@sema-agent/settings-schema 12.2.0 → 12.3.0

package/CHANGELOG.md

@@ -6,6 +6,64 @@
 > `@sema-agent/registry-core`(更早还曾是 `@sema-ai/registry-core`)。本档 `0.19.0` 以下各节里的
 > 包名是**历史记录**,如实保留不追改。
 
+## 12.3.0 — 2026-10-12 — minor:域读策略两张闭集表(新导出 `DOMAIN_ENTRY_SALVAGE`)· 域读分文档面 / 视图面两函数(新导出 `parseDomainSalvaged`)· 抢救按 schema 递归到嵌套集合 · `projects` 起逐条抢救
+
+> minor:域读策略拆成两张闭集表 —— 新导出 `DOMAIN_ENTRY_SALVAGE`(读时能否逐条丢坏条目,`"salvage" | "none"`),`DOMAIN_READ_FALLBACK` 名 / 值 / 义不变(只答「整域读不进」);
+> 域读分两面两函数 —— 文档面 `parseDomainLoud`(读数与 12.2.x 逐字同,永不抢救)与新导出的视图面 `parseDomainSalvaged`(按表逐条抢救,递归到嵌套集合);`projects` 起逐条抢救。
+> additive:零删、零改名;导出面新增两行(`DOMAIN_ENTRY_SALVAGE` / `parseDomainSalvaged`);好配置的读数逐字不变;写路径、写入席、`getDomain` / `exportBundle` 的读数逐字不变。
+
+### 两张表各答一个问题:`DOMAIN_ENTRY_SALVAGE` 与 `DOMAIN_READ_FALLBACK`
+
+此前「能否逐条丢一条坏条目」挂在 `DOMAIN_READ_FALLBACK` 的 `"default"` 档上 —— 与「整域读不进时能否退默认」被同一张表回答。`projects` 两件事的答案相反
+(丢一条登记 = 那个项目认领被拒,fail-closed;整域退默认 = 身份台账蒸发,放权),于是只能整域抛:一条存量登记被后来收紧的 schema 拒,**整个 scope 的项目**一起停摆。
+现在两张表:`DOMAIN_ENTRY_SALVAGE`(`as const satisfies Record<DomainName, "salvage" | "none">`,新域不表态 = 编译红,头注逐域理由)只管逐条丢;
+`DOMAIN_READ_FALLBACK` 只管整域读不进之后默认化还是抛。逐域:`projects` = `salvage`(整域档位仍 `"throw"`);闸域 `rosters` / `workers` / `governance` / `entitlement` /
+`execution` / `limits` = `none`(丢一条规则行 = 静默放权;`workers` 的逐行容错仍是 `readWorkersRows` 的扣留);其余目录 / 内容域 = `salvage`(与 12.2.x 同)。
+
+### 两面两函数:文档面 `parseDomainLoud` 永不抢救,视图面 `parseDomainSalvaged` 按表抢救
+
+文档面(`parseDomain` / `parseDomainLoud`:写入席、导出、`getDomain`)永不抢救;视图面(`parseDomainSalvaged` / `buildEffective`)按表抢救。
+两个读函数共用**同一只内部体**(严 parse + 未知键两条告警),只差「整域读不进」那一臂:文档面抛原错(与 12.2.x 逐字同 —— `FileConfigStore.getDomain`、
+`exportBundle`、`createSiblingResolver`、一致性门写入席 `strictWrite` 腿零改);视图面 `parseDomainSalvaged(domain, raw, onWarning?)` 按 `DOMAIN_ENTRY_SALVAGE`
+走 `salvageEntries` → 丢了东西就拿压缩后的文档再 parse;过 ⇒ 每条被丢条目一条 `entry-dropped`,其余告警的坐标经 `rebaseWarningPaths` 回写成原文档坐标;救不活 ⇒
+抛整域 parse 的原错、零告警。同一份**好**文档上两函数逐字同值、同告警。`buildEffective` 十六个域一处调视图面,整域读不进时只看 `DOMAIN_READ_FALLBACK`(此前 gate 域的行
+与其余域的行各调一只函数 —— 同一张表的第二份手抄,删了)。管理面要显示「生效配置里这个域是什么」时读视图面;读存量、改、整份写回的「现状」读文档面
+(经抢救读出再写回,被丢的条目就成了删除)。
+
+### 抢救递归到嵌套集合
+
+`salvageEntries`:集合里每一条,若它的 schema 是带集合字段的对象,先对它按**同一个函数**抢救,再拿抢救后的那一条判整条(从 schema 派生,没有任何域专用分支)。
+体内丢的子条目以父坐标为前缀上账(`["projects", <id>, "contextItems", 1]`),按文档序;整条最终仍判不过 ⇒ 整条丢、体内的半路账作废,记账行的判决取原文的(拒句坐标是原文档的)。
+零幸存者律在每一层成立(体内集合全坏 ⇒ 不压成空集合 —— 「空 = 不设限」的字段不会被抢救成全开)。
+`EntryKeptIndex` 的键 = 被压缩数组的原文档全路径(`formatConfigPath` 出门形;顶层数组的全路径就是字段名,12.2.x 的表形与义不变);`rebaseWarningPaths` 逐段回写
+每一层被压缩的数组(两层都压缩时两层各回写一次)。
+
+目录 / 内容域因此也变:条目体内某个子条目坏了,此前整条丢,现在只丢那个子条目、整条留下。被递归够到的嵌套集合(逐个,`salvage` 档域里条目体内的全部集合字段):
+
+| 域 | 嵌套集合 | 少一条的语义 |
+|---|---|---|
+| models | `models[].promptGuidance[]` | 少一条提示指引 |
+| skills | `skills[].scenarios[]` · `skills[].rosters[]` | 适用范围收窄(两者「空 = 全部」,零幸存者律不压成空) |
+| mcp | `servers[].allowTools[]` · `servers[].scenarios[]` · `servers[].rosters[]` | 暴露的工具 / 挂载范围收窄(三者「空 / 缺席 = 全部」,同上) |
+| systems | `systems[].callsWorkers[]` | 少给一个 worker 下发调用凭据 |
+| collab | `templates[].slots[]` → `slots[].members[]` · `slots[].tools[]` | slot / member 少一个:模板级判据(拓扑、重名)仍过时,这是「换了一个更小的模板在跑」而不是收权 —— **推断,无逐域钉**;`tools[]` 收窄 |
+| hosts | `hosts[].labels[]` | 少一个调度标签:匹配 `placement.requires` 的机器变少 |
+| prompts | `bindings[].declarations[]` | 少下发一条声明 |
+| projects | `projects.<id>.gitRemotes[]` · `.defaultScopes[]` · `.contextItems[]` | 少一条 remote 映射 / 默认记忆 scope / 上下文条目 |
+
+三问 —— **谁需要**:任何一次收紧持久化 schema 的版本(12.2.1 的 UNC 判法已让存量登记 `\\?\C:\…` 整 scope 读抛)读存量文档的一方 —— 服务端拿 effective、管理面列项目;
+**谁受伤**:无 —— 好配置读数逐字不变;文档面(写入席、导出、`getDomain`)读数逐字不变;视图面此前整域抛 / 整条丢的文档现在读出更多(只丢坏的那一格并点名);
+**补偿**:闸域显式 `none`(两张表都说不);文档面永不抢救;读改写面读文档面。
+钉:`test/projects-12.3.0.test.ts`(两表闭集 · 12.2.1 存量形黑盒读数 · 视图面与 `buildEffective` 同读数 · 文档面 / `getDomain` / `exportBundle` 与 12.2.x 逐字同 ·
+两函数好文档同值同告警 · 整域档位不变 · 闸域负控 · 写路径与写入席拒 · 递归坐标 / 位移表 / 每层零幸存者 / 判决取原文)·
+`test/entry-salvage-1.11.test.ts`(按新表分组;workers / entitlement / projects 三格空转修成真档位格)· `test/domain-completeness.test.ts` ⑤ ·
+`test/conformance-coverage.test.ts` ⑥ · 语料 `c76-projects-entry-salvage-nested`(读腿抢救 + 嵌套坐标回写 · 严写腿拒)。
+
+## 12.2.1 — 2026-10-12 — patch:`isAbsoluteHostPath` 的 UNC 首段按主机名形判(字母数字起头),Windows 设备命名空间前缀 `\\.\` 与长路径前缀 `\\?\` 一律拒(11.3.1 / 12.1.1 只排除 `?` / `*`,`\\.\C:\…` 曾被当 UNC 受理)
+
+- **行为修复(宿主路径形判,UNC 臂)**。三族律不变;UNC 首段 = 主机名形(`[A-Za-z0-9][A-Za-z0-9._-]*`),所以 `\\.\C:\x`、`\\.\pipe\x`、`\\?\C:\x`、`\\*\share`、`\\-srv\share` 都不绝对;`\\srv\share\…` / `\\10.0.0.5\share` 照旧真。posix / 盘符两族逐字不变。
+  三问 —— **谁需要**:两种设备前缀同一判法(此前一受理一拒,读者无法解释);**谁受伤**:无(设备命名空间路径不是任务 `cwd` / 项目登记的形);**补偿**:无。钉:`test/host-path-11.3.1.test.ts` 不绝对形加两形。
+
 ## 12.2.0 — 2026-10-12 — minor:`mcp.servers[]` 条目三只解析透明可选键 `toolAxes` / `authForm` / `entryKind` · http 传输可选 `assertionHeader`(与 `principalHeader` 互斥)
 
