@ultimat3/core 24.0.0 → 25.0.0

package/src/config-navigation.ts

@@ -6,7 +6,6 @@
 // were: shape, merge and screen are one subject.
 
 import { describeValue } from './error-render';
-import { ConfigInvalidError } from './errors';
 
 /**
  * The surfaces that render documents a browser navigates between. `api` answers JSON and `shared`
@@ -73,7 +72,7 @@ export interface NavigationSectionInput {
 }
 
 /**
- * Whole-value keys: the last layer that listed surfaces wins, as `locales` does — and so does the
+ * Whole-value keys: the last layer that listed surfaces wins, as `roles` does — and so does the
  * last one that set `speculation.prefetch` or listed `speculation.exclude`, each on its own.
  */
 export function mergeNavigation(layers: readonly NavigationSectionInput[]): NavigationSection {
@@ -138,29 +137,6 @@ function speculationIssues(speculation: unknown, issues: string[]): void {
   }
 }
 
-/**
- * `navigation.speculation` as some reader OUTSIDE `defineConfig` found it (`@ultimat3/cli` imports
- * the app's config module structurally): the defaults for what it does not say, and the SAME
- * refusal `defineConfig` gives for what it says wrongly. One validator — a second reader that
- * coerced `'eager'` to `'moderate'` or dropped a bad pattern would serve rules the app never wrote.
- */
-export function resolveSpeculation(said: unknown): SpeculationConfig {
-  if (said === undefined) return DEFAULT_SPECULATION;
-  const { speculation } = mergeNavigation([
-    { navigation: { speculation: said as SpeculationInput } },
-  ]).navigation;
-  const issues: string[] = [];
-  speculationIssues(speculation, issues);
-  if (issues.length > 0) {
-    throw new ConfigInvalidError({
-      cause: issues.join('; '),
-      fix: 'Correct navigation.speculation in app.config.ts: prefetch is "moderate", "conservative" or false, and exclude is a list of path patterns starting with "/"',
-      meta: { issues },
-    });
-  }
-  return speculation;
-}
-
 /** Appends every refusal the section earns to `issues`, `config.ts`' one list. */
 export function navigationIssues(config: NavigationSection, issues: string[]): void {
   speculationIssues(config.navigation.speculation, issues);

package/src/config-pwa.ts

@@ -13,7 +13,7 @@
 import { describeValue } from './error-render';
 
