diff --git a/CHANGELOG.md b/CHANGELOG.md
index 170d52a2..cc464bbb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,35 @@ Pithead ships as **one product, one version** — the version lives in the top-l
 [`VERSION`](VERSION) file and every released image is tagged with it. Releases are cut
 per the process in [`docs/dev/releasing.md`](docs/dev/releasing.md).
 
-## [Unreleased]
+## [1.9.3] - 2026-07-19
+
+### Fixed
+
+- **Keyboard users can sort the Workers table (#671).** Each sort header's click target is now a
+  real `<button>` (the #657 pattern), so it is focusable and activates on Enter/Space. The
+  worker-history table also stops advertising a pointer cursor on headers that do nothing.
+- **The configuration reference says how to make an edit take effect (#675).** The callout above
+  the key table now states that editing `config.json` changes nothing until `./pithead apply`,
+  for readers who deep-link into the table and never see the intro.
+- **Config editor saves work again (#679).** Every save through the dashboard's Configuration
+  editor — Form and JSON mode alike — was rejected with the "sets both workers.list[] and
+  dashboard.workers[]" error: the editor merges `config.reference.json` (which ships both worker
+  keys as empty-array defaults) under the operator's config and round-trips the merged document,
+  and validation refused on key presence. The refusal now keys on populated lists; an empty array
+  beside the populated key is the schema default and passes. The editor's own
+  `_core_keys`/`_editable_keys` metadata is likewise stripped from the intent before it reaches
+  the host gate.
+
+### Changed
+
+- **The disk readout switches to TB at 1 TB (#677).** The system card and the Telegram `/system`
+  reply format disk used/total through one shared helper: GB with one decimal below 1024 GB
+  (unchanged), both values scaled to TB together at or above it — `Disk: 0.4 / 3.6 TB` instead
+  of `Disk: 408.6 / 3666.4 GB`. RAM, stored telemetry, and the metrics endpoint stay GB.
+- **`apply` migrates the deprecated `dashboard.workers[]` to `workers.list[]` (#679).** A
+  validated legacy list is moved in place on the next apply: entries land under `workers.list`,
+  the old key is deleted, and the pre-migration file is kept beside the config as
+  `config.json.bak-workers`. Dry runs (including every dashboard preview) never write.
 
 ## [1.9.2] - 2026-07-19
 
diff --git a/VERSION b/VERSION
index 6f2d3653..7b0231f5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.9.2
\ No newline at end of file
+1.9.3
\ No newline at end of file
diff --git a/build/dashboard/mining_dashboard/config/config.py b/build/dashboard/mining_dashboard/config/config.py
index e8cfd542..863908c4 100644
--- a/build/dashboard/mining_dashboard/config/config.py
+++ b/build/dashboard/mining_dashboard/config/config.py
@@ -208,8 +208,9 @@
 # parse only has to stay safe if the mount is stale or hand-edited.
 #
 # workers.list[] is the current sub-key (#506); dashboard.workers[] (#172) is read as a deprecated
-# fallback when workers.list is unset, logged once, and removed in v1.9 — pithead's apply-time
-# validation refuses a config that sets both, so this loader only needs to pick whichever is present.
+# fallback when workers.list is unset or empty, logged once, and removed in v1.9 — pithead's
+# apply-time validation refuses a config that populates both, so this loader only needs to pick
+# whichever is populated (an empty array is a schema default, never an operator choice, #679).
 #   name  — 1-128 printable non-space ASCII chars (matched against the stratum name, '+' stripped)
 #   host  — hostname or IPv4 literal: letters/digits/dot/dash/underscore only, so a config value
 #           can never smuggle a port, path, or userinfo into the probe URL (no ':/@?#'; IPv6
@@ -231,8 +232,10 @@ def _valid_watts(v):
 def load_worker_endpoints(path=None):
     """The validated workers.list[] entries (#506); invalid entries dropped, first name wins.
 
-    dashboard.workers[] (#172) is read as a deprecated fallback when workers.list is unset
-    (removed in v1.9 — pithead's apply-time validation refuses a config that sets both).
+    dashboard.workers[] (#172) is read as a deprecated fallback when workers.list is unset or an
+    empty array (removed in v1.9 — pithead's apply-time validation refuses a config that
+    populates both, but an empty workers.list may legitimately sit alongside a populated legacy
+    key, #679: empty arrays are schema defaults, not operator choices).
     """
     try:
         with open(path or HOST_CONFIG_PATH) as f:
@@ -241,7 +244,7 @@ def load_worker_endpoints(path=None):
         return []
     workers_block = doc.get("workers") if isinstance(doc, dict) else None
     raw = workers_block.get("list") if isinstance(workers_block, dict) else None
-    if raw is None:
+    if raw is None or raw == []:
         dashboard_block = doc.get("dashboard") if isinstance(doc, dict) else None
         if isinstance(dashboard_block, dict) and "workers" in dashboard_block:
             raw = dashboard_block["workers"]
diff --git a/build/dashboard/mining_dashboard/helper/utils.py b/build/dashboard/mining_dashboard/helper/utils.py
index 640ddacf..bd0bc5d5 100644
--- a/build/dashboard/mining_dashboard/helper/utils.py
+++ b/build/dashboard/mining_dashboard/helper/utils.py
@@ -74,6 +74,26 @@ def format_hashrate(hashrate):
         return "0 H/s"
 
