@sema-agent/settings-schema 12.2.1 → 13.0.0

package/dist/config-fns.js

@@ -419,78 +419,122 @@ function judgeEntry(schema, value, rejectedAs) {
  * 抛出来的文案可能带 secret。抢救是**尽力而为**的:抢不动就当没抢救(返回原引用),让既有的整域档位去裁,
  * 绝不把解析拖下水、更不回显它的错误(与同文件 {@link droppedKeys} 逐字同纪律)。
  *
- * 边界(如实登记):① 只看**顶层**字段(条目集合就在顶层,嵌套的坏形属于条目自身的问题);② raw 不是
+ * **递归**(12.3.0,S-1494):集合里的每一条,先对它自己按**同一个函数**抢救(它的 schema 若是带集合字段的对象 —— 从 schema 派生,
+ * 没有任何域专用分支),再拿抢救后的那一条去判整条。体内丢的子条目以父坐标为前缀上账(`["projects", <id>, "contextItems", 1]`),
+ * 体内压缩过的数组以全路径进位移表({@link EntryKeptIndex});整条最终仍判不过 ⇒ 整条丢,它体内的半路账一并作废(一条一个结论),
+ * 记账行的判决取**原文**的(拒句坐标是原文档的,不是抢救形里压缩过的下标)。
+ * 零幸存者律在**每一层**成立 —— 体内的集合全坏 ⇒ 不压成空集合,那一条照原样去判(于是整条丢):嵌套里同样有「空 = 不设限」的字段
+ * (`skills[].scenarios` / `mcp.servers[].allowTools` …),抢救成 `[]` 就是把限定范围放成全开。账按文档序排(父条目丢在哪个位置,
+ * 体内的子条目就排在哪个位置)。
+ *
+ * 边界(如实登记):① 只下钻**条目**(集合的元素 / 值),不下钻顶层的普通对象字段(`models.atMention` 不是条目);② raw 不是
  * 纯 JSON 对象、字段值与 schema 形状对不上(schema 说数组、文档给对象)⇒ 原样返回,交给整域档位裁;
  * ③ 域级判据(重名 / 悬空 ref)不在本函数视野内 —— 丢条目救不了它们,调用方据此回落整域档位;
- * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向)。
+ * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向);⑤ 递归深度止于 schema
+ * (本包没有自引用 schema);`z.lazy` 包着的 schema 不展开(`unwrapSchema` 不认它)⇒ 不下钻,那一条按原样判。
  */
 export function salvageEntries(schema, raw) {
+    const layer = salvageLayer(schema, raw);
+    return { raw: layer.raw, dropped: layer.dropped, keptIndex: keptIndexOf(layer.shifts) };
+}
+/** 一层抢救,抢不动就当没抢救(反射 / 访问器抛错:绝不外泄其文案)。最外层与每一条条目体内走的是**同一只** —— 一条条目体内抢不动,
+ *  只是这一条不下钻、照原样去判,不连坐它所在的那一层。 */
+function salvageLayer(schema, raw) {
     try {
-        return salvageEntriesUnsafe(schema, raw);
+        return salvageLayerUnsafe(schema, raw);
     }
     catch {
-        return { raw, dropped: [], keptIndex: NO_ENTRIES_DROPPED }; // 反射/访问器抛错:抢不动就当没抢救,绝不外泄其文案
+        return { raw, dropped: [], shifts: [] };
+    }
+}
+/** 集合字段的值 → 它的位置表;值的形与 schema 对不上(schema 说数组、文档给对象)⇒ `undefined`(不抢救,交给整域档位)。
+ *  数组走 `forEach`(不是手写 `for (i < value.length)`):它在**进入时**就钉死了长度,而重读 `value.length` 会跟着一个在校验期间
+ *  自我增殖的数组一路跑下去(病态 getter 在 zod 读字段时往同一个数组里再 push 一条)—— 抢救是尽力而为的旁路,绝不许把同步读挂死;
+ *  位置表在任何判定之前就收齐了,之后数组再怎么长都与本次抢救无关。`forEach` 跳过空洞,与此前的 `filter` 同。 */
+function collectionSlots(value, isArray) {
+    if (isArray) {
+        if (!Array.isArray(value))
+            return undefined;
+        const slots = [];
+        value.forEach((entry, i) => void slots.push([i, entry]));
+        return slots;
     }
+    return isPlainJsonObject(value) ? Object.entries(value) : undefined;
 }
-function salvageEntriesUnsafe(schema, raw) {
+function salvageLayerUnsafe(schema, raw) {
+    const untouched = { raw, dropped: [], shifts: [] };
     if (!isPlainJsonObject(raw))
-        return { raw, dropped: [], keptIndex: NO_ENTRIES_DROPPED };
+        return untouched;
     const root = unwrapSchema(schema);
     if (!(root instanceof z.ZodObject))
-        return { raw, dropped: [], keptIndex: NO_ENTRIES_DROPPED };
+        return untouched;
     const shape = root.shape;
     const dropped = [];
+    const shifts = [];
     const patch = {};
-    const keptIndex = {};
     for (const [field, fieldSchema] of Object.entries(shape)) {
