@sema-agent/settings-schema 12.2.1 → 13.0.0

package/conformance/cases/c45-s792-identity-bounds-and-decode-depth/expected.json

@@ -61,9 +61,7 @@
             "name": "keep",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/c47-s811-roles-key-url-userinfo-withheld/expected.json

@@ -38,9 +38,7 @@
             "name": "keep",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {

package/conformance/cases/c48-s935-model-headers-transported/expected.json

@@ -41,9 +41,7 @@
             "name": "claude-1m",
             "provider": "anthropic",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           },
           {
             "api": "openai-completions",
@@ -56,9 +54,7 @@
             "name": "gw",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           },
           {
             "api": "openai-completions",
@@ -68,9 +64,7 @@
             "name": "plain",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},
@@ -126,9 +120,7 @@
             "name": "claude-1m",
             "provider": "anthropic",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           },
           {
             "api": "openai-completions",
@@ -141,9 +133,7 @@
             "name": "gw",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           },
           {
             "api": "openai-completions",
@@ -153,9 +143,7 @@
             "name": "plain",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/c49-s935-model-headers-secret-entry-dropped/expected.json

@@ -38,9 +38,7 @@
             "name": "gw",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/c69-deep-encoded-token-past-every-reading/expected.json

@@ -38,9 +38,7 @@
             "name": "keep",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {

package/conformance/cases/c70-rewritten-token-in-front-of-encoded-pem-header/expected.json

@@ -38,9 +38,7 @@
             "name": "keep",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {

package/conformance/cases/c72-dangling-reference-write-seat-refuses/expected.json

@@ -38,9 +38,7 @@
             "name": "m1",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/c76-projects-entry-salvage-nested/expected.json

@@ -0,0 +1,142 @@
+{
+  "domains": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "atMention": {
+          "mode": "all"
+        },
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {
+          "01890a5d-ac96-774b-bcce-b302099a8001": {
+            "defaultScopes": [
+              "proj"
+            ],
+            "displayName": "one",
+            "gitRemotes": [],
+            "registeredAt": "2026-10-01T00:00:00.000Z",
+            "registeredBy": "alice"
+          },
+          "01890a5d-ac96-774b-bcce-b302099a8002": {
+            "contextItems": [
+              {
+                "kind": "folder",
+                "value": "/srv/two"
+              },
+              {
+                "kind": "note",
+                "value": "keep"
+              }
+            ],
+            "defaultScopes": [
+              "proj"
+            ],
+            "displayName": "two",
+            "gitRemotes": [],
+            "registeredAt": "2026-10-01T00:00:00.000Z",
+            "registeredBy": "alice"
+          }
+        }
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [
+      {
+        "domain": "projects",
+        "kind": "entry-dropped",
+        "path": [
+          "projects",
+          "01890a5d-ac96-774b-bcce-b302099a8002",
+          "contextItems",
+          1
+        ],
+        "reasonCode": "entry-schema-invalid"
+      },
+      {
+        "domain": "projects",
+        "kind": "entry-dropped",
+        "path": [
+          "projects",
+          "01890a5d-ac96-774b-bcce-b302099a8003"
+        ],
+        "reasonCode": "entry-schema-invalid"
+      },
+      {
+        "domain": "projects",
+        "keys": [
+          [
+            "projects",
+            "01890a5d-ac96-774b-bcce-b302099a8002",
+            "contextItems",
+            2,
+            "typo"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      }
+    ],
+    "metadata": {
+      "version": 18,
+      "updatedAt": "2026-10-13T00:00:00.000Z"
+    }
+  },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:读腿要逐条丢两条才读得进的文档,写入席整份拒 —— 写入席不替运维删他的条目(写路径永不抢救)。"
+  },
+  "wire": {
+    "derive": true
+  },
+  "localRoot": {
+    "derive": true,
+    "localVersion": 2617555914511015
+  }
+}