 
+def format_disk_size(used_gb, total_gb):
+    """Format a disk used/total pair, switching from GB to TB once the volume reaches
+    1 TB (1024 GB — the same 1024-based scale as the collector's ``BYTES_IN_GB``).
+
+    Both values switch together so the pair stays comparable; a mixed
+    ``408.6 GB / 3.6 TB`` line would not. Shared by the dashboard system card and the
+    Telegram ``/system`` reply so disk reads the same on every surface (#677).
+
+    Returns:
+        tuple: (used_str, total_str, unit) with one decimal place.
+    """
+    try:
+        used, total = float(used_gb or 0), float(total_gb or 0)
+    except (ValueError, TypeError):
+        used, total = 0.0, 0.0
+    if total >= 1024:
+        return f"{used / 1024:.1f}", f"{total / 1024:.1f}", "TB"
+    return f"{used:.1f}", f"{total:.1f}", "GB"
+
+
 def format_xmr(amount):
     """Format an XMR amount with magnitude-adaptive precision — 4 decimal places at >= 1 XMR,
     6 at >= 0.001, 8 below that — so a small daily estimate isn't truncated to zeros.
diff --git a/build/dashboard/mining_dashboard/service/control_service.py b/build/dashboard/mining_dashboard/service/control_service.py
index 72736b2f..3e35e0ad 100644
--- a/build/dashboard/mining_dashboard/service/control_service.py
+++ b/build/dashboard/mining_dashboard/service/control_service.py
@@ -223,6 +223,14 @@ def submit(action, cfg=None, actor="", intent_id=None, version=None):
     rid = str(uuid.UUID(intent_id)) if intent_id else str(uuid.uuid4())
     request = {"id": rid, "action": action, "actor": actor}
     if cfg is not None:
+        # read_config's own metadata injections (#529/#613) ride back with the editor's POST —
+        # both modes round-trip the fetched doc wholesale — and the host gate's closed-schema
+        # check would refuse a commit carrying them (#679). Shed them at the one choke point
+        # every config intent passes through; everything else unknown still fails closed host-side.
+        # A non-dict cfg passes through untouched: the host runner already rejects it with its
+        # own "config must be a JSON object" result, which the UI knows how to surface.
+        if isinstance(cfg, dict):
+            cfg = {k: v for k, v in cfg.items() if k not in ("_core_keys", "_editable_keys")}
         request["config"] = cfg
     if version is not None:
         request["version"] = version
diff --git a/build/dashboard/mining_dashboard/service/telegram_commands.py b/build/dashboard/mining_dashboard/service/telegram_commands.py
index 00686113..bd207ed6 100644
--- a/build/dashboard/mining_dashboard/service/telegram_commands.py
+++ b/build/dashboard/mining_dashboard/service/telegram_commands.py
@@ -19,6 +19,7 @@
 )
 from mining_dashboard.helper.utils import (
     effective_hashrate,
+    format_disk_size,
     format_duration,
     format_hashrate,
     format_xmr,
@@ -285,13 +286,15 @@ def format_system(system, host_label=""):
     """Host resource usage — the answer to '/system'. Reads the ``system`` snapshot the dashboard
     already collects (disk / RAM / CPU / load / HugePages)."""
     disk = system.get("disk", {})
+    disk_used, disk_total, disk_unit = format_disk_size(
+        disk.get("used_gb", 0), disk.get("total_gb", 0)
+    )
     mem = system.get("memory", {})
     hp_status, _hp_class, hp_value = system.get("hugepages", ["Unknown", "", "0/0"])
     return "\n".join(
         [
             f"{_prefix(host_label)}\U0001f5a5️ System",
-            f"Disk: {disk.get('used_gb', 0):.1f}/{disk.get('total_gb', 0):.1f} GB "
-            f"({disk.get('percent_str', '0%')})",
+            f"Disk: {disk_used}/{disk_total} {disk_unit} ({disk.get('percent_str', '0%')})",
             f"RAM: {mem.get('used_gb', 0):.1f}/{mem.get('total_gb', 0):.1f} GB "
             f"({mem.get('percent_str', '0%')})",
             f"CPU: {system.get('cpu_percent', '0%')} · load {system.get('load', 'n/a')}",
diff --git a/build/dashboard/mining_dashboard/web/static/components.mjs b/build/dashboard/mining_dashboard/web/static/components.mjs
index d345cced..b7d1d5da 100644
--- a/build/dashboard/mining_dashboard/web/static/components.mjs
+++ b/build/dashboard/mining_dashboard/web/static/components.mjs
@@ -164,7 +164,7 @@ function Header({ state }) {
                     <span class=${s.hugepages.variant === "ok" ? "status-ok" : "status-bad"}>Huge Pages: ${s.hugepages.status} (${s.hugepages.value})</span>
                 </div>
                 <div class="flex items-center">
-                    <span class=${(s.disk.level === "high" ? "status-bad" : "text-muted") + " mr-2"}>Disk: ${s.disk.used} / ${s.disk.total} GB (${s.disk.percent})</span> <${HighUsage} level=${s.disk.level} />
+                    <span class=${(s.disk.level === "high" ? "status-bad" : "text-muted") + " mr-2"}>Disk: ${s.disk.used} / ${s.disk.total} ${s.disk.unit} (${s.disk.percent})</span> <${HighUsage} level=${s.disk.level} />
                     <div class="disk-bar">
                         <div class="progress-bg">
                             <div class=${"progress-fill " + s.disk.fill} style=${{ width: s.disk.width }}></div>
@@ -786,14 +786,17 @@ function WorkersTable({ workers, summary, ui, onSort, hostIp, stratumPort, onIns
                     <tr>${WORKER_COLUMNS.map(
                       // Sorted column carries the direction, visibly (arrow) and for AT (aria-sort);
                       // the title makes clickability discoverable without hovering rows (#656).
-                      (c, i) => html`<th onClick=${() => onSort(i)}
+                      // The click target is a real <button> so keyboard users can sort too (#671):
+                      // native buttons are focusable and activate on Enter/Space without extra wiring.
+                      (c, i) => html`<th
                             class=${i === ui.sortIndex ? "sorted" : null}
-                            aria-sort=${i === ui.sortIndex ? (ui.sortAsc ? "ascending" : "descending") : null}
-                            title=${"Sort by " + c.label}>${c.label}${
-                              i === ui.sortIndex
-                                ? html`<span class="sort-arrow">${ui.sortAsc ? " ▲" : " ▼"}</span>`
-                                : ""
-                            }</th>`,
+                            aria-sort=${i === ui.sortIndex ? (ui.sortAsc ? "ascending" : "descending") : null}><button
+                              type="button" class="th-sort-btn" onClick=${() => onSort(i)}
+                              title=${"Sort by " + c.label}>${c.label}${
+                                i === ui.sortIndex
+                                  ? html`<span class="sort-arrow">${ui.sortAsc ? " ▲" : " ▼"}</span>`
+                                  : ""
+                              }</button></th>`,
                     )}</tr>
                 </thead>
                 <tbody id="workers-tbody">
diff --git a/build/dashboard/mining_dashboard/web/static/dashboard.css b/build/dashboard/mining_dashboard/web/static/dashboard.css
index b77ecb7e..97e59c1c 100644
--- a/build/dashboard/mining_dashboard/web/static/dashboard.css
+++ b/build/dashboard/mining_dashboard/web/static/dashboard.css
@@ -360,11 +360,27 @@ th {
   padding: 10px;
   border-bottom: 1px solid var(--border);
   text-transform: uppercase;
-  cursor: pointer;
 }
 th.sorted {
   color: var(--text);
 }
+/* Sortable headers (#671): the sort control is a real <button>, so it is keyboard-operable.
+ * It absorbs the th padding and inherits the th typography — the whole cell stays the click
+ * target and the header looks unchanged. */
+th:has(.th-sort-btn) {
+  padding: 0;
+}
+.th-sort-btn {
+  display: block;
+  width: 100%;
+  padding: 10px;
+  background: none;
+  border: none;
+  font: inherit;
+  color: inherit;
+  text-align: inherit;
+  cursor: pointer;
+}
 .sort-arrow {
   font-size: 0.6rem;
 }
diff --git a/build/dashboard/mining_dashboard/web/views.py b/build/dashboard/mining_dashboard/web/views.py
index 4bab5827..63fc72c8 100644
--- a/build/dashboard/mining_dashboard/web/views.py
+++ b/build/dashboard/mining_dashboard/web/views.py
@@ -30,6 +30,7 @@
 )
 from mining_dashboard.helper.utils import (
     detect_host_ipv4,
+    format_disk_size,
     format_duration,
     format_hashrate,
     format_time_abs,
@@ -785,6 +786,9 @@ def build_system(data):
     system = data.get("system", {})
 
     disk_usage = system.get("disk", {})
+    disk_used, disk_total, disk_unit = format_disk_size(
+        disk_usage.get("used_gb", 0), disk_usage.get("total_gb", 0)
+    )
     disk_percent = disk_usage.get("percent", 0)
     disk_fill = "critical" if disk_percent > 90 else "warning" if disk_percent > 70 else ""
 
