@sema-agent/settings-schema 7.0.0 → 8.0.0

package/conformance/cases/cli05-long-and-prefix-colliding-names/expected.json

@@ -99,6 +99,59 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-id",
+            "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          },
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "prefix-shared-name-aaaa-id",
+            "name": "prefix-shared-name-aaaa",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          },
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "prefix-shared-name-aaab-id",
+            "name": "prefix-shared-name-aaab",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:300 字节的模型名与一组同前缀名,读腿不截断不去重;严写同样逐字收下,受理形等于读腿 models 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/t01-absent-domain-key-not-null/expected.json

@@ -83,6 +83,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:文档集里有不是域名的键 `web-admin-ui` —— 写入席没有这个域可受理(models / hosts 两份本身是好的,但写是一个动作,一份不受理就整次不受理)。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/t02-entry-salvage-vs-whole-domain-refusal/expected.json

@@ -3,6 +3,11 @@
     "outcome": "rejected",
     "stage": "validate"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:同一份坏条目在 models(读腿逐条丢)与 rosters(gate 域,读腿整域拒)两处;读腿已整域拒,严写同样不受理 —— 两处任一都够拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/t03-prototype-name-key-not-swallowed/expected.json

@@ -97,6 +97,35 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "m0-id",
+            "name": "m0",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:`__proto__` / `constructor` / `toString` 作条目内的未知键被 schema 剥掉(读腿报 unknown-keys-dropped);严写同样剥,受理形等于读腿 models 那一格,原型不被污染。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/t04-secret-literal-never-in-warning-value/expected.json

@@ -99,6 +99,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models 第 2 条的 api 是一把密钥字面(不在闭集里),读腿逐条丢(entry-dropped)并剥未知键;严写 ⇒ 整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/z01-every-domain-empty-object/expected.json

@@ -62,6 +62,70 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:十七个域各一份空对象,读腿零告警;严写逐份受理,受理形 = 十七个域的 schema 默认(只含提交的键 —— 这里恰好十七个都在)。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/z02-every-domain-unknown-key/expected.json

@@ -218,6 +218,72 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {
+        "zzzUnknown": 1
+      },
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:十七个域各带一个未知键 —— 十六个被 schema 剥掉(读腿报 unknown-keys-dropped)、limits 承运(unknown-keys-carried);严写同样剥 / 承运、不铸告警,受理形等于读腿十七格。"
+  },
   "wire": {
     "derive": true
   },

