@sema-agent/settings-schema 7.0.1 → 8.0.0

package/conformance/cases/cli05-long-and-prefix-colliding-names/expected.json

@@ -99,6 +99,59 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-id",
+            "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          },
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "prefix-shared-name-aaaa-id",
+            "name": "prefix-shared-name-aaaa",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          },
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "prefix-shared-name-aaab-id",
+            "name": "prefix-shared-name-aaab",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:300 字节的模型名与一组同前缀名,读腿不截断不去重;严写同样逐字收下,受理形等于读腿 models 那一格。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/t01-absent-domain-key-not-null/expected.json

@@ -83,6 +83,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:文档集里有不是域名的键 `web-admin-ui` —— 写入席没有这个域可受理(models / hosts 两份本身是好的,但写是一个动作,一份不受理就整次不受理)。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/t02-entry-salvage-vs-whole-domain-refusal/expected.json

@@ -3,6 +3,11 @@
     "outcome": "rejected",
     "stage": "validate"
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:同一份坏条目在 models(读腿逐条丢)与 rosters(gate 域,读腿整域拒)两处;读腿已整域拒,严写同样不受理 —— 两处任一都够拒。"
+  },
   "wire": {
     "outcome": "rejected",
     "stage": "validate",

package/conformance/cases/t03-prototype-name-key-not-swallowed/expected.json

@@ -97,6 +97,35 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "models": {
+        "models": [
+          {
+            "api": "openai-completions",
+            "apiKeyEnv": "OPENAI_API_KEY",
+            "enabled": true,
+            "id": "m0-id",
+            "name": "m0",
+            "provider": "openai",
+            "quotaWeight": 1,
+            "reasoning": false,
+            "tier": "standard",
+            "vision": false
+          }
+        ],
+        "roles": {},
+        "tierGroups": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:`__proto__` / `constructor` / `toString` 作条目内的未知键被 schema 剥掉(读腿报 unknown-keys-dropped);严写同样剥,受理形等于读腿 models 那一格,原型不被污染。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/t04-secret-literal-never-in-warning-value/expected.json

@@ -99,6 +99,11 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "rejected",
+    "stage": "validate",
+    "why": "拒:models 第 2 条的 api 是一把密钥字面(不在闭集里),读腿逐条丢(entry-dropped)并剥未知键;严写 ⇒ 整次不受理。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/z01-every-domain-empty-object/expected.json

@@ -62,6 +62,70 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {},
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:十七个域各一份空对象,读腿零告警;严写逐份受理,受理形 = 十七个域的 schema 默认(只含提交的键 —— 这里恰好十七个都在)。"
+  },
   "wire": {
     "derive": true
   },

package/conformance/cases/z02-every-domain-unknown-key/expected.json

@@ -218,6 +218,72 @@
       "updatedAt": "2026-09-16T00:00:00.000Z"
     }
   },
+  "strictWrite": {
+    "outcome": "effective",
+    "effective": {
+      "collab": {
+        "templates": []
+      },
+      "entitlement": {
+        "budgetGroups": [],
+        "groupBindings": [],
+        "subjects": [],
+        "tiers": []
+      },
+      "execution": {
+        "allowedLanes": [
+          "host"
+        ],
+        "required": false
+      },
+      "governance": {},
+      "hosts": {
+        "hosts": []
+      },
+      "limits": {
+        "zzzUnknown": 1
+      },
+      "mcp": {
+        "servers": []
+      },
+      "models": {
+        "models": [],
+        "roles": {},
+        "tierGroups": []
+      },
+      "plugins": {
+        "plugins": []
+      },
+      "projects": {
+        "projects": {}
+      },
+      "prompts": {
+        "bindings": []
+      },
+      "rosters": {
+        "rosters": []
+      },
+      "runtime": {},
+      "scenarios": {
+        "scenarios": []
+      },
+      "skills": {
+        "skills": []
+      },
+      "systems": {
+        "systems": []
+      },
+      "workers": {
+        "workers": []
+      }
+    },
+    "warnings": [],
+    "metadata": {
+      "version": 7,
+      "updatedAt": "2026-09-16T00:00:00.000Z"
+    },
+    "why": "受理:十七个域各带一个未知键 —— 十六个被 schema 剥掉(读腿报 unknown-keys-dropped)、limits 承运(unknown-keys-carried);严写同样剥 / 承运、不铸告警,受理形等于读腿十七格。"
+  },
   "wire": {
     "derive": true
   },