@@ -814,8 +818,9 @@ def build_system(data):
             "level": _usage_level(mem_usage.get("percent", 0)),
         },
         "disk": {
-            "used": f"{disk_usage.get('used_gb', 0):.1f}",
-            "total": f"{disk_usage.get('total_gb', 0):.1f}",
+            "used": disk_used,
+            "total": disk_total,
+            "unit": disk_unit,
             "percent": disk_usage.get("percent_str", "0%"),
             "width": f"{disk_percent}%",
             "fill": disk_fill,
diff --git a/build/dashboard/pyproject.toml b/build/dashboard/pyproject.toml
index 6997f793..0135d541 100644
--- a/build/dashboard/pyproject.toml
+++ b/build/dashboard/pyproject.toml
@@ -7,7 +7,7 @@ name = "mining-dashboard"
 # Keep in lockstep with the top-level VERSION file — the single source of truth for the stack version
 # (#44). A shell test (tests/stack/run.sh) fails if these drift; the dashboard *displays* the version
 # from VERSION (baked in as PITHEAD_VERSION, #58), so this is packaging metadata only.
-version = "1.9.2"
+version = "1.9.3"
 description = "Monitoring dashboard and XvB switching engine for Pithead"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/build/dashboard/tests/config/test_config.py b/build/dashboard/tests/config/test_config.py
index fbef7720..34e59d8d 100644
--- a/build/dashboard/tests/config/test_config.py
+++ b/build/dashboard/tests/config/test_config.py
@@ -235,9 +235,10 @@ def test_valid_watts_loads_and_bad_watts_drops_entry(self, tmp_path):
 
 class TestWorkerEndpointsDualRead:
     """workers.list[] (#506) is the current sub-key; dashboard.workers[] (#172) is read as a
-    deprecated fallback only when workers.list is unset. pithead's apply-time validation refuses
-    a config that sets both, so the loader only has to pick whichever is present and prefer the
-    new shape."""
+    deprecated fallback when workers.list is unset or an empty array. pithead's apply-time
+    validation refuses a config that populates both, but an empty array is a schema default
+    (config.reference.json ships both keys as []) and must never shadow the populated shape
+    (#679)."""
 
     def _load(self, tmp_path, payload):
         from mining_dashboard.config.config import load_worker_endpoints
@@ -269,6 +270,30 @@ def test_legacy_fallback_used_when_new_shape_unset(self, tmp_path):
         got = self._load(tmp_path, {"dashboard": {"workers": [{"name": "legacy-rig"}]}})
         assert got == [{"name": "legacy-rig"}]
 
+    def test_legacy_fallback_used_when_new_shape_empty(self, tmp_path):
+        # The editor round-trip shape (#679): config.reference.json's workers.list: [] merged
+        # beside a populated legacy key — the empty schema default must not shadow the entries.
+        got = self._load(
+            tmp_path,
+            {
+                "workers": {"list": []},
+                "dashboard": {"workers": [{"name": "legacy-rig"}]},
+            },
+        )
+        assert got == [{"name": "legacy-rig"}]
+
+    def test_empty_legacy_default_beside_populated_new_shape_reads_new(self, tmp_path):
+        # The mirror round-trip shape (#679): dashboard.workers: [] injected by the reference
+        # merge beside a populated workers.list.
+        got = self._load(
+            tmp_path,
+            {
+                "workers": {"list": [{"name": "new-rig"}]},
+                "dashboard": {"workers": []},
+            },
+        )
+        assert got == [{"name": "new-rig"}]
+
     def test_legacy_fallback_logs_a_deprecation_notice(self, tmp_path, caplog):
         import logging
 
diff --git a/build/dashboard/tests/frontend/components.test.mjs b/build/dashboard/tests/frontend/components.test.mjs
index fb14591e..8b1675f1 100644
--- a/build/dashboard/tests/frontend/components.test.mjs
+++ b/build/dashboard/tests/frontend/components.test.mjs
@@ -13,6 +13,7 @@ import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
 
 import { App } from '../../mining_dashboard/web/static/components.mjs';
+import { WORKER_COLUMNS } from '../../mining_dashboard/web/static/logic.mjs';
 import { StatsTable } from '../../mining_dashboard/web/static/workerview.mjs';
 import { render } from './helpers/render.mjs';
 
@@ -492,9 +493,19 @@ test('WorkersTable marks the sorted column, visibly and via aria-sort (#656)', (
     // No sort chosen (server order): no column claims a direction.
     assert.doesNotMatch(renderApp(), /aria-sort/);
     const asc = renderApp({ ui: { ...UI, sortIndex: 0, sortAsc: true } });
-    assert.match(asc, /<th[^>]*class="sorted"[^>]*aria-sort="ascending"[^>]*>Worker<span class="sort-arrow"> ▲<\/span>/);
+    assert.match(asc, /<th[^>]*class="sorted"[^>]*aria-sort="ascending"[^>]*><button[^>]*>Worker<span class="sort-arrow"> ▲<\/span>/);
     const desc = renderApp({ ui: { ...UI, sortIndex: 0, sortAsc: false } });
-    assert.match(desc, /aria-sort="descending"[^>]*>Worker<span class="sort-arrow"> ▼<\/span>/);
+    assert.match(desc, /aria-sort="descending"[^>]*><button[^>]*>Worker<span class="sort-arrow"> ▼<\/span>/);
+});
+
+test('WorkersTable sort headers are real buttons, so keyboard can sort (#671)', () => {
+    // A native <button> is focusable and activates on Enter/Space, firing the same onClick
+    // (onSort) path the mouse takes — keyboard operability rides on the element choice, so
+    // the component-tier assertion is that every header's click target IS a native button.
+    const html = renderApp();
+    const btns = html.match(/<button type="button" class="th-sort-btn" title="Sort by /g) || [];
+    assert.equal(btns.length, WORKER_COLUMNS.length);
+    assert.match(html, /<th><button type="button" class="th-sort-btn" title="Sort by Worker">Worker</);
 });
 
 test('WorkersTable with no workers shows the connect hint instead of a bare table (#385)', () => {
diff --git a/build/dashboard/tests/helper/test_utils.py b/build/dashboard/tests/helper/test_utils.py
index 216aafbe..8be0fbb8 100644
--- a/build/dashboard/tests/helper/test_utils.py
+++ b/build/dashboard/tests/helper/test_utils.py
@@ -6,6 +6,7 @@
     PPLNS_BLOCK_TIME_DEFAULT,
     PPLNS_BLOCK_TIME_NANO,
     detect_host_ipv4,
+    format_disk_size,
     format_duration,
     format_hashrate,
     format_time_abs,
@@ -120,6 +121,23 @@ def test_bad_data(self):
         assert format_hashrate(None) == "0 H/s"
 
 
+class TestFormatDiskSize:
+    """#677: GB below 1 TB, TB at or above it; both values switch together."""
+
+    def test_stays_gb_below_1024(self):
+        assert format_disk_size(408.6, 931.5) == ("408.6", "931.5", "GB")
+
+    def test_switches_to_tb_at_boundary(self):
+        assert format_disk_size(512, 1024) == ("0.5", "1.0", "TB")
+
+    def test_large_volume_reads_in_tb(self):
+        assert format_disk_size(408.6, 3666.4) == ("0.4", "3.6", "TB")
+
+    def test_bad_data(self):
+        assert format_disk_size(None, None) == ("0.0", "0.0", "GB")
+        assert format_disk_size("invalid", "invalid") == ("0.0", "0.0", "GB")
+
+
 class TestFormatXmr:
     """#387: mirrors formatXmr in web/static/logic.mjs so dashboard and Telegram agree."""
 
diff --git a/build/dashboard/tests/service/test_control_service.py b/build/dashboard/tests/service/test_control_service.py
index 4530e6a0..e9076284 100644
--- a/build/dashboard/tests/service/test_control_service.py
+++ b/build/dashboard/tests/service/test_control_service.py
@@ -119,6 +119,25 @@ def test_garbage_intent_id_rejected(self, spool):
         with pytest.raises(ValueError):
             control_service.submit("commit", intent_id="../../etc/passwd")
 