 /**
- * `installPrompt` was removed 2026-08, same rule: `@ultimat3/pwa`'s `createInstallController` is
+ * `installPrompt` was removed 2026-08, same rule: `@ultimat3/pwa`'s `installController` is
  * real and complete, nothing ever threaded the flag into it, and both tracked apps plus every
  * scaffolded app set a switch with no wire. Call the controller from your own affordance instead.
  */
@@ -115,8 +115,8 @@ export interface PwaScreenshot {
 /**
  * The install chrome's two colours for one scheme, as CSS colour strings.
  *
- * ONE OF THE TWO PLACES A RAW COLOUR IS LEGAL, alongside `ThemeConfig.tokens` one section up, and
- * for a stronger reason than that one has: a browser paints the install splash and the address bar
+ * THE ONE PLACE IN `app.config.ts` A RAW COLOUR IS LEGAL (`theme.tokens`, the other, was deleted in
+ * 25.0.0 — the theme is `defineTheme` in `@ultimat3/ui`), because a browser paints the install splash and the address bar
  * from these before a single stylesheet has loaded, so there is no token to resolve them against
  * and no component anywhere in the loop.
  */
@@ -173,10 +173,20 @@ export function pwaIssues(pwa: PwaConfig, issues: string[]): boolean {
   // `pwa.enabled` means an installable app, and an installable app that shows the browser's error
   // page offline is the failure the whole block exists to prevent, so this is required rather
   // than optional: the alternative is two meanings for one switch (axiom 1).
+  // Same origin, too: `//host/offline` and `/\host/offline` start with `/` and are still another
+  // host, which the worker would precache and serve as this app's offline page.
   const fallback: unknown = pwa.offline?.fallback;
-  if (typeof fallback !== 'string' || !fallback.startsWith('/')) {
+  if (!isSameOriginPath(fallback)) {
     issues.push(
-      `pwa.offline.fallback is required when pwa.enabled is true and must be an absolute route path like "/offline", and is ${describeValue(fallback)}`,
+      `pwa.offline.fallback is required when pwa.enabled is true and must be an absolute route path on this origin like "/offline", and is ${describeValue(fallback)}`,
+    );
+  }
+  for (const key of ['image', 'font'] as const) {
+    const placeholder: unknown = pwa.offline?.[key];
+    if (placeholder === undefined || placeholder === null || isSameOriginPath(placeholder))
+      continue;
+    issues.push(
+      `pwa.offline.${key} must be a path on this origin like "/offline.svg", and is ${describeValue(placeholder)}`,
     );
   }
   const personal: unknown = pwa.offline?.personalPages;
@@ -233,3 +243,30 @@ function manifestIssues(pwa: PwaConfig, issues: string[]): void {
     }
   }
 }
+
+/** An origin no relative path can reach: a value that resolves anywhere else left this origin. */
+const PROBE_ORIGIN = 'http://x.invalid';
+
+/**
+ * A path on THIS origin, as a browser will resolve it — the one predicate for every URL the worker
+ * precaches and serves as an offline answer (`@ultimat3/pwa`'s build asks the same question).
+ * Judged by RESOLUTION, never by the raw prefix: the URL parser strips a tab, CR or LF anywhere and
+ * reads `\` as `/`, so `/\t/evil.test/x` is `//evil.test/x` once parsed. Every C0 control and DEL
+ * is refused before the parse, as `@ultimat3/http`'s sign-in redirect does; a dot segment that
+ * leaves a `//` pathname (`/.//evil.test`) is refused after it, since any reader without the base
+ * takes that pathname as a host.
+ */
+export function isSameOriginPath(value: unknown): value is string {
+  if (typeof value !== 'string' || !value.startsWith('/')) return false;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 0x20 || code === 0x7f) return false;
+  }
+  let resolved: URL;
+  try {
+    resolved = new URL(value, PROBE_ORIGIN);
+  } catch {
+    return false;
+  }
+  return resolved.origin === PROBE_ORIGIN && !resolved.pathname.startsWith('//');
+}