package/dist/cli.js

@@ -6,7 +6,8 @@
  * 不进主桶 —— 它是 bin 的实现,不是契约面。
  *
  * 退出码:0 = 已写回 / 无事可做;1 = 有 worker 迁不了(refused)或迁出的文档整域读不进 7.0.0,**一字不写**;2 = 用法 / 读文件 /
- * JSON 错(此时 stdout 为空);3 = `--check` 且会有改动(不写)。
+ * JSON 错(此时 stdout 为空);3 = `--check` 且会有改动(不写)。**8.0.0**:`--check` 与真跑过同一只判定({@link verdictOf}),
+ * 只在「有改动、且整域判得过」那一支上分开(pending vs applied)—— 整域会被拒的文档 `--check` 也报 refused / rc 1。
  *
  * ## 报告形(7.0.1:让「没写」在机读上不可能被读成「写了」)
  * 退出码 0 / 1 / 3 时 stdout 恰两行:
@@ -43,8 +44,41 @@ function writtenOf(outcome) {
         }
     }
 }
+/**
+ * 迁移结果 → 结论。顺序:逐只 refused → 无改动 ⇒ noop → **整域终判**(迁出来的文档读不读得进 7.0.0:名字 / 路由唯一 …)→ 有改动。
+ * 7.0.1 把整域终判放在 `--check` 之后:同一份文档 `--check` 报 pending(rc 3)、真跑报 refused(rc 1),按 `--check` 做闸的脚本会放行
+ * 一次必被拒的真跑;而整域终判拒时 `refused[]` 为空、拒因只在 stderr。现在两种跑法过同一只判定,`refused[]` 逐条带出被拒项。
+ */
+function verdictOf(m) {
+    if (m.refused.length > 0) {
+        return {
+            kind: "refused",
+            refused: m.refused.map((r) => ({ name: r.name, field: r.field, reason: r.reason })),
+            why: `${m.refused.length} worker(s) cannot be migrated (see "refused") — fix them by hand and re-run`,
+        };
+    }
+    if (m.changed.length === 0)
+        return { kind: "noop" };
+    const whole = DOMAIN_SCHEMAS.workers.safeParse(m.doc);
+    if (whole.success)
+        return { kind: "changes" };
+    const issues = sanitizeZodError(whole.error).issues;
+    const workers = isRecord(m.doc) && Array.isArray(m.doc.workers) ? m.doc.workers : [];
+    return {
+        kind: "refused",
+        refused: issues.map((i) => {
+            const [head, index, ...rest] = i.path;
+            if (head !== "workers" || typeof index !== "number")
+                return { name: null, field: i.path, reason: i.message };
+            const entry = workers[index];
+            return { name: isRecord(entry) && typeof entry.name === "string" ? entry.name : null, field: rest, reason: i.message };
+        }),
+        why: `the migrated document does not read as a 7.0.0 workers domain — ${issues.map((i) => `${formatConfigPath(i.path)}: ${i.message}`).join("; ")}`,
+    };
+}
+const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 /** 一次发出报告:结论行 + JSON 行(一次 `stdout` 调用)。键名带时态:写了 ⇒ `changed` / `dropped`,没写 ⇒ `wouldChange` / `wouldDrop`。 */
-function reportOf(outcome, file, m) {
+function reportOf(outcome, file, m, refused) {
     const written = writtenOf(outcome);
     const dropped = m.dropped.map((d) => ({ name: d.name, field: formatConfigPath(d.field) }));
     const json = JSON.stringify({
@@ -53,7 +87,7 @@ function reportOf(outcome, file, m) {
         written,
         file,
         ...(written ? { changed: m.changed, dropped } : { wouldChange: m.changed, wouldDrop: dropped }),
-        refused: m.refused.map((r) => ({ name: r.name, field: formatConfigPath(r.field), reason: r.reason })),
+        refused: refused.map((r) => ({ name: r.name, field: formatConfigPath(r.field), reason: r.reason })),
     });
     return `outcome=${outcome} written=${written}\n${json}\n`;
 }
@@ -83,28 +117,26 @@ export async function runSettingsSchemaCli(argv, io) {
         return 2;
     }
     const m = migrateWorkersDomain(doc);
-    if (m.refused.length > 0) {
-        io.stdout(reportOf("refused", file, m));
-        io.stderr(`settings-schema: ${m.refused.length} worker(s) cannot be migrated (see "refused") — fix them by hand and re-run; nothing was written\n`);
-        return 1;
-    }
-    if (m.changed.length === 0) {
-        io.stdout(reportOf("noop", file, m));
-        return 0;
-    }
-    if (check) {
-        io.stdout(reportOf("pending", file, m));
-        return 3;
-    }
-    // 整域再判一次(域层规则:名字 / 路由唯一 …)—— 读不进 7.0.0 的文档不落盘。
-    const whole = DOMAIN_SCHEMAS.workers.safeParse(m.doc);
-    if (!whole.success) {
-        const issues = sanitizeZodError(whole.error).issues.map((i) => `${formatConfigPath(i.path)}: ${i.message}`);
-        io.stdout(reportOf("refused", file, m));
-        io.stderr(`settings-schema: the migrated document does not read as a 7.0.0 workers domain — ${issues.join("; ")}; nothing was written\n`);
-        return 1;
+    const verdict = verdictOf(m);
+    switch (verdict.kind) {
+        case "refused":
+            io.stdout(reportOf("refused", file, m, verdict.refused));
+            io.stderr(`settings-schema: ${verdict.why}; nothing was written\n`);
+            return 1;
+        case "noop":
+            io.stdout(reportOf("noop", file, m, []));
+            return 0;
+        case "changes":
+            if (check) {
+                io.stdout(reportOf("pending", file, m, []));
+                return 3;
+            }
+            await io.writeFileAtomic(file, `${JSON.stringify(m.doc, null, 2)}\n`);
+            io.stdout(reportOf("applied", file, m, [])); // 写盘成功之后才报 applied
+            return 0;
+        default: {
+            const unhandled = verdict;
+            throw new Error(`settings-schema: unhandled verdict ${JSON.stringify(unhandled)}`);
+        }
     }
-    await io.writeFileAtomic(file, `${JSON.stringify(m.doc, null, 2)}\n`);
-    io.stdout(reportOf("applied", file, m)); // 写盘成功之后才报 applied
-    return 0;
 }