package/conformance/cases/c76-projects-entry-salvage-nested/input.json

@@ -0,0 +1,54 @@
+{
+  "meta": {
+    "version": 18,
+    "updatedAt": "2026-10-13T00:00:00.000Z"
+  },
+  "domains": {
+    "projects": {
+      "projects": {
+        "01890a5d-ac96-774b-bcce-b302099a8001": {
+          "displayName": "one",
+          "gitRemotes": [],
+          "defaultScopes": [
+            "proj"
+          ],
+          "registeredBy": "alice",
+          "registeredAt": "2026-10-01T00:00:00.000Z"
+        },
+        "01890a5d-ac96-774b-bcce-b302099a8002": {
+          "displayName": "two",
+          "gitRemotes": [],
+          "defaultScopes": [
+            "proj"
+          ],
+          "registeredBy": "alice",
+          "registeredAt": "2026-10-01T00:00:00.000Z",
+          "contextItems": [
+            {
+              "kind": "folder",
+              "value": "/srv/two"
+            },
+            {
+              "kind": "folder",
+              "value": "\\\\?\\C:\\x"
+            },
+            {
+              "kind": "note",
+              "value": "keep",
+              "typo": 1
+            }
+          ]
+        },
+        "01890a5d-ac96-774b-bcce-b302099a8003": {
+          "displayName": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+          "gitRemotes": [],
+          "defaultScopes": [
+            "proj"
+          ],
+          "registeredBy": "alice",
+          "registeredAt": "2026-10-01T00:00:00.000Z"
+        }
+      }
+    }
+  }
+}

package/conformance/cases/c76-projects-entry-salvage-nested/meta.json

@@ -0,0 +1,6 @@
+{
+  "contributor": "contract",
+  "claim": "12.3.0(S-1494)projects 逐条抢救 + 抢救递归:三条登记里第 2 条的第 1 个上下文条目是 Windows 长路径前缀形(12.2.1 起拒)、第 3 条 displayName 201 字。读腿:登记 1、2 在(2 的 contextItems 丢第 1 项,其余照用)、3 不在,两条 entry-dropped 分别点到嵌套那一格与整条登记;第 2 条第 2 项上的拼错键按**原文档**下标报(压缩后它是第 1 项)。严写腿整份拒。打的是三种读法分歧:projects 仍整域拒(12.2.x 读法,整个 scope 的项目停摆)/ 抢救只下到顶层(整条登记 2 连坐丢掉)/ 嵌套坐标报压缩后的下标。",
+  "firstRedOn": [],
+  "note": "firstRedOn 为空:historical 阶梯(≤ 2.1.0)不覆盖 11.3.0 的 projects 扩形;对 12.2.x 这一条会红(projects 整域拒),那一版不在入库的真跑证据里。"
+}

package/conformance/cases/cc03-model-compat-unknown-subkey/expected.json

@@ -42,9 +42,7 @@
             "name": "m0",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},
@@ -101,9 +99,7 @@
             "name": "m0",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/cli01-model-name-nfc-vs-nfd/expected.json

@@ -38,9 +38,7 @@
             "name": "ascii-ok",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/cli02-control-and-zero-width-chars/expected.json

@@ -51,9 +51,7 @@
             "name": "ok-name",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/cli05-long-and-prefix-colliding-names/expected.json

@@ -38,9 +38,7 @@
             "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           },
           {
             "api": "openai-completions",
@@ -50,9 +48,7 @@
             "name": "prefix-shared-name-aaaa",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           },
           {
             "api": "openai-completions",
@@ -62,9 +58,7 @@
             "name": "prefix-shared-name-aaab",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},
@@ -117,9 +111,7 @@
             "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           },
           {
             "api": "openai-completions",
@@ -129,9 +121,7 @@
             "name": "prefix-shared-name-aaaa",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           },
           {
             "api": "openai-completions",
@@ -141,9 +131,7 @@
             "name": "prefix-shared-name-aaab",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/t01-absent-domain-key-not-null/expected.json