package/src/config-removed.ts

@@ -0,0 +1,131 @@
+// Single responsibility: the `app.config.ts` keys a major DELETED, and the refusal an app still
+// writing one gets. A deleted key the validator ignores is a switch with no wire — an operator sets
+// it, redeploys and nothing changes — so each is refused by name, with the line that replaces it.
+
+import { isJsonObject } from './json-object';
+
+export interface RemovedConfigKey {
+  /** The major that deleted it. */
+  readonly removedIn: string;
+  /** What an app writes instead — the second half of the `fix:`. */
+  readonly instead: string;
+}
+
+/**
+ * Dotted paths, one row per deleted leaf. Every row older than 25.0.0 was silently carried through
+ * `section()` until 25.0.0 refused it — this table by name, then `config-keys.ts` closing the
+ * shape for any other key; a row is what turns "not a key" into the line that replaces it. A row
+ * is never removed: a config written against an older major must keep getting the instruction,
+ * not silence. `Object.freeze`d, read through `Object.hasOwn`, so `__proto__` in a layer names no
+ * row.
+ */
+export const REMOVED_CONFIG_KEYS: Readonly<Record<string, RemovedConfigKey>> = Object.freeze({
+  locales: {
+    removedIn: '25.0.0',
+    instead:
+      "the app's locales are the keys of its catalogs: defineCatalogs({ default: 'en', locales: { en, es } }) from @ultimat3/i18n, in packages/i18n/src/index.ts",
+  },
+  defaultLocale: {
+    removedIn: '25.0.0',
+    instead:
+      "the fallback locale is defineCatalogs({ default: 'en', locales: { en } })'s default, from @ultimat3/i18n",
+  },
+  defaultTimeZone: {
+    removedIn: '25.0.0',
+    instead:
+      "nothing read it; there is no ambient zone — pass one at every call: formatDate(at, { locale, zone: 'Europe/Paris' }), task({ tz }), userActor({ tz })",
+  },
+  defaultCurrency: {
+    removedIn: '25.0.0',
+    instead:
+      "nothing read it; every Money carries its own currency ({ minor, currency: 'USD' }) — an app that wants a default declares its own constant in an app module",
+  },
+  'jobs.driver': {
+    removedIn: '5.0.0',
+    instead:
+      'nothing read it and boot always built Postgres; the driver is code — setJobDriver(postgresJobDriver({ executor })) from @ultimat3/jobs, or setJobDriver(memoryJobDriver()) in a test',
+  },
+  'realtime.heartbeatMs': {
+    removedIn: '4.0.0',
+    instead:
+      "nothing read it; the page socket's beat is the sync node's, named in its hello reply, and the presence beat is a third of the presence ttl",
+  },
+  'database.urlEnv': {
+    removedIn: '4.0.0',
+    instead:
+      'nothing read it; the connection string is the DATABASE_URL environment variable, read by @ultimat3/db',
+  },
+  'database.poolSize': {
+    removedIn: '4.0.0',
+    instead:
+      'nothing read it; the pool is sized by the DATABASE_POOL_MAX environment variable, per process',
+  },
+  'database.schema': {
+    removedIn: '4.0.0',
+    instead:
+      'nothing read it and nothing emits SET search_path; entity() tables live in public, and there is no replacement',
+  },
+  'pwa.installPrompt': {
+    removedIn: '8.0.0',
+    instead:
+      'nothing read it; call installController() from @ultimat3/pwa in your own install affordance',
+  },
+  'auth.afterSignInPath': {
+    removedIn: '8.0.0',
+    instead:
+      'nothing read it; send the visitor where you mean from your sign-in route, the only code that can honour it',
+  },
+  'ai.modelEnv': {
+    removedIn: '8.0.0',
+    instead:
+      "nothing read it; the model is the prompt's own, or llm({ model }) from @ultimat3/ai — read your own env key and pass it there",
+  },
+  'cache.driver': {
+    removedIn: '9.0.0',
+    instead:
+      "cache.tiers is the one selector — name the rung: cache: { tiers: ['request-memo', 'lru', 'redis'] }",
+  },
+  'cache.urlEnv': {
+    removedIn: '9.0.0',
+    instead:
+      "nothing read it; the redis tier reads the REDIS_URL environment variable, so name 'redis' in cache.tiers and set REDIS_URL",
+  },
+  'realtime.tier': {
+    removedIn: '10.0.0',
+    instead:
+      "nothing read it; an app's realtime tier is what it declares — a channel() topic, a live: true query, persist: true on an entity",
+  },
+  'theme.tokens': {
+    removedIn: '25.0.0',
+    instead:
+      "nothing read it; the app's theme is declared once with export const brand = defineTheme({ … }) from @ultimat3/ui, in apps/web/shared/theme.ts",
+  },
+  'ai.mcp.path': {
+    removedIn: '25.0.0',
+    instead:
+      "an MCP endpoint's path is its own: defineAppMcp({ path: '/mcp' }) from @ultimat3/mcp, in apps/<app>/mcp.ts — the default is /mcp, and every endpoint mounts where its own metadata says",
+  },
+});
+
+const said = (layer: unknown, path: string): boolean => {
+  let at: unknown = layer;
+  for (const segment of path.split('.')) {
+    if (!isJsonObject(at) || !Object.hasOwn(at, segment)) return false;
+    at = at[segment];
+  }
+  // `undefined` is a layer not saying, the rule every other key follows.
+  return at !== undefined;
+};
+
+/** The removed keys one layer still writes, in table order. */
+export function removedKeysIn(layer: unknown): readonly string[] {
+  return Object.keys(REMOVED_CONFIG_KEYS).filter((path) => said(layer, path));
+}
+
+/** One cause line per removed key, naming the major. */
+export const removedKeyIssue = (path: string): string =>
+  `${path} was removed in ${REMOVED_CONFIG_KEYS[path]?.removedIn ?? 'a major'} and is no longer read`;
+
+/** One instruction per removed key: delete the line, and what replaces it. */
+export const removedKeyFix = (path: string): string =>
+  `delete ${path} from app.config.ts — ${REMOVED_CONFIG_KEYS[path]?.instead ?? ''}`;