-        const value = raw[field];
-        if (value === undefined)
-            continue;
         const collection = unwrapSchema(fieldSchema);
-        if (collection instanceof z.ZodArray && Array.isArray(value)) {
-            const element = collection.element;
-            const bad = [];
-            const keptFrom = [];
-            // `filter`(不是手写 `for (i < value.length)`):它在**进入时**就钉死了长度,而重读 `value.length`
-            // 会跟着一个在校验期间自我增殖的数组一路跑下去(病态 getter 在 zod 读字段时往同一个数组里再 push
-            // 一条)——抢救是尽力而为的旁路,绝不许把同步读挂死。下标在回调里收,`filter` 本来就给 index。
-            const kept = value.filter((entry, i) => {
-                const verdict = judgeEntry(element, entry, "entry-schema-invalid");
-                if (verdict === undefined) {
-                    keptFrom.push(i); // 压缩后第 keptFrom.length-1 条 = 原文档第 i 条
-                    return true;
-                }
-                bad.push(droppedEntry(outgoingPath([field, i]), verdict, entry));
-                return false;
-            });
-            // 零幸存者 ⇒ 没有要抢救的东西(见头注:绝不凭空造出一个空集合)。
-            if (bad.length > 0 && kept.length > 0) {
-                dropped.push(...bad);
-                patch[field] = kept;
-                keptIndex[field] = keptFrom; // 只在真压缩了的字段上登记(见 {@link EntryKeptIndex})
-            }
-        }
-        else if (collection instanceof z.ZodRecord && isPlainJsonObject(value)) {
-            const keySchema = collection.keyType;
-            const valueSchema = collection.valueType;
-            const bad = [];
-            const kept = {};
-            for (const [key, entry] of Object.entries(value)) {
-                const verdict = judgeEntry(keySchema, key, "entry-key-invalid") ?? judgeEntry(valueSchema, entry, "entry-schema-invalid");
-                if (verdict === undefined)
-                    kept[key] = entry;
-                else
-                    bad.push(droppedEntry(outgoingPath([field, key]), verdict, entry)); // 键是用户写的,可能就是一条粘错位置的凭据
+        const isArray = collection instanceof z.ZodArray;
+        if (!isArray && !(collection instanceof z.ZodRecord))
+            continue; // 不是条目集合:连读都不读(少触发一次访问器)
+        const slots = collectionSlots(raw[field], isArray);
+        if (slots === undefined)
+            continue;
+        const element = (collection instanceof z.ZodArray ? collection.element : collection.valueType);
+        const keySchema = collection instanceof z.ZodRecord ? collection.keyType : undefined;
+        const found = []; // 本字段上账的:本层丢的整条 + 幸存条目体内丢的子条目,按文档序
+        const survivors = []; // 幸存条目(体内抢救过的,是它的抢救形)
+        const innerShifts = [];
+        for (const [address, entry] of slots) {
+            const at = outgoingPath([field, address]); // 键是用户写的,可能就是一条粘错位置的凭据
+            // Record 的键先判:键坏的条目不再算值,也不下钻。
+            const keyVerdict = keySchema === undefined ? undefined : judgeEntry(keySchema, address, "entry-key-invalid");
+            if (keyVerdict !== undefined) {
+                found.push(droppedEntry(at, keyVerdict, entry));
+                continue;
             }
-            if (bad.length > 0 && Object.keys(kept).length > 0) {
-                dropped.push(...bad);
-                patch[field] = kept;