package/dist/config-fns.js

@@ -18,7 +18,7 @@
 import { z } from "zod";
 import { MODEL_ENTRY_REFUSAL_CODES, ModelRefusalsWire } from "./fleet.js";
 import { carriesUserinfo, secretScanForms } from "./secret-scan.js"; // package-private display-side normalization + the userinfo judgement (not in the barrel)
-import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX, InfraCostRates, LimitsConfig, PRIVATE_KEY_PEM_HEADER, SkillsManifestSchema, containsSecretToken } from "./types.js";
+import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX, InfraCostRates, LimitsConfig, PRIVATE_KEY_PEM_HEADER, SkillsManifestSchema, containsSecretToken, isDomainName } from "./types.js";
 /** Redact secret-shaped tokens from a validation MESSAGE — a zod error echoes the offending value (e.g.
  *  `received 'sk-live-…'`), so a secret pasted into the WRONG field would leak via the error string. Redacts
  *  space-spanning auth credentials (`Bearer <token>`) FIRST (the token pass can't see across the space), then
@@ -134,6 +134,12 @@ export function emptyEffective() {
 }
 /** Validate + fill defaults for a domain payload (or the schema's empty default when absent/invalid). */
 export function parseDomain(domain, raw) {
+    // A name that is not a domain is refused for what it is — before, `DOMAIN_SCHEMAS[name]` was undefined and the
+    // TypeError surfaced through the guard below as "a value could not be read", which names the wrong failure. The
+    // strict-write face hands this function every key of a submitted document set, so the name is user text: it leaves
+    // through the same outgoing redaction as a warning coordinate segment.
+    if (!isDomainName(domain))
+        throw new Error(`"${outgoingSegment(String(domain))}" is not a config domain`);
     // ONLY true absence (undefined) defaults; an explicit `null` (e.g. a `config.d/<d>.json` containing JSON
     // `null`) is corrupt input → let zod reject it ("expected object, received null"), not silently default. R4.
     let r;

