@sema-agent/settings-schema 10.1.1 → 11.1.0

package/dist/config-fns.js

@@ -1,6 +1,6 @@
 /**
- * Pure config functions + data shapes — LIFTED verbatim out of sema-registry's `store.ts` (the half that
- * depends only on `./types`, zero app/DB/next coupling). sema-registry re-exports these so its existing
+ * Pure config functions + data shapes — LIFTED verbatim out of web-admin's `store.ts` (the half that
+ * depends only on `./types`, zero app/DB/next coupling). web-admin re-exports these so its existing
  * `@/lib/config` importers keep working unchanged (ONE copy of the code, here).
  *
  * Two DETERMINISM refactors vs. the original store.ts (so the package is wall-clock-free and a local file
@@ -10,15 +10,16 @@
  *   2. `emptyEffective()` seeds the epoch (`new Date(0).toISOString()`) instead of the wall clock, matching
  *      the stores' existing "epoch sentinel" reduce seed.
  *
- * The fat `ConfigStore` interface itself STAYS in sema-registry (app-only, ~32 publish/RBAC/worker-status
+ * The fat `ConfigStore` interface itself STAYS in web-admin (app-only, ~32 publish/RBAC/worker-status
  * methods); only the narrow {@link ConfigReader} (reader.ts) is carried here.
  */
 // zod is a VALUE import here (not just a type): {@link salvageEntries} introspects a domain schema to find
 // its entry collections. zod is this package's one runtime dependency, so this costs nothing new.
 import { z } from "zod";
 import { MODEL_ENTRY_REFUSAL_CODES, ModelRefusalsWire } from "./fleet.js";
-import { carriesUserinfo, secretScanForms } from "./secret-scan.js"; // package-private display-side normalization + the userinfo judgement (not in the barrel)
-import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX, InfraCostRates, LimitsConfig, PRIVATE_KEY_PEM_HEADER, SkillsManifestSchema, containsSecretToken, isDomainName } from "./types.js";
+import { carriesUserinfo, secretScanForms } from "./secret-scan.js"; // package-private normalization (both scanners read it) + the userinfo judgement (not in the barrel)
+import { unwrapSchema } from "./zod-unwrap.js"; // package-private: the ONE reading of zod's wrapper layers (salvage + the one-time migrations share it)
+import { DOMAIN_SCHEMAS, InfraCostRates, LimitsConfig, PRIVATE_KEY_PEM_HEADER, RETIRED_DOMAINS, SkillsManifestSchema, containsSecretToken, isDomainName, isRetiredDomainName, renderQuotedSentence, retiredDomainSentence } from "./types.js";
 /** Redact secret-shaped tokens from a validation MESSAGE — a zod error echoes the offending value (e.g.
  *  `received 'sk-live-…'`), so a secret pasted into the WRONG field would leak via the error string. Redacts
  *  space-spanning auth credentials (`Bearer <token>`) FIRST (the token pass can't see across the space), then
@@ -26,9 +27,8 @@ import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX,
  *  containsSecretToken). invariant ①: a secret VALUE never rides an error. R13/R14.
  *
  *  **Output invariant** (S-712 verification pass N1 + codex review [high] ×2; 6.3.0): a string holding a private-key
- *  PEM header ANYWHERE ({@link PRIVATE_KEY_PEM_HEADER}) in ANY of its {@link secretScanForms} `forms` is withheld WHOLE, a
- *  string whose normalization did not finish (`unresolved`) is withheld WHOLE, and no result trips `containsSecretToken` on
- *  any of its forms.
+ *  PEM header ANYWHERE ({@link PRIVATE_KEY_PEM_HEADER}) in ANY of its {@link secretScanForms} `forms` is withheld WHOLE, and no
+ *  result trips `containsSecretToken` (which counts an unfinished normalization as secret-shaped, 11.0.0).
  *  The whole-string judgement is ONE rule — both detectors run over the normalized forms: the PEM header on every form of
  *  the ORIGINAL text, `containsSecretToken` on every form of the targeted result; what could not be normalized does not go
  *  out (6.3.0, codex r1 F1: `-----BEGIN+PRIVATE+KEY` form-encoded headers and four-layer encodings both rode out).
@@ -40,45 +40,97 @@ import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX,
  *  key body after it would ride out untouched — codex verification round). A PEM header carries spaces, so the
  *  targeted passes can never isolate it. Every free-text warning face that goes through here (coordinates, error text)
  *  inherits the same guarantee; the entry identity face additionally has to be an identifier ({@link isDisclosableIdentity}).
- *  Write and display read the private-key header at the same PLACE and with the same regex since 10.0.0: the validation-side
- *  detector `containsSecretToken` reads {@link PRIVATE_KEY_PEM_HEADER} anywhere in a string too, on the raw text and its first three
- *  percent layers. They do NOT yet read the same FORMS: this redactor reads more (deeper layers, the `+` and boundary readings of
- *  `secretScanForms`), so a header spelled only in one of those forms is withheld on display but still passes write validation —
- *  an open gap (a pin in the 10.0.0 test file registers it), not a contract. The redactor also keeps its own PEM check on the ORIGINAL
- *  text's forms because the token pass above can rewrite the header away before `containsSecretToken` ever sees the result. */
+ *  Write and display are ONE scanner since 11.0.0 (S-1274): `containsSecretToken` reads the same `secretScanForms` forms through the
+ *  same shape table, so "withheld on display" and "refused on write" no longer disagree on any form. The redactor keeps its own PEM
+ *  check on the ORIGINAL text's forms only because the token pass above can rewrite the header away before the scanner sees the
+ *  result. */
+/** What separates the candidate segments of a free text (a URL candidate is a run between these): whitespace only —— quotes,
+ *  angle brackets and backticks can sit inside a URL password (codex r1), so a quoted URL goes out as one segment, quotes and all.
+ *  Split (linear), not a scanning regex — a scanning `[^…]*@[^…]*` is quadratic on a long run without `@`. */
+const OUTGOING_RUN_DELIMITERS = /(\s+)/;
 export function redactSecrets(text) {
     const targeted = text
         .replace(/\b(bearer|basic)(\s+)\S+/gi, "$1$2[redacted-secret]")
+        .split(OUTGOING_RUN_DELIMITERS)
+        .map((run, i) => (i % 2 === 0 && carriesUserinfo(run) ? "[redacted-secret]" : run)) // a URL candidate segment carrying userinfo ⇒ the whole segment (S-811)
+        .join("")
         .replace(/[A-Za-z0-9_./:+=%-]{6,}/g, (tok) => (containsSecretToken(tok) ? "[redacted-secret]" : tok));
+    // What could not be normalized does not go out: the scanner counts an unfinished normalization as secret-shaped, so such a run is
+    // either replaced by the targeted pass above or still in `targeted` — where `containsSecretToken` withholds the whole string.
+    // A credential pair only visible on a normalized form (percent-encoded `https%3A%2F%2Fu%3Apw%40h`) withholds the whole string too.
     const scan = secretScanForms(text);
     const targetedForms = targeted === text ? scan.forms : secretScanForms(targeted).forms; // 没替换过(最常见)⇒ 同一组形,不再归一化一遍
-    const whole = scan.unresolved || scan.forms.some((form) => PRIVATE_KEY_PEM_HEADER.test(form)) || targetedForms.some((form) => containsSecretToken(form));
+    const whole = scan.forms.some((form) => PRIVATE_KEY_PEM_HEADER.test(form)) || containsSecretToken(targeted) || targetedForms.some((form) => carriesUserinfo(form));
     return whole ? "[redacted-secret]" : targeted;
 }
-/** Sanitize a ZodError IN PLACE so no surfaced error (message / `received` / nested `unionErrors`) echoes a
- *  pasted secret. RECURSES into `unionErrors` (a `z.union` failure nests a ZodError per member — e.g. RoleTarget
- *  `{model}|{select}`) and redacts string path segments too. The ONE sanitizer every validation entry point
- *  uses (parseDomain / validateDomain / validateRemoteExec / write*). R14. */
+/** Sanitize a ZodError IN PLACE so no surfaced error (message / any issue field / nested issues) echoes a pasted secret.