+            const inner = salvageLayer(element, entry); // 先下钻:这一条自己的集合按同一条律抢救
+            const verdict = judgeEntry(element, inner.raw, "entry-schema-invalid");
+            if (verdict !== undefined) {
+                // 整条丢 ⇒ 记账行说的是**原文**:身份取原文,判决也取原文的(拒句里的坐标是运维手里那份文档的 —— 抢救形的数组压缩过,
+                // 条目级判据点到体内下标时会报错位;坐标律 S-323b 在 `error` 这一面同样成立)。体内的半路账作废。体内真丢过东西的条目,原文必判不过
+                // (被丢的子条目本身就过不了它的 schema),`?? verdict` 只为类型。
+                found.push(droppedEntry(at, inner.raw === entry ? verdict : (judgeEntry(element, entry, "entry-schema-invalid") ?? verdict), entry));
+                continue;
             }
+            survivors.push([address, inner.raw]);
+            for (const d of inner.dropped)
+                found.push({ ...d, path: [...at, ...d.path] });
+            for (const s of inner.shifts)
+                innerShifts.push({ at: [...at, ...s.at], kept: s.kept });
         }
+        // 零幸存者 ⇒ 没有要抢救的东西(见头注:绝不凭空造出一个空集合);什么都没上账 ⇒ 这个字段原样不动。
+        if (survivors.length === 0 || found.length === 0)
+            continue;
+        dropped.push(...found);
+        // fromEntries(不是逐键赋值):Record 的键是用户写的,`__proto__` 作键时逐键赋值会走原型 setter(S-332 同一条「键就是键」)。
+        patch[field] = isArray ? survivors.map(([, e]) => e) : Object.fromEntries(survivors);
+        const keptFrom = survivors.map(([i]) => i);
+        if (isArray && (keptFrom.length < slots.length || keptFrom.some((original, j) => original !== j)))
+            shifts.push({ at: outgoingPath([field]), kept: keptFrom });
+        shifts.push(...innerShifts);
     }
     if (dropped.length === 0)
-        return { raw, dropped, keptIndex: NO_ENTRIES_DROPPED };
-    return { raw: { ...raw, ...patch }, dropped, keptIndex };
+        return untouched;
+    return { raw: { ...raw, ...patch }, dropped, shifts };
+}
+/** 段坐标记的位移账 → {@link EntryKeptIndex}(键 = 全路径的出门串)。同一个键出现两次只可能是两只被打码成同一串的 Record 键
+ *  (坐标本身已分不清是谁)⇒ 那个键不登记。什么都没压缩 ⇒ 冻结的共享空表。 */
+function keptIndexOf(shifts) {
+    if (shifts.length === 0)
+        return NO_ENTRIES_DROPPED;
+    const byKey = new Map();
+    for (const s of shifts) {
+        const key = formatConfigPath(s.at);
+        byKey.set(key, byKey.has(key) ? undefined : s.kept);
+    }
+    // fromEntries:键是出门串,含用户写的 Record 键段 —— 不走原型 setter。
+    return Object.fromEntries([...byKey].filter((e) => e[1] !== undefined));
 }
 /**
  * Shared GC predicate for worker-status rows (F10) — keeps memory/sqlite/tidb identical. Given the rows'
@@ -617,30 +661,36 @@ function rebasePaths(keys, keptIndex) {
     return changed ? out : keys;
 }
 /**
- * `[field, N, ...rest]` → `[field, 原 N, ...rest]`。**一条律**(S-323c,3.0.0):`p[0]` 是字符串且在位移表里
- * (= 那个数组字段真被压缩过)∧ `p[1]` 是**数字段** ⇔ 它是一条数组路径。不满足 ⇒ 原样。
+ * 压缩后的坐标 → 原文档坐标。**一条律**(S-323c 3.0.0 立,12.3.0 S-1494 推到每一层):坐标里的每个**数字段** `p[i]`,若它前面那段
+ * 前缀(已回写成原文档坐标、按 {@link formatConfigPath} 出门形)在位移表里 ⇔ 它是那个被压缩过的数组的下标 ⇒ 换成原下标。
+ * 从左往右逐段做:外层先回写,内层的前缀才是原文档坐标,才对得上表里的键(位移表的键都是原文档全路径)—— 两层都压缩过时
+ * 两层各回写一次,只回写最长前缀那一层会把外层的下标留在压缩坐标上。
  *
  * 2.1.0 在点号串上需要三道门(字段在表里 / 段数合它那一支文法 / 下标段是规范十进制),因为串把「这一段
  * 是下标还是键名」这个位丢了,只能靠文法猜回来;段形把那个位带在类型里,三道门收成一道 —— 判它是正确
  * 抽象的第一判据就是**规则数变少**(`PathGrammar`、段数门、规范十进制正则三件随之删除)。