package/dist/conformance/contract-adapter.d.ts

@@ -1,7 +1,9 @@
 import type { ConformanceAdapter, ConformanceProvenance, LegEntry, LegName } from "./types.js";
-/** 一份契约模块(新旧版同形 —— 三条腿的签名自 0.19.0 起没动过)。 */
+/** 一份契约模块(新旧版同形 —— 四条腿的签名自 0.19.0 起没动过)。 */
 export interface ContractModule {
     buildEffective(version: number, getRaw: (d: string) => unknown, updatedAt: string, onWarning?: (w: unknown) => void): unknown;
+    /** 严写受理的生产入口:一个域名 + 一份原始文档 → 受理后的域文档,不受理就抛。 */
+    parseDomain(domain: string, raw: unknown): unknown;
     readEffectiveWire(raw: unknown, onWarning?: (w: unknown) => void): unknown;
     loadLocalConfig(root: string, opts?: {
         onWarning?: (w: unknown) => void;
@@ -14,7 +16,7 @@ export interface ContractAdapterOptions {
     name: string;
     provenance: ConformanceProvenance;
     mod: ContractModule;
-    /** 三条腿各自的生产入口坐标(绝对路径)。 */
+    /** 四条腿各自的生产入口坐标(绝对路径)。 */
     entries: Record<LegName, LegEntry>;
 }
 export declare function createContractAdapter(opts: ContractAdapterOptions): ConformanceAdapter;