+    def test_read_config_metadata_stripped_from_the_intent(self, spool):
+        # The editor round-trips the fetched doc wholesale, so read_config's own metadata
+        # injections (_core_keys/_editable_keys) ride back with the POST; the host gate's
+        # closed-schema check refuses a commit carrying them (#679). submit is the choke point.
+        rid = control_service.submit(
+            "preview",
+            {"p2pool": {"pool": "main"}, "_core_keys": ["a"], "_editable_keys": ["b"]},
+            actor="admin",
+        )
+        req = json.loads((spool / "requests" / f"{rid}.json").read_text())
+        assert req["config"] == {"p2pool": {"pool": "main"}}
+
+    def test_non_dict_config_passes_through_for_the_host_to_reject(self, spool):
+        # Malformed client payloads keep their host-side rejection ("config must be a JSON
+        # object") instead of dying in the container on the metadata strip.
+        rid = control_service.submit("preview", ["not", "a", "config"], actor="admin")
+        req = json.loads((spool / "requests" / f"{rid}.json").read_text())
+        assert req["config"] == ["not", "a", "config"]
+
 
 class TestResult:
     def test_result_pending_then_ready(self, spool):
diff --git a/build/dashboard/tests/service/test_telegram_commands.py b/build/dashboard/tests/service/test_telegram_commands.py
index 1cd3fcbc..277a0ea5 100644
--- a/build/dashboard/tests/service/test_telegram_commands.py
+++ b/build/dashboard/tests/service/test_telegram_commands.py
@@ -222,6 +222,12 @@ def test_system_reads_snapshot():
     assert "HugePages: Enabled (3072/3072)" in out
 
 
+def test_system_disk_reads_in_tb_on_large_volumes():
+    # Threshold mechanics live in test_utils.py; this proves /system wires the unit through.
+    out = tc.format_system({"disk": {"used_gb": 408.6, "total_gb": 3666.4, "percent_str": "11.1%"}})
+    assert "Disk: 0.4/3.6 TB (11.1%)" in out
+
+
 @pytest.mark.parametrize(
     "n,expected",
     [
diff --git a/build/dashboard/tests/web/test_views.py b/build/dashboard/tests/web/test_views.py
index 72e33bf2..cfdfae8d 100644
--- a/build/dashboard/tests/web/test_views.py
+++ b/build/dashboard/tests/web/test_views.py
@@ -778,6 +778,13 @@ def test_high_usage_levels_and_fill(self):
     def test_warning_fill_between_70_and_90(self):
         assert build_system({"system": {"disk": {"percent": 75}}})["disk"]["fill"] == "warning"
 
+    def test_disk_unit_switches_to_tb_on_large_volumes(self):
+        # Threshold mechanics live in test_utils.py; this proves the card wires the unit through.
+        s = build_system(
+            {"system": {"disk": {"used_gb": 408.6, "total_gb": 3666.4, "percent_str": "11.1%"}}}
+        )
+        assert (s["disk"]["used"], s["disk"]["total"], s["disk"]["unit"]) == ("0.4", "3.6", "TB")
+
     def test_unparseable_cpu_is_ok(self):
         assert build_system({"system": {"cpu_percent": "n/a"}})["cpu"]["level"] == "ok"
 
diff --git a/build/dashboard/uv.lock b/build/dashboard/uv.lock
index 17d74f2c..8b7aa0a7 100644
--- a/build/dashboard/uv.lock
+++ b/build/dashboard/uv.lock
@@ -782,7 +782,7 @@ wheels = [
 
 [[package]]
 name = "mining-dashboard"
-version = "1.9.2"
+version = "1.9.3"
 source = { editable = "." }
 dependencies = [
     { name = "aiofiles" },
diff --git a/docs/configuration.md b/docs/configuration.md
index 4e674f88..97a8afd4 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -70,7 +70,9 @@ plain HTTP, edit `config.json` and run `./pithead apply`.
 ## Configuration reference
 
 > Only `monero.wallet_address` and `tari.wallet_address` are required. Everything below is optional
-> and has a default. Add a key only when you want to change its behavior.
+> and has a default. Add a key only when you want to change its behavior. Editing `config.json`
+> changes nothing by itself — run `./pithead apply` afterward (see
+> [Changing settings later](#changing-settings-later)).
 