@@ -46,9 +46,7 @@
             "name": "m0",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/t03-prototype-name-key-not-swallowed/expected.json

@@ -38,9 +38,7 @@
             "name": "m0",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},
@@ -115,9 +113,7 @@
             "name": "m0",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/conformance/cases/t04-secret-literal-never-in-warning-value/expected.json

@@ -38,9 +38,7 @@
             "name": "keep",
             "provider": "openai",
             "quotaWeight": 1,
-            "reasoning": false,
-            "tier": "standard",
-            "vision": false
+            "tier": "standard"
           }
         ],
         "roles": {},

package/dist/config-fns.d.ts

@@ -263,11 +263,16 @@ export declare function isReportableRefusalName(name: string): boolean;
  *  摘要输入取 `JSON.stringify(name)`:UTF-8 编码会把孤立代理项换成 U+FFFD(`"\ud800"` / `"\ud801"` / `"\ufffd"` 三个不同的名同一串字节),
  *  JSON 串形逐个 UTF-16 码元保留(孤立代理项写成转义)—— 不同的名恒是不同的输入。 */
 export declare function withheldNameToken(name: string): string;
-/** 抢救造成的**下标位移表**:数组字段名 → 该字段压缩后每个位置的**原**下标(`kept[j]` = 压缩后第 j 条
+/** 抢救造成的**下标位移表**:被压缩过的数组 → 它压缩后每个位置的**原**下标(`kept[j]` = 压缩后第 j 条
  *  在原文档里的下标)。纯数据,无行为。
  *
- *  只登记**真发生过丢弃**的数组字段 —— 没丢的字段没有位移,给它登记一份恒等映射只会把「有没有位移」
- *  从表的**在场性**挪成表的**内容**,凭空多一层判据。Record 字段永不登记:它的条目按键寻址,丢一条
+ *  **键 = 那个数组在原文档里的全路径**,经 {@link formatConfigPath} 出门形(12.3.0,S-1494:抢救递归之后,被压缩的数组可以住在
+ *  幸存条目体内 —— `"projects.<id>.contextItems"`、`"items.2.subs"`)。顶层数组字段的全路径就是它的字段名(`"models"`),所以
+ *  12.2.x 及更早的表(`{ models: [0, 2] }`)形与义都不变。路径段是出门形(Record 键过脱敏器,与告警坐标同一道):两只不同的、
+ *  都被打码成同一串的 Record 键体内各有一个压缩数组时,那一格坐标本身就分不清是谁 —— 那个键不登记(不回写好过回写错)。
+ *
+ *  只登记**真发生过丢弃或位移**的数组 —— 没丢的数组没有位移,给它登记一份恒等映射只会把「有没有位移」
+ *  从表的**在场性**挪成表的**内容**,凭空多一层判据。Record 永不登记:它的条目按键寻址,丢一条
  *  不动其余键的坐标。 */
 export type EntryKeptIndex = Readonly<Record<string, readonly number[]>>;
 /** {@link salvageEntries} 的结果。`raw` 是剔掉坏条目后的文档;**什么都没丢时返回原引用**
@@ -304,10 +309,19 @@ export interface EntrySalvageResult {
  * 抛出来的文案可能带 secret。抢救是**尽力而为**的:抢不动就当没抢救(返回原引用),让既有的整域档位去裁,
  * 绝不把解析拖下水、更不回显它的错误(与同文件 {@link droppedKeys} 逐字同纪律)。
  *
- * 边界(如实登记):① 只看**顶层**字段(条目集合就在顶层,嵌套的坏形属于条目自身的问题);② raw 不是
+ * **递归**(12.3.0,S-1494):集合里的每一条,先对它自己按**同一个函数**抢救(它的 schema 若是带集合字段的对象 —— 从 schema 派生,
+ * 没有任何域专用分支),再拿抢救后的那一条去判整条。体内丢的子条目以父坐标为前缀上账(`["projects", <id>, "contextItems", 1]`),
+ * 体内压缩过的数组以全路径进位移表({@link EntryKeptIndex});整条最终仍判不过 ⇒ 整条丢,它体内的半路账一并作废(一条一个结论),
+ * 记账行的判决取**原文**的(拒句坐标是原文档的,不是抢救形里压缩过的下标)。
+ * 零幸存者律在**每一层**成立 —— 体内的集合全坏 ⇒ 不压成空集合,那一条照原样去判(于是整条丢):嵌套里同样有「空 = 不设限」的字段
+ * (`skills[].scenarios` / `mcp.servers[].allowTools` …),抢救成 `[]` 就是把限定范围放成全开。账按文档序排(父条目丢在哪个位置,
+ * 体内的子条目就排在哪个位置)。
+ *
+ * 边界(如实登记):① 只下钻**条目**(集合的元素 / 值),不下钻顶层的普通对象字段(`models.atMention` 不是条目);② raw 不是