+ *  Every string an issue carries is redacted, string path segments included, and the walk RECURSES into the issues zod nests
+ *  inside an issue — `invalid_union.errors` (one issue list per union member, e.g. RoleTarget `{model}|{select}`) and
+ *  `invalid_key` / `invalid_element`.issues — because a nested issue's message can echo the same value. Non-string path
+ *  segments other than numbers (zod types a path as `PropertyKey[]`) leave as their redacted `String()` form, so a path read
+ *  off a sanitized error is always `string | number`. The error's `message` is re-derived from the
+ *  sanitized issues at the end (zod caches it on first read, so an earlier read would otherwise keep the raw text).
+ *  The ONE sanitizer every validation entry point uses (parseDomain / validateDomain / validateRemoteExec / write*). R14. */
 export function sanitizeZodError(err) {
-    for (const iss of err.issues) {
-        const rec = iss;
-        for (const k of Object.keys(rec)) {
-            const v = rec[k];
-            if (typeof v === "string")
-                rec[k] = redactSecrets(v);
-            else if (Array.isArray(v)) {
-                rec[k] = v.map((el) => {
-                    if (typeof el === "string")
-                        return redactSecrets(el);
-                    if (el && typeof el === "object" && Array.isArray(el.issues))
-                        return sanitizeZodError(el); // nested unionErrors
-                    return el;
-                });
-            }
-        }
-    }
+    for (const iss of err.issues)
+        sanitizeIssueFields(iss, 0);
+    err.message = JSON.stringify(err.issues, null, 2);
     return err;
 }
+/** Nesting bound for {@link sanitizeIssueFields}: zod nests one level per union / key / element boundary; anything deeper than
+ *  this is not a shape zod produces, and a value the walk does not reach is withheld rather than passed through. */
+const SANITIZE_MAX_DEPTH = 32;
+function sanitizeIssueFields(rec, depth) {
+    if (typeof rec.code === "string" && typeof rec.message === "string")
+        boundIssueIdentifiers(rec);
+    for (const k of Object.keys(rec))
+        rec[k] = sanitizeIssueValue(rec[k], depth + 1);
+}
+/** S-815(11.0.0):一条 issue 里**用户写的标识串** —— 坐标的字符串段(`path`)、zod 回显的未知键(`keys`)、自定义问题句里的操作数
+ *  (`params.operands`,{@link QuotedIssueParams})—— 出门前过告警坐标段同一道 {@link outgoingSegment}(长过 256 ⇒ 整段扣,否则脱敏),
+ *  句子由同一组出门形重铸:带 `params` 的按模板重渲染({@link renderQuotedSentence}),zod 自己的句子把每个改过的原串换成它的出门形
+ *  (长的先换)。之后整条 issue 照旧过逐字段脱敏。改前只有告警坐标段有上界:同一个 300 字的坏键在坐标里读 `[redacted-secret]`、
+ *  在 `keys` / `message` 里原样 —— 一条告警两种读法。 */
+function boundIssueIdentifiers(rec) {
+    const changed = new Map();
+    const bound = (v) => {
+        if (typeof v !== "string")
+            return v;
+        const out = outgoingSegment(v);
+        if (out !== v)
+            changed.set(v, out);
+        return out;
+    };
+    if (Array.isArray(rec.path))
+        rec.path = rec.path.map(bound);
+    if (Array.isArray(rec.keys))
+        rec.keys = rec.keys.map(bound);
+    const params = rec.params;
+    if (params !== undefined && Array.isArray(params.template) && Array.isArray(params.operands)) {
+        const quoted = { template: params.template, operands: params.operands.map((o) => bound(o)) };
+        rec.params = { ...params, ...quoted };
+        rec.message = renderQuotedSentence(quoted);
+        return;
+    }
+    let message = rec.message;
+    for (const [raw, out] of [...changed].sort((a, b) => b[0].length - a[0].length))
+        message = message.split(raw).join(out);
+    rec.message = message;
+}
+function sanitizeIssueValue(v, depth) {
+    if (typeof v === "string")
+        return redactSecrets(v);
+    if (typeof v === "symbol")
+        return redactSecrets(String(v));
+    if (v === null || typeof v !== "object")
+        return v;
+    if (depth > SANITIZE_MAX_DEPTH)
+        return "[redacted-secret]";
+    if (Array.isArray(v))
+        return v.map((el) => sanitizeIssueValue(el, depth + 1));
+    sanitizeIssueFields(v, depth);
+    return v;
+}
 export const ROLE_RANK = { viewer: 0, editor: 1, publisher: 2, admin: 3 };
 export const USER_ROLES = ["viewer", "editor", "publisher", "admin"];
 /** True if `role` is at least `min` in the hierarchy (e.g. publisher satisfies editor). */
@@ -107,21 +159,21 @@ export const DOMAIN_WRITE_ROLE = {
     // systems drive CREDENTIAL minting/delivery/rotation (S2/S3) — the credential lifecycle is ≥ the skills tier.
     systems: "publisher",
     // access: DELETED in 0.6.0 (域整删,EXPERT-REDESIGN §9)。
-    // governance (治理三件,0.6.0 从 runtime 拆出): editor(EXPERT-REDESIGN §5 domainWriteRole 同步——与
-    // runtime 残余同档,default 即 editor,故不列条目;此注释即该裁定的落点)。
+    // governance (治理三件,0.6.0 从 runtime 拆出): editor(EXPERT-REDESIGN §5 domainWriteRole 同步;
+    // default 即 editor,故不列条目;此注释即该裁定的落点)。
     // entitlement governs who-can-USE-what (models/skills/mcp/budget/runtime caps) per principal — a governance +
     // security surface (budget ceilings, bypass kill-switch) on par with systems. Same raised gate.
     entitlement: "publisher",
     // prompts (0.10.19, [ref]③/②d): declaration text goes STRAIGHT into the system prompt of
     // every worker×scenario the binding covers — the same injection surface (and rationale) as skills/mcp,
-    // so the same raised gate. Center had pre-raised this locally per governance precedent; this row is the
+    // so the same raised gate. Web-admin had pre-raised this locally per governance precedent; this row is the
     // contract-side source of truth so every consumer of the shared write gate gets publisher, not editor.
     prompts: "publisher",
     // execution (0.8.0): editor — same档 as governance (治理旋钮同类;真安全边界在 service gate,
     // client-advisory 面不值 publisher 档)。default 即 editor,故不列条目;此注释即该裁定的落点。
     // projects (0.10.0, 142-S3): editor — 登记簿是身份索引不是注入面(无 prompt/凭据/可执行内容);
     // mint/claim 动作端点与编辑面同档(草案 §3 "该 scope editor+")。default 即 editor,故不列条目。
-    // limits (0.19.0): editor —— 与 runtime(它的限额残余前身)同档,刻意不抬 publisher:本域是纯数值
+    // limits (0.19.0): editor —— 与它的前身 runtime 域(11.0.0 retired)同档,刻意不抬 publisher:本域是纯数值
     // 旋钮,无 prompt 注入面、无凭据、无可执行内容;真正的执法点在消费方的限额闸,发布闸(PUBLISH_MODE /
     // 审批流)才是"要不要多一道人"的属主。default 即 editor,故不列条目;此注释即该裁定的落点。
 };
@@ -135,8 +187,39 @@ export function domainWriteRole(domain) {
 export function emptyEffective() {
     return buildEffective(0, () => undefined, new Date(0).toISOString());
 }
+/**
+ * 一个**retired 域**的文档带着事实 —— 读存储文档的每个读者同一只拒(`parseDomain` 写、`buildEffective` 向店要、`readEffectiveWire` 看 wire、
+ * `FileConfigStore` 与 `readBundle` 读 `config.d/`)。`message` 是墓碑表那一行的整句(点名retired版本、事实今天住哪、改写存量的一次性迁移);
+ * `code` 是机读码,`domain` / `migration` 是那一行的两格。墓碑是拒,不是读法:它从不把旧文档读成任何值。
+ */
+export class RetiredDomainError extends Error {
+    domain;
+    code = "retired_domain";
+    migration;
+    constructor(domain) {
+        super(retiredDomainSentence(domain));
+        this.domain = domain;
+        this.name = "RetiredDomainError";
+        this.migration = RETIRED_DOMAINS[domain].migration;
+    }
+}
+/** 一份retired 域文档**带不带事实**:缺席与 `{}` 不带(没有可丢的东西,读者不理会);其余一切(含 `null` / 非对象 / 有键的对象)都带 ⇒ 拒。 */
+function carriesFacts(raw) {
+    if (raw === undefined)
+        return false;
+    return !(isPlainJsonObject(raw) && Object.keys(raw).length === 0);
+}
+/** 墓碑判一次:`raw` 是retired 域 `domain` 的文档,带事实 ⇒ 抛 {@link RetiredDomainError}。 */
+export function refuseRetiredDomain(domain, raw) {
+    if (carriesFacts(raw))
+        throw new RetiredDomainError(domain);
+}
 /** Validate + fill defaults for a domain payload (or the schema's empty default when absent/invalid). */
 export function parseDomain(domain, raw) {
+    // A retired domain is refused by its tombstone (one sentence naming the one-time migration), not as "not a domain":
+    // a writer still submitting it needs to know where its keys went.