package/src/config-shape.ts

@@ -77,36 +77,3 @@ export function nameListIssues(
     }
   }
 }
-
-function canonicalTag(tag: unknown): string | undefined {
-  if (typeof tag !== 'string') return undefined;
-  try {
-    const canonical = Intl.getCanonicalLocales(tag);
-    return canonical.length === 1 ? canonical[0] : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * The locale list and the tag that must be in it. Two spellings of ONE locale are refused: the
- * list keys a catalog, a route prefix and an `hreflang` each, and `['EN', 'en']` is two of every
- * one of them for a single language.
- */
-export function localeIssues(tags: readonly unknown[], fallback: unknown, issues: string[]): void {
-  if (tags.length === 0) issues.push('locales must list at least one locale');
-  const seen = new Map<string, unknown>();
-  for (const tag of tags) {
-    const canonical = canonicalTag(tag);
-    if (canonical === undefined) {
-      issues.push(`locales contains ${said(tag)}, not a BCP-47 tag`);
-    } else if (seen.has(canonical)) {
-      issues.push(
-        `locales lists ${canonical} twice, as ${said(seen.get(canonical))} and ${said(tag)}`,
-      );
-    } else {
-      seen.set(canonical, tag);
-    }
-  }
-  if (!tags.includes(fallback)) issues.push(`defaultLocale ${said(fallback)} is not in locales`);
-}

package/src/config.ts

@@ -2,26 +2,28 @@
 // defaults, validated eagerly, and composable so a big app can split it across `config/*.ts`
 // without inventing a second config mechanism.
 
-import { CURRENCY_CODE_PATTERN } from '@ultimat3/schema';
 // Same rule for the same reason: `app.config.ts` CONSUMES the cache tier names, it does not own
 // them. Declaring them here is what let `cache.tiers` and the ladder `@ultimat3/cache` orders by
 // drift into two vocabularies with no map between them (issue #293).
 import { CACHE_TIERS, type CacheTierName } from './cache-vocabulary';
+import type { AiConfig, AiConfigInput } from './config-ai';
 import { countIssue } from './config-count';
 import { configDefaults } from './config-defaults';
-import { BASE_FIX, CACHE_TIER_FIX, TIMEZONE_FIX } from './config-fixes';
-import type { DrainConfig, HealthConfig } from './config-health';
-import { readinessModeIssue } from './config-health';
+import { BASE_FIX, CACHE_TIER_FIX } from './config-fixes';
+import { type DrainConfig, type HealthConfig, readinessModeIssue } from './config-health';
 import type { IslandsConfig, IslandsSectionInput } from './config-islands';
 import { islandsIssues, mergeIslands } from './config-islands';
+import { type JobsConcurrency, jobsConcurrencyIssues } from './config-jobs';
+import { refuseUnknownKeys } from './config-keys';
+import { type MailConfig, type MailSectionInput, mailIssues, mergeMail } from './config-mail';
 import { type Input, lastSaid, layered } from './config-merge';
 import type { NavigationConfig, NavigationSectionInput } from './config-navigation';
 import { mergeNavigation, navigationIssues } from './config-navigation';
 import type { PwaConfig, PwaOfflineConfig } from './config-pwa';
 import { PWA_FIX, pwaIssues } from './config-pwa';
+import { removedKeyFix, removedKeyIssue, removedKeysIn } from './config-removed';
 import {
   booleanIssue,
-  localeIssues,
   nameListIssues,
   oneOfIssue,
   routePathIssue,
@@ -29,11 +31,10 @@ import {
 } from './config-shape';
 import type { SeoConfig, SiteConfig, SiteSectionsInput } from './config-site';
 import { mergeSite, siteIssues } from './config-site';
+import { drainIssues } from './drain-deadline';
 import { describeValue } from './error-render';
 import { ConfigInvalidError } from './errors';
-import { readinessGraceIssue } from './lifecycle-grace';
 import { ROLES, type Role } from './roles';
-import { isIanaZoneName } from './time-zone-name';
 