package/dist/cli.js

@@ -6,17 +6,91 @@
  * 不进主桶 —— 它是 bin 的实现,不是契约面。
  *
  * 退出码:0 = 已写回 / 无事可做;1 = 有 worker 迁不了(refused)或迁出的文档整域读不进 7.0.0,**一字不写**;2 = 用法 / 读文件 /
- * JSON 错;3 = `--check` 且会有改动(不写)。stdout 恒打一行 JSON 报告(`event: "workers_domain_migrated"`,只点名字段、不带值)。
+ * JSON 错(此时 stdout 为空);3 = `--check` 且会有改动(不写)。**8.0.0**:`--check` 与真跑过同一只判定({@link verdictOf}),
+ * 只在「有改动、且整域判得过」那一支上分开(pending vs applied)—— 整域会被拒的文档 `--check` 也报 refused / rc 1。
+ *
+ * ## 报告形(7.0.1:让「没写」在机读上不可能被读成「写了」)
+ * 退出码 0 / 1 / 3 时 stdout 恰两行:
+ *  · 第 1 行 = **唯一结论行** `outcome=<refused|applied|noop|pending> written=<true|false>`;
+ *  · 第 2 行 = JSON 报告(`event: "workers_domain_migrated"`,只点名字段、不带值),同带 `outcome` / `written`。
+ * `written` 不是独立字段:由 `outcome` 派生({@link writtenOf};只有 `applied` 写盘)。**键名带时态**:`written=true` 才有 `changed` /
+ * `dropped`;`written=false`(refused / noop / pending)时是 `wouldChange` / `wouldDrop` —— 读旧字段 `changed` 的脚本在没写的时候
+ * 读不到值,而不是读到一份「已迁」名单。结论行在**写盘成功之后**才出(写盘抛错 ⇒ 没有 `outcome=applied`)。
  */
 import { formatConfigPath, sanitizeZodError } from "./config-fns.js";
+import { MIGRATE_WORKERS_COMMAND } from "./execution-lane-index.js";
 import { migrateWorkersDomain } from "./migrate-workers.js";
 import { DOMAIN_SCHEMAS } from "./types.js";
 const USAGE = [
-    "usage: settings-schema migrate-workers <workers.json> [--check]",
+    `usage: ${MIGRATE_WORKERS_COMMAND} <workers.json> [--check]`,
     "  One-time 7.0.0 migration of a workers domain document ({ \"workers\": [...] }): env.REMOTE_EXEC + lane keys →",
     "  runtime.execution, sessionBackend / coords.tidb* / runtime.db / tidbPasswordEnv → runtime.store. Writes the file in",
     "  place only when every worker migrates; --check only reports (exit 3 if the file would change).",
+    "  stdout (exit 0 / 1 / 3): line 1 = outcome=<refused|applied|noop|pending> written=<true|false>, line 2 = the JSON report",
+    "  (changed / dropped only when written=true; otherwise wouldChange / wouldDrop).",
 ].join("\n");
+/** 这个结论写没写盘 —— 只有 `applied` 写。`written` 从这里派生,不是报告里一个可以和 `outcome` 各说各话的独立字段。 */
+function writtenOf(outcome) {
+    switch (outcome) {
+        case "applied":
+            return true;
+        case "refused":
+        case "noop":
+        case "pending":
+            return false;
+        default: {
+            const unhandled = outcome;
+            throw new Error(`settings-schema: unhandled outcome ${String(unhandled)}`);
+        }
+    }
+}
+/**
+ * 迁移结果 → 结论。顺序:逐只 refused → 无改动 ⇒ noop → **整域终判**(迁出来的文档读不读得进 7.0.0:名字 / 路由唯一 …)→ 有改动。
+ * 7.0.1 把整域终判放在 `--check` 之后:同一份文档 `--check` 报 pending(rc 3)、真跑报 refused(rc 1),按 `--check` 做闸的脚本会放行
+ * 一次必被拒的真跑;而整域终判拒时 `refused[]` 为空、拒因只在 stderr。现在两种跑法过同一只判定,`refused[]` 逐条带出被拒项。
+ */
+function verdictOf(m) {
+    if (m.refused.length > 0) {
+        return {
+            kind: "refused",
+            refused: m.refused.map((r) => ({ name: r.name, field: r.field, reason: r.reason })),
+            why: `${m.refused.length} worker(s) cannot be migrated (see "refused") — fix them by hand and re-run`,
+        };
+    }
+    if (m.changed.length === 0)
+        return { kind: "noop" };
+    const whole = DOMAIN_SCHEMAS.workers.safeParse(m.doc);
+    if (whole.success)
+        return { kind: "changes" };
+    const issues = sanitizeZodError(whole.error).issues;
+    const workers = isRecord(m.doc) && Array.isArray(m.doc.workers) ? m.doc.workers : [];
+    return {
+        kind: "refused",
+        refused: issues.map((i) => {
+            const [head, index, ...rest] = i.path;
+            if (head !== "workers" || typeof index !== "number")
+                return { name: null, field: i.path, reason: i.message };
+            const entry = workers[index];
+            return { name: isRecord(entry) && typeof entry.name === "string" ? entry.name : null, field: rest, reason: i.message };
+        }),
+        why: `the migrated document does not read as a 7.0.0 workers domain — ${issues.map((i) => `${formatConfigPath(i.path)}: ${i.message}`).join("; ")}`,
+    };
+}
+const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+/** 一次发出报告:结论行 + JSON 行(一次 `stdout` 调用)。键名带时态:写了 ⇒ `changed` / `dropped`,没写 ⇒ `wouldChange` / `wouldDrop`。 */
+function reportOf(outcome, file, m, refused) {
+    const written = writtenOf(outcome);
+    const dropped = m.dropped.map((d) => ({ name: d.name, field: formatConfigPath(d.field) }));
+    const json = JSON.stringify({
+        event: "workers_domain_migrated",
+        outcome,
+        written,
+        file,
+        ...(written ? { changed: m.changed, dropped } : { wouldChange: m.changed, wouldDrop: dropped }),
+        refused: refused.map((r) => ({ name: r.name, field: formatConfigPath(r.field), reason: r.reason })),
+    });
+    return `outcome=${outcome} written=${written}\n${json}\n`;
+}
 export async function runSettingsSchemaCli(argv, io) {
     const [command, ...rest] = argv;
     const check = rest.includes("--check");
@@ -43,28 +117,26 @@ export async function runSettingsSchemaCli(argv, io) {
         return 2;
     }
     const m = migrateWorkersDomain(doc);
-    io.stdout(`${JSON.stringify({
-        event: "workers_domain_migrated",
-        file,
-        changed: m.changed,
-        dropped: m.dropped.map((d) => ({ name: d.name, field: formatConfigPath(d.field) })),
-        refused: m.refused.map((r) => ({ name: r.name, field: formatConfigPath(r.field), reason: r.reason })),
-    })}\n`);
-    if (m.refused.length > 0) {
-        io.stderr(`settings-schema: ${m.refused.length} worker(s) cannot be migrated (see "refused") — fix them by hand and re-run; nothing was written\n`);
-        return 1;
-    }
-    if (m.changed.length === 0)
-        return 0;
-    if (check)
-        return 3;
-    // 整域再判一次(域层规则:名字 / 路由唯一 …)—— 读不进 7.0.0 的文档不落盘。
-    const whole = DOMAIN_SCHEMAS.workers.safeParse(m.doc);
-    if (!whole.success) {
-        const issues = sanitizeZodError(whole.error).issues.map((i) => `${formatConfigPath(i.path)}: ${i.message}`);
-        io.stderr(`settings-schema: the migrated document does not read as a 7.0.0 workers domain — ${issues.join("; ")}; nothing was written\n`);
-        return 1;
+    const verdict = verdictOf(m);
+    switch (verdict.kind) {
+        case "refused":
+            io.stdout(reportOf("refused", file, m, verdict.refused));
+            io.stderr(`settings-schema: ${verdict.why}; nothing was written\n`);
+            return 1;
+        case "noop":
+            io.stdout(reportOf("noop", file, m, []));
+            return 0;
+        case "changes":
+            if (check) {
+                io.stdout(reportOf("pending", file, m, []));
+                return 3;
+            }
+            await io.writeFileAtomic(file, `${JSON.stringify(m.doc, null, 2)}\n`);
+            io.stdout(reportOf("applied", file, m, [])); // 写盘成功之后才报 applied
+            return 0;
+        default: {
+            const unhandled = verdict;
+            throw new Error(`settings-schema: unhandled verdict ${JSON.stringify(unhandled)}`);
+        }
     }
-    await io.writeFileAtomic(file, `${JSON.stringify(m.doc, null, 2)}\n`);
-    return 0;
 }