+    if (isRetiredDomainName(domain))
+        throw new RetiredDomainError(domain);
     // A name that is not a domain is refused for what it is — before, `DOMAIN_SCHEMAS[name]` was undefined and the
     // TypeError surfaced through the guard below as "a value could not be read", which names the wrong failure. The
     // strict-write face hands this function every key of a submitted document set, so the name is user text: it leaves
@@ -155,41 +238,7 @@ export function parseDomain(domain, raw) {
     }
     if (r.success)
         return r.data;
-    throw sanitizeZodError(r.error); // recursive redaction (message/received/unionErrors) — no secret echo. R13/R14.
-}
-// ── 逐条容错律(2.0.0,S-144 按类修)───────────────────────────────────────────────────────────────
-//
-// 病:域解析整域 all-or-nothing —— 13 个模型里坏一条,整张目录退成 schema 默认 = 一条都不剩。缓解一直
-// 是**逐键**打补丁(把新键改成 `z.unknown()` 让它别拒),那是给每个新键加特判,规则只会越来越多;
-// 而本仓的调度存储早就有成熟的逐条容错形(坏记录逐条丢 + 逐条上报,其余全存活),只是没抬到域面。
-//
-// 本节把那条判据提成**域无关的单铸点**:`salvageEntries(domain, raw)` 从域 schema 自身派生出「哪些字段
-// 是条目集合」(数组 / Record),逐条 parse,坏的丢掉并点名。域面唯一的调用点是 `buildEffective` 的
-// `parseOr`,且**只在整域解析已经失败之后**才跑 —— 好配置的解析路径一字不动(与 0.8.1 的 grandfather
-// 同姿势:先精确、后通用、成功路径 byte 不变)。
-//
-// 🔴 不新开档位:容错只发生在 {@link DOMAIN_READ_FALLBACK} 判 `"default"` 的域。gate 域(rosters /
-// governance / entitlement / execution / workers / runtime / limits / projects)坏条目仍然 throw ——
-// 悄悄丢掉一条 roster 就是那个 worker 静默拿到全量目录,与整域降级是同一条「放权,不许」的理由,所以
-// 共用同一张表,不为容错另立一张。
-/** 展开 zod 的包装层(`.optional()` / `.default()` / `.nullable()` / `.catch()` / `.transform()` /
- *  `.superRefine()`),拿到里面真正的那个 schema。包装不改变「条目能不能单独解析」这件事。 */
-function unwrapSchema(schema) {
-    let cur = schema;
-    // 有界:包装层数是 schema 作者写出来的常数,8 层远超实际(防被畸形 schema 拖住)。
-    for (let i = 0; i < 8; i++) {
-        if (cur instanceof z.ZodEffects)
-            cur = cur.innerType();
-        else if (cur instanceof z.ZodOptional || cur instanceof z.ZodNullable)
-            cur = cur.unwrap();
-        else if (cur instanceof z.ZodDefault)
-            cur = cur.removeDefault();
-        else if (cur instanceof z.ZodCatch)
-            cur = cur.removeCatch();
-        else
-            return cur;
-    }
-    return cur;
+    throw sanitizeZodError(r.error); // recursive redaction (message / every issue field / nested issues) — no secret echo. R13/R14.
 }
 /** 一个**逐字出门**的字符串段的样子 —— 一条判据,不是一串特例:**逐字写出去之后读回来只能是它自己**。
  *  所以四类字符串段必须改走引号形:空串、含 `.`(段分隔符)、含 `"`(引号形自身)或控制字符的,以及
@@ -207,17 +256,19 @@ const PLAIN_PATH_SEGMENT = /^(?!(?:0|[1-9]\d*)$)[^."\u0000-\u001f]+$/;
 export function formatConfigPath(p) {
     return p.map((seg) => (typeof seg === "number" ? String(seg) : PLAIN_PATH_SEGMENT.test(seg) ? seg : JSON.stringify(seg))).join(".");
 }
-/** 本文件铸的、带用户写的键段的告警坐标出门前的**唯一**一道(6.3.0,codex r1 F2):字符串段过 {@link outgoingSegment} —— 与 `error` 文案
+/** 带用户写的键段的坐标出门前的**唯一**一道(6.3.0,codex r1 F2):字符串段过 {@link outgoingSegment} —— 与 `error` 文案
  *  ({@link sanitizeZodError})、身份否决({@link isDisclosableIdentity})**同一只**脱敏器,不另设判据;数字段(下标)原样。
  *  键段是用户写的,完全可能就是一条粘错位置的凭据:被丢 Record 条目的键、未知键告警(`unknown-keys-dropped` /
  *  `-carried`)的键名都一样(后者 0.19.0 起从不过脱敏器,`sk-…` 形的未知键名原样进告警与投影)。schema 已知的字段名
  *  脱敏器原样放行,所以坐标里「它是哪个字段」照旧可读。经它的坐标就是出门形 —— {@link droppedKeys} /
- *  {@link carriedUnknownKeys} 这两只导出函数给消费方的 `keys` 同样是它的产物。`legacy-governance-lifted.keys` 不经它:那些键只来自
- *  闭集 {@link GOVERNANCE_MIRROR_KEYS},按构造没有用户写的串(opus 腿 I1)。 */
-function outgoingPath(p) {
+ *  {@link carriedUnknownKeys} 这两只扫描交给告警的 `keys` 同样是它的产物。
+ *
+ *  11.0.0 起导出:读告警之外还有两处铸坐标的面 —— 一次性迁移的收据(`./one-time-migrations`)与 workers 的逐行终判(`readWorkersRows`
+ *  的 `held[].field`),它们与告警走同一道,不另抄一份判据;消费方自己拼坐标出门(日志 / 界面)时也调它。 */
+export function outgoingPath(p) {
     return p.map((seg) => (typeof seg === "string" ? outgoingSegment(seg) : seg));
 }
-/** 一段用户写的串(坐标键段、`hosts-grandfathered` 被夹紧的主机名)出门前的那一道:长过 {@link DISCLOSABLE_IDENTITY_MAX}(与身份白名单同一只上界)
+/** 一段用户写的串(坐标键段、域名)出门前的那一道:长过 {@link DISCLOSABLE_IDENTITY_MAX}(与身份白名单同一只上界)
  *  ⇒ 不扫描、整段 `[redacted-secret]`(标识符不会那么长;fail-closed 且 O(1) —— opus 独立腿 M1:6.3.0 首稿让每个未知键名
  *  不论多长都过脱敏器,64 个 16 KB 的键名把一次读拖到 20 s 以上);否则过 {@link redactSecrets}。 */
 function outgoingSegment(seg) {
@@ -233,8 +284,7 @@ function outgoingSegment(seg) {
  * 为什么是词而不是 `error` 句:句子随 zod 小版本改字、可经脱敏,拿它当判据就是拿实现当契约;wire 上也不许有自由文本。
  * 这张表由 `test/dropped-entry-reason-code-s1295.test.ts` 的两格咬住:穷举 `switch`(给表加词而不补臂 ⇒ `tsc` 红,门 = `npm run typecheck`)与
  * 满射格(每个词至少有一个真丢弃点触发它 = 没有死词;每个被丢条目的词都在表里 = 没有无词的丢弃点)。
- * 边界(如实登记):本表只管 `salvageEntries` 铸的 {@link DroppedEntry};读路径上另一条按名剔条目的臂
- * (`hosts-grandfathered`,主机名超长)走它自己的告警臂,不是 `DroppedEntry`,不在本表。
+ * 读路径上剔条目的只有 `salvageEntries` 这一处(11.0.0 起 hosts 的读侧夹紧臂已retired),所以本表覆盖读路径上每一条被丢的条目。
  */
 export const DROPPED_ENTRY_REASON_CODES = ["entry-schema-invalid", "entry-key-invalid", "entry-unreadable"];
 /** 可披露身份与出门坐标段的**长度上界**(一只常量,两处用:{@link DISCLOSABLE_IDENTITY_RE} 的上限、{@link outgoingSegment}
