Known limitations of this surface

Recorded deliberately — a document that hides its own gaps is worse than none.

1. Most unknown keys written directly INTO THE FILE are silently ignored. The loader has no default branch, so a typo such as identtiy.actor typed into the file does nothing and says nothing. (saphan config set itself does reject unknown keys, listing every valid one — the silent-ignore applies only to hand-edits that bypass the verb.) The closed [probe.model] family is an exception: an unknown backend there is refused by name at load, and so are [class], [verify.<scope>] and [oauth_server]. Planned fix: a strict saphan config validate pass reporting every dropped key with its line number.
2. saphan config show does not yet print workspace.worktree_grant_class — the key is honored everywhere it matters, but the show projection omits it. Set it, then verify with the composing verb's own output.
3. The config set help text lists a subset of keys. This document is broader than --help; they should be reconciled. The unknown-key error, unlike the help text, is complete.
4. scheduler.usage_probe_after_exhausted is parsed but consumed by nothing yet (§4).
5. Four policy fields have a closed enum with load-time validation — trust.enforce, org.supersede_policy, ssh_host_key_policy (both tiers) and run.confinement. Every future policy field should follow that route rather than a free string.