 > minor:`mcp.servers[]` 条目上多三只**解析透明**的可选键 `toolAxes` / `authForm` / `entryKind`;http 形传输上多一只可选键 `assertionHeader`(HTTP 头名),与 `principalHeader` 互斥。

package/README.md

@@ -371,8 +371,15 @@ therefore shows only `zod`. Node built-ins only (`node:crypto`, `node:fs`).
   primitive). **2.0.0** adds per-ENTRY
   tolerance on the same read path: one malformed catalog entry is dropped on its own (named through
   `onWarning` as `entry-dropped`) and its siblings survive, instead of the whole domain falling to
-  its schema default. It is the SAME `DOMAIN_READ_FALLBACK` table that decides where this applies — gate
-  domains keep failing loud, entry by entry included. **S-712** (additive) lets each `entry-dropped` carry an
+  its schema default. **12.3.0**: where this applies is its OWN closed table, `DOMAIN_ENTRY_SALVAGE`
+  (`"salvage" | "none"`; until 12.2.x it rode on `DOMAIN_READ_FALLBACK`'s `"default"` tier, which now answers only
+  "the whole domain is unreadable — default or throw?") — gate domains (rosters / workers / governance / entitlement /
+  execution / limits) never drop a single entry, `projects` does (a missing registration = that project's claim is
+  refused; the domain stays `"throw"` when unreadable as a whole). Domain reading has two faces with two functions
+  sharing ONE body (strict parse + the unknown-key warnings): the DOCUMENT face (`parseDomain` / `parseDomainLoud` — the
+  write seat, export, `getDomain`) never salvages and reads exactly as 12.2.x; the VIEW face (`parseDomainSalvaged`, which
+  `buildEffective` calls for every domain) salvages per the table, recursing into a surviving entry's own collections
+  (coordinates carry the parent prefix, the zero-survivor law holds at every level). **S-712** (additive) lets each `entry-dropped` carry an
   optional `identity?: { name?, id?, enabled? }` read from the dropped entry's OWN text (`DroppedEntryIdentity`):
   a string `name` / `id` and a boolean `enabled`, own data properties only, each key present only when it
   reads with that exact type and `isDisclosableIdentity` says it may ride out (not guessed, not coerced, not

package/conformance/VERSION

@@ -1 +1 @@
-12.2.0
+12.3.0

package/conformance/cases/c76-projects-entry-salvage-nested/expected.json

@@ -0,0 +1,142 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "atMention": {
+          "mode": "all"
+        },
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {
+          "01890a5d-ac96-774b-bcce-b302099a8001": {
+            "defaultScopes": [
+              "proj"
+            ],
+            "displayName": "one",
+            "gitRemotes": [],
+            "registeredAt": "2026-10-01T00:00:00.000Z",
+            "registeredBy": "alice"
+          },
+          "01890a5d-ac96-774b-bcce-b302099a8002": {
+            "contextItems": [
+              {
+                "kind": "folder",
+                "value": "/srv/two"
+              },
+              {
+                "kind": "note",
+                "value": "keep"
+              }
+            ],
+            "defaultScopes": [
+              "proj"
+            ],
+            "displayName": "two",
+            "gitRemotes": [],
+            "registeredAt": "2026-10-01T00:00:00.000Z",
+            "registeredBy": "alice"
+          }
+        }
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "projects",
+        "kind": "entry-dropped",
+        "path": [
+          "projects",
+          "01890a5d-ac96-774b-bcce-b302099a8002",
+          "contextItems",
+          1
+        ],
+        "reasonCode": "entry-schema-invalid"
+      },
+      {
+        "domain": "projects",
+        "kind": "entry-dropped",
+        "path": [
+          "projects",
+          "01890a5d-ac96-774b-bcce-b302099a8003"
+        ],
+        "reasonCode": "entry-schema-invalid"
+      },
+      {
+        "domain": "projects",
+        "keys": [
+          [
+            "projects",
+            "01890a5d-ac96-774b-bcce-b302099a8002",
+            "contextItems",
+            2,
+            "typo"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      }
+    ],
+    "metadata": {
+      "version": 18,
+      "updatedAt": "2026-10-13T00:00:00.000Z"
+    }
+  },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:读腿要逐条丢两条才读得进的文档,写入席整份拒 —— 写入席不替运维删他的条目(写路径永不抢救)。"
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c76-projects-entry-salvage-nested/input.json

@@ -0,0 +1,54 @@
+{
+  "meta": {
+    "version": 18,
+    "updatedAt": "2026-10-13T00:00:00.000Z"
+  },
+  "domains": {
+    "projects": {
+      "projects": {
+        "01890a5d-ac96-774b-bcce-b302099a8001": {
+          "displayName": "one",
+          "gitRemotes": [],
+          "defaultScopes": [
+            "proj"
+          ],
+          "registeredBy": "alice",
+          "registeredAt": "2026-10-01T00:00:00.000Z"
+        },
+        "01890a5d-ac96-774b-bcce-b302099a8002": {
+          "displayName": "two",
+          "gitRemotes": [],
+          "defaultScopes": [
+            "proj"
+          ],
+          "registeredBy": "alice",
+          "registeredAt": "2026-10-01T00:00:00.000Z",
+          "contextItems": [
+            {
+              "kind": "folder",
+              "value": "/srv/two"
+            },
+            {
+              "kind": "folder",
+              "value": "\\\\?\\C:\\x"
+            },
+            {
+              "kind": "note",
+              "value": "keep",
+              "typo": 1
+            }
+          ]
+        },
+        "01890a5d-ac96-774b-bcce-b302099a8003": {
+          "displayName": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+          "gitRemotes": [],
+          "defaultScopes": [
+            "proj"
+          ],
+          "registeredBy": "alice",
+          "registeredAt": "2026-10-01T00:00:00.000Z"
+        }
+      }
+    }
+  }
+}

package/conformance/cases/c76-projects-entry-salvage-nested/meta.json

@@ -0,0 +1,6 @@
+{
+  "contributor": "contract",
+  "claim": "12.3.0(S-1494)projects 逐条抢救 + 抢救递归:三条登记里第 2 条的第 1 个上下文条目是 Windows 长路径前缀形(12.2.1 起拒)、第 3 条 displayName 201 字。读腿:登记 1、2 在(2 的 contextItems 丢第 1 项,其余照用)、3 不在,两条 entry-dropped 分别点到嵌套那一格与整条登记;第 2 条第 2 项上的拼错键按**原文档**下标报(压缩后它是第 1 项)。严写腿整份拒。打的是三种读法分歧:projects 仍整域拒(12.2.x 读法,整个 scope 的项目停摆)/ 抢救只下到顶层(整条登记 2 连坐丢掉)/ 嵌套坐标报压缩后的下标。",
+  "firstRedOn": [],
+  "note": "firstRedOn 为空:historical 阶梯(≤ 2.1.0)不覆盖 11.3.0 的 projects 扩形;对 12.2.x 这一条会红(projects 整域拒),那一版不在入库的真跑证据里。"
+}