@@ -254,8 +304,8 @@ export const DISCLOSABLE_IDENTITY_RE = new RegExp(`^[A-Za-z0-9._:/@+-]{1,${DISCL
  *   ② **否决**(「无密钥形」):坐标脱敏器 {@link redactSecrets} 原样放行 —— 集内照样有密钥形(`sk-…` / `ghp_…` /
  *      `AKIA…` / 三段 JWT 的字符全在集内),而且判它的必须是坐标段、`error` 文案({@link sanitizeZodError})用的**同一只**
  *      脱敏器:两只判据会在同一条告警里给出两种答案(对抗轮 #2 真复现;集内的残例 = `@` 之后的单点 `eyJ…` 串,裸探测器
- *      判阴、脱敏器会改,语料 c41 钉着);∧ 不是带 userinfo 的 URL —— 校验侧 `NON_SECRET_URL` 拒写的同一只判定
- *      (`carriesUserinfo`,包内私有;opus 腿 L1:`postgres://svc:pw@h` 的字符全在集内)。
+ *      判阴、脱敏器会改,语料 c41 钉着)。带 userinfo 的 URL(opus 腿 L1:`postgres://svc:pw@h` 的字符全在集内)由同一只脱敏器扣下
+ *      (11.0.0 S-811 起它对 URL 候选段问 `carriesUserinfo`),不再单列一条否决。
  *  入参是 `string`、返回 `boolean`,**刻意不是**类型谓词(`v is string`):它对一些字符串答 false,谓词形会让调用方的
  *  否定分支把一个 `string` 收窄成 `never`;「是不是字符串」由调用点自己判(运行期收到非字符串照答 false、不抛)。
  *  不可披露的串按**无名**处置(不带,而不是打码:打过码的串不再是身份)。
@@ -263,7 +313,7 @@ export const DISCLOSABLE_IDENTITY_RE = new RegExp(`^[A-Za-z0-9._:/@+-]{1,${DISCL
  *  (经 {@link isReportableRefusalName},S-768);引擎自己的日志 / 拒因句里要不要写出一个名字,同样问这一只。 */
 export function isDisclosableIdentity(v) {
     // 非字符串(JS / any 调用方)⇒ false,不抛(秘密轴 fail-closed)
-    return typeof v === "string" && DISCLOSABLE_IDENTITY_RE.test(v) && redactSecrets(v) === v && !carriesUserinfo(v);
+    return typeof v === "string" && DISCLOSABLE_IDENTITY_RE.test(v) && redactSecrets(v) === v;
 }
 /** S-768 —— 「一个目录条目名能不能当 {@link ModelRefusalsWire} `entries` 的键」的**唯一**判据;引擎铸键前只调这一只,
  *  不过 ⇒ 按无名处置(不进键、不计数)。两条律的合取,不手抄任何一条:
@@ -291,8 +341,8 @@ function readEntryIdentity(entry) {
         const id = own("id");
         const enabled = own("enabled");
         const identity = {
-            ...(typeof name === "string" && isDisclosableIdentity(name) ? { name } : {}),
-            ...(typeof id === "string" && isDisclosableIdentity(id) ? { id } : {}),
+            ...(typeof name === "string" ? (isDisclosableIdentity(name) ? { name } : { nameWithheld: true }) : {}),
+            ...(typeof id === "string" ? (isDisclosableIdentity(id) ? { id } : { idWithheld: true }) : {}),
             ...(typeof enabled === "boolean" ? { enabled } : {}),
         };
         return Object.keys(identity).length > 0 ? identity : undefined;
@@ -409,8 +459,8 @@ function salvageEntriesUnsafe(schema, raw) {
             }
         }
         else if (collection instanceof z.ZodRecord && isPlainJsonObject(value)) {
-            const keySchema = collection.keySchema;
-            const valueSchema = collection.valueSchema;
+            const keySchema = collection.keyType;
+            const valueSchema = collection.valueType;
             const bad = [];
             const kept = {};
             for (const [key, entry] of Object.entries(value)) {
@@ -434,41 +484,21 @@ function salvageEntriesUnsafe(schema, raw) {
  * Shared GC predicate for worker-status rows (F10) — keeps memory/sqlite/tidb identical. Given the rows'
  * `{name, updatedAt}` and the GC options, returns the names to prune (A: not in `keepNames`; B: older than
  * `ttlMs`). Pass neither selector → prunes nothing (guards against a wipe-all). See `ConfigStore.gcWorkerStatuses`.
+ *
+ * `now` is REQUIRED (11.0.0): this package never reads the wall clock (the determinism rule in the file header) — the
+ * TTL arm used to fall back to `new Date()`, the one argless clock left in the package. The caller owns the time.
  */
 export function statusRowsToPrune(rows, opts) {
     if (opts.keepNames === undefined && opts.ttlMs === undefined)
         return [];
+    if (!(opts.now instanceof Date) || Number.isNaN(opts.now.getTime()))
+        throw new Error("statusRowsToPrune: opts.now must be a valid Date (the caller owns the clock)");
     const keep = opts.keepNames ? new Set(opts.keepNames) : undefined;
-    const cutoff = opts.ttlMs !== undefined ? (opts.now ?? new Date()).getTime() - opts.ttlMs : undefined;
+    const cutoff = opts.ttlMs !== undefined ? opts.now.getTime() - opts.ttlMs : undefined;
     return rows
         .filter((r) => (keep !== undefined && !keep.has(r.name)) || (cutoff !== undefined && Date.parse(r.updatedAt) < cutoff))
         .map((r) => r.name);
 }
-/**
- * Merge every domain into the effective config a consumer pulls. Shared by all store impls.
- * `updatedAt` is REQUIRED (the determinism refactor — the original store.ts defaulted it to the wall clock,
- * which made `emptyEffective`/the memory store non-deterministic). Every caller now supplies it explicitly.
- */
-/** Lift the governance trio out of a LEGACY runtime doc (pre-0.6 stored runtime carried autonomy/commandPolicy/
- *  approvalRequire). Used as the governance domain's read fallback when governance was NEVER set — so a 0.5
- *  store upgrades with zero data migration and zero gate loss. An explicitly-set governance domain WINS
- *  (its absence-of-a-key then means "center not managing", never "fall back to legacy runtime").