  * 纯 JSON 对象、字段值与 schema 形状对不上(schema 说数组、文档给对象)⇒ 原样返回,交给整域档位裁;
  * ③ 域级判据(重名 / 悬空 ref)不在本函数视野内 —— 丢条目救不了它们,调用方据此回落整域档位;
- * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向)。
+ * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向);⑤ 递归深度止于 schema
+ * (本包没有自引用 schema);`z.lazy` 包着的 schema 不展开(`unwrapSchema` 不认它)⇒ 不下钻,那一条按原样判。
  */
 export declare function salvageEntries(schema: z.ZodType, raw: unknown): EntrySalvageResult;
 /**
@@ -362,7 +376,8 @@ export type EffectiveReadWarning = {
 /** 一条**条目**没通过它自己的 entry schema,被单独丢掉了(域内其余条目照常生效)。`path` = 段坐标
  *  (`["models",3]` / `["roles","summarize"]`),与 `unknown-keys-dropped` 的坐标形同一套。逐条一发 —— 载荷是
  *  O(域里的条目数),与被读文档同阶,不放大,故不设条数上限(有上限的是**单条**告警里的键列表)。
- *  2.0.0 起;只可能来自 {@link DOMAIN_READ_FALLBACK} 判 `"default"` 的域,gate 域坏形仍然 throw。
+ *  2.0.0 起;只可能来自 {@link DOMAIN_ENTRY_SALVAGE} 判 `"salvage"` 的域(12.3.0 起该表单列;此前挂在 `DOMAIN_READ_FALLBACK` 的
+ *  `"default"` 档上),闸域坏条目仍然整域读不进。`path` 可以落在幸存条目体内(12.3.0 递归:`["projects", <id>, "contextItems", 1]`)。
  *  **S-712**(additive):`identity` = 被丢条目原文里读得出的身份({@link DroppedEntryIdentity};
  *  读不出 ⇒ 键缺席),消费方据此知道「丢的是谁」而不必拿坐标回读原文档。
  *  **S-1295**(additive):`reasonCode` = 为什么丢的机读闭集词({@link DROPPED_ENTRY_REASON_CODES}),消费方据此知道「为什么丢」
@@ -486,12 +501,34 @@ export declare const EXTENSION_NAMESPACES: Partial<Record<DomainName, ReadonlyAr
  *  契约(`semaGPT_5` / `semaX-v2` 都是成员,后缀不设未声明的文法)。 */
 export declare function isReservedExtensionKey(domain: DomainName, parent: ConfigPath, key: string): boolean;
 /**
- * 一域的 parse + **静默剥键/静默承运两条告警**(0.19.0)。`buildEffective` 与 `FileConfigStore.getDomain`
- * 共用这一个判据 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
+ * **文档面**的域读函数:一域的严 parse + **静默剥键/静默承运两条告警**,**永不抢救**。`FileConfigStore.getDomain`(于是 `exportBundle`、
+ * `createSiblingResolver`)与一致性门写入席(`strictWrite` 腿)读它 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
  * (对抗复审 复审 round2 F3:导出一份被剥了键的域再导入 = 持久的配置丢失,而且全程无声)。
+ *
+ * 文档面回答「这份文档本身读不读得进」:读不进就抛(sanitized ZodError),一条条目都不替运维删 —— 写入席、导出、读改写的「现状」读的都是它。
+ * 视图面(「这份文档在生效配置里是什么」)是 {@link parseDomainSalvaged}:同一只内部体({@link readDomainDocument}),读不进时多一步逐条抢救。
  */
 export declare function parseDomainLoud<K extends DomainName>(domain: K, raw: unknown, onWarning?: (w: EffectiveReadWarning) => void): DomainConfig[K];
+/**
+ * **视图面**的域读函数(12.3.0,S-1494):与 {@link parseDomainLoud} 同一只内部体,整域读不进时按 {@link DOMAIN_ENTRY_SALVAGE} 逐条抢救。
+ * `buildEffective` 十六个域一处调它(`parseOr`);管理面要显示「生效配置里这个域是什么」时读它。
+ *
+ * 读法:
+ *  1. 整域 `parseDomain`;过 ⇒ 未知键两条告警按原文档坐标出门,返回 —— 与 {@link parseDomainLoud} 逐字同值同告警(好配置的路径一字不动)。
+ *  2. 不过,且 {@link DOMAIN_ENTRY_SALVAGE} 判该域 `"salvage"` ⇒ {@link salvageEntries}(递归到嵌套集合);丢了东西 ⇒ 拿压缩后的
+ *     文档再 `parseDomain` 一次。过 ⇒ 每条被丢条目一条 `entry-dropped`(它们本来就是原文档坐标),其余告警是对压缩文档的诊断,