package/dist/config-fns.d.ts

@@ -263,11 +263,16 @@ export declare function isReportableRefusalName(name: string): boolean;
  *  摘要输入取 `JSON.stringify(name)`:UTF-8 编码会把孤立代理项换成 U+FFFD(`"\ud800"` / `"\ud801"` / `"\ufffd"` 三个不同的名同一串字节),
  *  JSON 串形逐个 UTF-16 码元保留(孤立代理项写成转义)—— 不同的名恒是不同的输入。 */
 export declare function withheldNameToken(name: string): string;
-/** 抢救造成的**下标位移表**:数组字段名 → 该字段压缩后每个位置的**原**下标(`kept[j]` = 压缩后第 j 条
+/** 抢救造成的**下标位移表**:被压缩过的数组 → 它压缩后每个位置的**原**下标(`kept[j]` = 压缩后第 j 条
  *  在原文档里的下标)。纯数据,无行为。
  *
- *  只登记**真发生过丢弃**的数组字段 —— 没丢的字段没有位移,给它登记一份恒等映射只会把「有没有位移」
- *  从表的**在场性**挪成表的**内容**,凭空多一层判据。Record 字段永不登记:它的条目按键寻址,丢一条
+ *  **键 = 那个数组在原文档里的全路径**,经 {@link formatConfigPath} 出门形(12.3.0,S-1494:抢救递归之后,被压缩的数组可以住在
+ *  幸存条目体内 —— `"projects.<id>.contextItems"`、`"items.2.subs"`)。顶层数组字段的全路径就是它的字段名(`"models"`),所以
+ *  12.2.x 及更早的表(`{ models: [0, 2] }`)形与义都不变。路径段是出门形(Record 键过脱敏器,与告警坐标同一道):两只不同的、
+ *  都被打码成同一串的 Record 键体内各有一个压缩数组时,那一格坐标本身就分不清是谁 —— 那个键不登记(不回写好过回写错)。
+ *
+ *  只登记**真发生过丢弃或位移**的数组 —— 没丢的数组没有位移,给它登记一份恒等映射只会把「有没有位移」
+ *  从表的**在场性**挪成表的**内容**,凭空多一层判据。Record 永不登记:它的条目按键寻址,丢一条
  *  不动其余键的坐标。 */
 export type EntryKeptIndex = Readonly<Record<string, readonly number[]>>;
 /** {@link salvageEntries} 的结果。`raw` 是剔掉坏条目后的文档;**什么都没丢时返回原引用**
@@ -304,10 +309,19 @@ export interface EntrySalvageResult {
  * 抛出来的文案可能带 secret。抢救是**尽力而为**的:抢不动就当没抢救(返回原引用),让既有的整域档位去裁,
  * 绝不把解析拖下水、更不回显它的错误(与同文件 {@link droppedKeys} 逐字同纪律)。
  *
- * 边界(如实登记):① 只看**顶层**字段(条目集合就在顶层,嵌套的坏形属于条目自身的问题);② raw 不是
+ * **递归**(12.3.0,S-1494):集合里的每一条,先对它自己按**同一个函数**抢救(它的 schema 若是带集合字段的对象 —— 从 schema 派生,
+ * 没有任何域专用分支),再拿抢救后的那一条去判整条。体内丢的子条目以父坐标为前缀上账(`["projects", <id>, "contextItems", 1]`),
+ * 体内压缩过的数组以全路径进位移表({@link EntryKeptIndex});整条最终仍判不过 ⇒ 整条丢,它体内的半路账一并作废(一条一个结论),
+ * 记账行的判决取**原文**的(拒句坐标是原文档的,不是抢救形里压缩过的下标)。
+ * 零幸存者律在**每一层**成立 —— 体内的集合全坏 ⇒ 不压成空集合,那一条照原样去判(于是整条丢):嵌套里同样有「空 = 不设限」的字段
+ * (`skills[].scenarios` / `mcp.servers[].allowTools` …),抢救成 `[]` 就是把限定范围放成全开。账按文档序排(父条目丢在哪个位置,
+ * 体内的子条目就排在哪个位置)。
+ *
+ * 边界(如实登记):① 只下钻**条目**(集合的元素 / 值),不下钻顶层的普通对象字段(`models.atMention` 不是条目);② raw 不是
  * 纯 JSON 对象、字段值与 schema 形状对不上(schema 说数组、文档给对象)⇒ 原样返回,交给整域档位裁;
  * ③ 域级判据(重名 / 悬空 ref)不在本函数视野内 —— 丢条目救不了它们,调用方据此回落整域档位;
- * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向)。
+ * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向);⑤ 递归深度止于 schema
+ * (本包没有自引用 schema);`z.lazy` 包着的 schema 不展开(`unwrapSchema` 不认它)⇒ 不下钻,那一条按原样判。
  */
 export declare function salvageEntries(schema: z.ZodType, raw: unknown): EntrySalvageResult;
 /**
@@ -362,7 +376,8 @@ export type EffectiveReadWarning = {
 /** 一条**条目**没通过它自己的 entry schema,被单独丢掉了(域内其余条目照常生效)。`path` = 段坐标
  *  (`["models",3]` / `["roles","summarize"]`),与 `unknown-keys-dropped` 的坐标形同一套。逐条一发 —— 载荷是
  *  O(域里的条目数),与被读文档同阶,不放大,故不设条数上限(有上限的是**单条**告警里的键列表)。
- *  2.0.0 起;只可能来自 {@link DOMAIN_READ_FALLBACK} 判 `"default"` 的域,gate 域坏形仍然 throw。
+ *  2.0.0 起;只可能来自 {@link DOMAIN_ENTRY_SALVAGE} 判 `"salvage"` 的域(12.3.0 起该表单列;此前挂在 `DOMAIN_READ_FALLBACK` 的
+ *  `"default"` 档上),闸域坏条目仍然整域读不进。`path` 可以落在幸存条目体内(12.3.0 递归:`["projects", <id>, "contextItems", 1]`)。
  *  **S-712**(additive):`identity` = 被丢条目原文里读得出的身份({@link DroppedEntryIdentity};
  *  读不出 ⇒ 键缺席),消费方据此知道「丢的是谁」而不必拿坐标回读原文档。
  *  **S-1295**(additive):`reasonCode` = 为什么丢的机读闭集词({@link DROPPED_ENTRY_REASON_CODES}),消费方据此知道「为什么丢」
@@ -486,12 +501,34 @@ export declare const EXTENSION_NAMESPACES: Partial<Record<DomainName, ReadonlyAr
  *  契约(`semaGPT_5` / `semaX-v2` 都是成员,后缀不设未声明的文法)。 */
 export declare function isReservedExtensionKey(domain: DomainName, parent: ConfigPath, key: string): boolean;
 /**
- * 一域的 parse + **静默剥键/静默承运两条告警**(0.19.0)。`buildEffective` 与 `FileConfigStore.getDomain`
- * 共用这一个判据 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
+ * **文档面**的域读函数:一域的严 parse + **静默剥键/静默承运两条告警**,**永不抢救**。`FileConfigStore.getDomain`(于是 `exportBundle`、
+ * `createSiblingResolver`)与一致性门写入席(`strictWrite` 腿)读它 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
  * (对抗复审 复审 round2 F3:导出一份被剥了键的域再导入 = 持久的配置丢失,而且全程无声)。
+ *
+ * 文档面回答「这份文档本身读不读得进」:读不进就抛(sanitized ZodError),一条条目都不替运维删 —— 写入席、导出、读改写的「现状」读的都是它。
+ * 视图面(「这份文档在生效配置里是什么」)是 {@link parseDomainSalvaged}:同一只内部体({@link readDomainDocument}),读不进时多一步逐条抢救。
  */
 export declare function parseDomainLoud<K extends DomainName>(domain: K, raw: unknown, onWarning?: (w: EffectiveReadWarning) => void): DomainConfig[K];
+/**
+ * **视图面**的域读函数(12.3.0,S-1494):与 {@link parseDomainLoud} 同一只内部体,整域读不进时按 {@link DOMAIN_ENTRY_SALVAGE} 逐条抢救。
+ * `buildEffective` 十六个域一处调它(`parseOr`);管理面要显示「生效配置里这个域是什么」时读它。
+ *
+ * 读法:
+ *  1. 整域 `parseDomain`;过 ⇒ 未知键两条告警按原文档坐标出门,返回 —— 与 {@link parseDomainLoud} 逐字同值同告警(好配置的路径一字不动)。
+ *  2. 不过,且 {@link DOMAIN_ENTRY_SALVAGE} 判该域 `"salvage"` ⇒ {@link salvageEntries}(递归到嵌套集合);丢了东西 ⇒ 拿压缩后的
+ *     文档再 `parseDomain` 一次。过 ⇒ 每条被丢条目一条 `entry-dropped`(它们本来就是原文档坐标),其余告警是对压缩文档的诊断,
+ *     过本层位移表({@link rebaseWarningPaths})回写成原文档坐标(坐标律 S-323b)。
+ *  3. 其余一切(`"none"` 档、什么都没丢、丢了仍读不进)⇒ **抛第 1 步的原错**,零告警 —— 一个域一个结论:没救活就不留「丢了某条」的半路叙述。
+ *     整域读不进之后是默认化还是抛,是调用方按 {@link DOMAIN_READ_FALLBACK} 的事(`buildEffective` 的 `parseOr`),本函数不读那张表。
+ *
+ * 写路径与导出面不调它:`parseDomain` / `validateDomain` / `writeDomainFile` 判整份文档,写入席与 `getDomain` / `exportBundle` 读 {@link parseDomainLoud}。