 The table below has ~94 keys across 13 sections — most of it you'll never touch. A handful of keys
 are **core**: wallet addresses, `monero.mode`, `p2pool.pool`, the dashboard login and host, and
@@ -146,7 +148,7 @@ control channel will commit, are unaffected either way.
 | `workers.api_auth` | `none` | How the dashboard reads each worker's xmrig API. Beyond what the proxy reports, the dashboard probes every connected miner's own xmrig HTTP API (`/1/summary`) for uptime and per-miner hashrate, one configured way, no auto-detection. `none` (default) expects an open, read-only API (xmrig `http.restricted` with no `access-token`), which is what a stock RigForge worker exposes. `name` sends the worker's stratum name as the Bearer token (for miners whose `access-token` equals their name). `token` sends a single shared `workers.api_token` for every worker. A worker whose probe fails isn't dropped: it keeps its proxy-reported hashrate and is flagged `api ⚠` on the dashboard, with one log line explaining why (so a misconfigured API is distinct from an offline miner). Upgrading from a build whose miners set an `access-token`? Set this to `name` (or reprovision the miners to drop the token), otherwise the default no-auth probe `401`s and every worker shows `api ⚠`. |
 | `workers.api_token` | `""` | The single shared Bearer token used when `workers.api_auth` is `token`. Ignored otherwise. |
 | `workers.api_port` | `8080` | TCP port the worker xmrig API listens on. Change only if your miners expose the API on a non-standard port. |
-| `workers.list` | `[]` | Per-worker overrides for the worker-API probe, a list of `{name, host?, port?, token?, watts?, control_port?}` objects. Only needed when one rig doesn't match the fleet defaults above — a different API port, an API on another interface (NAT / multi-homed), or its own token. Each field is optional bar `name` (the rig's stratum name). **Merge rule:** a per-worker field beats the fleet default (`workers.api_port`, `workers.api_auth`/`workers.api_token`), which beats the built-in default; unlisted rigs inherit the fleet defaults untouched. A per-worker `token` forces token-auth for that one rig, whatever the fleet `api_auth` mode. `watts` is a manual power-draw estimate for the [energy calculator](dashboard.md#energy--profit), used only for a rig whose enriched feed reports no measured watts. `control_port` (default `8082`) is the rig's writable control API port, used by [Worker Inspect](dashboard.md#worker-inspect) to push config changes — set it alongside `host` + `token` to make a rig editable. Matched by `name` first, then by connecting IP against an operator-set `host`; duplicate names → first-declared wins, so a renamed rig needs its entry updated. `host` **must** be operator-set here and is never derived from a miner-advertised value: the dashboard never sends a configured token to a miner-controlled host ([SSRF guard](workers.md#per-worker-overrides)). The standard fleet needs no entries. See [Connecting Miners › Per-worker overrides](workers.md#per-worker-overrides). `dashboard.workers` is a deprecated alias for this key (#506): still read if `workers.list` is unset, but setting both is refused at apply, and the old location is removed in v1.9. |
+| `workers.list` | `[]` | Per-worker overrides for the worker-API probe, a list of `{name, host?, port?, token?, watts?, control_port?}` objects. Only needed when one rig doesn't match the fleet defaults above — a different API port, an API on another interface (NAT / multi-homed), or its own token. Each field is optional bar `name` (the rig's stratum name). **Merge rule:** a per-worker field beats the fleet default (`workers.api_port`, `workers.api_auth`/`workers.api_token`), which beats the built-in default; unlisted rigs inherit the fleet defaults untouched. A per-worker `token` forces token-auth for that one rig, whatever the fleet `api_auth` mode. `watts` is a manual power-draw estimate for the [energy calculator](dashboard.md#energy--profit), used only for a rig whose enriched feed reports no measured watts. `control_port` (default `8082`) is the rig's writable control API port, used by [Worker Inspect](dashboard.md#worker-inspect) to push config changes — set it alongside `host` + `token` to make a rig editable. Matched by `name` first, then by connecting IP against an operator-set `host`; duplicate names → first-declared wins, so a renamed rig needs its entry updated. `host` **must** be operator-set here and is never derived from a miner-advertised value: the dashboard never sends a configured token to a miner-controlled host ([SSRF guard](workers.md#per-worker-overrides)). The standard fleet needs no entries. See [Connecting Miners › Per-worker overrides](workers.md#per-worker-overrides). `dashboard.workers` is a deprecated alias for this key (#506): still read if `workers.list` is unset or empty, and the next `apply` migrates it here in place, keeping the old file as `config.json.bak-workers` (#679). Populating both is refused at apply (an empty array beside the populated key is allowed — it is the schema default), and the old location is removed in v1.9. |
 | `dashboard.energy.cost_per_kwh` | `0` _(off)_ | Your electricity price per kWh, for the dashboard's [energy & profit](dashboard.md#energy--profit) tab. `0` or unset shows fleet power draw and efficiency but hides the cost and profit math. Any positive number adds power cost per day/month/year; combine with `xmr_price` for net profit. In the `currency` label below. |
 | `dashboard.energy.xmr_price` | `0` _(off)_ | The fiat price of 1 XMR, in your `currency`, for the net-profit figure (`P2Pool XMR earnings × this − power cost`) and the ≈-fiat rows on the earnings card. `0` or unset hides net profit (energy cost still shows if `cost_per_kwh` is set). By default no price is fetched — fetching an exchange rate is network egress this stack doesn't do unbidden — so you supply the price yourself, or opt into the Tor-routed `price_feed` below. This is the base gate for net profit: it's P2Pool XMR only unless a Tari price is also known (#520). XvB (raffle status, not a per-day income estimate) is always excluded. |
 | `dashboard.energy.tari_price` | `0` _(off)_ | The fiat price of 1 XTM, in your `currency` (#520). Once both this and `xmr_price` are set, net profit folds in the estimated Tari merge-mining revenue (same what-if Tari/day estimate the Tari tab shows) — the card's heading and Net/day tooltip say "P2Pool + Tari" so the figure is never silently P2Pool-only. `0` or unset (or Tari not currently merge-mining) keeps net profit P2Pool XMR only. Supplied by you, or fetched live via `price_feed` below. |
diff --git a/docs/dashboard.md b/docs/dashboard.md
index 419e22df..27c0a2dc 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -79,8 +79,10 @@ successful refresh.
 ### Top bar
 
 A status strip across the top shows the hostname, host telemetry (CPU, load, RAM, HugePages, disk),
-total hashrate, and 1h / 24h routed averages for both P2Pool and XvB (your split). Next to the disk
-readout, an `XMR Pruned` / `XMR Full` badge shows the Monero node's blockchain mode.
+total hashrate, and 1h / 24h routed averages for both P2Pool and XvB (your split). The disk readout
+switches from GB to TB once the volume reaches 1 TB, on the same scale in the Telegram `/system`
+reply. Next to the disk readout, an `XMR Pruned` / `XMR Full` badge shows the Monero node's
+blockchain mode.
 