+ *     过本层位移表({@link rebaseWarningPaths})回写成原文档坐标(坐标律 S-323b)。
+ *  3. 其余一切(`"none"` 档、什么都没丢、丢了仍读不进)⇒ **抛第 1 步的原错**,零告警 —— 一个域一个结论:没救活就不留「丢了某条」的半路叙述。
+ *     整域读不进之后是默认化还是抛,是调用方按 {@link DOMAIN_READ_FALLBACK} 的事(`buildEffective` 的 `parseOr`),本函数不读那张表。
+ *
+ * 写路径与导出面不调它:`parseDomain` / `validateDomain` / `writeDomainFile` 判整份文档,写入席与 `getDomain` / `exportBundle` 读 {@link parseDomainLoud}。
+ * 读改写(读存量、改、整份写回)的「现状」也不许读它 —— 抢救读出再写回,被丢的条目就成了删除。
+ */
+export declare function parseDomainSalvaged<K extends DomainName>(domain: K, raw: unknown, onWarning?: (w: EffectiveReadWarning) => void): DomainConfig[K];
 /** Per-domain READ-corruption policy (0.8.1) — what buildEffective does when a stored domain no longer parses.
+ *  **One question only** (12.3.0, S-1494): the domain as a whole is unreadable — after {@link parseDomainSalvaged} has tried
+ *  whatever entry salvage {@link DOMAIN_ENTRY_SALVAGE} allows — so does the read default it or throw? Whether single bad
+ *  entries may be dropped is the OTHER table's question; neither table reads the other.
  *  `"default"` = degrade to the schema default + warn (safe: the default only REMOVES capability, fail-closed).
  *  `"throw"` = keep fail-loud (defaulting would LOOSEN gates or destructively apply — worse than an outage,
  *  consumers fail-static on last-good). A `satisfies Record<DomainName,…>` forces every FUTURE domain to make
@@ -534,6 +571,55 @@ export declare const DOMAIN_READ_FALLBACK: {
     readonly prompts: "default";
     readonly limits: "throw";
 };
+/** Per-domain ENTRY-SALVAGE policy (12.3.0, S-1494) — may the view-face domain reader ({@link parseDomainSalvaged}) drop single bad
+ *  entries (an array element, a Record value, and — recursively — a bad entry inside a surviving entry) and read the rest?
+ *  **One question only**: what happens when the domain stays unreadable after that is {@link DOMAIN_READ_FALLBACK}'s question.
+ *  `"salvage"` = drop each bad entry, name it (`entry-dropped`, coordinate + identity + reason word), keep the rest.
+ *  `"none"` = never drop a single entry: the first bad entry makes the whole domain unreadable.
+ *  A `satisfies Record<DomainName,…>` forces every FUTURE domain to answer this explicitly (compile error until classified).
+ *
+ *  **View face only.** The document face never salvages: `parseDomain` / `validateDomain` / `writeDomainFile` judge the whole
+ *  document, and {@link parseDomainLoud} — what the conformance write seat (`strictWrite` leg), `FileConfigStore.getDomain` and
+ *  `exportBundle` read — throws on it. A write path that reads the stored "current" value through `parseDomainSalvaged` and writes
+ *  it back would turn every dropped entry into a deletion — read-modify-write faces read the stored document with the document face.