- *
- *  SUNSET (2.0.0): removal is a **persistent-data** break — a store still carrying the 0.5 shape would lose
- *  its guardrails silently, so this arm cannot simply be deleted at a minor. It goes at the next MAJOR, with
- *  the standard persistent-data treatment (a loud refusal naming the domain + a one-time migration on the
- *  writer side), and the closing condition is observable rather than a promise: `buildEffective` now emits
- *  `legacy-governance-lifted` every time the arm actually fires, so a deployment can prove it no longer does. */
-export function legacyGovernanceFromRuntime(rawRuntime) {
-    if (rawRuntime === null || typeof rawRuntime !== "object")
-        return undefined;
-    const r = rawRuntime;
-    const lifted = {};
-    for (const k of GOVERNANCE_MIRROR_KEYS)
-        if (r[k] !== undefined)
-            lifted[k] = r[k];
-    return Object.keys(lifted).length ? lifted : undefined;
-}
 /** {@link EffectiveReadWarning} 的 `kind` **闭集**(运行期值)。一致性 kit 的覆盖律按它计数,消费方要遍历
  *  「所有告警种类」也用它 —— 属主在告警联合自己的模块里,`./conformance` 只再导出(4.0.0 前它住在 kit 里,
  *  那边是联合的下游,却握着联合的闭集)。
@@ -480,11 +510,9 @@ export function legacyGovernanceFromRuntime(rawRuntime) {
  *  进本表」这半条缝,由 `test/warning-projection-derived-4.0.0.test.ts` 的闭集格看着(本表 == 从 AST 解出的
  *  臂集,逐字同集同序)。 */
 export const WARNING_KINDS = [
-    "hosts-grandfathered",
     "domain-defaulted",
     "unknown-keys-dropped",
     "unknown-keys-carried",
-    "legacy-governance-lifted",
     "entry-dropped",
     "unread-config-file",
 ];
@@ -497,8 +525,6 @@ export const WARNING_KINDS = [
  */
 export function projectWarning(w) {
     switch (w.kind) {
-        case "hosts-grandfathered":
-            return { kind: w.kind, domain: w.domain, droppedNames: w.droppedNames, ...(w.droppedTotal === undefined ? {} : { droppedTotal: w.droppedTotal }), ...(w.truncatedFrom === undefined ? {} : { truncatedFrom: w.truncatedFrom }) };
         case "domain-defaulted":
             return { kind: w.kind, domain: w.domain };
         // 两臂字段相同但**不合并**:合并后 `kind` 塌成两员的联合,TS 就再也认不出它属于投影联合的哪一员
@@ -507,8 +533,6 @@ export function projectWarning(w) {
             return { kind: w.kind, domain: w.domain, keys: w.keys, ...(w.truncatedFrom === undefined ? {} : { truncatedFrom: w.truncatedFrom }) };
         case "unknown-keys-carried":
             return { kind: w.kind, domain: w.domain, keys: w.keys, ...(w.truncatedFrom === undefined ? {} : { truncatedFrom: w.truncatedFrom }) };
-        case "legacy-governance-lifted":
-            return { kind: w.kind, domain: w.domain, keys: w.keys };
         case "entry-dropped":
             return { kind: w.kind, domain: w.domain, path: w.path, ...(w.identity === undefined ? {} : { identity: w.identity }), ...(w.reasonCode === undefined ? {} : { reasonCode: w.reasonCode }) };
         case "unread-config-file":
@@ -537,19 +561,18 @@ export function projectWarning(w) {
  * **闭集穷举**:`switch` 覆盖 {@link EffectiveReadWarning} 的每个 `kind`,新 kind 不声明处置 = 编译红
  * (#157 的闭集纪律)。只分两类,没有第三类:**带坐标的回写,不带坐标的原样返回**。
  *
- * 为什么 `entry-dropped` 也回写:它**不是**「恒为原坐标」,只是不经**铸它那一层自己**的表 —— 上面那条律
- * 说的就是这件事。{@link salvageEntries} 铸 `entry-dropped` 时用的是它**入参**那份文档的坐标;如果那份
- * 文档本身已被外层(hosts 的 {@link grandfatherHostsRead})压缩过,外层照样要回写它一次。把「不动」写成
- * 一条臂的性质,就是把「哪一层」这件事错记在了「哪个 kind」上。
+ * 为什么 `entry-dropped` 也有回写臂:它**不是**「恒为原坐标」,只是不经**铸它那一层自己**的表 —— 上面那条律
+ * 说的就是这件事。{@link salvageEntries} 铸 `entry-dropped` 时用的是它**入参**那份文档的坐标;若那份文档本身被外层
+ * 压缩过,外层照样要回写它一次。今天读路径上只有一个压缩点(11.0.0 起 hosts 的读侧夹紧臂已retired),所以这一臂当下
+ * 只对 `keptIndex` 为空的表恒等;把「不动」写成一条臂的性质,就是把「哪一层」这件事错记在了「哪个 kind」上。
  *
  * **恒等纪律**:没有任何一条路径真的变了(含 `keptIndex` 为空)⇒ 返回**同一个对象引用**,连 `keys`
- * 数组也不复制(与 {@link grandfatherHostsRead} 的「没夹紧就返回原引用」同一条 byte 不变律)。
+ * 数组也不复制(好数据穿过读路径 byte 不变)。
  */
 export function rebaseWarningPaths(w, keptIndex) {
     switch (w.kind) {
         case "unknown-keys-dropped":
-        case "unknown-keys-carried":
-        case "legacy-governance-lifted": {
+        case "unknown-keys-carried": {
             const keys = rebasePaths(w.keys, keptIndex);
             return keys === w.keys ? w : { ...w, keys };
         }
@@ -557,8 +580,7 @@ export function rebaseWarningPaths(w, keptIndex) {
             const path = rebasePath(w.path, keptIndex);
             return path === w.path ? w : { ...w, path };
         }
-        // 以下三臂不带任何坐标:`hosts-grandfathered` 点名的是主机**名**,另两条点名的是错误/文件名。
-        case "hosts-grandfathered":
+        // 以下两臂不带任何坐标:点名的是错误 / 文件名。
         case "domain-defaulted":
         case "unread-config-file":
             return w;
@@ -654,22 +676,20 @@ function isPlainJsonObject(v) {
     const proto = Object.getPrototypeOf(v);
     return proto === Object.prototype || proto === null;
 }
-function collectDropped(domain, raw, parsed, prefix, depth, spared, acc) {
+function collectDropped(domain, raw, parsed, prefix, depth, acc) {
     if (depth > DROP_SCAN_MAX_DEPTH)
         return;
     if (Array.isArray(raw) && Array.isArray(parsed)) {
-        // 长度不同 = 整条元素被丢/被裁(hosts 的 grandfather clamp 有自己的警告),不在本判据内,别造重复噪声。
+        // 长度不同 = 整条元素被丢(`entry-dropped` 有自己的警告),不在本判据内,别造重复噪声。
         if (raw.length !== parsed.length)
             return;
         for (let i = 0; i < raw.length; i++)
-            collectDropped(domain, raw[i], parsed[i], [...prefix, i], depth + 1, [], acc);
+            collectDropped(domain, raw[i], parsed[i], [...prefix, i], depth + 1, acc);
         return;
     }
     if (!isPlainJsonObject(raw) || !isPlainJsonObject(parsed))
         return;
     for (const k of Object.keys(raw)) {
-        if (depth === 0 && spared.includes(k))
-            continue;
         if (!Object.prototype.hasOwnProperty.call(parsed, k)) {
             if (isReservedExtensionKey(domain, prefix, k))
                 continue; // 扩展命名空间:按契约放的键,不是未知键
@@ -678,38 +698,36 @@ function collectDropped(domain, raw, parsed, prefix, depth, spared, acc) {
                 acc.keys.push(outgoingPath([...prefix, k]));
             continue;
         }
-        collectDropped(domain, raw[k], parsed[k], [...prefix, k], depth + 1, spared, acc);
