fix(release): validate non-console config keys with target loader

scripts/stack-release.sh

@@ -1073,27 +1073,37 @@ slot_problem() {
     [ "$size" != 0 ] || echo "is empty"
 }
 
-# Row 200 item 3 and the design's phase 2 rollback order: a config.json with a `console` key must be
-# one the target's loader reads, or its bus, Console and seats fail on their next read. Runs the
-# target's own scripts/mosaic-config.mjs validate; its output, the resolved config, is not kept.
+# Row 200 item 3 and #1797: every existing parseable config must be one the
+# target loader reads. Older copies without a loader accept only the four keys
+# in c3d29e796's first loader. A console or federation key (row 203) keeps its own refusal text.
+# Resolved config stdout is never kept.
 config_checks() {
-    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first
-    # 0: a console or federation key (row 203: a pre-203 loader refuses federation too); 1: neither, or no file; 2: the file doesn't parse, so whether it holds the key
-    # is unknown, and the run refuses rather than pass it (webby-0028 N2). load_config already exits on
-    # such a file before anything is read or stopped, so this is reached only if the file changes after it.
+    local cfg="${MOSAIC_CONFIG:-$HOME/.config/mosaic-dev/config.json}" out loader="$COPIES/$TO/scripts/mosaic-config.mjs" first extra
+    # 1: missing file; 2: unreadable JSON. This also fences a change after load_config.
+    # extra: "console" or "federation" first (row 203: a pre-203 loader refuses federation too),
+    # then the first key outside the oldest set.
     local key=0
-    node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
-process.exit(d!==null&&typeof d==="object"&&(Object.hasOwn(d,"console")||Object.hasOwn(d,"federation"))?0:1)' -- "$cfg" 2>/dev/null || key=$?
+    extra="$(node -e 'const fs=require("fs"),f=process.argv[1];if(!fs.existsSync(f))process.exit(1);let d;try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch{process.exit(2)}
+const oldest=["configVersion","environment","dataRoot","execution"];
+if(d===null||typeof d!=="object"||Array.isArray(d)){process.stdout.write(JSON.stringify("[configuration shape]"));process.exit(0)}
+const k=Object.hasOwn(d,"console")?"console":Object.hasOwn(d,"federation")?"federation":Object.keys(d).find(k=>!oldest.includes(k));if(k!==undefined)process.stdout.write(JSON.stringify(k))' -- "$cfg" 2>/dev/null)" || key=$?
     [ "$key" != 1 ] || return 0
     if [ "$key" != 0 ]; then
         check_refuse config-console-key "$cfg cannot be read as JSON, so whether $TO's loader reads it is unknown; fix the config first, then run the $OP again"
         return 0
     fi
-    if [ ! -f "$loader" ]; then out="it has no scripts/mosaic-config.mjs"
+    if [ ! -f "$loader" ]; then
+        [ -n "$extra" ] || return 0
+        if [ "$extra" = '"console"' ] || [ "$extra" = '"federation"' ]; then out="it has no scripts/mosaic-config.mjs"
+        else out="it has no scripts/mosaic-config.mjs to validate configuration key: $extra"; fi
     elif out="$(MOSAIC_CONFIG="$cfg" node "$loader" validate 2>&1 >/dev/null)"; then return 0
     fi
     first="${out%%$'\n'*}"
-    check_refuse config-console-key "$cfg holds a console or federation key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
+    if [ "$extra" = '"console"' ] || [ "$extra" = '"federation"' ]; then
+        check_refuse config-console-key "$cfg holds a console or federation key, and $TO's loader refuses it ($first); remove the key first (restore the config.json backup from the window's step 1), then run the $OP again"
+    else
+        check_refuse config-console-key "$cfg is refused by $TO's loader ($first); remove the refused key first (restore the config.json backup from the window's step 1), then run the $OP again"
+    fi
 }
 
 # Row 189 (mos-0972): --no-send drops --send from RUN_CONSOLE, so the unit and the pointer both lose