  *
- * 字面含点的顶层键(`["models.1.k"]`)天然不受影响:它只有一段,`p[1]` 缺席。Record 形的条目坐标
- * (`[field, key]`)同样:Record 字段从不进位移表(条目按键寻址,丢一条不动其余键的坐标),而它的第二段
- * 是字符串键、不是下标 —— 两道判据各自都挡得住。
+ * 字面含点的顶层键(`["models.1.k"]`)天然不受影响:它只有一段,没有数字段。Record 形的条目坐标
+ * (`[field, key]`)同样:Record 从不进位移表(条目按键寻址,丢一条不动其余键的坐标),而它的那一段
+ * 是字符串键、不是下标 —— 两道判据各自都挡得住。首段不判(域文档的根是对象,首段恒是字段名)。
  *
  * **恒等纪律**:没有任何一段真的变了(表长外、或原下标与压缩后下标相同)⇒ 返回**原引用**,不复制。
  */
 function rebasePath(p, keptIndex) {
-    const field = p[0];
-    if (typeof field !== "string" || !Object.prototype.hasOwnProperty.call(keptIndex, field))
-        return p;
-    const index = typeof p[1] === "number" ? p[1] : undefined;
-    if (index === undefined)
-        return p;
-    const original = keptIndex[field][index];
-    if (original === undefined || original === index)
-        return p; // 表长外 ⇒ 原样(与 2.1.0「越界原样」同律)
-    return [field, original, ...p.slice(2)];
+    let out;
+    for (let i = 1; i < p.length; i++) {
+        const seg = p[i];
+        if (typeof seg !== "number")
+            continue;
+        const at = formatConfigPath((out ?? p).slice(0, i));
+        if (!Object.prototype.hasOwnProperty.call(keptIndex, at))
+            continue;
+        const original = keptIndex[at][seg];
+        if (original === undefined || original === seg)
+            continue; // 表长外 ⇒ 原样(与 2.1.0「越界原样」同律)
+        (out ??= [...p])[i] = original;
+    }
+    return out ?? p;
 }
 /** 扫描深度上限(嵌套再深的配置文档不存在;有上限才不会被恶意深链拖住)。 */
 const DROP_SCAN_MAX_DEPTH = 8;
@@ -796,23 +846,90 @@ function carriedUnknownKeys(domain, parsed) {
     return acc;
 }
 /**
- * 一域的 parse + **静默剥键/静默承运两条告警**(0.19.0)。`buildEffective` 与 `FileConfigStore.getDomain`
- * 共用这一个判据 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
+ * **文档面**的域读函数:一域的严 parse + **静默剥键/静默承运两条告警**,**永不抢救**。`FileConfigStore.getDomain`(于是 `exportBundle`、
+ * `createSiblingResolver`)与一致性门写入席(`strictWrite` 腿)读它 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
  * (对抗复审 复审 round2 F3:导出一份被剥了键的域再导入 = 持久的配置丢失,而且全程无声)。
+ *
+ * 文档面回答「这份文档本身读不读得进」:读不进就抛(sanitized ZodError),一条条目都不替运维删 —— 写入席、导出、读改写的「现状」读的都是它。
+ * 视图面(「这份文档在生效配置里是什么」)是 {@link parseDomainSalvaged}:同一只内部体({@link readDomainDocument}),读不进时多一步逐条抢救。
  */
 export function parseDomainLoud(domain, raw, onWarning) {
-    const parsed = parseDomain(domain, raw);
+    return readDomainDocument(domain, raw, onWarning, (unreadable) => {
+        throw unreadable;
+    });
+}
+/**
+ * **视图面**的域读函数(12.3.0,S-1494):与 {@link parseDomainLoud} 同一只内部体,整域读不进时按 {@link DOMAIN_ENTRY_SALVAGE} 逐条抢救。
+ * `buildEffective` 十六个域一处调它(`parseOr`);管理面要显示「生效配置里这个域是什么」时读它。
+ *
+ * 读法:
+ *  1. 整域 `parseDomain`;过 ⇒ 未知键两条告警按原文档坐标出门,返回 —— 与 {@link parseDomainLoud} 逐字同值同告警(好配置的路径一字不动)。
+ *  2. 不过,且 {@link DOMAIN_ENTRY_SALVAGE} 判该域 `"salvage"` ⇒ {@link salvageEntries}(递归到嵌套集合);丢了东西 ⇒ 拿压缩后的
+ *     文档再 `parseDomain` 一次。过 ⇒ 每条被丢条目一条 `entry-dropped`(它们本来就是原文档坐标),其余告警是对压缩文档的诊断,
+ *     过本层位移表({@link rebaseWarningPaths})回写成原文档坐标(坐标律 S-323b)。
+ *  3. 其余一切(`"none"` 档、什么都没丢、丢了仍读不进)⇒ **抛第 1 步的原错**,零告警 —— 一个域一个结论:没救活就不留「丢了某条」的半路叙述。
+ *     整域读不进之后是默认化还是抛,是调用方按 {@link DOMAIN_READ_FALLBACK} 的事(`buildEffective` 的 `parseOr`),本函数不读那张表。
+ *