+        collectDropped(domain, raw[k], parsed[k], [...prefix, k], depth + 1, acc);
     }
 }
 /**
  * 一份域文档里被域 schema **丢掉的键**(zod 对象默认 `"strip"`),段坐标形({@link ConfigPath})。
  *
- * 成案(消费方 #322 真事故):往 `runtime` 文档里加一个不属于该域的键,两条腿都会把它剥掉,
+ * 成案(消费方 #322 真事故):往一份域文档里加一个不属于该域的键,两条腿都会把它剥掉,
  * `domainErrors` 空、解析"成功"——配置写了、值没到、零告警。剥除行为本身是**刻意的前向兼容**
- * (新 center 的新键不该炸老消费方),所以修法不是收紧成 `.strict()`,而是让它**响亮**:
+ * (新 web-admin 的新键不该炸老消费方),所以修法不是收紧成 `.strict()`,而是让它**响亮**:
  * {@link buildEffective} 每域解析成功后调用本函数,非空即发 `"unknown-keys-dropped"` 警告。
  *
  * **嵌套也扫**(对抗复审 复审 F2 真 finding):`{infraCostRates:{toolCalMicroUsd:10}}` 这种**拼错的嵌套
  * 键**在顶层看不见(`infraCostRates` 键还在),只看顶层等于对计费面的错键完全失明。故按 raw↔parsed
  * 的键集逐层对比(对象逐键、数组同长时逐下标),不依赖任何 zod 内省。
  *
- * `runtime` 域的治理三件({@link GOVERNANCE_MIRROR_KEYS})**不算被丢**:0.5 期 runtime 文档携带它们是
- * 成文的抬升位(本文件的 governance 抬升函数会把它们抬进 governance 域),报出来是噪声。豁免只在顶层。
+ * 零豁免(11.0.0):此前 `runtime` 域顶层的治理三件不算被丢(读侧抬升臂的成文位);抬升臂与 `runtime` 域一起retired,豁免随之删。
  *
- * 返回 {@link UnknownKeyScan}:`keys` 是**有界**的点名列表,`total` 是截断前的真实总数(4.0.0 BREAKING,
- * 此前只回 `keys` —— 见 {@link UnknownKeyScan} 的成案)。本包自己的告警(`unknown-keys-dropped`)也是拿这两个
- * 数拼出来的,**一个铸点**:消费方自铸的 `truncatedFrom` 与告警里那个恒等。
+ * 返回 {@link UnknownKeyScan}:`keys` 是**有界**的点名列表,`total` 是截断前的真实总数;告警(`unknown-keys-dropped`)
+ * 的 `keys` / `truncatedFrom` 就是拿这两个数拼出来的(模块私有,见 {@link UnknownKeyScan})。
  *
  * 边界(如实登记):① 深度上限 {@link DROP_SCAN_MAX_DEPTH}、键数上限 {@link DROP_SCAN_MAX_KEYS}(告警
- * 载荷有界,超出即少报**点名**——`total` 不少报);② 数组长度不同就整段跳过(元素级裁剪由各自的 clamp 告警
+ * 载荷有界,超出即少报**点名**——`total` 不少报);② 数组长度不同就整段跳过(元素级剔除由 `entry-dropped`
  * 负责);③ 只比对纯 JSON 对象——raw 若是类实例/Proxy 这类形状不扫;④ 读 raw 的值可能触发访问器,整段包
  * try/catch 且**绝不**让其错误外泄(错误文案可能带 secret,与 parseDomain 的 R13 同纪律),扫描失败即当作
  * "没看见"(`{ keys: [], total: 0 }`),不影响解析。
  */
-export function droppedKeys(domain, raw, parsed) {
+function droppedKeys(domain, raw, parsed) {
     const acc = { keys: [], total: 0 };
     try {
-        collectDropped(domain, raw, parsed, [], 0, domain === "runtime" ? GOVERNANCE_MIRROR_KEYS : [], acc);
+        collectDropped(domain, raw, parsed, [], 0, acc);
     }
     catch {
         return { keys: [], total: 0 }; // 反射/访问器抛错:告警是尽力而为的审计线,绝不能把解析拖下水,更不能回显其错误文案
@@ -737,14 +755,13 @@ const OPEN_WORLD_KNOWN_KEYS = {
  * 一份已解析的 open-world 域文档里,**本包不认识但已承运**的键(段坐标)。非 open-world 域恒空
  * (它们的未知键走 {@link droppedKeys} 那条更重的「被丢了」告警)。
  *
- * 返回 {@link UnknownKeyScan}(4.0.0 BREAKING,与 {@link droppedKeys} 同形同律:`keys` 有界、`total` 是
- * 截断前的真实总数)。非 open-world 域返回的也是这个形(`{ keys: [], total: 0 }`),不是别的东西 ——
- * 「这个域没有承运未知键」与「这个域不参与承运」在消费方那里是同一个处置。
+ * 返回 {@link UnknownKeyScan}(与 {@link droppedKeys} 同形同律:`keys` 有界、`total` 是截断前的真实总数;模块私有)。
+ * 非 open-world 域返回的也是这个形(`{ keys: [], total: 0 }`):「这个域没有承运未知键」与「这个域不参与承运」是同一个处置。
  *
  * 边界(如实):只看 {@link OPEN_WORLD_KNOWN_KEYS} 登记了的层级 —— 未登记层级(如某个未知键自己的
  * 子树)不再下探,那本就是消费方自定义的内容,逐层猜没有意义。
  */
-export function carriedUnknownKeys(domain, parsed) {
+function carriedUnknownKeys(domain, parsed) {
     const table = OPEN_WORLD_KNOWN_KEYS[domain];
     const acc = { keys: [], total: 0 };
     if (table === undefined)
@@ -790,14 +807,12 @@ export function parseDomainLoud(domain, raw, onWarning) {
  *  this call explicitly (compile error until it's classified). Per-domain rationale:
  *    - models/skills/mcp/plugins/scenarios/systems/collab: additive capability catalogs — empty = the
  *      capability disappears (fail-closed), no gate is lost.
- *    - hosts: empty registry = no auto-placement targets (availability-only); self-registration re-lands
- *      entries as approved:false = 待批 (fail-closed). Plus the precise grandfather clamp runs FIRST.
+ *    - hosts: empty host registry = no auto-placement targets (availability-only); self-registration re-lands
+ *      entries as approved:false = 待批 (fail-closed).
  *    - rosters: THROW — a lost roster makes resolveEffectiveForWorker fall back to the FULL models catalog
  *      ("global(fallback)"), silently WIDENING every restricted worker's model access. 放权,不许.
  *    - workers: THROW — an empty fleet spec would make the reconciler RETIRE every managed worker
  *      (destructive apply — far worse than a read outage).
- *    - runtime: THROW — defaulting drops centrally-published rate/cost ceilings = unbounded spend (fail-open
- *      on the budget axis).
  *    - governance: THROW — defaulting drops autonomy/commandPolicy/approvalRequire = the consumer falls back
  *      to env/defaults with the operator's guardrails silently gone. 放权,不许.
  *    - entitlement: THROW — defaulting drops the org kill-switch/budget ceilings/tier restrictions for every
@@ -821,7 +836,6 @@ export const DOMAIN_READ_FALLBACK = {
     collab: "default",
     workers: "throw",
     hosts: "default",
-    runtime: "throw",
     governance: "throw",
     entitlement: "throw",
     execution: "throw",
@@ -830,80 +844,33 @@ export const DOMAIN_READ_FALLBACK = {
     // backfill-empty-default 同口径);fail-closed 由 PUBLISH_MODE 发布闸承担,default 不扩权
     // (空 bindings=不下发任何内容)。
     prompts: "default",
-    // limits(0.19.0):THROW —— 与 runtime 逐字同判据(本域就是 runtime 限额残余的继任发布位)。坏形
+    // limits(0.19.0):THROW —— 本域是成本 / 限流天花板的唯一发布位(11.0.0 起 runtime 域retired)。坏形
     // 降级成空域 = 中央发布的成本/限流天花板整片蒸发,消费方回自己的 env 底(可能宽得多)= 预算轴放权。
     // 消费方 fail-static 在上一份好配置严格更好。
     limits: "throw",
 };
-/** READ-path grandfather clamp for the 0.8.0 hosts tightening (0.8.1, S3 M-1). Clamps ONLY the two bounds
- *  0.8.0 added (name > 63 → drop the entry; array > 1024 → slice) so 0.7-era legal stored data keeps reading;
- *  everything else (regex, types, duplicates) is left for parseDomain — this is a targeted grandfather, not a
- *  lenient parser. PURE + idempotent; returns the ORIGINAL reference when nothing exceeds the bounds.
+/**
+ * Merge every domain into the effective config a consumer pulls. Shared by all store impls.
+ * `updatedAt` is REQUIRED (the determinism refactor — the original store.ts defaulted it to the wall clock,
+ * which made `emptyEffective`/the memory store non-deterministic). Every caller now supplies it explicitly.
