进行了一些小优化

tests/widget-system/admin-ui-contract.test.cjs

@@ -62,3 +62,23 @@ test('navigation, focus, responsive layout, and reduced motion are contracted',
   assert.match(styles, /@media \(max-width:\s*480px\)/)
   assert.match(styles, /@media \(prefers-reduced-motion:\s*reduce\)/)
 })
+
+test('captcha scene whitelist matches both admin schemas and excludes dead email verification', () => {
+  const captcha = read('inc/modules/captcha.php')
+  const phpSchema = read('src/Admin/Schema/SchemaPermissions.php')
+  const jsSchema = read('assets/admin/src/schema/sections/permissions/index.js')
+
+  assert.doesNotMatch(captcha, /'verify_email'\s*=>/)
+  assert.doesNotMatch(phpSchema, /'verify_email'/)
+  assert.doesNotMatch(jsSchema, /value:\s*'verify_email'/)
+
+  const sceneBlock = captcha.match(/function aksrt_captcha_scenes\(\): array \{[\s\S]*?return \[([\s\S]*?)\n\t\];/)
+  const phpField = phpSchema.match(/'key' => 'enabled_scenarios'[\s\S]*?'options' => \[([\s\S]*?)\]\],/)
+  const jsField = jsSchema.match(/key: 'enabled_scenarios'[\s\S]*?options: \[([\s\S]*?)\n\s*\],/)
+  assert.ok(sceneBlock && phpField && jsField, 'captcha scene contracts must be discoverable')
+
+  const values = (text, pattern) => [...text.matchAll(pattern)].map((match) => match[1]).sort()
+  const scenes = values(sceneBlock[1], /'([^']+)'\s*=>/g)
+  assert.deepStrictEqual(values(phpField[1], /'value'\s*=>\s*'([^']+)'/g), scenes)
+  assert.deepStrictEqual(values(jsField[1], /value:\s*'([^']+)'/g), scenes)
+})