+ * 写路径与导出面不调它:`parseDomain` / `validateDomain` / `writeDomainFile` 判整份文档,写入席与 `getDomain` / `exportBundle` 读 {@link parseDomainLoud}。
+ * 读改写(读存量、改、整份写回)的「现状」也不许读它 —— 抢救读出再写回,被丢的条目就成了删除。
+ */
+export function parseDomainSalvaged(domain, raw, onWarning) {
+    return readDomainDocument(domain, raw, onWarning, (unreadable) => parseSalvaged(domain, raw, unreadable, onWarning));
+}
+/**
+ * 两面共用的**唯一内部体**:严 parse(`parseDomain`)+ 未知键两条告警。整域读不进时交给 `whenUnreadable`(文档面:抛原错;视图面:逐条抢救)——
+ * 两个读函数只差这一个入参。告警在 parse 成功之后、`try` 之外发:`onWarning` 自己抛的错不会被当成「文档读不进」。
+ */
+function readDomainDocument(domain, raw, onWarning, whenUnreadable) {
+    let parsed;
+    try {
+        parsed = parseDomain(domain, raw);
+    }
+    catch (unreadable) {
+        return whenUnreadable(unreadable);
+    }
+    if (onWarning)
+        announceUnknownKeys(domain, raw, parsed, onWarning);
+    return parsed;
+}
+/** {@link parseDomainSalvaged} 的第 2 / 3 步(整域 parse 已经失败):能救就救,救不了就抛 `unreadable`(第 1 步的原错)。
+ *  档位判 `!== "salvage"`(不是 `=== "none"`):一个不是域的名字(JS 调用方 / 写入席收到的任意键)查表得到 `undefined` 或原型链上的东西,
+ *  照样不抢救 —— 只有表里白纸黑字的 `"salvage"` 才开这扇门。 */
+function parseSalvaged(domain, raw, unreadable, onWarning) {
+    if (DOMAIN_ENTRY_SALVAGE[domain] !== "salvage")
+        throw unreadable;
+    const salvage = salvageEntries(DOMAIN_SCHEMAS[domain], raw);
+    if (salvage.dropped.length === 0)
+        throw unreadable;
+    let parsed;
+    try {
+        parsed = parseDomain(domain, salvage.raw);
+    }
+    catch {
+        throw unreadable; // 条目之外还有毛病(重名 / 悬空 ref / 域级判据)—— 丢条目救不了它
+    }
     if (onWarning) {
-        const dropped = droppedKeys(domain, raw, parsed);
-        if (dropped.keys.length > 0)
-            onWarning({ domain, kind: "unknown-keys-dropped", keys: dropped.keys, ...(dropped.total > dropped.keys.length ? { truncatedFrom: dropped.total } : {}) });
-        const carried = carriedUnknownKeys(domain, parsed);
-        if (carried.keys.length > 0)
-            onWarning({ domain, kind: "unknown-keys-carried", keys: carried.keys, ...(carried.total > carried.keys.length ? { truncatedFrom: carried.total } : {}) });
+        // 坐标律(S-323b):一条告警用「铸它的那一层所见文档」的坐标表达;哪一层压缩了文档,哪一层就把从它下方上来的告警回写一次。
+        // `entry-dropped` 是本层(salvage)铸的,用的就是本层入参那份文档的坐标 ⇒ 原样出门;未知键扫描是对本层**压缩后**文档的诊断 ⇒ 过本层的位移表。
+        for (const d of salvage.dropped)
+            onWarning(entryDroppedWarning(domain, d));
+        announceUnknownKeys(domain, salvage.raw, parsed, (w) => onWarning(rebaseWarningPaths(w, salvage.keptIndex)));
     }
     return parsed;
 }
+/** 未知键两条告警(剥掉的 / 承运的)—— `raw` 是这次真被 parse 的那份文档,`emit` 决定坐标出门前要不要回写。 */
+function announceUnknownKeys(domain, raw, parsed, emit) {
+    const dropped = droppedKeys(domain, raw, parsed);
+    if (dropped.keys.length > 0)
+        emit({ domain, kind: "unknown-keys-dropped", keys: dropped.keys, ...(dropped.total > dropped.keys.length ? { truncatedFrom: dropped.total } : {}) });
+    const carried = carriedUnknownKeys(domain, parsed);
+    if (carried.keys.length > 0)
+        emit({ domain, kind: "unknown-keys-carried", keys: carried.keys, ...(carried.total > carried.keys.length ? { truncatedFrom: carried.total } : {}) });
+}