 export const THEME_MODES = ['light', 'dark', 'system'] as const;
 export type ThemeMode = (typeof THEME_MODES)[number];
@@ -44,10 +45,12 @@ export type ThemeMode = (typeof THEME_MODES)[number];
 export const REALTIME_TRANSPORTS = ['memory', 'nats'] as const;
 export type RealtimeTransport = (typeof REALTIME_TRANSPORTS)[number];
 
+/**
+ * No `tokens` (deleted in 25.0.0): read by nothing once the theme seam landed — the app's theme is
+ * `export const brand = defineTheme(…)` from `@ultimat3/ui`. A second theming path nothing read.
+ */
 export interface ThemeConfig {
   readonly defaultMode: ThemeMode;
-  /** Semantic design tokens. Raw hex is a lint error in components, never here. */
-  readonly tokens: Readonly<Record<string, string>>;
 }
 
 /**
@@ -133,7 +136,7 @@ export interface DatabaseConfig {
  */
 export interface CacheConfig {
   readonly defaultTtlMs: number;
-  /** Order is fixed by `TIER_ORDER`; listing order here selects rungs, it does not rank them. */
+  /** Order is fixed by `CACHE_TIERS`; listing order here selects rungs, it does not rank them. */
   readonly tiers: readonly CacheTierName[];
 }
 
@@ -142,17 +145,21 @@ const JOB_BACKOFFS = ['exponential', 'fixed'] as const;
 export interface JobsConfig {
   /**
    * No `driver`. It accepted `'postgres' | 'redis' | 'nats'`, was read by NOTHING, and boot always
-   * built `createPgDriver` — so `jobs: { driver: 'redis' }` did not throw, did not warn, and
-   * silently gave you Postgres. Deleted 2026-08-20, and it is the worse shape of the same defect
-   * `realtime.heartbeatMs` was: a knob that fails SILENTLY in the dangerous direction.
+   * built the Postgres driver — so `jobs: { driver: 'redis' }` did not throw, did not warn, and
+   * silently gave you Postgres. Deleted 2026-08-20 (5.0.0); since 25.0.0 a config still writing it
+   * is REFUSED by name (`config-removed.ts`) rather than carried through the spread.
    *
-   * The seam that works is `setJobDriver(driver)` — `setJobDriver(createPgDriver({ executor }))`,
-   * or `setJobDriver(createMemoryDriver())` in a test. Swap the driver, zero job-code change, which
-   * is the whole of what the `JobDriver` interface buys. There is no config line, and one that
-   * cannot be honoured is worse than none.
+   * The seam that works is `setJobDriver(driver)` —
+   * `setJobDriver(postgresJobDriver({ executor }))`, or `setJobDriver(memoryJobDriver())` in a
+   * test. Swap the driver, zero job-code change, which is the whole of what the `JobDriver`
+   * interface buys. There is no config line, and one that cannot be honoured is worse than none.
    */
   readonly queues: readonly string[];
-  readonly concurrency: number;
+  /**
+   * Slots per worker process: one number for every queue it serves, or a table per queue
+   * (`{ banks: 4, 'banks-long': 2 }`, a queue it does not name at `JOBS_CONCURRENCY_DEFAULT`).
+   */
+  readonly concurrency: JobsConcurrency;
   readonly maxAttempts: number;
   readonly backoff: (typeof JOB_BACKOFFS)[number];
   readonly visibilityTimeoutMs: number;
@@ -167,37 +174,28 @@ export interface JobsConfig {
  *
  * No `tier` either (deleted 2026-08-23): no file read it, so `tier: 'local-first'` bought nothing.
  * An app's realtime tier is what it DECLARES — a `channel()` topic, a `live: true` query, a local
- * store — never a config key; `transport` and `urlEnv` are the only fields any code reads.
+ * store — never a config key. `transport`, `urlEnv` and the two per-actor caps (read by the `sync`
+ * role into its registry and node) are the fields code reads.
  */
 export interface RealtimeConfig {
   readonly enabled: boolean;
   readonly transport: RealtimeTransport;
   readonly urlEnv: string | undefined;
-}
-
-export interface McpConfig {
-  readonly expose: boolean;
-  readonly path: string;
+  /** Live subscriptions one actor (or anonymous network) may hold per sync node. Unset: 1,000. */
+  readonly maxSubscriptionsPerActor?: number | undefined;
+  /** Sockets one actor (or anonymous network) may hold per sync node. Unset: 16. */
+  readonly maxSocketsPerActor?: number | undefined;
 }
 