  *
- *  SUNSET (2.0.0): same persistent-data class as the governance lift — it goes at the next MAJOR. This one was
- *  never silent (`hosts-grandfathered` fires whenever it clamps), so the closing condition is already
- *  observable: a deployment that has not seen that warning across a full read cycle no longer needs the arm. */
-export function grandfatherHostsRead(raw) {
-    if (raw === null || typeof raw !== "object" || !Array.isArray(raw.hosts)) {
-        return { raw, droppedNames: [], droppedTotal: 0, keptIndex: NO_ENTRIES_DROPPED }; // not the expected shape — let parseDomain rule on it
-    }
-    const original = raw.hosts;
-    const droppedNames = [];
-    let droppedTotal = 0;
-    const keptFrom = [];
-    let hosts = original.filter((h, i) => {
-        const name = h !== null && typeof h === "object" ? h.name : undefined;
-        if (typeof name === "string" && name.length > HOST_NAME_MAX) {
-            droppedTotal += 1;
-            // 先钳后扫(S-813):只给前 DROP_SCAN_MAX_KEYS 个铸标签,其余只计数 —— 出门那一道每个名都要归一化一遍,不能随文档条数放大。
-            if (droppedNames.length >= DROP_SCAN_MAX_KEYS)
-                return false;
-            // 出门前先过同一道(6.3.0,opus 腿 M2):用户写的主机名完全可能就是一条粘错位置的凭据,夹紧只管载荷上界、不管秘密 ——
-            // 此前 `sk-live-…` 形 / 编码 PEM 形以 63 字原文前缀出门。判在夹紧**之前**(截断会把秘密形截成探测器认不出的半截)。
-            const out = outgoingSegment(name);
-            droppedNames.push(out.length > HOST_NAME_MAX ? out.slice(0, HOST_NAME_MAX) + "…" : out); // audit label — clipped so the warning itself stays bounded
-            return false;
-        }
-        keptFrom.push(i); // 夹紧后第 keptFrom.length-1 条 = 原文档第 i 条
-        return true;
-    });
-    let truncatedFrom;
-    if (hosts.length > HOSTS_ARRAY_MAX) {
-        truncatedFrom = hosts.length;
-        hosts = hosts.slice(0, HOSTS_ARRAY_MAX);
-    }
-    if (droppedTotal === 0 && truncatedFrom === undefined)
-        return { raw, droppedNames, droppedTotal, keptIndex: NO_ENTRIES_DROPPED }; // identity — byte-stable
-    // 位移**只**来自按名剔条目;纯截断留下的是原数组前缀,幸存者下标不动 ⇒ 不登记(见 EntryKeptIndex)。
-    const keptIndex = droppedTotal > 0 ? { hosts: keptFrom.slice(0, hosts.length) } : NO_ENTRIES_DROPPED;
-    return { raw: { ...raw, hosts }, droppedNames, droppedTotal, truncatedFrom, keptIndex };
-}
+ * 11.0.0:`getRaw` 也会被问到墓碑表里的retired 域(今天只有 `runtime`)。店里还留着一份**带事实**的retired 域文档 ⇒ 整份 effective 抛
+ * {@link RetiredDomainError}(拒句点名改写它的一次性迁移);缺席或 `{}` ⇒ 不理会。读写两面同一只 schema:读路径上不再有任何抬升臂。
+ */
 export function buildEffective(version, getRaw, updatedAt, onWarning) {
+    // 墓碑先判:一份没迁的retired 域文档意味着这个 scope 的存量还没过一次性迁移 —— 拿剩下的域拼一份 effective 等于静默丢掉它的事实。
+    for (const retired of Object.keys(RETIRED_DOMAINS))
+        refuseRetiredDomain(retired, getRaw(retired));
     // 0.19.0 静默剥键/静默承运门:解析**成功**的域,把 schema 丢掉的键、以及 open-world 域里承运但本包
-    // 不认识的键(都含嵌套,点号路径)点名(行为不变,只是不再无声)。判据与 `getDomain` 同源
+    // 不认识的键(都含嵌套,段坐标)点名(行为不变,只是不再无声)。判据与 `getDomain` 同源
     // ({@link parseDomainLoud})。只在成功路径上报——降级路径已经有 domain-defaulted 那条更重的警告。
     const parseLoud = (domain, raw) => parseDomainLoud(domain, raw, onWarning);
-    /**
-     * 一层读的**告警出口**,外面裹了那一层的坐标换算(S-323b 统一律)。
-     *
-     * 读路径上有**两个压缩点**:{@link grandfatherHostsRead}(parse 之前按名剔 host 条目)与
-     * {@link salvageEntries}(整域 parse 失败后剔坏条目)。律只有一条:**一条告警用「铸它的那一层所见
-     * 文档」的坐标表达;哪一层压缩了文档,哪一层就把从它下方上来的告警回写一次。** 组合因此是自然的
-     * ——内层先换算、外层后换算,不重不漏,而每一层都只需要知道**自己**那本账。
-     *
-     * 位移表**空**(这一层这次什么都没压缩)⇒ 原样返回 `onWarning`,连一层闭包都不套 —— 与
-     * {@link rebaseWarningPaths} 的恒等纪律同一条律:没发生的事不留痕迹。
-     */
-    const exitOf = (keptIndex) => onWarning === undefined || Object.keys(keptIndex).length === 0 ? onWarning : (w) => onWarning(rebaseWarningPaths(w, keptIndex));
     // Generic READ guardrail (0.8.1): a domain that no longer parses degrades to its schema default + a warning
     // — but ONLY where DOMAIN_READ_FALLBACK says the default is safe; gate-bearing domains keep throwing (决策
     // 表与逐域理由见 DOMAIN_READ_FALLBACK). The success path is UNCHANGED (same parseDomain, same bytes).
-    //
-    // `emit` = 这一腿的告警出口(默认 = 本函数的 `onWarning`)。**刻意不收「外层压缩了多少」这种入参**:
-    // parseOr 不必知道自己上面还有没有一层,它只管把告警交给给它的那个出口 —— 换算是出口的事。
-    const parseOr = (domain, raw, emit = onWarning) => {
+    const parseOr = (domain, raw) => {
         try {
-            return parseDomainLoud(domain, raw, emit);
+            return parseDomainLoud(domain, raw, onWarning);
         }
         catch (e) {
             if (DOMAIN_READ_FALLBACK[domain] === "throw")
@@ -916,47 +883,23 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
                 try {
                     const buffered = [];
                     const parsed = parseDomainLoud(domain, salvage.raw, (w) => buffered.push(w));
-                    // 统一律落地:`entry-dropped` 是**本层**(salvage)铸的,用的就是本层入参那份文档的坐标 ⇒
-                    // 不过本层自己的表,直接交给出口(出口会补上更外层的换算);`buffered` 里的是对**本层压缩后**
-                    // 文档的诊断,是从下方上来的 ⇒ 先过本层的表,再交给出口。scan 函数一字不动。
+                    // 坐标律(S-323b):一条告警用「铸它的那一层所见文档」的坐标表达;哪一层压缩了文档,哪一层就把从它下方上来的告警回写一次。
+                    // `entry-dropped` 是本层(salvage)铸的,用的就是本层入参那份文档的坐标 ⇒ 原样出门;`buffered` 里的是对本层**压缩后**
+                    // 文档的诊断 ⇒ 先过本层的位移表。读路径上只有这一个压缩点(11.0.0 起 hosts 的读侧夹紧臂已retired)。
                     for (const d of salvage.dropped)
-                        emit?.(entryDroppedWarning(domain, d));
+                        onWarning?.(entryDroppedWarning(domain, d));
                     for (const w of buffered)
-                        emit?.(rebaseWarningPaths(w, salvage.keptIndex));
+                        onWarning?.(rebaseWarningPaths(w, salvage.keptIndex));
                     return parsed;
                 }
                 catch {
                     // 条目之外还有毛病(重名 / 悬空 ref / 域级判据)—— 丢条目救不了它,照常整域降级。
                 }
             }
-            emit?.({ domain, kind: "domain-defaulted", error: e });
+            onWarning?.({ domain, kind: "domain-defaulted", error: e });
             return parseDomain(domain, undefined); // schema default — always valid
         }
     };
-    // governance TRUTH: the domain itself; if it was never set, lift the trio from a legacy runtime doc
-    // (0.5→0.6 upgrade path — a2/local stores keep their gates without a data migration).
-    const governanceRaw = getRaw("governance");
-    let governanceSource = governanceRaw;
-    if (governanceRaw === undefined) {
-        const lifted = legacyGovernanceFromRuntime(getRaw("runtime"));
-        // 兼容臂真生效时出声(2.0.0):行为一字不变,但窗要能关就得有人看得见它还开着。
-        if (lifted !== undefined)
-            onWarning?.({ domain: "governance", kind: "legacy-governance-lifted", keys: Object.keys(lifted).map((k) => [k]) });
-        governanceSource = lifted;
-    }
-    const governance = parseLoud("governance", governanceSource);
-    // runtime slot = limit residue ONLY. 0.7.1(BREAKING,service 回执收账):E1 的 governance→runtime
-    // 六闸双写镜像已撤——service 1.150.0 已切优先读 eff.governance 并回帖确认(撤双写以其确认为门槛,
-    // ask⑤ 顺序契约兑现)。READ 方向的 legacy lift(governance 域从未设时从旧 runtime 文档抬升三闸,
-    // 见 legacyGovernanceFromRuntime)保留——那是 0.5→0.6 升级路径,与写出镜像无关。
-    const runtime = parseLoud("runtime", getRaw("runtime"));
-    // hosts: the PRECISE grandfather for the 0.8.0 tightening runs BEFORE parse (0.7-era legal data over the
-    // new bounds reads on, clamped + warned); any residual corruption falls to the generic guardrail above.