 When the dashboard host is a name (not already an IP), the machine's IP shows beside it as
 `hostname @ ip` (e.g. `pithead.local @ 192.168.1.42`), a way back in when the hostname doesn't
diff --git a/docs/workers.md b/docs/workers.md
index 3bbf3849..17cc6011 100644
--- a/docs/workers.md
+++ b/docs/workers.md
@@ -246,8 +246,12 @@ multi-homed), or carries its own token — override just that rig with
 ```
 
 `dashboard.workers` is a deprecated alias for `workers.list` (#506): a config from before the move
-still works — the old location is read as a fallback with a one-time warning — but setting both is
-refused at apply, and the old location is removed in v1.9.
+still works — the old location is read as a fallback with a one-time warning, and the next
+`./pithead apply` migrates it in place (#679): the entries move to `workers.list`, the old key is
+deleted, and the pre-migration file is kept beside the config as `config.json.bak-workers`.
+Populating both locations is refused at apply. An empty array beside the populated key is fine:
+`[]` is the schema default `config.reference.json` ships for both keys, and the dashboard's config
+editor round-trips it (#679).
 
 The merge rule is: **per-worker field > fleet default > built-in default.** A rig with no entry (or
 an entry that only sets `port`) inherits everything else from `workers.*`. A per-worker `token`
diff --git a/pithead b/pithead
index cc7d8382..27c1bc99 100755
--- a/pithead
+++ b/pithead
@@ -2372,31 +2372,47 @@ ensure_onion_password() {
     log "Dashboard onion is on but no password was set — generated one and saved it to config.json (login: admin; see dashboard.auth.password)."
 }
 
+# The one selection rule for every reader of the per-worker descriptors (#506): workers.list[]
+# wins whenever it is set to anything but an empty array; an empty or absent workers.list falls
+# back to the deprecated dashboard.workers[] (#172). An empty array is a schema default, not an
+# operator choice — the dashboard config editor merges config.reference.json UNDER the operator's
+# config, so a staged editor config always carries BOTH keys with at least one of them empty
+# (#679); keying any decision on mere presence picks (or refuses) the wrong shape. A set-but-not-
+# an-array workers.list still wins, so validation flags it under its own name.
+readonly WORKER_LIST_JQ='def worker_list:
+    ((.workers // {}) | .list // []) as $n
+    | if ($n | type) == "array" and ($n | length) == 0
+      then ((.dashboard // {}) | .workers // []) else $n end;'
+
 # Validate the per-worker endpoint descriptors (#506): a list of {name, host?, port?, token?}
 # objects the dashboard uses to override the fleet worker-API defaults per rig. workers.list[] is
 # the current sub-key; dashboard.workers[] (#172) is read as a deprecated fallback (removed in
-# v1.9, one-time warning below) — setting BOTH is refused outright, since silently picking one
-# would leave the other a stale, unnoticed copy of hosts/tokens. Nothing here renders to .env — the
+# v1.9, one-time warning below) — POPULATING both is refused outright, since silently picking one
+# would leave the other a stale, unnoticed copy of hosts/tokens. Presence alone never refuses
+# (#679, see WORKER_LIST_JQ above). Nothing here renders to .env — the
 # dashboard reads the list straight off its read-only config.json bind mount (tokens stay in the
 # one owner-only file that already holds secrets) — so this validation exists to fail an apply
 # LOUDLY on a typo instead of the dashboard silently dropping the entry at runtime. The `host`
 # charset matters for #122: it must never be able to smuggle a port, path, or userinfo into the
 # dashboard's probe URL.
 validate_worker_endpoints() {
-    local has_new has_legacy dw_path dw_err dw_dups
-    has_new=$(jq -r '(.workers // {}) | has("list")' "$CONFIG_FILE" 2>/dev/null)
-    has_legacy=$(jq -r '(.dashboard // {}) | has("workers")' "$CONFIG_FILE" 2>/dev/null)
-    if [ "$has_new" = "true" ] && [ "$has_legacy" = "true" ]; then
+    local new_n legacy_n dw_path dw_err dw_dups
+    # Length, not presence (#679): 0 = absent or empty array (schema default — never an operator
+    # signal), >0 = populated, -1 = set to something that isn't an array (validated below under
+    # the right path label). A jq parse hiccup degrades to 0, same as the old has() going silent.
+    new_n=$(jq -r '(.workers // {}) | (.list // []) | if type == "array" then length else -1 end' "$CONFIG_FILE" 2>/dev/null || echo 0)
+    legacy_n=$(jq -r '(.dashboard // {}) | (.workers // []) | if type == "array" then length else -1 end' "$CONFIG_FILE" 2>/dev/null || echo 0)
+    if [ "${new_n:-0}" != "0" ] && [ "${legacy_n:-0}" != "0" ]; then
         error "config.json sets both workers.list[] and dashboard.workers[] — pick one. dashboard.workers[] is a deprecated alias for workers.list[] (#506, removed in v1.9); move its entries to workers.list[] and delete dashboard.workers."
     fi
-    if [ "$has_legacy" = "true" ] && [ -z "${PITHEAD_WORKERS_LEGACY_WARNED:-}" ]; then
+    if [ "${legacy_n:-0}" != "0" ] && [ -z "${PITHEAD_WORKERS_LEGACY_WARNED:-}" ]; then
         warn "dashboard.workers[] is deprecated — move its entries to workers.list[] (#506, removed in v1.9)."
         PITHEAD_WORKERS_LEGACY_WARNED=1
     fi
     dw_path="workers.list"
-    [ "$has_new" = "true" ] || dw_path="dashboard.workers"
-    dw_err=$(jq -r --arg path "$dw_path" '
-        (.workers.list // .dashboard.workers // []) as $w
+    if [ "${new_n:-0}" = "0" ] && [ "${legacy_n:-0}" != "0" ]; then dw_path="dashboard.workers"; fi
+    dw_err=$(jq -r --arg path "$dw_path" "$WORKER_LIST_JQ"'
+        worker_list as $w
         | if ($w | type) != "array" then "\($path) must be an array of {name, host?, port?, token?} objects."
           else [ $w[] |
               if type != "object" then "\($path) entries must be objects (got a \(type))."
@@ -2416,10 +2432,46 @@ validate_worker_endpoints() {
           ] | first // empty end' "$CONFIG_FILE" 2>/dev/null)
     [ -z "$dw_err" ] || error "$dw_err"
     # Duplicate names are legal but only the FIRST declaration counts — surface that, once.
-    dw_dups=$(jq -r '[(.workers.list // .dashboard.workers // [])[] | .name] | group_by(.) | map(select(length > 1) | .[0]) | join(", ")' "$CONFIG_FILE" 2>/dev/null)
+    dw_dups=$(jq -r "$WORKER_LIST_JQ"'[worker_list[] | .name] | group_by(.) | map(select(length > 1) | .[0]) | join(", ")' "$CONFIG_FILE" 2>/dev/null)
     [ -z "$dw_dups" ] || warn "$dw_path has duplicate names ($dw_dups) — the first-declared entry wins; a renamed rig needs its config entry updated."
 }
 
+# Migrate a validated deprecated dashboard.workers[] (#172) to workers.list[] (#506) in place:
+# move the entries, drop the old key, keep the pre-migration file as ${CONFIG_FILE}.bak-workers
+# (the control channel's .bak-control naming). Runs AFTER validate_worker_endpoints, so only a
+# config whose legacy entries already passed validation is ever rewritten. Write-back rules
+# follow persist_node_credentials: never on a dry run (#556) — which also covers every
+# control-channel preview, since preview dry-runs a staged copy — atomic temp+mv under umask 077,
+# and best-effort: a failed write warns and the run continues reading the legacy key via
+# worker_list. The pre-migration owner is restored after the mv so a root control-runner apply
+# (#33) cannot strand config.json root-owned — the #480 bug class control_reown_operator_files
+# exists for, handled here because this write happens mid-apply, before that reown runs.
+migrate_legacy_workers() {
+    local new_n legacy_n owner tmp="${CONFIG_FILE}.tmp"
+    [ "$PITHEAD_DRY_RUN" -eq 1 ] && return 0
+    new_n=$(jq -r '(.workers // {}) | (.list // []) | if type == "array" then length else -1 end' "$CONFIG_FILE" 2>/dev/null || echo 0)
+    legacy_n=$(jq -r '(.dashboard // {}) | (.workers // []) | if type == "array" then length else -1 end' "$CONFIG_FILE" 2>/dev/null || echo 0)
+    { [ "${legacy_n:-0}" -gt 0 ] && [ "${new_n:-0}" = "0" ]; } || return 0
+    if ! cp -p "$CONFIG_FILE" "${CONFIG_FILE}.bak-workers" 2>/dev/null; then