package/dist/config-fns.js

@@ -18,7 +18,7 @@
 import { z } from "zod";
 import { MODEL_ENTRY_REFUSAL_CODES, ModelRefusalsWire } from "./fleet.js";
 import { carriesUserinfo, secretScanForms } from "./secret-scan.js"; // package-private display-side normalization + the userinfo judgement (not in the barrel)
-import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX, InfraCostRates, LimitsConfig, PRIVATE_KEY_PEM_HEADER, SkillsManifestSchema, containsSecretToken } from "./types.js";
+import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX, InfraCostRates, LimitsConfig, PRIVATE_KEY_PEM_HEADER, SkillsManifestSchema, containsSecretToken, isDomainName } from "./types.js";
 /** Redact secret-shaped tokens from a validation MESSAGE — a zod error echoes the offending value (e.g.
  *  `received 'sk-live-…'`), so a secret pasted into the WRONG field would leak via the error string. Redacts
  *  space-spanning auth credentials (`Bearer <token>`) FIRST (the token pass can't see across the space), then
@@ -134,6 +134,12 @@ export function emptyEffective() {
 }
 /** Validate + fill defaults for a domain payload (or the schema's empty default when absent/invalid). */
 export function parseDomain(domain, raw) {
+    // A name that is not a domain is refused for what it is — before, `DOMAIN_SCHEMAS[name]` was undefined and the
+    // TypeError surfaced through the guard below as "a value could not be read", which names the wrong failure. The
+    // strict-write face hands this function every key of a submitted document set, so the name is user text: it leaves
+    // through the same outgoing redaction as a warning coordinate segment.
+    if (!isDomainName(domain))
+        throw new Error(`"${outgoingSegment(String(domain))}" is not a config domain`);
     // ONLY true absence (undefined) defaults; an explicit `null` (e.g. a `config.d/<d>.json` containing JSON
     // `null`) is corrupt input → let zod reject it ("expected object, received null"), not silently default. R4.
     let r;