package/dist/conformance/contract-adapter.js

@@ -1,10 +1,14 @@
 /**
- * 契约仓自己的三腿适配器 —— 也是 `historical` 模式拿旧版包跑时用的同一只工厂。
+ * 契约仓自己的四腿适配器 —— 也是 `historical` 模式拿旧版包跑时用的同一只工厂。
  *
  * **它不是给消费方抄的**:消费方登记的腿必须是**自己生产代码**的入口(来源律,§2d-2);把契约包的函数
- * 注册成腿,门证明的就只是「包等于包」。本工厂存在的理由只有两个:①契约仓自证三腿同源(对契约仓而言
- * `buildEffective` / `readEffectiveWire` / `loadLocalConfig` **就是**它的生产入口);②historical 模式要对
- * 一份旧版 dist 跑同样的三腿。
+ * 注册成腿,门证明的就只是「包等于包」。本工厂存在的理由只有两个:①契约仓自证四腿(对契约仓而言
+ * `buildEffective` / `parseDomain` / `readEffectiveWire` / `loadLocalConfig` **就是**它的生产入口);②historical 模式要对
+ * 一份旧版 dist 跑同样的四腿。
+ *
+ * `strictWrite`(严写受理)= 文档集里**每一个**键各自过 `parseDomain`(写入席收下的那份);任何一份不受理 ⇒ 整次
+ * `rejected{stage:"validate"}`(写是一个动作,不是逐份抢救);全部受理 ⇒ `effective` = 键 → 受理后的域文档(只含入参里的
+ * 键,不补缺席域)。`parseDomain` 不铸告警,所以这条腿的告警面恒空。
  *
  * 4.0.0 起这句自陈**有牙**:入口落在契约包自己身上 ⇒ 造适配器那一刻就**拒**(抛,不是告警 —— 一条告警
  * 在 CI 日志里活不过第二天,而这道门一旦被同义反复接进去,它报的全绿是**假绿**)。判别式单铸在
@@ -13,7 +17,7 @@
  *
  * 拒绝分层的判据(一条,不是一串特例):**ZodError 形的错 = `validate`**(某个域没通过它的 schema);
  * 其余按腿各自的默认层 —— wire 腿是 `envelope`(它在解析任何域之前先判信封),local-root 腿是 `parse`
- * (文件层先判:空文件 / 非 JSON / 非对象),domains 腿本来就只有校验这一层。
+ * (文件层先判:空文件 / 非 JSON / 非对象),domains 与 strictWrite 两腿本来就只有校验这一层。
  */
 import { materializeLocalRoot } from "./run.js";
 import { contractOwnedEntry, contractOwnedEntryWhy } from "./entry-origin.js";
@@ -29,7 +33,7 @@ const reject = (e, fallback) => {
     return { outcome: "rejected", stage, diagnostics };
 };
 /**
- * 入口的**运行期拒**(fail-closed):三条腿的入口一条都不许落在**这份正在跑的**契约包自己的构建产物里,
+ * 入口的**运行期拒**(fail-closed):四条腿的入口一条都不许落在**这份正在跑的**契约包自己的构建产物里,
  * 缺席也不行。判别式与拒绝句来自 `./entry-origin.js`,这里只负责「拒」这个动作 —— 以及**按形分派**:
  * 工厂看不见 `mode`,所以它只拒在任何模式下都错的那一形(`own-build-output` = 拿自己比自己);
  * `another-installed-copy` 在 `historical` 模式下是正当的(那个模式就是拿旧版包比行为,而旧版包常常正好
@@ -40,7 +44,7 @@ function refuseContractOwnedEntries(entries) {
     for (const leg of LEG_NAMES) {
         const entry = entries[leg];
         if (entry === undefined || typeof entry.module !== "string" || entry.module.length === 0) {
-            throw new Error(`conformance: leg \`${leg}\` 缺 entry.module —— 三条腿各自的**生产入口**坐标是必填的(来源律 §2d-2)`);
+            throw new Error(`conformance: leg \`${leg}\` 缺 entry.module —— 每条腿各自的**生产入口**坐标是必填的(来源律 §2d-2)`);
         }
         const owned = contractOwnedEntry(entry.module);
         if (owned === undefined)
@@ -72,6 +76,15 @@ export function createContractAdapter(opts) {
                 catch (e) {
                     return reject(e, "validate");
                 }
+            case "strictWrite":
+                try {
+                    // fromEntries(不是逐键赋值):文档集的键是用户写的,`__proto__` 作键时逐键赋值会走原型 setter。
+                    const accepted = Object.fromEntries(Object.entries(input.docs).map(([d, raw]) => [d, mod.parseDomain(d, raw)]));
+                    return { outcome: "effective", effective: accepted, warnings: [], version: input.version, updatedAt: input.updatedAt };
+                }
+                catch (e) {
+                    return reject(e, "validate");
+                }
             case "wire":
                 try {
                     const effective = mod.readEffectiveWire(input.payload, onWarning);
@@ -104,6 +117,7 @@ export function createContractAdapter(opts) {
         provenance: opts.provenance,
         legs: {
             domains: { entry: opts.entries.domains, run },
+            strictWrite: { entry: opts.entries.strictWrite, run },
             wire: { entry: opts.entries.wire, run },
             localRoot: { entry: opts.entries.localRoot, run },
         },