 /**
- * No `modelEnv`. It named the env KEY holding the model id, "so no model string is baked into the
- * image" — and its only reader was this file's own merge, copying input to output. Nothing
- * consumed the merged value, so `modelEnv: 'ANTHROPIC_MODEL'` selected no model: `@ultimat3/ai`
- * reads env for API KEYS only, and the model is `request.model ?? DEFAULT_MODEL`, a compile-time
- * constant in `models.ts`. The exact thing the key existed to prevent is what it delivered.
- * Deleted 2026-08 — pass `model` on the request, or read your own env key and pass it.
+ * No `locales` / `defaultLocale`, `defaultTimeZone` or `defaultCurrency` (deleted in 25.0.0, and
+ * REFUSED by name when written — `config-removed.ts`). The locales were a second declaration of
+ * `defineCatalogs({ default })`; the zone and the currency were read by nothing, and an ambient
+ * default for either is the defect the framework forbids (every format call takes its zone, every
+ * `Money` its currency).
  */
-export interface AiConfig {
-  readonly mcp: McpConfig;
-}
-
 export interface AppConfig {
   readonly name: string;
-  readonly locales: readonly string[];
-  readonly defaultLocale: string;
-  readonly defaultTimeZone: string;
-  readonly defaultCurrency: string;
   readonly theme: ThemeConfig;
   readonly auth: AuthConfig;
   readonly pwa: PwaConfig;
@@ -214,11 +212,7 @@ export interface AppConfig {
   readonly seo: SeoConfig;
   readonly navigation: NavigationConfig;
   readonly islands: IslandsConfig;
-}
-
-/** `mcp` is the only member, and it is NESTED — `Input<AiConfig>` would make it all-or-nothing. */
-export interface AiConfigInput {
-  readonly mcp?: Input<McpConfig> | undefined;
+  readonly mail: MailConfig;
 }
 
 /**
@@ -235,12 +229,9 @@ export interface PwaConfigInput extends Omit<Input<PwaConfig>, 'offline'> {
 export interface AppConfigInput
   extends SiteSectionsInput,
     NavigationSectionInput,
-    IslandsSectionInput {
+    IslandsSectionInput,
+    MailSectionInput {
   readonly name: string;
-  readonly locales?: readonly string[] | undefined;
-  readonly defaultLocale?: string | undefined;
-  readonly defaultTimeZone?: string | undefined;
-  readonly defaultCurrency?: string | undefined;
   readonly theme?: Input<ThemeConfig> | undefined;
   readonly auth?: Input<AuthConfig> | undefined;
   readonly pwa?: PwaConfigInput | undefined;
@@ -260,21 +251,10 @@ export type AppConfigOverlay = Omit<AppConfigInput, 'name'> & { readonly name?:
 
 const NAME_RE = /^[a-z][a-z0-9-]{1,63}$/;
 