package/dist/conformance/contract-adapter.d.ts

@@ -1,7 +1,9 @@
 import type { ConformanceAdapter, ConformanceProvenance, LegEntry, LegName } from "./types.js";
-/** 一份契约模块(新旧版同形 —— 三条腿的签名自 0.19.0 起没动过)。 */
+/** 一份契约模块(新旧版同形 —— 四条腿的签名自 0.19.0 起没动过)。 */
 export interface ContractModule {
     buildEffective(version: number, getRaw: (d: string) => unknown, updatedAt: string, onWarning?: (w: unknown) => void): unknown;
+    /** 严写受理的生产入口:一个域名 + 一份原始文档 → 受理后的域文档,不受理就抛。 */
+    parseDomain(domain: string, raw: unknown): unknown;
     readEffectiveWire(raw: unknown, onWarning?: (w: unknown) => void): unknown;
     loadLocalConfig(root: string, opts?: {
         onWarning?: (w: unknown) => void;
@@ -14,7 +16,7 @@ export interface ContractAdapterOptions {
     name: string;
     provenance: ConformanceProvenance;
     mod: ContractModule;
-    /** 三条腿各自的生产入口坐标(绝对路径)。 */
+    /** 四条腿各自的生产入口坐标(绝对路径)。 */
     entries: Record<LegName, LegEntry>;
 }
 export declare function createContractAdapter(opts: ContractAdapterOptions): ConformanceAdapter;