+ * 读改写(读存量、改、整份写回)的「现状」也不许读它 —— 抢救读出再写回,被丢的条目就成了删除。
+ */
+export declare function parseDomainSalvaged<K extends DomainName>(domain: K, raw: unknown, onWarning?: (w: EffectiveReadWarning) => void): DomainConfig[K];
 /** Per-domain READ-corruption policy (0.8.1) — what buildEffective does when a stored domain no longer parses.
+ *  **One question only** (12.3.0, S-1494): the domain as a whole is unreadable — after {@link parseDomainSalvaged} has tried
+ *  whatever entry salvage {@link DOMAIN_ENTRY_SALVAGE} allows — so does the read default it or throw? Whether single bad
+ *  entries may be dropped is the OTHER table's question; neither table reads the other.
  *  `"default"` = degrade to the schema default + warn (safe: the default only REMOVES capability, fail-closed).
  *  `"throw"` = keep fail-loud (defaulting would LOOSEN gates or destructively apply — worse than an outage,
  *  consumers fail-static on last-good). A `satisfies Record<DomainName,…>` forces every FUTURE domain to make
@@ -534,6 +571,55 @@ export declare const DOMAIN_READ_FALLBACK: {
     readonly prompts: "default";
     readonly limits: "throw";
 };
+/** Per-domain ENTRY-SALVAGE policy (12.3.0, S-1494) — may the view-face domain reader ({@link parseDomainSalvaged}) drop single bad
+ *  entries (an array element, a Record value, and — recursively — a bad entry inside a surviving entry) and read the rest?
+ *  **One question only**: what happens when the domain stays unreadable after that is {@link DOMAIN_READ_FALLBACK}'s question.
+ *  `"salvage"` = drop each bad entry, name it (`entry-dropped`, coordinate + identity + reason word), keep the rest.
+ *  `"none"` = never drop a single entry: the first bad entry makes the whole domain unreadable.
+ *  A `satisfies Record<DomainName,…>` forces every FUTURE domain to answer this explicitly (compile error until classified).
+ *
+ *  **View face only.** The document face never salvages: `parseDomain` / `validateDomain` / `writeDomainFile` judge the whole
+ *  document, and {@link parseDomainLoud} — what the conformance write seat (`strictWrite` leg), `FileConfigStore.getDomain` and
+ *  `exportBundle` read — throws on it. A write path that reads the stored "current" value through `parseDomainSalvaged` and writes
+ *  it back would turn every dropped entry into a deletion — read-modify-write faces read the stored document with the document face.
+ *
+ *  Per-domain rationale:
+ *    - models/skills/mcp/plugins/scenarios/systems/collab/prompts: additive capability / content catalogs — a dropped entry is
+ *      one capability gone (fail-closed). Inside a surviving entry the same holds: the nested collections these entries carry
+ *      are allowlists / scopings (`allowTools`, `scenarios`, `rosters`, `callsWorkers`, …) where one entry fewer only NARROWS,
+ *      and the zero-survivor law (never mint an empty collection — several of these read "empty = all") holds at every level.
+ *    - hosts: a dropped host is one placement target fewer; a dropped label makes a host match fewer `placement.requires`.
+ *    - projects: SALVAGE — a registration absent from the ledger = that project's claim is refused (fail-closed). Throwing the
+ *      whole domain stops EVERY project of the scope, which protects nothing: one stored registration that a later, tighter
+ *      schema refuses (12.2.1's UNC judgement on `contextItems[].value`) must not take the scope's other projects with it.
+ *      Its whenUnreadable stance stays `"throw"` (a ledger that cannot be read at all is never defaulted — see
+ *      {@link DOMAIN_READ_FALLBACK}).
+ *    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
+ *      (放权,不许).
+ *    - workers: NONE — a dropped worker row reads as "this worker is no longer declared": the reconciler would retire it. The
+ *      per-row tolerance this domain does have lives in `readWorkersRows` (rows are HELD with their original, never dropped).
+ *    - governance: NONE — a dropped commandPolicy / approvalRequire row is a guardrail silently gone (放权,不许).
+ *    - entitlement: NONE — a dropped tier / subject / binding / budget group changes who may do what (放权,不许).
+ *    - execution: NONE — a dropped lane / public key changes the execution mandate (放权,不许).
+ *    - limits: NONE — a dropped allowlist row changes a published ceiling (the domain is the one publishing seat of those ceilings). */
+export declare const DOMAIN_ENTRY_SALVAGE: {
+    readonly models: "salvage";
+    readonly rosters: "none";
+    readonly skills: "salvage";
+    readonly mcp: "salvage";
+    readonly plugins: "salvage";
+    readonly scenarios: "salvage";
+    readonly systems: "salvage";
+    readonly collab: "salvage";
+    readonly workers: "none";
+    readonly hosts: "salvage";
+    readonly governance: "none";
+    readonly entitlement: "none";
+    readonly execution: "none";
+    readonly projects: "salvage";
+    readonly prompts: "salvage";
+    readonly limits: "none";
+};
 /** 一个读者向店要文档的口:配置域,以及墓碑表里的retired 域({@link RETIRED_DOMAINS})—— 后者只为让墓碑看见没迁的旧文档。 */
 export type StoredDocumentReader = (d: DomainName | RetiredDomainName) => unknown;
 /**