 /** Per-domain READ-corruption policy (0.8.1) — what buildEffective does when a stored domain no longer parses.
+ *  **One question only** (12.3.0, S-1494): the domain as a whole is unreadable — after {@link parseDomainSalvaged} has tried
+ *  whatever entry salvage {@link DOMAIN_ENTRY_SALVAGE} allows — so does the read default it or throw? Whether single bad
+ *  entries may be dropped is the OTHER table's question; neither table reads the other.
  *  `"default"` = degrade to the schema default + warn (safe: the default only REMOVES capability, fail-closed).
  *  `"throw"` = keep fail-loud (defaulting would LOOSEN gates or destructively apply — worse than an outage,
  *  consumers fail-static on last-good). A `satisfies Record<DomainName,…>` forces every FUTURE domain to make
@@ -861,6 +978,55 @@ export const DOMAIN_READ_FALLBACK = {
     // 消费方 fail-static 在上一份好配置严格更好。
     limits: "throw",
 };
+/** Per-domain ENTRY-SALVAGE policy (12.3.0, S-1494) — may the view-face domain reader ({@link parseDomainSalvaged}) drop single bad
+ *  entries (an array element, a Record value, and — recursively — a bad entry inside a surviving entry) and read the rest?
+ *  **One question only**: what happens when the domain stays unreadable after that is {@link DOMAIN_READ_FALLBACK}'s question.
+ *  `"salvage"` = drop each bad entry, name it (`entry-dropped`, coordinate + identity + reason word), keep the rest.
+ *  `"none"` = never drop a single entry: the first bad entry makes the whole domain unreadable.
+ *  A `satisfies Record<DomainName,…>` forces every FUTURE domain to answer this explicitly (compile error until classified).
+ *
+ *  **View face only.** The document face never salvages: `parseDomain` / `validateDomain` / `writeDomainFile` judge the whole
+ *  document, and {@link parseDomainLoud} — what the conformance write seat (`strictWrite` leg), `FileConfigStore.getDomain` and
+ *  `exportBundle` read — throws on it. A write path that reads the stored "current" value through `parseDomainSalvaged` and writes
+ *  it back would turn every dropped entry into a deletion — read-modify-write faces read the stored document with the document face.
+ *
+ *  Per-domain rationale:
+ *    - models/skills/mcp/plugins/scenarios/systems/collab/prompts: additive capability / content catalogs — a dropped entry is
+ *      one capability gone (fail-closed). Inside a surviving entry the same holds: the nested collections these entries carry
+ *      are allowlists / scopings (`allowTools`, `scenarios`, `rosters`, `callsWorkers`, …) where one entry fewer only NARROWS,
+ *      and the zero-survivor law (never mint an empty collection — several of these read "empty = all") holds at every level.
+ *    - hosts: a dropped host is one placement target fewer; a dropped label makes a host match fewer `placement.requires`.
+ *    - projects: SALVAGE — a registration absent from the ledger = that project's claim is refused (fail-closed). Throwing the
+ *      whole domain stops EVERY project of the scope, which protects nothing: one stored registration that a later, tighter
+ *      schema refuses (12.2.1's UNC judgement on `contextItems[].value`) must not take the scope's other projects with it.