+ *
+ *  Per-domain rationale:
+ *    - models/skills/mcp/plugins/scenarios/systems/collab/prompts: additive capability / content catalogs — a dropped entry is
+ *      one capability gone (fail-closed). Inside a surviving entry the same holds: the nested collections these entries carry
+ *      are allowlists / scopings (`allowTools`, `scenarios`, `rosters`, `callsWorkers`, …) where one entry fewer only NARROWS,
+ *      and the zero-survivor law (never mint an empty collection — several of these read "empty = all") holds at every level.
+ *    - hosts: a dropped host is one placement target fewer; a dropped label makes a host match fewer `placement.requires`.
+ *    - projects: SALVAGE — a registration absent from the ledger = that project's claim is refused (fail-closed). Throwing the
+ *      whole domain stops EVERY project of the scope, which protects nothing: one stored registration that a later, tighter
+ *      schema refuses (12.2.1's UNC judgement on `contextItems[].value`) must not take the scope's other projects with it.
+ *      Its whenUnreadable stance stays `"throw"` (a ledger that cannot be read at all is never defaulted — see
+ *      {@link DOMAIN_READ_FALLBACK}).
+ *    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
+ *      (放权,不许).
+ *    - workers: NONE — a dropped worker row reads as "this worker is no longer declared": the reconciler would retire it. The
+ *      per-row tolerance this domain does have lives in `readWorkersRows` (rows are HELD with their original, never dropped).
+ *    - governance: NONE — a dropped commandPolicy / approvalRequire row is a guardrail silently gone (放权,不许).
+ *    - entitlement: NONE — a dropped tier / subject / binding / budget group changes who may do what (放权,不许).
+ *    - execution: NONE — a dropped lane / public key changes the execution mandate (放权,不许).
+ *    - limits: NONE — a dropped allowlist row changes a published ceiling (the domain is the one publishing seat of those ceilings). */
+export declare const DOMAIN_ENTRY_SALVAGE: {
+    readonly models: "salvage";
+    readonly rosters: "none";
+    readonly skills: "salvage";
+    readonly mcp: "salvage";
+    readonly plugins: "salvage";
+    readonly scenarios: "salvage";
+    readonly systems: "salvage";
+    readonly collab: "salvage";
+    readonly workers: "none";
+    readonly hosts: "salvage";
+    readonly governance: "none";
+    readonly entitlement: "none";
+    readonly execution: "none";
+    readonly projects: "salvage";
+    readonly prompts: "salvage";
+    readonly limits: "none";
+};
 /** 一个读者向店要文档的口:配置域,以及墓碑表里的retired 域({@link RETIRED_DOMAINS})—— 后者只为让墓碑看见没迁的旧文档。 */
 export type StoredDocumentReader = (d: DomainName | RetiredDomainName) => unknown;
 /**