+        warn "Could not back up $CONFIG_FILE before migrating dashboard.workers[] — leaving the deprecated key in place."
+        return 0
+    fi
+    owner=$(stat -c '%u:%g' "$CONFIG_FILE" 2>/dev/null || stat -f '%u:%g' "$CONFIG_FILE" 2>/dev/null) || owner=""
+    if (
+        umask 077
+        jq '.workers = ((.workers // {}) + {list: .dashboard.workers}) | .dashboard |= del(.workers)' \
+            "$CONFIG_FILE" >"$tmp" 2>/dev/null
+    ); then
+        mv "$tmp" "$CONFIG_FILE"
+        chmod 600 "$CONFIG_FILE"
+        if [ -n "$owner" ]; then chown "$owner" "$CONFIG_FILE" 2>/dev/null || true; fi
+        log "Migrated dashboard.workers[] to workers.list[] (#506) — the old copy is at ${CONFIG_FILE}.bak-workers."
+    else
+        rm -f "$tmp"
+        warn "Could not migrate dashboard.workers[] to workers.list[] — continuing on the deprecated key (backup left at ${CONFIG_FILE}.bak-workers)."
+    fi
+}
+
 # Validate the dashboard.energy block for the energy/profit calculator (#260). Like the worker
 # descriptors, this renders nothing to .env — the dashboard reads it off the read-only config.json
 # bind mount — so validation exists only to fail an apply loudly on a typo. Prices are operator-set
@@ -2603,6 +2655,7 @@ parse_and_validate_config() {
     fi
 
     validate_worker_endpoints
+    migrate_legacy_workers
     validate_energy_config
 
     # Optional miner authentication on the stratum port (#152). xmrig-proxy's --access-password
@@ -2918,8 +2971,9 @@ render_masked_config() { # <control-dir>
     tmp="$mdir/.config.json.tmp"
     # Per-worker tokens (#172) live in the variable-length descriptor array, out of reach of the
     # fixed-path walk above — mask each SET .token entry by entry. workers.list[] is current
-    # (#506); dashboard.workers[] is the deprecated fallback — mask whichever is actually
-    # populated (validate_worker_endpoints already refuses a config that sets both).
+    # (#506); dashboard.workers[] is the deprecated fallback — mask BOTH shapes unconditionally
+    # (validate_worker_endpoints refuses a config that populates both, but empty schema defaults
+    # may sit alongside the populated one, #679, and masking an empty array is a no-op).
     if jq --argjson paths "$CONTROL_SECRET_PATHS" '
         reduce $paths[] as $p (.;
             if ((try getpath($p) catch null) // "") == "" then .
@@ -5087,8 +5141,8 @@ control_preview() { # <request-file> <id> <actor> <control-dir>
     # (first-declared wins on duplicate names, matching the container's probe; whichever shape the
     # live config actually uses). A sentinel for a rig with no live token collapses to "" too, and
     # the sentinel is restored into whichever shape the submitted doc carries.
-    (umask 077 && jq --argjson paths "$CONTROL_SECRET_PATHS" --slurpfile live "$CONFIG_FILE" '
-        (reduce (($live[0].workers.list // $live[0].dashboard.workers // []) | reverse | .[]) as $w ({};
+    (umask 077 && jq --argjson paths "$CONTROL_SECRET_PATHS" --slurpfile live "$CONFIG_FILE" "$WORKER_LIST_JQ"'
+        (reduce (($live[0] | worker_list) | reverse | .[]) as $w ({};
             if ($w | type) == "object" and ($w.name | type) == "string"
             then .[$w.name] = ($w.token // "") else . end)) as $livetok
         | reduce $paths[] as $p (.config;
@@ -5148,7 +5202,7 @@ control_reown_operator_files() {
     # GNU stat first, BSD fallback (see the provision_onion_client_auth note). No owner → skip.
     owner=$(stat -c '%u:%g' "$CONFIG_FILE" 2>/dev/null || stat -f '%u:%g' "$CONFIG_FILE" 2>/dev/null) || owner=""
     [ -n "$owner" ] || return 0
-    for f in "$ENV_FILE" "Caddyfile" "${CONFIG_FILE}.bak-control"; do
+    for f in "$ENV_FILE" "Caddyfile" "${CONFIG_FILE}.bak-control" "${CONFIG_FILE}.bak-workers"; do
         [ -e "$f" ] || continue
         # Fail safe: a chown that can't complete leaves the pre-existing bug, never corrupts state.
         chown "$owner" "$f" 2>/dev/null ||
@@ -5588,9 +5642,9 @@ control_worker_apply() { # <claimed-file> <id> <actor> <control-dir>
     # host or no token cannot be a target (fail closed): the rig's control path is bearer-mandatory and
     # we only ever dial an operator-set host.
     local host cport token
-    host=$(jq -r --arg n "$worker" '(.workers.list // .dashboard.workers // [])[] | select(.name == $n) | .host // ""' "$CONFIG_FILE" 2>/dev/null | head -1)
-    cport=$(jq -r --arg n "$worker" '(.workers.list // .dashboard.workers // [])[] | select(.name == $n) | .control_port // 8082' "$CONFIG_FILE" 2>/dev/null | head -1)
-    token=$(jq -r --arg n "$worker" '(.workers.list // .dashboard.workers // [])[] | select(.name == $n) | .token // ""' "$CONFIG_FILE" 2>/dev/null | head -1)
+    host=$(jq -r --arg n "$worker" "$WORKER_LIST_JQ"'worker_list[] | select(.name == $n) | .host // ""' "$CONFIG_FILE" 2>/dev/null | head -1)
+    cport=$(jq -r --arg n "$worker" "$WORKER_LIST_JQ"'worker_list[] | select(.name == $n) | .control_port // 8082' "$CONFIG_FILE" 2>/dev/null | head -1)
+    token=$(jq -r --arg n "$worker" "$WORKER_LIST_JQ"'worker_list[] | select(.name == $n) | .token // ""' "$CONFIG_FILE" 2>/dev/null | head -1)
     if [ -z "$host" ]; then
         _wa_reject "worker '$worker' has no configured host in workers.list[] (or the deprecated dashboard.workers[]) — set host + control_port + token to edit it."
         return 0
diff --git a/tests/stack/run.sh b/tests/stack/run.sh
index 2b33b589..b75862a4 100755
--- a/tests/stack/run.sh
+++ b/tests/stack/run.sh
@@ -2699,6 +2699,76 @@ rc=$?
 assert_rc "both workers.list and dashboard.workers set is rejected" "$rc" "1"
 assert_contains "both-set refusal names both keys" "$out" "sets both workers.list[] and dashboard.workers[]"
 
+# The refusal keys on CONTENT, not presence (#679): the dashboard config editor merges
+# config.reference.json (which ships BOTH keys as empty-array schema defaults) under the
+# operator's config before serving the form, and round-trips the merged doc on save — so an
+# empty array beside the populated key must neither refuse nor warn.
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","workers":[]}, "workers":{"list":[{"name":"new-rig","host":"worker-lan.local"}]} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+assert_rc "workers.list beside an empty dashboard.workers applies (#679)" "$?" "0"
+assert_not_contains "empty legacy default does not trip the both-set refusal" "$out" "sets both workers.list[] and dashboard.workers[]"
+assert_not_contains "empty legacy default raises no deprecation warning" "$out" "deprecated"
+
+# Mirror: a populated legacy list beside an empty workers.list (the same reference-merge shape,
+# for an operator still on the deprecated key) selects — and still validates — the legacy entries.
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","workers":[{"name":"legacy-rig","host":"10.0.0.5"}]}, "workers":{"list":[]} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+assert_rc "populated dashboard.workers beside an empty workers.list applies (#679)" "$?" "0"
+assert_contains "legacy shape beside the empty default still warns as deprecated" "$out" "dashboard.workers[] is deprecated"
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","workers":[{"name":"legacy-rig","host":"attacker:8080"}]}, "workers":{"list":[]} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+assert_rc "an empty workers.list must not shadow legacy entries from validation (#679)" "$?" "1"
+assert_contains "shadowed legacy entry is flagged under its own path label" "$out" "dashboard.workers[legacy-rig].host"
+
+# The editor contract itself (#679): the shipped config.reference.json deep-merged UNDER a valid
+# operator config — exactly the document read_config serves and the editor POSTs back — must
+# survive the same dry-run the control channel's preview leg runs. Fails on any future schema
+# default that trips validation, whatever the key.
+seed_env
+cp "$ROOT/config.reference.json" "$V/reference.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan"}, "workers":{"list":[{"name":"new-rig","host":"worker-lan.local"}]} }\n' "$WALLET" >"$V/operator.json"