+ *      Its whenUnreadable stance stays `"throw"` (a ledger that cannot be read at all is never defaulted — see
+ *      {@link DOMAIN_READ_FALLBACK}).
+ *    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
+ *      (放权,不许).
+ *    - workers: NONE — a dropped worker row reads as "this worker is no longer declared": the reconciler would retire it. The
+ *      per-row tolerance this domain does have lives in `readWorkersRows` (rows are HELD with their original, never dropped).
+ *    - governance: NONE — a dropped commandPolicy / approvalRequire row is a guardrail silently gone (放权,不许).
+ *    - entitlement: NONE — a dropped tier / subject / binding / budget group changes who may do what (放权,不许).
+ *    - execution: NONE — a dropped lane / public key changes the execution mandate (放权,不许).
+ *    - limits: NONE — a dropped allowlist row changes a published ceiling (the domain is the one publishing seat of those ceilings). */
+export const DOMAIN_ENTRY_SALVAGE = {
+    models: "salvage",
+    rosters: "none",
+    skills: "salvage",
+    mcp: "salvage",
+    plugins: "salvage",
+    scenarios: "salvage",
+    systems: "salvage",
+    collab: "salvage",
+    workers: "none",
+    hosts: "salvage",
+    governance: "none",
+    entitlement: "none",
+    execution: "none",
+    projects: "salvage",
+    prompts: "salvage",
+    limits: "none",
+};
 /**
  * Merge every domain into the effective config a consumer pulls. Shared by all store impls.
  * `updatedAt` is REQUIRED (the determinism refactor — the original store.ts defaulted it to the wall clock,
@@ -873,41 +1039,17 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
     // 墓碑先判:一份没迁的retired 域文档意味着这个 scope 的存量还没过一次性迁移 —— 拿剩下的域拼一份 effective 等于静默丢掉它的事实。
     for (const retired of Object.keys(RETIRED_DOMAINS))
         refuseRetiredDomain(retired, getRaw(retired));
-    // 0.19.0 静默剥键/静默承运门:解析**成功**的域,把 schema 丢掉的键、以及 open-world 域里承运但本包
-    // 不认识的键(都含嵌套,段坐标)点名(行为不变,只是不再无声)。判据与 `getDomain` 同源
-    // ({@link parseDomainLoud})。只在成功路径上报——降级路径已经有 domain-defaulted 那条更重的警告。
-    const parseLoud = (domain, raw) => parseDomainLoud(domain, raw, onWarning);
-    // Generic READ guardrail (0.8.1): a domain that no longer parses degrades to its schema default + a warning
-    // — but ONLY where DOMAIN_READ_FALLBACK says the default is safe; gate-bearing domains keep throwing (决策
-    // 表与逐域理由见 DOMAIN_READ_FALLBACK). The success path is UNCHANGED (same parseDomain, same bytes).
+    // 每个域同一只读法(12.3.0,S-1494):视图面读函数 {@link parseDomainSalvaged}(整域 parse → 按 DOMAIN_ENTRY_SALVAGE 逐条抢救 → 未知键告警;
+    // 与文档面 `parseDomainLoud` 共用同一只内部体)读不进 ⇒ 只剩**整域读不进**这一个问题,答案只看 DOMAIN_READ_FALLBACK(决策表与逐域理由见那张表):
+    // `"throw"` ⇒ 原错抛出;`"default"` ⇒ schema 默认 + `domain-defaulted`。哪个域走哪一档不再写在下面的行上(此前 gate 域的行
+    // 调 parseLoud、其余调 parseOr —— 同一张表的第二份手抄),行只说「读这个域」。好配置的路径一字不动(同一次 parseDomain,同一份字节)。
     const parseOr = (domain, raw) => {
         try {
-            return parseDomainLoud(domain, raw, onWarning);
+            return parseDomainSalvaged(domain, raw, onWarning);
         }
         catch (e) {
             if (DOMAIN_READ_FALLBACK[domain] === "throw")
                 throw e;
-            // 逐条容错(2.0.0)在整域降级**之前**试一次:只丢掉真正坏掉的那几条条目,同域好兄弟活下来。
-            // 告警先缓存再决定 —— 一个域只给一个结论:救活了就逐条报 `entry-dropped`,没救活就只报
-            // `domain-defaulted`(那一域的条目反正一条都不剩,再讲「丢了第 3 条」只会误导)。
-            const salvage = salvageEntries(DOMAIN_SCHEMAS[domain], raw);
-            if (salvage.dropped.length > 0) {
-                try {
-                    const buffered = [];