package/dist/config-fns.js

@@ -419,78 +419,122 @@ function judgeEntry(schema, value, rejectedAs) {
  * 抛出来的文案可能带 secret。抢救是**尽力而为**的:抢不动就当没抢救(返回原引用),让既有的整域档位去裁,
  * 绝不把解析拖下水、更不回显它的错误(与同文件 {@link droppedKeys} 逐字同纪律)。
  *
- * 边界(如实登记):① 只看**顶层**字段(条目集合就在顶层,嵌套的坏形属于条目自身的问题);② raw 不是
+ * **递归**(12.3.0,S-1494):集合里的每一条,先对它自己按**同一个函数**抢救(它的 schema 若是带集合字段的对象 —— 从 schema 派生,
+ * 没有任何域专用分支),再拿抢救后的那一条去判整条。体内丢的子条目以父坐标为前缀上账(`["projects", <id>, "contextItems", 1]`),
+ * 体内压缩过的数组以全路径进位移表({@link EntryKeptIndex});整条最终仍判不过 ⇒ 整条丢,它体内的半路账一并作废(一条一个结论),
+ * 记账行的判决取**原文**的(拒句坐标是原文档的,不是抢救形里压缩过的下标)。
+ * 零幸存者律在**每一层**成立 —— 体内的集合全坏 ⇒ 不压成空集合,那一条照原样去判(于是整条丢):嵌套里同样有「空 = 不设限」的字段
+ * (`skills[].scenarios` / `mcp.servers[].allowTools` …),抢救成 `[]` 就是把限定范围放成全开。账按文档序排(父条目丢在哪个位置,
+ * 体内的子条目就排在哪个位置)。
+ *
+ * 边界(如实登记):① 只下钻**条目**(集合的元素 / 值),不下钻顶层的普通对象字段(`models.atMention` 不是条目);② raw 不是
  * 纯 JSON 对象、字段值与 schema 形状对不上(schema 说数组、文档给对象)⇒ 原样返回,交给整域档位裁;
  * ③ 域级判据(重名 / 悬空 ref)不在本函数视野内 —— 丢条目救不了它们,调用方据此回落整域档位;
- * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向)。
+ * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向);⑤ 递归深度止于 schema
+ * (本包没有自引用 schema);`z.lazy` 包着的 schema 不展开(`unwrapSchema` 不认它)⇒ 不下钻,那一条按原样判。
  */
 export function salvageEntries(schema, raw) {
+    const layer = salvageLayer(schema, raw);
+    return { raw: layer.raw, dropped: layer.dropped, keptIndex: keptIndexOf(layer.shifts) };
+}
+/** 一层抢救,抢不动就当没抢救(反射 / 访问器抛错:绝不外泄其文案)。最外层与每一条条目体内走的是**同一只** —— 一条条目体内抢不动,
+ *  只是这一条不下钻、照原样去判,不连坐它所在的那一层。 */
+function salvageLayer(schema, raw) {
     try {
-        return salvageEntriesUnsafe(schema, raw);
+        return salvageLayerUnsafe(schema, raw);
     }
     catch {
-        return { raw, dropped: [], keptIndex: NO_ENTRIES_DROPPED }; // 反射/访问器抛错:抢不动就当没抢救,绝不外泄其文案
+        return { raw, dropped: [], shifts: [] };
+    }
+}
+/** 集合字段的值 → 它的位置表;值的形与 schema 对不上(schema 说数组、文档给对象)⇒ `undefined`(不抢救,交给整域档位)。
+ *  数组走 `forEach`(不是手写 `for (i < value.length)`):它在**进入时**就钉死了长度,而重读 `value.length` 会跟着一个在校验期间
+ *  自我增殖的数组一路跑下去(病态 getter 在 zod 读字段时往同一个数组里再 push 一条)—— 抢救是尽力而为的旁路,绝不许把同步读挂死;
+ *  位置表在任何判定之前就收齐了,之后数组再怎么长都与本次抢救无关。`forEach` 跳过空洞,与此前的 `filter` 同。 */
+function collectionSlots(value, isArray) {
+    if (isArray) {
+        if (!Array.isArray(value))
+            return undefined;
+        const slots = [];
+        value.forEach((entry, i) => void slots.push([i, entry]));
+        return slots;
     }
+    return isPlainJsonObject(value) ? Object.entries(value) : undefined;
 }
-function salvageEntriesUnsafe(schema, raw) {
+function salvageLayerUnsafe(schema, raw) {
+    const untouched = { raw, dropped: [], shifts: [] };
     if (!isPlainJsonObject(raw))
-        return { raw, dropped: [], keptIndex: NO_ENTRIES_DROPPED };
+        return untouched;
     const root = unwrapSchema(schema);
     if (!(root instanceof z.ZodObject))
-        return { raw, dropped: [], keptIndex: NO_ENTRIES_DROPPED };
+        return untouched;
     const shape = root.shape;
     const dropped = [];
+    const shifts = [];
     const patch = {};
-    const keptIndex = {};
     for (const [field, fieldSchema] of Object.entries(shape)) {
-        const value = raw[field];
-        if (value === undefined)
-            continue;
         const collection = unwrapSchema(fieldSchema);
-        if (collection instanceof z.ZodArray && Array.isArray(value)) {
-            const element = collection.element;
-            const bad = [];
-            const keptFrom = [];
-            // `filter`(不是手写 `for (i < value.length)`):它在**进入时**就钉死了长度,而重读 `value.length`
-            // 会跟着一个在校验期间自我增殖的数组一路跑下去(病态 getter 在 zod 读字段时往同一个数组里再 push
-            // 一条)——抢救是尽力而为的旁路,绝不许把同步读挂死。下标在回调里收,`filter` 本来就给 index。
-            const kept = value.filter((entry, i) => {
-                const verdict = judgeEntry(element, entry, "entry-schema-invalid");
-                if (verdict === undefined) {
-                    keptFrom.push(i); // 压缩后第 keptFrom.length-1 条 = 原文档第 i 条
-                    return true;
-                }
-                bad.push(droppedEntry(outgoingPath([field, i]), verdict, entry));
-                return false;
-            });
-            // 零幸存者 ⇒ 没有要抢救的东西(见头注:绝不凭空造出一个空集合)。
-            if (bad.length > 0 && kept.length > 0) {
-                dropped.push(...bad);
-                patch[field] = kept;
-                keptIndex[field] = keptFrom; // 只在真压缩了的字段上登记(见 {@link EntryKeptIndex})
-            }
-        }
-        else if (collection instanceof z.ZodRecord && isPlainJsonObject(value)) {
-            const keySchema = collection.keyType;
-            const valueSchema = collection.valueType;
-            const bad = [];
-            const kept = {};
-            for (const [key, entry] of Object.entries(value)) {
-                const verdict = judgeEntry(keySchema, key, "entry-key-invalid") ?? judgeEntry(valueSchema, entry, "entry-schema-invalid");
-                if (verdict === undefined)
-                    kept[key] = entry;
-                else
-                    bad.push(droppedEntry(outgoingPath([field, key]), verdict, entry)); // 键是用户写的,可能就是一条粘错位置的凭据
+        const isArray = collection instanceof z.ZodArray;
+        if (!isArray && !(collection instanceof z.ZodRecord))
+            continue; // 不是条目集合:连读都不读(少触发一次访问器)
+        const slots = collectionSlots(raw[field], isArray);
+        if (slots === undefined)
+            continue;
+        const element = (collection instanceof z.ZodArray ? collection.element : collection.valueType);
+        const keySchema = collection instanceof z.ZodRecord ? collection.keyType : undefined;
+        const found = []; // 本字段上账的:本层丢的整条 + 幸存条目体内丢的子条目,按文档序
+        const survivors = []; // 幸存条目(体内抢救过的,是它的抢救形)
+        const innerShifts = [];
+        for (const [address, entry] of slots) {
+            const at = outgoingPath([field, address]); // 键是用户写的,可能就是一条粘错位置的凭据
+            // Record 的键先判:键坏的条目不再算值,也不下钻。
+            const keyVerdict = keySchema === undefined ? undefined : judgeEntry(keySchema, address, "entry-key-invalid");
+            if (keyVerdict !== undefined) {
+                found.push(droppedEntry(at, keyVerdict, entry));
+                continue;
             }
-            if (bad.length > 0 && Object.keys(kept).length > 0) {
-                dropped.push(...bad);
-                patch[field] = kept;
+            const inner = salvageLayer(element, entry); // 先下钻:这一条自己的集合按同一条律抢救
+            const verdict = judgeEntry(element, inner.raw, "entry-schema-invalid");
+            if (verdict !== undefined) {
+                // 整条丢 ⇒ 记账行说的是**原文**:身份取原文,判决也取原文的(拒句里的坐标是运维手里那份文档的 —— 抢救形的数组压缩过,
+                // 条目级判据点到体内下标时会报错位;坐标律 S-323b 在 `error` 这一面同样成立)。体内的半路账作废。体内真丢过东西的条目,原文必判不过
+                // (被丢的子条目本身就过不了它的 schema),`?? verdict` 只为类型。