+jq -s '(.[0] | del(._docs)) * .[1]' "$V/reference.json" "$V/operator.json" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply --dry-run --porcelain 2>&1)"
+assert_rc "reference-merged editor round-trip survives the preview dry-run (#679)" "$?" "0"
+
+# Migration (#679): a validated legacy dashboard.workers[] is moved to workers.list[] in place on
+# apply — old key deleted, sibling workers.* keys and per-worker tokens preserved, pre-migration
+# copy kept beside the file (the .bak-control naming). Dry runs never write.
+rm -f "$V/config.json.bak-workers"
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","workers":[{"name":"legacy-rig","host":"worker-lan.local","token":"tok_mig456"}]}, "workers":{"api_port":9090} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply --dry-run --porcelain 2>&1)"
+assert_rc "dry run on a legacy config succeeds" "$?" "0"
+if [ -f "$V/config.json.bak-workers" ]; then bad "dry run never migrates (#556)" "backup appeared"; else ok "dry run never migrates (#556)"; fi
+assert_eq "dry run leaves dashboard.workers in place" "$(jq -r '.dashboard | has("workers")' "$V/config.json")" "true"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+assert_rc "legacy config applies and migrates" "$?" "0"
+assert_contains "migration is announced with the backup path" "$out" "Migrated dashboard.workers[] to workers.list[]"
+assert_eq "entries moved to workers.list (token intact)" "$(jq -r '.workers.list[0].token' "$V/config.json")" "tok_mig456"
+assert_eq "sibling workers.* keys survive the move" "$(jq -r '.workers.api_port' "$V/config.json")" "9090"
+assert_eq "dashboard.workers is gone after migration" "$(jq -r '.dashboard | has("workers")' "$V/config.json")" "false"
+assert_eq "pre-migration copy still holds the legacy key" "$(jq -r '.dashboard.workers[0].name' "$V/config.json.bak-workers")" "legacy-rig"
+case "$(stat -c '%a' "$V/config.json" 2>/dev/null || stat -f '%Lp' "$V/config.json" 2>/dev/null)" in
+600) ok "migrated config.json stays owner-only" ;;
+*) bad "migrated config.json stays owner-only" "mode $(stat -c '%a' "$V/config.json" 2>/dev/null || stat -f '%Lp' "$V/config.json" 2>/dev/null)" ;;
+esac
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+assert_rc "second apply after migration succeeds" "$?" "0"
+assert_not_contains "migration runs once — nothing to move on the next apply" "$out" "Migrated dashboard.workers[]"
+assert_not_contains "no deprecation warning after migration" "$out" "deprecated"
+
+# An INVALID legacy list fails validation before the migration hook — config and backup untouched.
+rm -f "$V/config.json.bak-workers"
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","workers":[{"name":"legacy-rig","host":"attacker:8080"}]} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+assert_rc "invalid legacy config still fails apply" "$?" "1"
+assert_eq "failed validation leaves the legacy key untouched" "$(jq -r '.dashboard | has("workers")' "$V/config.json")" "true"
+if [ -f "$V/config.json.bak-workers" ]; then bad "no backup written for a refused config" "backup appeared"; else ok "no backup written for a refused config"; fi
+
 # dashboard.energy (#260): malformed price/currency fails apply loudly, like the worker descriptors.
 en_case() { # <energy-json> <label> <expected-msg-fragment>
     seed_env
@@ -4946,7 +5016,7 @@ for ev in node_down node_recovered worker_offline worker_recovered worker_joined
     roundtrip_key "TELEGRAM_EVENT ${ev}" ".telegram.events.${ev}=false" ".telegram.events.${ev}" "false"
 done
 
-echo "== black-box: per-worker token mask + host-side restore (#172) =="
+echo "== black-box: per-worker token mask + host-side restore, legacy dashboard.workers (#172/#679) =="
 # dashboard.workers[].token is a per-rig credential living in a VARIABLE-LENGTH array — out of the
 # fixed CONTROL_SECRET_PATHS walk. The masked prefill copy must sentinel each set token (extends
 # the #440 property per-rig), and the staging swap must restore each sentinel from the LIVE token
@@ -4954,12 +5024,15 @@ echo "== black-box: per-worker token mask + host-side restore (#172) =="
 # refuses any dashboard.workers change, asserted above) — so this restore is exactly what lets an
 # operator's OTHER edits round-trip: the workers come back as sentinels and must resolve to the
 # live values unchanged, or every dashboard commit on a stack with configured workers would fail.
+# Since #679 `apply` MIGRATES the legacy shape, so a live config carries dashboard.workers only
+# between a hand-edit and the next apply — exactly the state the preview leg (a dry run, never
+# migrates) still serves. Hand-edit to legacy and render the masked copy directly, no apply.
 jq '.dashboard.workers=[
     {name:"rig1",host:"10.0.0.5",token:"tok_rig1secret"},
     {name:"rig2"},
-    {name:"rig3",token:"tok_rig3secret"}]' "$C/config.json" >"$C/config.json.tmp" &&
+    {name:"rig3",token:"tok_rig3secret"}] | del(.workers.list)' "$C/config.json" >"$C/config.json.tmp" &&
     mv "$C/config.json.tmp" "$C/config.json"
-(cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
+run_sourced "$C" render_masked_config "$C/data/control" >/dev/null 2>&1
 # 1) masked prefill copy: each SET per-worker token is a sentinel, the raw token never appears,
 #    and a token-less worker stays token-less.
 assert_eq "per-worker token masked to the sentinel" "$(jq -c '.dashboard.workers[0].token' "$MASKED" 2>/dev/null)" '{"__secret__":true}'
@@ -4982,18 +5055,22 @@ case "$(cat "$RESULTS/$UUID6.json")$(cat "$AUDIT")" in
 *tok_rig1secret* | *tok_rig3secret*) bad "results/audit stay free of the restored per-worker token" "a per-worker token leaked" ;;
 *) ok "results/audit stay free of the restored per-worker token" ;;
 esac
-# 3) commit: workers restored to live == live, so the gate passes on the pool-only change, and the
-#    committed config KEEPS the live per-worker tokens (restored by name, not lost, never a dict).
+# 3) commit: workers restored to live == live, so the gate passes on the pool-only change; the
+#    commit's `apply -y` then MIGRATES (#679) — the committed config keeps the live per-worker
+#    tokens under workers.list[], the legacy key is gone, and the pre-migration copy sits beside.
 printf '{"id":"%s","action":"commit","actor":"admin"}\n' "$UUID6" >"$REQS/$UUID6.json"
 run_pending >/dev/null
 assert_eq "worker-sentinel commit applies" "$(jq -r '.status' "$RESULTS/$UUID6.json" 2>/dev/null)" "applied"
-assert_eq "committed config keeps the live per-worker token" "$(jq -r '.dashboard.workers[0].token' "$C/config.json")" "tok_rig1secret"
+assert_eq "committed config keeps the live per-worker token (migrated to workers.list, #679)" "$(jq -r '.workers.list[0].token' "$C/config.json")" "tok_rig1secret"
+assert_eq "commit migrated the legacy key away (#679)" "$(jq -r '.dashboard | has("workers")' "$C/config.json")" "false"
+assert_eq "pre-migration copy kept through the control commit (#679)" "$(jq -r '.dashboard.workers[0].token' "$C/config.json.bak-workers" 2>/dev/null)" "tok_rig1secret"
 assert_eq "committed config carries no sentinel dict" "$(jq -r '[.. | objects | select(.__secret__?)] | length' "$C/config.json")" "0"
 # 4) duplicate names resolve first-declared-wins (staging only — a duplicate can't round-trip a
-#    commit, since the second entry's token would flip and trip the gate).
-jq '.dashboard.workers=[{name:"rig1",host:"10.0.0.5",token:"tok_first"},{name:"rig1",token:"tok_second"}]' "$C/config.json" >"$C/config.json.tmp" &&
+#    commit, since the second entry's token would flip and trip the gate). Same hand-edited
+#    legacy state as above: masked copy rendered directly, no apply, so no migration yet.
+jq 'del(.workers.list) | .dashboard.workers=[{name:"rig1",host:"10.0.0.5",token:"tok_first"},{name:"rig1",token:"tok_second"}]' "$C/config.json" >"$C/config.json.tmp" &&
     mv "$C/config.json.tmp" "$C/config.json"
-(cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
+run_sourced "$C" render_masked_config "$C/data/control" >/dev/null 2>&1
 UUID7="77777777-7777-4777-8777-777777777777"
 jq --arg id "$UUID7" '{id:$id, action:"preview", actor:"admin", config: .}' "$MASKED" >"$REQS/$UUID7.json"
 run_pending >/dev/null