package/dist/conformance/contract-adapter.js

@@ -1,10 +1,14 @@
 /**
- * 契约仓自己的三腿适配器 —— 也是 `historical` 模式拿旧版包跑时用的同一只工厂。
+ * 契约仓自己的四腿适配器 —— 也是 `historical` 模式拿旧版包跑时用的同一只工厂。
  *
  * **它不是给消费方抄的**:消费方登记的腿必须是**自己生产代码**的入口(来源律,§2d-2);把契约包的函数
- * 注册成腿,门证明的就只是「包等于包」。本工厂存在的理由只有两个:①契约仓自证三腿同源(对契约仓而言
- * `buildEffective` / `readEffectiveWire` / `loadLocalConfig` **就是**它的生产入口);②historical 模式要对
- * 一份旧版 dist 跑同样的三腿。
+ * 注册成腿,门证明的就只是「包等于包」。本工厂存在的理由只有两个:①契约仓自证四腿(对契约仓而言
+ * `buildEffective` / `parseDomain` / `readEffectiveWire` / `loadLocalConfig` **就是**它的生产入口);②historical 模式要对
+ * 一份旧版 dist 跑同样的四腿。
+ *
+ * `strictWrite`(严写受理)= 文档集里**每一个**键各自过 `parseDomain`(写入席收下的那份);任何一份不受理 ⇒ 整次
+ * `rejected{stage:"validate"}`(写是一个动作,不是逐份抢救);全部受理 ⇒ `effective` = 键 → 受理后的域文档(只含入参里的
+ * 键,不补缺席域)。`parseDomain` 不铸告警,所以这条腿的告警面恒空。
  *
  * 4.0.0 起这句自陈**有牙**:入口落在契约包自己身上 ⇒ 造适配器那一刻就**拒**(抛,不是告警 —— 一条告警
  * 在 CI 日志里活不过第二天,而这道门一旦被同义反复接进去,它报的全绿是**假绿**)。判别式单铸在
@@ -13,7 +17,7 @@
  *
  * 拒绝分层的判据(一条,不是一串特例):**ZodError 形的错 = `validate`**(某个域没通过它的 schema);
  * 其余按腿各自的默认层 —— wire 腿是 `envelope`(它在解析任何域之前先判信封),local-root 腿是 `parse`
- * (文件层先判:空文件 / 非 JSON / 非对象),domains 腿本来就只有校验这一层。
+ * (文件层先判:空文件 / 非 JSON / 非对象),domains 与 strictWrite 两腿本来就只有校验这一层。
  */
 import { materializeLocalRoot } from "./run.js";
 import { contractOwnedEntry, contractOwnedEntryWhy } from "./entry-origin.js";
@@ -29,7 +33,7 @@ const reject = (e, fallback) => {
     return { outcome: "rejected", stage, diagnostics };
 };
 /**
- * 入口的**运行期拒**(fail-closed):三条腿的入口一条都不许落在**这份正在跑的**契约包自己的构建产物里,
+ * 入口的**运行期拒**(fail-closed):四条腿的入口一条都不许落在**这份正在跑的**契约包自己的构建产物里,
  * 缺席也不行。判别式与拒绝句来自 `./entry-origin.js`,这里只负责「拒」这个动作 —— 以及**按形分派**:
  * 工厂看不见 `mode`,所以它只拒在任何模式下都错的那一形(`own-build-output` = 拿自己比自己);
  * `another-installed-copy` 在 `historical` 模式下是正当的(那个模式就是拿旧版包比行为,而旧版包常常正好
@@ -40,7 +44,7 @@ function refuseContractOwnedEntries(entries) {
     for (const leg of LEG_NAMES) {
         const entry = entries[leg];
         if (entry === undefined || typeof entry.module !== "string" || entry.module.length === 0) {
-            throw new Error(`conformance: leg \`${leg}\` 缺 entry.module —— 三条腿各自的**生产入口**坐标是必填的(来源律 §2d-2)`);
+            throw new Error(`conformance: leg \`${leg}\` 缺 entry.module —— 每条腿各自的**生产入口**坐标是必填的(来源律 §2d-2)`);
         }
         const owned = contractOwnedEntry(entry.module);
         if (owned === undefined)
@@ -72,6 +76,15 @@ export function createContractAdapter(opts) {
                 catch (e) {
                     return reject(e, "validate");
                 }
+            case "strictWrite":
+                try {
+                    // fromEntries(不是逐键赋值):文档集的键是用户写的,`__proto__` 作键时逐键赋值会走原型 setter。
+                    const accepted = Object.fromEntries(Object.entries(input.docs).map(([d, raw]) => [d, mod.parseDomain(d, raw)]));
+                    return { outcome: "effective", effective: accepted, warnings: [], version: input.version, updatedAt: input.updatedAt };
+                }
+                catch (e) {
+                    return reject(e, "validate");
+                }
             case "wire":
                 try {
                     const effective = mod.readEffectiveWire(input.payload, onWarning);
@@ -104,6 +117,7 @@ export function createContractAdapter(opts) {
         provenance: opts.provenance,
         legs: {
             domains: { entry: opts.entries.domains, run },
+            strictWrite: { entry: opts.entries.strictWrite, run },
             wire: { entry: opts.entries.wire, run },
             localRoot: { entry: opts.entries.localRoot, run },
         },