package/dist/conformance/corpus.js

@@ -6,8 +6,9 @@
  *   · `input.json`    —— **真源是 `domains`**(各域原始文档);`wire` / `local-root` 两腿的入参由
  *                        `derive.ts` 的变换表派生。个别腿的入参派生不出来(坏 wire 信封、空文件)时,
  *                        用 `wirePayload` / `localFiles` 显式给。
- *   · `expected.json` —— `domains` 腿的期望是**显式 golden**;另两腿默认写 `{"derive":true}`,由变换表
- *                        派生;派生解释不了的腿写显式期望并带 `why`(那是明示声明,不是暗门)。
+ *   · `expected.json` —— 每条腿一格(四条腿一条不少)。`domains` 与 `strictWrite` 两腿的期望恒是**显式 golden**
+ *                        (能不能派生只看 `derive.ts` 的 `LEG_EXPECTATION`);`wire` / `local-root` 默认写 `{"derive":true}`,
+ *                        由变换表派生;派生解释不了的腿写显式期望并带 `why`(那是明示声明,不是暗门)。
  *   · `meta.json`     —— `contributor`(**只写真交了的仓**)、`claim`(这条想打谁、为什么会读错)、
  *                        `secrets`(语料里埋的秘密字面,告警面零命中门用)、`firstRedOn`(**由 historical
  *                        模式对旧版真跑填**,不许手写)。
@@ -17,7 +18,8 @@
 import { readFile, readdir } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { REJECT_STAGES } from "./types.js";
+import { LEG_NAMES, REJECT_STAGES } from "./types.js";
+import { LEG_EXPECTATION } from "./derive.js";
 /** 本包的根目录 —— `src/conformance/*.ts` 与 `dist/conformance/*.js` 距根同深,两处求值同一个地方。 */
 export const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
 /** 语料目录(默认 = 本包的 `conformance/`)。 */
@@ -72,13 +74,16 @@ export async function loadCase(dir, id) {
     if (!Array.isArray(meta.firstRedOn))
         throw new Error(`conformance corpus: ${id}/meta.json#firstRedOn must be an array`);
     const legs = {};
-    for (const leg of ["domains", "wire", "localRoot"]) {
+    for (const leg of LEG_NAMES) {
         if (expected[leg] === undefined)
             throw new Error(`conformance corpus: ${id}/expected.json has no \`${leg}\` — 每腿都要表态(派生 / 显式 / 不适用)`);
-        legs[leg] = checkLegExpectation(expected[leg], `${id}/expected.json#${leg}`);
+        const spec = checkLegExpectation(expected[leg], `${id}/expected.json#${leg}`);
+        // 能不能派生只看一张表(derive.ts 的 LEG_EXPECTATION),不按腿名特判。
+        if ("derive" in spec && LEG_EXPECTATION[leg].source === "explicit") {
+            throw new Error(`conformance corpus: ${id}/expected.json#${leg} cannot be derived — ${LEG_EXPECTATION[leg].why}`);
+        }
+        legs[leg] = spec;
     }
-    if ("derive" in legs.domains)
-        throw new Error(`conformance corpus: ${id}/expected.json#domains cannot be derived — domains 腿是真源`);
     return { id, dir, input: input, meta: meta, expected: legs };
 }
 /** 整套语料。 */

package/dist/conformance/derive.d.ts

@@ -9,6 +9,32 @@ export interface DerivationTransform {
 }
 /** 变换表(本文件头注的机器形;`docs/CONFORMANCE.md` 与 `test/conformance-coverage.test.ts` 都读它)。 */
 export declare const DERIVATION_TRANSFORMS: readonly DerivationTransform[];
+/**
+ * 每条腿的期望从哪来 —— 闭集表态(`Record<LegName, …>`:新开一条腿不在这里表态 ⇒ 编译红)。
+ *
+ *  · `derivable`:语料可以写 `{"derive":true}`,由上面的变换表从 `domains` 期望派生(也可写显式期望并带 `why`)。
+ *  · `explicit`:只收显式金样(`{"derive":true}` 加载即拒)。
+ *
+ * 语料加载器与驱动都读这张表(一条规则),不再各自特判某个腿名。
+ */
+export declare const LEG_EXPECTATION: {
+    readonly domains: {
+        readonly source: "explicit";
+        readonly why: "真源:domains 腿的期望就是金样本身";
+    };
+    readonly strictWrite: {
+        readonly source: "explicit";
+        readonly why: "入参与 domains 恒等,期望不派生:严写结局不是读结局的表示变换(读腿抢救处严写拒);从 domains 期望派生会让一份金样的错同时改写两条腿";
+    };
+    readonly wire: {
+        readonly source: "derivable";
+        readonly why: "T1 / T2 / T4";
+    };
+    readonly localRoot: {
+        readonly source: "derivable";
+        readonly why: "T3 / T4 / T5 / T6";
+    };
+};
 /** 非便携域 —— 由 {@link PORTABLE_DOMAINS} 派生,零手抄。 */
 export declare const NON_PORTABLE_DOMAINS: readonly DomainName[];
 /** 一份 `domains` 文档集里,**不是域名**的那些顶层键(T4 的触发面)。 */