-    const hostsGf = grandfatherHostsRead(getRaw("hosts"));
-    if (hostsGf.droppedTotal > 0 || hostsGf.truncatedFrom !== undefined) {
-        const clipped = hostsGf.droppedTotal > hostsGf.droppedNames.length ? { droppedTotal: hostsGf.droppedTotal } : {};
-        onWarning?.({ domain: "hosts", kind: "hosts-grandfathered", droppedNames: hostsGf.droppedNames, ...clipped, truncatedFrom: hostsGf.truncatedFrom });
-    }
     return {
         version,
         updatedAt,
@@ -969,11 +912,10 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
         systems: parseOr("systems", getRaw("systems")),
         collab: parseOr("collab", getRaw("collab")),
         workers: parseLoud("workers", getRaw("workers")),
-        // hosts 是读路径上**唯一**有外层压缩点的腿:`hostsGf.raw` 已被 grandfather 按名剔过条目,所以这一腿的
-        // 告警出口要裹上它的位移表(统一律:哪一层压缩,哪一层回写从它下方上来的告警)。
-        hosts: parseOr("hosts", hostsGf.raw, exitOf(hostsGf.keptIndex)),
-        runtime,
-        governance,
+        hosts: parseOr("hosts", getRaw("hosts")),
+        // governance TRUTH = the domain itself (11.0.0: the read-side lift from a 0.5-era runtime document is gone — the
+        // runtime tombstone above refuses such a document, and the one-time migration SS-M1 moves its trio here).
+        governance: parseLoud("governance", getRaw("governance")),
         entitlement: parseLoud("entitlement", getRaw("entitlement")),
         // execution (0.8.0, S3): plain scope-level parse — MIRRORS governance (no overlay/merge invented here).
         execution: parseLoud("execution", getRaw("execution")),
@@ -989,12 +931,15 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
     };
 }
 /** READ-side tolerant judgment for a GET /effective **wire payload**(the {@link EffectiveWire} contract)at
- *  its CONSUMPTION boundary — a service pulling from a remote center passes the parsed JSON here instead of
+ *  its CONSUMPTION boundary — a service pulling from a remote web-admin passes the parsed JSON here instead of
  *  type-asserting it(0.12.0,[2281] 裁B:「两个契约共用一个拼写不是一个被检查的契约」——拼写副本要在
  *  消费端被真校验)。ONE judgment, two legs: every known domain goes through the SAME `parseDomain` +
  *  {@link DOMAIN_READ_FALLBACK} policy as {@link buildEffective}(catalog 域坏形 → schema default + warning;
- *  gate 域坏形 → throw,caller 的整包 catch 决定回落),including the governance legacy-lift and the hosts
- *  read-grandfather — DELEGATED to buildEffective, not re-implemented(单判据双腿消费,§M4)。
+ *  gate 域坏形 → throw,caller 的整包 catch 决定回落),including the retired-domain tombstone — DELEGATED to
+ *  buildEffective, not re-implemented(单判据双腿消费,§M4)。A retired domain on the wire (an older web-admin still
+ *  ships `runtime`) is judged by the same tombstone: carrying facts ⇒ {@link RetiredDomainError}; `{}` (what an older
+ *  web-admin materialises for an unset domain) carries nothing and is dropped from the result — it never rides through as
+ *  an open-world key.
  *
  *  `skills` is the ONE wire divergence: on the wire it is a MANIFEST(content → contentHash,
  *  {@link SkillsManifest}),so the full skills-domain schema would reject every LEGAL manifest and silently
@@ -1002,9 +947,8 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
  *  same "default" fallback tier as the skills domain itself.
  *
  *  OPEN-WORLD on unknown top-level keys: they ride through VERBATIM(never validated, never dropped)— a
- *  newer center's new domain reaches an older service untouched(§M2 能力面语义:读不到即走老路,不该炸),
- *  and the legacy `teams` key(not a domain since 0.7, services still consume it for backward compat)keeps
- *  flowing. Throws ONLY on garbage no caller can partially trust: a non-object payload, or a missing/
+ *  newer web-admin's new domain reaches an older engine untouched(§M2 能力面语义:读不到即走老路,不该炸),
+ *  and so does any key no domain names(the 0.6-era `teams` key included — not a domain since 0.7, and no engine reads it). Throws ONLY on garbage no caller can partially trust: a non-object payload, or a missing/
  *  non-finite `version` — that is not "a bad domain", it is not an effective config at all. */
 export function readEffectiveWire(raw, onWarning) {
     if (raw === null || typeof raw !== "object" || Array.isArray(raw))
@@ -1015,11 +959,12 @@ export function readEffectiveWire(raw, onWarning) {
     const updatedAt = typeof r.updatedAt === "string" ? r.updatedAt : "";
     // skills redirected to undefined: buildEffective must never see the manifest(it would fail the full-domain
     // schema and "default" it with a FALSE domain-defaulted warning);the manifest is judged separately below.
-    // prompts likewise redirected(#100):on the wire it is the center-assembled RESOLVED form(worker lane
+    // prompts likewise redirected(#100):on the wire it is web-admin-assembled RESOLVED form(worker lane
     // strips the bindings storage table — types.ts PromptsConfig 注 [1057]⑤),consumer-validated additive JSON;
     // the storage-domain schema would swallow it to {bindings:[]} with ZERO warning(zod non-strict 剥键后
     // "成功")— 3.24.0 起 server 侧 promptsGate 恒败的根因。verbatim,by presence(见 return)。
     const built = buildEffective(r.version, (d) => (d === "skills" || d === "prompts" ? undefined : r[d]), updatedAt, onWarning);
+    // retired 域名不是 open-world 的未知键:墓碑已在 buildEffective 里判过(带事实 ⇒ 抛),剩下的 `{}` 没有可承运的东西。
     let skills;
     const manifest = SkillsManifestSchema.safeParse(r.skills ?? {});
     if (manifest.success) {
@@ -1047,15 +992,15 @@ export function readEffectiveWire(raw, onWarning) {
     // 与本文件另两处自有键判据(:548 `rebasePath` 查位移表、:612 `collectDropped` 比键集)同一条律,零特判。
     // `Object.fromEntries`,**不是**逐键 `passthrough[k] = v`:后者对 `"__proto__"` 走的是原型 setter
     // (改掉对象的原型,而不是加一个键),fromEntries 走 CreateDataProperty —— 同一条「键就是键」的律。
-    const passthrough = Object.fromEntries(Object.entries(r).filter(([k]) => !Object.prototype.hasOwnProperty.call(built, k) && k !== "skills"));
+    const passthrough = Object.fromEntries(Object.entries(r).filter(([k]) => !Object.prototype.hasOwnProperty.call(built, k) && k !== "skills" && !isRetiredDomainName(k)));
     // prompts:剥掉 buildEffective 恒物化的 {bindings:[]} 底座,按 wire 在场性 verbatim 挂回(#100:
-    // 缺席进缺席出——center worker-lane 闸关是常态形,物化会让消费端「缺席」分支永不可达)。
+    // 缺席进缺席出——web-admin worker-lane 闸关是常态形,物化会让消费端「缺席」分支永不可达)。
     const { prompts: _promptsMaterialized, ...builtSansPrompts } = built;
     return { ...passthrough, ...builtSansPrompts, skills, ...("prompts" in r ? { prompts: r.prompts } : {}) };
 }
 /** 档位组→引擎单表的唯一解析点(0.9.0)。返回 ACTIVE 档位组的绑定表(剔除未绑档),即 core
- *  `RunnerDeps.tiers` 要吃的那张单表——组切换=center 换这张表下发,零新引擎机制。无 active 组/未命中/
- *  组内一档未绑 → `undefined`(引擎档位层恒惰性,与「未配 tiers」逐字同义)。消费方(center /effective
+ *  `RunnerDeps.tiers` 要吃的那张单表——组切换=web-admin 换这张表下发,零新引擎机制。无 active 组/未命中/
+ *  组内一档未绑 → `undefined`(引擎档位层恒惰性,与「未配 tiers」逐字同义)。消费方(web-admin /effective
  *  投影、service applyEffective 接线)都走这一个函数,不要各自解析。 */
 export function resolveActiveTiers(models) {
     if (!models.activeTierGroup)