-                    const parsed = parseDomainLoud(domain, salvage.raw, (w) => buffered.push(w));
-                    // 坐标律(S-323b):一条告警用「铸它的那一层所见文档」的坐标表达;哪一层压缩了文档,哪一层就把从它下方上来的告警回写一次。
-                    // `entry-dropped` 是本层(salvage)铸的,用的就是本层入参那份文档的坐标 ⇒ 原样出门;`buffered` 里的是对本层**压缩后**
-                    // 文档的诊断 ⇒ 先过本层的位移表。读路径上只有这一个压缩点(11.0.0 起 hosts 的读侧夹紧臂已retired)。
-                    for (const d of salvage.dropped)
-                        onWarning?.(entryDroppedWarning(domain, d));
-                    for (const w of buffered)
-                        onWarning?.(rebaseWarningPaths(w, salvage.keptIndex));
-                    return parsed;
-                }
-                catch {
-                    // 条目之外还有毛病(重名 / 悬空 ref / 域级判据)—— 丢条目救不了它,照常整域降级。
-                }
-            }
             onWarning?.({ domain, kind: "domain-defaulted", error: e });
             return parseDomain(domain, undefined); // schema default — always valid
         }
@@ -916,30 +1058,26 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
         version,
         updatedAt,
         models: parseOr("models", getRaw("models")),
-        rosters: parseLoud("rosters", getRaw("rosters")),
+        rosters: parseOr("rosters", getRaw("rosters")),
         skills: parseOr("skills", getRaw("skills")),
         mcp: parseOr("mcp", getRaw("mcp")),
         plugins: parseOr("plugins", getRaw("plugins")),
         scenarios: parseOr("scenarios", getRaw("scenarios")),
         systems: parseOr("systems", getRaw("systems")),
         collab: parseOr("collab", getRaw("collab")),
-        workers: parseLoud("workers", getRaw("workers")),
+        workers: parseOr("workers", getRaw("workers")),
         hosts: parseOr("hosts", getRaw("hosts")),
         // governance TRUTH = the domain itself (11.0.0: the read-side lift from a 0.5-era runtime document is gone — the
         // runtime tombstone above refuses such a document, and the one-time migration SS-M1 moves its trio here).
-        governance: parseLoud("governance", getRaw("governance")),
-        entitlement: parseLoud("entitlement", getRaw("entitlement")),
+        governance: parseOr("governance", getRaw("governance")),
+        entitlement: parseOr("entitlement", getRaw("entitlement")),
         // execution (0.8.0, S3): plain scope-level parse — MIRRORS governance (no overlay/merge invented here).
-        execution: parseLoud("execution", getRaw("execution")),
-        // projects (0.10.0, 142-S3): THROW policy → parseLoud(≡ parseDomain + 剥键告警), never parseOr
-        // (defaulting would evaporate the identity ledger AND expose the claim read-modify-write face to
-        // clobbering stored registrations).
-        projects: parseLoud("projects", getRaw("projects")),
-        // prompts (0.10.18, [1064]②): content domain → parseOr(坏形回空默认=「无 prompts 管理」语义;
-        // fail-closed 由 PUBLISH_MODE 发布闸承担,空 bindings 不下发内容,default 不扩权)。
+        execution: parseOr("execution", getRaw("execution")),
+        projects: parseOr("projects", getRaw("projects")),
+        // prompts (0.10.18, [1064]②): content domain(坏形回空默认=「无 prompts 管理」语义;fail-closed 由 PUBLISH_MODE 发布闸承担,
+        // 空 bindings 不下发内容,default 不扩权)。
         prompts: parseOr("prompts", getRaw("prompts")),
-        // limits (0.19.0, 消费方 #322 批1): THROW 档 → parseLoud(坏形绝不静默降级成「没有天花板」)。
-        limits: parseLoud("limits", getRaw("limits")),
+        limits: parseOr("limits", getRaw("limits")),
     };
 }
 /** READ-side tolerant judgment for a GET /effective **wire payload**(the {@link EffectiveWire} contract)at