Known limitations of this surface

Recorded deliberately — a document that hides its own gaps is worse than none.

1. Some unknown keys written directly INTO THE FILE are silently ignored. Many sections are closed and refuse an unknown key by name when the file loads — among them [class], [channel], [gateway], [license], [oauth_server], [run.codex], [enforcement], the credentials section, the lane sections and the per-host sections. Others, such as [run], still skip a key they do not know, so a typo there does nothing and says nothing. saphan config set itself always rejects an unknown key and lists the valid ones — the silent skip applies only to hand-edits that bypass the verb. There is no separate validation command; after a hand-edit, read the value back with saphan config show.
2. saphan config show does not print workspace.worktree_grant_class. The key is honoured everywhere it matters, but the show projection omits it. Set it, then confirm it from the output of the verb that uses it.
3. scheduler.usage_probe_after_exhausted is parsed and shown, but nothing acts on it yet.