+                found.push(droppedEntry(at, inner.raw === entry ? verdict : (judgeEntry(element, entry, "entry-schema-invalid") ?? verdict), entry));
+                continue;
             }
+            survivors.push([address, inner.raw]);
+            for (const d of inner.dropped)
+                found.push({ ...d, path: [...at, ...d.path] });
+            for (const s of inner.shifts)
+                innerShifts.push({ at: [...at, ...s.at], kept: s.kept });
         }
+        // 零幸存者 ⇒ 没有要抢救的东西(见头注:绝不凭空造出一个空集合);什么都没上账 ⇒ 这个字段原样不动。
+        if (survivors.length === 0 || found.length === 0)
+            continue;
+        dropped.push(...found);
+        // fromEntries(不是逐键赋值):Record 的键是用户写的,`__proto__` 作键时逐键赋值会走原型 setter(S-332 同一条「键就是键」)。
+        patch[field] = isArray ? survivors.map(([, e]) => e) : Object.fromEntries(survivors);
+        const keptFrom = survivors.map(([i]) => i);
+        if (isArray && (keptFrom.length < slots.length || keptFrom.some((original, j) => original !== j)))
+            shifts.push({ at: outgoingPath([field]), kept: keptFrom });
+        shifts.push(...innerShifts);
     }
     if (dropped.length === 0)
-        return { raw, dropped, keptIndex: NO_ENTRIES_DROPPED };
-    return { raw: { ...raw, ...patch }, dropped, keptIndex };
+        return untouched;
+    return { raw: { ...raw, ...patch }, dropped, shifts };
+}
+/** 段坐标记的位移账 → {@link EntryKeptIndex}(键 = 全路径的出门串)。同一个键出现两次只可能是两只被打码成同一串的 Record 键
+ *  (坐标本身已分不清是谁)⇒ 那个键不登记。什么都没压缩 ⇒ 冻结的共享空表。 */
+function keptIndexOf(shifts) {
+    if (shifts.length === 0)
+        return NO_ENTRIES_DROPPED;
+    const byKey = new Map();
+    for (const s of shifts) {
+        const key = formatConfigPath(s.at);
+        byKey.set(key, byKey.has(key) ? undefined : s.kept);
+    }
+    // fromEntries:键是出门串,含用户写的 Record 键段 —— 不走原型 setter。
+    return Object.fromEntries([...byKey].filter((e) => e[1] !== undefined));
 }
 /**
  * Shared GC predicate for worker-status rows (F10) — keeps memory/sqlite/tidb identical. Given the rows'
@@ -617,30 +661,36 @@ function rebasePaths(keys, keptIndex) {
     return changed ? out : keys;
 }
 /**
- * `[field, N, ...rest]` → `[field, 原 N, ...rest]`。**一条律**(S-323c,3.0.0):`p[0]` 是字符串且在位移表里
- * (= 那个数组字段真被压缩过)∧ `p[1]` 是**数字段** ⇔ 它是一条数组路径。不满足 ⇒ 原样。
+ * 压缩后的坐标 → 原文档坐标。**一条律**(S-323c 3.0.0 立,12.3.0 S-1494 推到每一层):坐标里的每个**数字段** `p[i]`,若它前面那段
+ * 前缀(已回写成原文档坐标、按 {@link formatConfigPath} 出门形)在位移表里 ⇔ 它是那个被压缩过的数组的下标 ⇒ 换成原下标。
+ * 从左往右逐段做:外层先回写,内层的前缀才是原文档坐标,才对得上表里的键(位移表的键都是原文档全路径)—— 两层都压缩过时
+ * 两层各回写一次,只回写最长前缀那一层会把外层的下标留在压缩坐标上。
  *
  * 2.1.0 在点号串上需要三道门(字段在表里 / 段数合它那一支文法 / 下标段是规范十进制),因为串把「这一段
  * 是下标还是键名」这个位丢了,只能靠文法猜回来;段形把那个位带在类型里,三道门收成一道 —— 判它是正确
  * 抽象的第一判据就是**规则数变少**(`PathGrammar`、段数门、规范十进制正则三件随之删除)。
  *
- * 字面含点的顶层键(`["models.1.k"]`)天然不受影响:它只有一段,`p[1]` 缺席。Record 形的条目坐标
- * (`[field, key]`)同样:Record 字段从不进位移表(条目按键寻址,丢一条不动其余键的坐标),而它的第二段
- * 是字符串键、不是下标 —— 两道判据各自都挡得住。
+ * 字面含点的顶层键(`["models.1.k"]`)天然不受影响:它只有一段,没有数字段。Record 形的条目坐标
+ * (`[field, key]`)同样:Record 从不进位移表(条目按键寻址,丢一条不动其余键的坐标),而它的那一段
+ * 是字符串键、不是下标 —— 两道判据各自都挡得住。首段不判(域文档的根是对象,首段恒是字段名)。
  *
  * **恒等纪律**:没有任何一段真的变了(表长外、或原下标与压缩后下标相同)⇒ 返回**原引用**,不复制。
  */
 function rebasePath(p, keptIndex) {
-    const field = p[0];
-    if (typeof field !== "string" || !Object.prototype.hasOwnProperty.call(keptIndex, field))
-        return p;
-    const index = typeof p[1] === "number" ? p[1] : undefined;
-    if (index === undefined)
-        return p;
-    const original = keptIndex[field][index];
-    if (original === undefined || original === index)
-        return p; // 表长外 ⇒ 原样(与 2.1.0「越界原样」同律)
-    return [field, original, ...p.slice(2)];
+    let out;
+    for (let i = 1; i < p.length; i++) {
+        const seg = p[i];
+        if (typeof seg !== "number")
+            continue;
+        const at = formatConfigPath((out ?? p).slice(0, i));
+        if (!Object.prototype.hasOwnProperty.call(keptIndex, at))
+            continue;
+        const original = keptIndex[at][seg];
+        if (original === undefined || original === seg)
+            continue; // 表长外 ⇒ 原样(与 2.1.0「越界原样」同律)
+        (out ??= [...p])[i] = original;
+    }
+    return out ?? p;
 }
 /** 扫描深度上限(嵌套再深的配置文档不存在;有上限才不会被恶意深链拖住)。 */
 const DROP_SCAN_MAX_DEPTH = 8;
@@ -796,23 +846,90 @@ function carriedUnknownKeys(domain, parsed) {
     return acc;
 }
 /**
- * 一域的 parse + **静默剥键/静默承运两条告警**(0.19.0)。`buildEffective` 与 `FileConfigStore.getDomain`
- * 共用这一个判据 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
+ * **文档面**的域读函数:一域的严 parse + **静默剥键/静默承运两条告警**,**永不抢救**。`FileConfigStore.getDomain`(于是 `exportBundle`、
+ * `createSiblingResolver`)与一致性门写入席(`strictWrite` 腿)读它 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
  * (对抗复审 复审 round2 F3:导出一份被剥了键的域再导入 = 持久的配置丢失,而且全程无声)。
+ *
+ * 文档面回答「这份文档本身读不读得进」:读不进就抛(sanitized ZodError),一条条目都不替运维删 —— 写入席、导出、读改写的「现状」读的都是它。
+ * 视图面(「这份文档在生效配置里是什么」)是 {@link parseDomainSalvaged}:同一只内部体({@link readDomainDocument}),读不进时多一步逐条抢救。
  */
 export function parseDomainLoud(domain, raw, onWarning) {
-    const parsed = parseDomain(domain, raw);
+    return readDomainDocument(domain, raw, onWarning, (unreadable) => {
+        throw unreadable;
+    });
+}
+/**
+ * **视图面**的域读函数(12.3.0,S-1494):与 {@link parseDomainLoud} 同一只内部体,整域读不进时按 {@link DOMAIN_ENTRY_SALVAGE} 逐条抢救。
+ * `buildEffective` 十六个域一处调它(`parseOr`);管理面要显示「生效配置里这个域是什么」时读它。
+ *
+ * 读法:
+ *  1. 整域 `parseDomain`;过 ⇒ 未知键两条告警按原文档坐标出门,返回 —— 与 {@link parseDomainLoud} 逐字同值同告警(好配置的路径一字不动)。
+ *  2. 不过,且 {@link DOMAIN_ENTRY_SALVAGE} 判该域 `"salvage"` ⇒ {@link salvageEntries}(递归到嵌套集合);丢了东西 ⇒ 拿压缩后的
+ *     文档再 `parseDomain` 一次。过 ⇒ 每条被丢条目一条 `entry-dropped`(它们本来就是原文档坐标),其余告警是对压缩文档的诊断,
+ *     过本层位移表({@link rebaseWarningPaths})回写成原文档坐标(坐标律 S-323b)。
+ *  3. 其余一切(`"none"` 档、什么都没丢、丢了仍读不进)⇒ **抛第 1 步的原错**,零告警 —— 一个域一个结论:没救活就不留「丢了某条」的半路叙述。
+ *     整域读不进之后是默认化还是抛,是调用方按 {@link DOMAIN_READ_FALLBACK} 的事(`buildEffective` 的 `parseOr`),本函数不读那张表。
+ *
+ * 写路径与导出面不调它:`parseDomain` / `validateDomain` / `writeDomainFile` 判整份文档,写入席与 `getDomain` / `exportBundle` 读 {@link parseDomainLoud}。
+ * 读改写(读存量、改、整份写回)的「现状」也不许读它 —— 抢救读出再写回,被丢的条目就成了删除。
+ */
+export function parseDomainSalvaged(domain, raw, onWarning) {
+    return readDomainDocument(domain, raw, onWarning, (unreadable) => parseSalvaged(domain, raw, unreadable, onWarning));
+}
+/**
+ * 两面共用的**唯一内部体**:严 parse(`parseDomain`)+ 未知键两条告警。整域读不进时交给 `whenUnreadable`(文档面:抛原错;视图面:逐条抢救)——
+ * 两个读函数只差这一个入参。告警在 parse 成功之后、`try` 之外发:`onWarning` 自己抛的错不会被当成「文档读不进」。
+ */
+function readDomainDocument(domain, raw, onWarning, whenUnreadable) {
+    let parsed;
+    try {
+        parsed = parseDomain(domain, raw);
+    }
+    catch (unreadable) {
+        return whenUnreadable(unreadable);
+    }
+    if (onWarning)
+        announceUnknownKeys(domain, raw, parsed, onWarning);