-/**
- * Built from `@ultimat3/schema`'s `CURRENCY_CODE_PATTERN`, the framework's ONE declaration of what
- * an ISO 4217 code looks like — the same source `isCurrencyCode`, the published OpenAPI `pattern`
- * and `@ultimat3/entity`'s Postgres CHECK all derive from. It was a character-for-character copy
- * here until the `core -> schema` edge was declared (`scripts/lib/tiers.ts`), held equal only by a
- * pin test in `@ultimat3/cli`.
- */
-const CURRENCY_RE = new RegExp(CURRENCY_CODE_PATTERN);
-
 function validate(config: AppConfig): void {
   const issues: string[] = [];
-  // Zero or one entry: the zone's own remedy, carried only when the zone is what failed.
-  const zoneFix: string[] = [];
-  // Same shape, and it exists for the upgrade: an 8.0.0 app carrying `['memo', 'shared']` in an
-  // untyped config file reaches here rather than the compiler, and needs the new spelling.
+  // Zero or one entry, and it exists for the upgrade: an 8.0.0 app carrying `['memo', 'shared']`
+  // in an untyped config file reaches here rather than the compiler, and needs the new spelling.
   const tierFix: string[] = [];
   // Same shape again: carried only when an installable app is missing what an install needs.
   const pwaFix: string[] = [];
@@ -285,26 +265,13 @@ function validate(config: AppConfig): void {
   } else if (!NAME_RE.test(config.name)) {
     issues.push(`name "${config.name}" must match ${String(NAME_RE)}`);
   }
-  localeIssues(config.locales, config.defaultLocale, issues);
-  // `@ultimat3/time`'s rule, restated because tier 0 cannot import tier 1 — see
-  // `time-zone-name.ts`. One validator means a zone `app.config.ts` accepts is a zone every
-  // `format` call, `task()` and `toZoned` below it can then do arithmetic in.
-  if (!isIanaZoneName(config.defaultTimeZone)) {
-    issues.push(
-      `defaultTimeZone "${config.defaultTimeZone}" is not an IANA Area/Location zone name`,
-    );
-    zoneFix.push(TIMEZONE_FIX);
-  }
-  if (!CURRENCY_RE.test(config.defaultCurrency)) {
-    issues.push(`defaultCurrency "${config.defaultCurrency}" is not a 3-letter ISO 4217 code`);
-  }
   if (config.roles.length === 0) issues.push('roles must list at least one runtime role');
   // ONE check per key, each against the key's own domain. A number is never a bare `< 1` — every
   // comparison with `NaN` is false, so `concurrency < 1` passed `NaN`, `2.5` and `Infinity` — and
   // a switch is never read for truthiness: `ssl: 'false'` and `enabled: 'false'` were both ON.
   const perKey: readonly (string | undefined)[] = [
     ...config.roles.map((role) => oneOfIssue('roles', role, ROLES)),
-    countIssue('jobs.concurrency', config.jobs.concurrency, 1),
+    ...jobsConcurrencyIssues(config.jobs.concurrency),
     countIssue('jobs.maxAttempts', config.jobs.maxAttempts, 1),
     countIssue('jobs.visibilityTimeoutMs', config.jobs.visibilityTimeoutMs, 1),
     oneOfIssue('jobs.backoff', config.jobs.backoff, JOB_BACKOFFS),
@@ -317,10 +284,14 @@ function validate(config: AppConfig): void {
       ? undefined
       : routePathIssue('auth.signInPath', config.auth.signInPath),
     booleanIssue('ai.mcp.expose', config.ai.mcp.expose),
-    routePathIssue('ai.mcp.path', config.ai.mcp.path),
     booleanIssue('realtime.enabled', config.realtime.enabled),
     oneOfIssue('realtime.transport', config.realtime.transport, REALTIME_TRANSPORTS),
-    readinessGraceIssue(config.drain.readinessGraceMs),
+    ...(['maxSubscriptionsPerActor', 'maxSocketsPerActor'] as const).map((key) =>
+      config.realtime[key] === undefined
+        ? undefined
+        : countIssue(`realtime.${key}`, config.realtime[key], 1),
+    ),
+    ...drainIssues(config.drain),
     readinessModeIssue(config.health.readiness),
   ];
   for (const issue of perKey) if (issue !== undefined) issues.push(issue);
@@ -350,6 +321,7 @@ function validate(config: AppConfig): void {
   siteIssues(config, issues);
   navigationIssues(config, issues);
   islandsIssues(config, issues);
+  mailIssues(config, issues);
 