package/dist/conformance/derive.js

@@ -1,6 +1,7 @@
 /**
- * **三腿等价先定义再比**:语料以 `domains`(各域原始文档)为真源,`wire` 与 `local-root` 两腿的**入参**
- * 与**期望**都由本文件派生 —— 派生规则就是三条腿之间那几处**表示差异**的完整登记表。
+ * **读腿等价先定义再比**:语料以 `domains`(各域原始文档)为真源,`wire` 与 `local-root` 两腿的**入参**
+ * 与**期望**都由本文件派生 —— 派生规则就是三条读腿之间那几处**表示差异**的完整登记表(第四条腿
+ * `strictWrite` 的立场见下文与 {@link LEG_EXPECTATION})。
  *
  * 为什么派生期望而不是每腿各写一份 golden:三份手写 golden 之间的关系是**隐含**的,谁也说不清某一处
  * 不同是「设计如此」还是「某一腿读错了」。派生把那层关系变成代码:凡不能由登记的变换解释的差异,一定
@@ -27,6 +28,11 @@
  *
  * 语料可以对某一腿写**显式期望**(带 `why`)来覆盖派生 —— 那是「这条 case 的这条腿不由变换解释」的
  * 明示声明,不是一条暗门。
+ *
+ * **每条腿的期望从哪来**是一张闭集表({@link LEG_EXPECTATION},`Record<LegName, …>` —— 新开一条腿不来这里
+ * 表态就编译红)。`strictWrite`(严写受理)的**入参**与 `domains` 恒等(同一份各域原始文档),**期望不派生**:
+ * 严写的结局不是读结局的一种表示变换,而是另一个判断(读腿抢救的地方严写拒)。把它写成「从 domains 期望派生」
+ * 就等于让 domains 金样的一处错同时改写两条腿的期望 —— 两条腿同错、门照绿。它的金样逐条显式入库、各自冻结。
  */
 import { NON_DOMAIN_CONFIG_FILES, PORTABLE_DOMAINS } from "../file-store.js";
 import { skillContentHash } from "../skills-manifest.js";
@@ -40,6 +46,23 @@ export const DERIVATION_TRANSFORMS = [
     { id: "T5-file-layer-first", legs: ["localRoot"], what: "config.d/<域>.json 必须是 JSON 对象(空/null/数组/标量 throw),这一层在域解析之前" },
     { id: "T6-file-name-classification", legs: ["localRoot"], what: "config.d/ 的文件分三类:域文件 / NON_DOMAIN_CONFIG_FILES(remote-exec.json 自带读取与校验路径)/ 隐藏文件与非 .json(忽略);只有剩下的才报 not-a-domain" },
 ];
+/**
+ * 每条腿的期望从哪来 —— 闭集表态(`Record<LegName, …>`:新开一条腿不在这里表态 ⇒ 编译红)。
+ *
+ *  · `derivable`:语料可以写 `{"derive":true}`,由上面的变换表从 `domains` 期望派生(也可写显式期望并带 `why`)。
+ *  · `explicit`:只收显式金样(`{"derive":true}` 加载即拒)。
+ *
+ * 语料加载器与驱动都读这张表(一条规则),不再各自特判某个腿名。
+ */
+export const LEG_EXPECTATION = {
+    domains: { source: "explicit", why: "真源:domains 腿的期望就是金样本身" },
+    strictWrite: {
+        source: "explicit",
+        why: "入参与 domains 恒等,期望不派生:严写结局不是读结局的表示变换(读腿抢救处严写拒);从 domains 期望派生会让一份金样的错同时改写两条腿",
+    },
+    wire: { source: "derivable", why: "T1 / T2 / T4" },
+    localRoot: { source: "derivable", why: "T3 / T4 / T5 / T6" },
+};
 /** 非便携域 —— 由 {@link PORTABLE_DOMAINS} 派生,零手抄。 */
 export const NON_PORTABLE_DOMAINS = DOMAINS.filter((d) => !PORTABLE_DOMAINS.includes(d));
 const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);