package/dist/conformance/corpus.js

@@ -6,8 +6,9 @@
  *   · `input.json`    —— **真源是 `domains`**(各域原始文档);`wire` / `local-root` 两腿的入参由
  *                        `derive.ts` 的变换表派生。个别腿的入参派生不出来(坏 wire 信封、空文件)时,
  *                        用 `wirePayload` / `localFiles` 显式给。
- *   · `expected.json` —— `domains` 腿的期望是**显式 golden**;另两腿默认写 `{"derive":true}`,由变换表
- *                        派生;派生解释不了的腿写显式期望并带 `why`(那是明示声明,不是暗门)。
+ *   · `expected.json` —— 每条腿一格(四条腿一条不少)。`domains` 与 `strictWrite` 两腿的期望恒是**显式 golden**
+ *                        (能不能派生只看 `derive.ts` 的 `LEG_EXPECTATION`);`wire` / `local-root` 默认写 `{"derive":true}`,
+ *                        由变换表派生;派生解释不了的腿写显式期望并带 `why`(那是明示声明,不是暗门)。
  *   · `meta.json`     —— `contributor`(**只写真交了的仓**)、`claim`(这条想打谁、为什么会读错)、
  *                        `secrets`(语料里埋的秘密字面,告警面零命中门用)、`firstRedOn`(**由 historical
  *                        模式对旧版真跑填**,不许手写)。
@@ -17,7 +18,8 @@
 import { readFile, readdir } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { REJECT_STAGES } from "./types.js";
+import { LEG_NAMES, REJECT_STAGES } from "./types.js";
+import { LEG_EXPECTATION } from "./derive.js";
 /** 本包的根目录 —— `src/conformance/*.ts` 与 `dist/conformance/*.js` 距根同深,两处求值同一个地方。 */
 export const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
 /** 语料目录(默认 = 本包的 `conformance/`)。 */
@@ -72,13 +74,16 @@ export async function loadCase(dir, id) {
     if (!Array.isArray(meta.firstRedOn))
         throw new Error(`conformance corpus: ${id}/meta.json#firstRedOn must be an array`);
     const legs = {};
-    for (const leg of ["domains", "wire", "localRoot"]) {
+    for (const leg of LEG_NAMES) {
         if (expected[leg] === undefined)
             throw new Error(`conformance corpus: ${id}/expected.json has no \`${leg}\` — 每腿都要表态(派生 / 显式 / 不适用)`);
-        legs[leg] = checkLegExpectation(expected[leg], `${id}/expected.json#${leg}`);
+        const spec = checkLegExpectation(expected[leg], `${id}/expected.json#${leg}`);
+        // 能不能派生只看一张表(derive.ts 的 LEG_EXPECTATION),不按腿名特判。
+        if ("derive" in spec && LEG_EXPECTATION[leg].source === "explicit") {
+            throw new Error(`conformance corpus: ${id}/expected.json#${leg} cannot be derived — ${LEG_EXPECTATION[leg].why}`);
+        }
+        legs[leg] = spec;
     }
-    if ("derive" in legs.domains)
-        throw new Error(`conformance corpus: ${id}/expected.json#domains cannot be derived — domains 腿是真源`);
     return { id, dir, input: input, meta: meta, expected: legs };
 }
 /** 整套语料。 */

package/dist/conformance/derive.d.ts

@@ -9,6 +9,32 @@ export interface DerivationTransform {
 }
 /** 变换表(本文件头注的机器形;`docs/CONFORMANCE.md` 与 `test/conformance-coverage.test.ts` 都读它)。 */
 export declare const DERIVATION_TRANSFORMS: readonly DerivationTransform[];
+/**
+ * 每条腿的期望从哪来 —— 闭集表态(`Record<LegName, …>`:新开一条腿不在这里表态 ⇒ 编译红)。
+ *
+ *  · `derivable`:语料可以写 `{"derive":true}`,由上面的变换表从 `domains` 期望派生(也可写显式期望并带 `why`)。
+ *  · `explicit`:只收显式金样(`{"derive":true}` 加载即拒)。
+ *
+ * 语料加载器与驱动都读这张表(一条规则),不再各自特判某个腿名。
+ */
+export declare const LEG_EXPECTATION: {
+    readonly domains: {
+        readonly source: "explicit";
+        readonly why: "真源:domains 腿的期望就是金样本身";
+    };
+    readonly strictWrite: {
+        readonly source: "explicit";
+        readonly why: "入参与 domains 恒等,期望不派生:严写结局不是读结局的表示变换(读腿抢救处严写拒);从 domains 期望派生会让一份金样的错同时改写两条腿";
+    };
+    readonly wire: {
+        readonly source: "derivable";
+        readonly why: "T1 / T2 / T4";
+    };
+    readonly localRoot: {
+        readonly source: "derivable";
+        readonly why: "T3 / T4 / T5 / T6";
+    };
+};
 /** 非便携域 —— 由 {@link PORTABLE_DOMAINS} 派生,零手抄。 */
 export declare const NON_PORTABLE_DOMAINS: readonly DomainName[];
 /** 一份 `domains` 文档集里,**不是域名**的那些顶层键(T4 的触发面)。 */