IoT 自动化规则未实现：IoT 子系统无规则模型与存储（通用 automations 服务只跑 cron/事件规则，不含设备状态条件 + 设备动作执行器）",
+		HTTPCode: http.StatusNotImplemented,
+	})
 }
 
 // mapIotError maps iot sentinel errors to HTTP errors.
diff --git a/internal/services/gateway/admin_write_memory_rag.go b/internal/services/gateway/admin_write_memory_rag.go
index 5b39641..f68141b 100644
--- a/internal/services/gateway/admin_write_memory_rag.go
+++ b/internal/services/gateway/admin_write_memory_rag.go
@@ -2,6 +2,7 @@ package gateway
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"strings"
 
@@ -125,3 +126,45 @@ func (s *Server) adminIndexRag(w http.ResponseWriter, r *http.Request) {
 	s.auditClaims(r, "rag.index", "ok")
 	writeJSON(w, http.StatusCreated, map[string]any{"name": name})
 }
+
+// ragDeleteRequest is the POST /api/v1/admin/rag/delete body.
+type ragDeleteRequest struct {
+	ID string `json:"id"`
+}
+
+// adminDeleteRag removes a knowledge document by id: the store deletes the
+// project-index entry and cascades its chapters. A missing document is answered
+// with 404, a store that cannot delete with a clear 501, and any other failure
+// with 500 — never a fabricated success. The route is owner-gated and audited.
+func (s *Server) adminDeleteRag(w http.ResponseWriter, r *http.Request) {
+	if s.rag == nil {
+		s.auditClaims(r, "rag.delete", "error")
+		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "知识库 RAG 服务未配置（未注入 RagStore）", HTTPCode: http.StatusNotImplemented})
+		return
+	}
+	var req ragDeleteRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
+		return
+	}
+	id := strings.TrimSpace(req.ID)
+	if id == "" {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "id is required"))
+		return
+	}
+	if err := s.rag.DeleteDocument(r.Context(), id); err != nil {
+		s.auditClaims(r, "rag.delete", "error")
+		switch {
+		case errors.Is(err, knowledge.ErrDocumentNotFound):
+			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "知识库文档 %q 不存在", id))
+		case errors.Is(err, knowledge.ErrWriteUnsupported):
+			writeError(w, &apperr.AppError{Code: "not_implemented", Message: "该知识库存储不支持删除", HTTPCode: http.StatusNotImplemented})
+		default:
+			s.log.Error("rag delete", "id", id, "err", err)
+			writeError(w, apperr.Wrap(apperr.ErrInternal, "rag_delete_failed", "failed to delete knowledge document"))
+		}
+		return
+	}
+	s.auditClaims(r, "rag.delete", "ok")
+	writeJSON(w, http.StatusOK, map[string]any{"id": id, "deleted": true})
+}
diff --git a/internal/services/gateway/admin_write_personas_users.go b/internal/services/gateway/admin_write_personas_users.go
index 06ca427..623d660 100644
--- a/internal/services/gateway/admin_write_personas_users.go
+++ b/internal/services/gateway/admin_write_personas_users.go
@@ -132,12 +132,18 @@ func (s *Server) adminUpdatePersona(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, personaSummaryOf(p, characterFromRequest(req)))
 }
 
-// adminCreateUser answers honestly: there is no persistent user table yet (the
-// deployment is a single admin account + API keys), so user creation is deferred
-// to M10 rather than fabricated.
+// adminCreateUser answers honestly: there is no persistent user table and no
+// user-authenticated login to back one (the deployment is a single admin
+// account from .env plus runtime API keys; design/11 is single-user first), so
+// user creation would be a row nobody could log in with. It reports the missing
+// store instead of fabricating a user.
 func (s *Server) adminCreateUser(w http.ResponseWriter, r *http.Request) {
 	s.auditClaims(r, "user.create", "error")
-	writeError(w, &apperr.AppError{Code: "not_implemented", Message: "新增用户/角色存储为 M10 提供（当前为单 admin + APIKey 现状）", HTTPCode: http.StatusNotImplemented})
+	writeError(w, &apperr.AppError{
+		Code:     "not_implemented",
+		Message:  "新增用户/角色未实现：无用户表，登录仅用 .env 单 admin（ADMIN_USERNAME/PASSWORD），角色为 owner>admin>viewer 常量；多用户存储与登录接入需先设计（design/11 单用户为主）",
+		HTTPCode: http.StatusNotImplemented,
+	})
 }
 
 // apiKeyIssueRequest is the POST /api/v1/admin/users/apikey body.
diff --git a/internal/services/gateway/extra_test.go b/internal/services/gateway/extra_test.go
index b35f04a..6846252 100644
--- a/internal/services/gateway/extra_test.go
+++ b/internal/services/gateway/extra_test.go
@@ -1526,7 +1526,9 @@ func TestAdminRagEmptyWhenUnwired(t *testing.T) {
 	}
 }
 