+    return parsed;
+}
+/** {@link parseDomainSalvaged} 的第 2 / 3 步(整域 parse 已经失败):能救就救,救不了就抛 `unreadable`(第 1 步的原错)。
+ *  档位判 `!== "salvage"`(不是 `=== "none"`):一个不是域的名字(JS 调用方 / 写入席收到的任意键)查表得到 `undefined` 或原型链上的东西,
+ *  照样不抢救 —— 只有表里白纸黑字的 `"salvage"` 才开这扇门。 */
+function parseSalvaged(domain, raw, unreadable, onWarning) {
+    if (DOMAIN_ENTRY_SALVAGE[domain] !== "salvage")
+        throw unreadable;
+    const salvage = salvageEntries(DOMAIN_SCHEMAS[domain], raw);
+    if (salvage.dropped.length === 0)
+        throw unreadable;
+    let parsed;
+    try {
+        parsed = parseDomain(domain, salvage.raw);
+    }
+    catch {
+        throw unreadable; // 条目之外还有毛病(重名 / 悬空 ref / 域级判据)—— 丢条目救不了它
+    }
     if (onWarning) {
-        const dropped = droppedKeys(domain, raw, parsed);
-        if (dropped.keys.length > 0)
-            onWarning({ domain, kind: "unknown-keys-dropped", keys: dropped.keys, ...(dropped.total > dropped.keys.length ? { truncatedFrom: dropped.total } : {}) });
-        const carried = carriedUnknownKeys(domain, parsed);
-        if (carried.keys.length > 0)
-            onWarning({ domain, kind: "unknown-keys-carried", keys: carried.keys, ...(carried.total > carried.keys.length ? { truncatedFrom: carried.total } : {}) });
+        // 坐标律(S-323b):一条告警用「铸它的那一层所见文档」的坐标表达;哪一层压缩了文档,哪一层就把从它下方上来的告警回写一次。
+        // `entry-dropped` 是本层(salvage)铸的,用的就是本层入参那份文档的坐标 ⇒ 原样出门;未知键扫描是对本层**压缩后**文档的诊断 ⇒ 过本层的位移表。
+        for (const d of salvage.dropped)
+            onWarning(entryDroppedWarning(domain, d));
+        announceUnknownKeys(domain, salvage.raw, parsed, (w) => onWarning(rebaseWarningPaths(w, salvage.keptIndex)));
     }
     return parsed;
 }
+/** 未知键两条告警(剥掉的 / 承运的)—— `raw` 是这次真被 parse 的那份文档,`emit` 决定坐标出门前要不要回写。 */
+function announceUnknownKeys(domain, raw, parsed, emit) {
+    const dropped = droppedKeys(domain, raw, parsed);
+    if (dropped.keys.length > 0)
+        emit({ domain, kind: "unknown-keys-dropped", keys: dropped.keys, ...(dropped.total > dropped.keys.length ? { truncatedFrom: dropped.total } : {}) });
+    const carried = carriedUnknownKeys(domain, parsed);
+    if (carried.keys.length > 0)
+        emit({ domain, kind: "unknown-keys-carried", keys: carried.keys, ...(carried.total > carried.keys.length ? { truncatedFrom: carried.total } : {}) });
+}
 /** Per-domain READ-corruption policy (0.8.1) — what buildEffective does when a stored domain no longer parses.
+ *  **One question only** (12.3.0, S-1494): the domain as a whole is unreadable — after {@link parseDomainSalvaged} has tried
+ *  whatever entry salvage {@link DOMAIN_ENTRY_SALVAGE} allows — so does the read default it or throw? Whether single bad
+ *  entries may be dropped is the OTHER table's question; neither table reads the other.
  *  `"default"` = degrade to the schema default + warn (safe: the default only REMOVES capability, fail-closed).
  *  `"throw"` = keep fail-loud (defaulting would LOOSEN gates or destructively apply — worse than an outage,
  *  consumers fail-static on last-good). A `satisfies Record<DomainName,…>` forces every FUTURE domain to make
@@ -861,6 +978,55 @@ export const DOMAIN_READ_FALLBACK = {
     // 消费方 fail-static 在上一份好配置严格更好。
     limits: "throw",
 };
+/** Per-domain ENTRY-SALVAGE policy (12.3.0, S-1494) — may the view-face domain reader ({@link parseDomainSalvaged}) drop single bad
+ *  entries (an array element, a Record value, and — recursively — a bad entry inside a surviving entry) and read the rest?
+ *  **One question only**: what happens when the domain stays unreadable after that is {@link DOMAIN_READ_FALLBACK}'s question.
+ *  `"salvage"` = drop each bad entry, name it (`entry-dropped`, coordinate + identity + reason word), keep the rest.
+ *  `"none"` = never drop a single entry: the first bad entry makes the whole domain unreadable.
+ *  A `satisfies Record<DomainName,…>` forces every FUTURE domain to answer this explicitly (compile error until classified).
+ *
+ *  **View face only.** The document face never salvages: `parseDomain` / `validateDomain` / `writeDomainFile` judge the whole
+ *  document, and {@link parseDomainLoud} — what the conformance write seat (`strictWrite` leg), `FileConfigStore.getDomain` and
+ *  `exportBundle` read — throws on it. A write path that reads the stored "current" value through `parseDomainSalvaged` and writes
+ *  it back would turn every dropped entry into a deletion — read-modify-write faces read the stored document with the document face.
+ *
+ *  Per-domain rationale:
+ *    - models/skills/mcp/plugins/scenarios/systems/collab/prompts: additive capability / content catalogs — a dropped entry is
+ *      one capability gone (fail-closed). Inside a surviving entry the same holds: the nested collections these entries carry
+ *      are allowlists / scopings (`allowTools`, `scenarios`, `rosters`, `callsWorkers`, …) where one entry fewer only NARROWS,
+ *      and the zero-survivor law (never mint an empty collection — several of these read "empty = all") holds at every level.
+ *    - hosts: a dropped host is one placement target fewer; a dropped label makes a host match fewer `placement.requires`.
+ *    - projects: SALVAGE — a registration absent from the ledger = that project's claim is refused (fail-closed). Throwing the
+ *      whole domain stops EVERY project of the scope, which protects nothing: one stored registration that a later, tighter
+ *      schema refuses (12.2.1's UNC judgement on `contextItems[].value`) must not take the scope's other projects with it.
+ *      Its whenUnreadable stance stays `"throw"` (a ledger that cannot be read at all is never defaulted — see
+ *      {@link DOMAIN_READ_FALLBACK}).
+ *    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
+ *      (放权,不许).
+ *    - workers: NONE — a dropped worker row reads as "this worker is no longer declared": the reconciler would retire it. The
+ *      per-row tolerance this domain does have lives in `readWorkersRows` (rows are HELD with their original, never dropped).
+ *    - governance: NONE — a dropped commandPolicy / approvalRequire row is a guardrail silently gone (放权,不许).
+ *    - entitlement: NONE — a dropped tier / subject / binding / budget group changes who may do what (放权,不许).
+ *    - execution: NONE — a dropped lane / public key changes the execution mandate (放权,不许).
+ *    - limits: NONE — a dropped allowlist row changes a published ceiling (the domain is the one publishing seat of those ceilings). */
+export const DOMAIN_ENTRY_SALVAGE = {
+    models: "salvage",
+    rosters: "none",
+    skills: "salvage",
+    mcp: "salvage",
+    plugins: "salvage",
+    scenarios: "salvage",
+    systems: "salvage",
+    collab: "salvage",
+    workers: "none",
+    hosts: "salvage",