package/dist/conformance/index.d.ts

@@ -6,7 +6,8 @@
  *
  * 三步接线(消费方侧):
  *   1. 造一个 {@link ConformanceAdapter}:`provenance` = 你**实际加载到**的那份契约包(package.json 路径、
- *      版号、完整性串);`legs` = 你自己的生产读腿,每条带 `entry{module,export}`(生产入口的绝对路径)。
+ *      版号、完整性串);`legs` = **四条腿逐条表态**:你自己的生产入口(每条带 `entry{module,export}`,生产入口的
+ *      绝对路径),或 `{ declined: "no-production-path", why }`(你的生产代码结构上没有这种读法 / 写法)。
  *   2. `const report = await runConformance(adapter, { mode: "release" })`。
  *   3. 断言 `report.ok`;不绿就读 `report.violations` 与每格的 `diff`(effective 的 JSON patch、告警多重集差、
  *      元数据差三面分开)。
@@ -16,7 +17,7 @@
 export { runConformance, materializeLocalRoot, resolveLegExpectation } from "./run.js";
 export { createContractAdapter, type ContractAdapterOptions, type ContractModule } from "./contract-adapter.js";
 export { loadCorpus, loadCase, kitIdentity, DEFAULT_CORPUS_DIR, PACKAGE_ROOT, type Corpus, type ConformanceCase, type CaseInput, type CaseMeta, type LegExpectationJson } from "./corpus.js";
-export { DERIVATION_TRANSFORMS, NON_PORTABLE_DOMAINS, EPOCH_ISO, deriveWireInput, deriveLocalInput, deriveWireExpectation, deriveLocalExpectation, foreignKeysOf, toManifestDoc, type DerivationTransform, type LegExpectation, } from "./derive.js";
+export { DERIVATION_TRANSFORMS, LEG_EXPECTATION, NON_PORTABLE_DOMAINS, EPOCH_ISO, deriveWireInput, deriveLocalInput, deriveWireExpectation, deriveLocalExpectation, foreignKeysOf, toManifestDoc, type DerivationTransform, type LegExpectation, } from "./derive.js";
 export { canonicalize, deepEqual, diffJson, stableKey, type JsonPatchOp } from "./canonical.js";
 export { WARNING_KINDS, projectWarning, normalizeProjection, projectionKey, projectionValue, diffWarningMultiset, findSecretLeaks, type WarningKind, type WarningProjection, } from "./warnings.js";
-export { LEG_NAMES, REJECT_STAGES, type ConformanceAdapter, type ConformanceLeg, type ConformanceMode, type ConformanceNormalizer, type ConformanceOptions, type ConformanceProvenance, type ConformanceReport, type ConformanceResult, type ConformanceStatus, type KnownDivergence, type OutcomeDivergence, type PathDivergence, type LedgerRow, type LegEntry, type LegInput, type LegName, type LegOutcome, type RejectStage, } from "./types.js";
+export { LEG_DECLINE_REASONS, LEG_NAMES, REJECT_STAGES, type ConformanceAdapter, type ConformanceLeg, type DomainDocsInput, type LegDeclineReason, type LegDeclined, type LegStance, type ConformanceMode, type ConformanceNormalizer, type ConformanceOptions, type ConformanceProvenance, type ConformanceReport, type ConformanceResult, type ConformanceStatus, type KnownDivergence, type OutcomeDivergence, type PathDivergence, type LedgerRow, type LegEntry, type LegInput, type LegName, type LegOutcome, type RejectStage, } from "./types.js";