-func TestAdminRagDeleteNotImplemented(t *testing.T) {
+// TestAdminRagDeleteUnsupportedStore501 asserts a store that cannot delete is
+// answered with an honest 501 rather than a fabricated success.
+func TestAdminRagDeleteUnsupportedStore501(t *testing.T) {
 	t.Parallel()
 	srv, ts, jwt := buildEnv(t, cfgDefault(), Deps{RAG: &stubRag{err: knowledge.ErrWriteUnsupported}})
 	_ = srv
@@ -1537,8 +1539,8 @@ func TestAdminRagDeleteNotImplemented(t *testing.T) {
 		t.Fatalf("status = %d, want 501 (body=%s)", resp.StatusCode, body)
 	}
 	wantErrorShape(t, body)
-	if !strings.Contains(string(body), "M10") {
-		t.Fatalf("error body = %s, want M10 write message", body)
+	if !strings.Contains(string(body), "not_implemented") {
+		t.Fatalf("error body = %s, want not_implemented code", body)
 	}
 }
 
diff --git a/internal/services/gateway/server.go b/internal/services/gateway/server.go
index b38e157..5626283 100644
--- a/internal/services/gateway/server.go
+++ b/internal/services/gateway/server.go
@@ -235,9 +235,11 @@ type OwnerRegistrar interface {
 }
 
 // RagStore backs the admin knowledge-base RAG module (design/10 §3.12 module 8).
-// *runtime/knowledge.Store is the production implementation. Every method is
-// read-only for this milestone: IndexDocument/DeleteDocument return a clear
-// "write lands in M10" error rather than a fabricated success.
+// *runtime/knowledge.Store is the production implementation: it lists/searches
+// the project index, imports a document (chunk + index) and deletes one
+// (project entry + cascaded chapters). An implementation that cannot write
+// reports a clear error (knowledge.ErrWriteUnsupported) rather than a fabricated
+// success; the handlers map a missing document to 404.
 type RagStore interface {
 	// ListDocuments enumerates the knowledge-base documents (project-index
 	// entries).
@@ -245,9 +247,10 @@ type RagStore interface {
 	// Search answers a knowledge-base query (line-level hierarchy + optional
 	// semantic/vector ranking).
 	Search(ctx context.Context, query string) ([]knowledge.Hit, error)
-	// IndexDocument uploads/chunks/embeds a document. M10; returns an error.
+	// IndexDocument uploads/chunks/embeds a document into the project index.
 	IndexDocument(ctx context.Context, doc knowledge.Doc) error
-	// DeleteDocument removes a document. M10; returns an error.
+	// DeleteDocument removes a document (and its chapters) by id, returning
+	// knowledge.ErrDocumentNotFound when no such document exists.
 	DeleteDocument(ctx context.Context, id string) error
 }
 
@@ -509,7 +512,6 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("GET /api/v1/admin/backthink", adminAuth(http.HandlerFunc(s.adminListBackthink)))
 	mux.Handle("GET /api/v1/admin/rag", adminAuth(http.HandlerFunc(s.adminListRag)))
 	mux.Handle("POST /api/v1/admin/rag/query", adminAuth(http.HandlerFunc(s.adminSearchRag)))
-	mux.Handle("POST /api/v1/admin/rag/delete", adminAuth(http.HandlerFunc(s.adminDeleteRag)))
 	mux.Handle("GET /api/v1/admin/observability/metrics", adminAuth(http.HandlerFunc(s.adminObservabilityMetrics)))
 	mux.Handle("GET /api/v1/admin/observability/trace", adminAuth(http.HandlerFunc(s.adminObservabilityTrace)))
 	mux.Handle("GET /api/v1/admin/observability/audit", adminAuth(http.HandlerFunc(s.adminObservabilityAudit)))
@@ -549,6 +551,7 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("POST /api/v1/admin/memories", ownerAuth(http.HandlerFunc(s.adminAddMemory)))
 	mux.Handle("POST /api/v1/admin/memories/search", ownerAuth(http.HandlerFunc(s.adminMemorySearch)))
 	mux.Handle("POST /api/v1/admin/rag", ownerAuth(http.HandlerFunc(s.adminIndexRag)))
+	mux.Handle("POST /api/v1/admin/rag/delete", ownerAuth(http.HandlerFunc(s.adminDeleteRag)))
 	mux.Handle("GET /api/v1/admin/sessions/{id}/export", adminAuth(http.HandlerFunc(s.adminExportSession)))
 	mux.Handle("POST /api/v1/admin/system/revoke-keys", ownerAuth(http.HandlerFunc(s.adminRevokeAllKeys)))
 	mux.Handle("POST /api/v1/admin/system/rotate-jwt", ownerAuth(http.HandlerFunc(s.adminRotateJWT)))