+    governance: "none",
+    entitlement: "none",
+    execution: "none",
+    projects: "salvage",
+    prompts: "salvage",
+    limits: "none",
+};
 /**
  * Merge every domain into the effective config a consumer pulls. Shared by all store impls.
  * `updatedAt` is REQUIRED (the determinism refactor — the original store.ts defaulted it to the wall clock,
@@ -873,41 +1039,17 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
     // 墓碑先判:一份没迁的retired 域文档意味着这个 scope 的存量还没过一次性迁移 —— 拿剩下的域拼一份 effective 等于静默丢掉它的事实。
     for (const retired of Object.keys(RETIRED_DOMAINS))
         refuseRetiredDomain(retired, getRaw(retired));
-    // 0.19.0 静默剥键/静默承运门:解析**成功**的域,把 schema 丢掉的键、以及 open-world 域里承运但本包
-    // 不认识的键(都含嵌套,段坐标)点名(行为不变,只是不再无声)。判据与 `getDomain` 同源
-    // ({@link parseDomainLoud})。只在成功路径上报——降级路径已经有 domain-defaulted 那条更重的警告。
-    const parseLoud = (domain, raw) => parseDomainLoud(domain, raw, onWarning);
-    // Generic READ guardrail (0.8.1): a domain that no longer parses degrades to its schema default + a warning
-    // — but ONLY where DOMAIN_READ_FALLBACK says the default is safe; gate-bearing domains keep throwing (决策
-    // 表与逐域理由见 DOMAIN_READ_FALLBACK). The success path is UNCHANGED (same parseDomain, same bytes).
+    // 每个域同一只读法(12.3.0,S-1494):视图面读函数 {@link parseDomainSalvaged}(整域 parse → 按 DOMAIN_ENTRY_SALVAGE 逐条抢救 → 未知键告警;
+    // 与文档面 `parseDomainLoud` 共用同一只内部体)读不进 ⇒ 只剩**整域读不进**这一个问题,答案只看 DOMAIN_READ_FALLBACK(决策表与逐域理由见那张表):
+    // `"throw"` ⇒ 原错抛出;`"default"` ⇒ schema 默认 + `domain-defaulted`。哪个域走哪一档不再写在下面的行上(此前 gate 域的行
+    // 调 parseLoud、其余调 parseOr —— 同一张表的第二份手抄),行只说「读这个域」。好配置的路径一字不动(同一次 parseDomain,同一份字节)。
     const parseOr = (domain, raw) => {
         try {
-            return parseDomainLoud(domain, raw, onWarning);
+            return parseDomainSalvaged(domain, raw, onWarning);
         }
         catch (e) {
             if (DOMAIN_READ_FALLBACK[domain] === "throw")
                 throw e;
-            // 逐条容错(2.0.0)在整域降级**之前**试一次:只丢掉真正坏掉的那几条条目,同域好兄弟活下来。
-            // 告警先缓存再决定 —— 一个域只给一个结论:救活了就逐条报 `entry-dropped`,没救活就只报
-            // `domain-defaulted`(那一域的条目反正一条都不剩,再讲「丢了第 3 条」只会误导)。
-            const salvage = salvageEntries(DOMAIN_SCHEMAS[domain], raw);
-            if (salvage.dropped.length > 0) {
-                try {
-                    const buffered = [];
-                    const parsed = parseDomainLoud(domain, salvage.raw, (w) => buffered.push(w));
-                    // 坐标律(S-323b):一条告警用「铸它的那一层所见文档」的坐标表达;哪一层压缩了文档,哪一层就把从它下方上来的告警回写一次。
-                    // `entry-dropped` 是本层(salvage)铸的,用的就是本层入参那份文档的坐标 ⇒ 原样出门;`buffered` 里的是对本层**压缩后**
-                    // 文档的诊断 ⇒ 先过本层的位移表。读路径上只有这一个压缩点(11.0.0 起 hosts 的读侧夹紧臂已retired)。
-                    for (const d of salvage.dropped)
-                        onWarning?.(entryDroppedWarning(domain, d));
-                    for (const w of buffered)
-                        onWarning?.(rebaseWarningPaths(w, salvage.keptIndex));
-                    return parsed;
-                }
-                catch {
-                    // 条目之外还有毛病(重名 / 悬空 ref / 域级判据)—— 丢条目救不了它,照常整域降级。
-                }
-            }
             onWarning?.({ domain, kind: "domain-defaulted", error: e });
             return parseDomain(domain, undefined); // schema default — always valid
         }
@@ -916,30 +1058,26 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
         version,
         updatedAt,
         models: parseOr("models", getRaw("models")),
-        rosters: parseLoud("rosters", getRaw("rosters")),
+        rosters: parseOr("rosters", getRaw("rosters")),
         skills: parseOr("skills", getRaw("skills")),
         mcp: parseOr("mcp", getRaw("mcp")),
         plugins: parseOr("plugins", getRaw("plugins")),
         scenarios: parseOr("scenarios", getRaw("scenarios")),
         systems: parseOr("systems", getRaw("systems")),
         collab: parseOr("collab", getRaw("collab")),
-        workers: parseLoud("workers", getRaw("workers")),
+        workers: parseOr("workers", getRaw("workers")),
         hosts: parseOr("hosts", getRaw("hosts")),
         // governance TRUTH = the domain itself (11.0.0: the read-side lift from a 0.5-era runtime document is gone — the
         // runtime tombstone above refuses such a document, and the one-time migration SS-M1 moves its trio here).
-        governance: parseLoud("governance", getRaw("governance")),
-        entitlement: parseLoud("entitlement", getRaw("entitlement")),
+        governance: parseOr("governance", getRaw("governance")),
+        entitlement: parseOr("entitlement", getRaw("entitlement")),
         // execution (0.8.0, S3): plain scope-level parse — MIRRORS governance (no overlay/merge invented here).
-        execution: parseLoud("execution", getRaw("execution")),
-        // projects (0.10.0, 142-S3): THROW policy → parseLoud(≡ parseDomain + 剥键告警), never parseOr
-        // (defaulting would evaporate the identity ledger AND expose the claim read-modify-write face to
-        // clobbering stored registrations).
-        projects: parseLoud("projects", getRaw("projects")),
-        // prompts (0.10.18, [1064]②): content domain → parseOr(坏形回空默认=「无 prompts 管理」语义;
-        // fail-closed 由 PUBLISH_MODE 发布闸承担,空 bindings 不下发内容,default 不扩权)。
+        execution: parseOr("execution", getRaw("execution")),
+        projects: parseOr("projects", getRaw("projects")),
+        // prompts (0.10.18, [1064]②): content domain(坏形回空默认=「无 prompts 管理」语义;fail-closed 由 PUBLISH_MODE 发布闸承担,
+        // 空 bindings 不下发内容,default 不扩权)。
         prompts: parseOr("prompts", getRaw("prompts")),
-        // limits (0.19.0, 消费方 #322 批1): THROW 档 → parseLoud(坏形绝不静默降级成「没有天花板」)。
-        limits: parseLoud("limits", getRaw("limits")),
+        limits: parseOr("limits", getRaw("limits")),
     };
 }
 /** READ-side tolerant judgment for a GET /effective **wire payload**(the {@link EffectiveWire} contract)at

package/dist/host-path.js

@@ -15,7 +15,8 @@ export const ABSOLUTE_HOST_PATH_MAX = 4096;
  * 读方只拿「形合法」这一个事实,怎么解析归宿主那一族 —— 这里不碰文件系统、不做族内归一。
  */
 const WIN_DRIVE_ABSOLUTE = /^[A-Za-z]:[\\/]/;
-const WIN_UNC_ABSOLUTE = /^\\\\[^\\/?*]+[\\/][^\\/]+/;
+// UNC 首段是主机名(字母数字起头,其后字母数字 . _ -):Windows 设备命名空间前缀 `\\.\` 与长路径前缀 `\\?\` 都不是主机路径,一律拒。
+const WIN_UNC_ABSOLUTE = /^\\\\[A-Za-z0-9][A-Za-z0-9._-]*[\\/][^\\/]+/;
 export function isAbsoluteHostPath(p) {
     return (typeof p === "string" && p.length > 0 && p.length <= ABSOLUTE_HOST_PATH_MAX && !p.includes("\0") &&
         (p.startsWith("/") || WIN_DRIVE_ABSOLUTE.test(p) || WIN_UNC_ABSOLUTE.test(p)) &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "12.2.0",
+  "version": "12.3.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-web-admin, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",