   // A rung the ladder cannot build is the defect this key had: `sortTiers` places a name by its
   // index in `CACHE_TIERS`, and a name missing from it sorts to `-1` — AHEAD of the request memo.
@@ -368,7 +340,7 @@ function validate(config: AppConfig): void {
       cause: issues.join('; '),
       // The generic instruction goes LAST so the fix line still ends in a command that can be
       // pasted — a trailing `.` after `x verify` is a command nobody can run.
-      fix: [...zoneFix, ...tierFix, ...pwaFix, BASE_FIX].join('. '),
+      fix: [...tierFix, ...pwaFix, BASE_FIX].join('. '),
       meta: { issues },
     });
   }
@@ -383,22 +355,6 @@ function merge(name: string, layers: readonly AppConfigOverlay[]): AppConfig {
   const base = configDefaults(name);
   return {
     name,
-    locales: lastSaid(
-      base.locales,
-      layers.map((layer) => layer.locales),
-    ),
-    defaultLocale: lastSaid(
-      base.defaultLocale,
-      layers.map((layer) => layer.defaultLocale),
-    ),
-    defaultTimeZone: lastSaid(
-      base.defaultTimeZone,
-      layers.map((layer) => layer.defaultTimeZone),
-    ),
-    defaultCurrency: lastSaid(
-      base.defaultCurrency,
-      layers.map((layer) => layer.defaultCurrency),
-    ),
     theme: layered(
       base.theme,
       layers.map((layer) => layer.theme),
@@ -461,9 +417,27 @@ function merge(name: string, layers: readonly AppConfigOverlay[]): AppConfig {
     ...mergeSite(layers),
     ...mergeNavigation(layers),
     ...mergeIslands(layers),
+    ...mergeMail(layers),
   };
 }
 
+/**
+ * FIRST, before shape: a removed key is an instruction the app is still giving, and the answer is
+ * the line to delete and what replaces it — never silence, and never a shape complaint about a
+ * section (`theme.tokens: null`) that no longer has the key at all. Every layer is asked, so a
+ * stale `config/theme.ts` overlay is caught as surely as the base.
+ */
+function refuseRemovedKeys(layers: readonly unknown[]): void {
+  const removed = [...new Set(layers.flatMap((layer) => removedKeysIn(layer)))];
+  if (removed.length === 0) return;
+  const issues = removed.map(removedKeyIssue);
+  throw new ConfigInvalidError({
+    cause: issues.join('; '),
+    fix: [...removed.map(removedKeyFix), BASE_FIX].join('. '),
+    meta: { issues, removed },
+  });
+}
+
 /**
  * The single config entry point. Later overlays win, so `config/jobs.ts` can own jobs without
  * touching `app.config.ts`.
@@ -473,12 +447,15 @@ export function defineConfig(
   ...overlays: readonly AppConfigOverlay[]
 ): AppConfig {
   const layers: readonly AppConfigOverlay[] = [input, ...overlays];
+  refuseRemovedKeys(layers);
   // Structure FIRST, per layer and before the merge: a section written as `null` or a list
   // written as a string is what `Object.entries` and `.length` raised a native `TypeError` on.
   const issues: string[] = [];
   // `navigation` is left out: `config-navigation.ts` carries a wrong shape through AS WRITTEN and
   // refuses it in its own words, with the surfaces it accepts.
   const reference = { ...merge(input.name, []), navigation: undefined };
+  // Closed BEFORE shape: a typo'd section (`drian: null`) is the wrong name, not the wrong kind.
+  refuseUnknownKeys(reference, layers);
   for (const layer of layers) shapeIssues(reference, layer, issues);
   if (issues.length > 0) {
     throw new ConfigInvalidError({ cause: issues.join('; '), fix: BASE_FIX, meta: { issues } });