@@ -145,14 +145,33 @@ README.md
   `.strict()` at the top level (`config.ts`) — so a key no version of
   TypeScript has ever declared throws a `ZodError` and resolution never
   reaches the source-listing step at all, while Java/C#/Python all resolve
-  successfully, silently ignoring it. Not added as a shared `expectFiles`
-  case here because doing so would need EITHER loosening `ConfigSchema`'s
-  top-level strictness (a reference-implementation behavior change with a
-  blast radius well beyond source resolution — every `loadConfig` caller,
-  not just this corpus) OR asserting a `true`-sentinel `expectError` that
-  TypeScript alone would satisfy, contradicting the other three ports'
-  actual success — neither of which this corpus is positioned to decide
-  unilaterally. Left as an open, human-reviewable follow-up.
+  successfully, silently ignoring it.
+
+  **RULED: the asymmetry is INTENDED, and neither side moves.** It is not a
+  defect that leaked; it falls out of who owns the file. `.metaobjects/config.json`
+  is TypeScript's, and TypeScript is the only port that models its whole
+  vocabulary — so it is the only port that CAN tell a typo from a key a sibling
+  owns. `.strict()` is what converts that knowledge into a diagnostic, and the
+  hazard is specific and proven: a stripped `scopes` (for `scope`) silently means
+  "everything in scope", and a stripped `migrate.scopee` silently governs the whole
+  database. Java, C# and Python know only `schema_version` + `sources`; for them
+  every other key is indistinguishable from a TS-owned one, so strictness there
+  could only be imitated by embedding TypeScript's key list and keeping it in
+  lockstep forever — at which point any port a release behind would REJECT a
+  config a newer `meta` had just written. Tolerance is the only coherent behaviour
+  for a partial reader, and strictness the only coherent behaviour for the owner.
+
+  So this stays OFF the shared corpus permanently — not deferred. A shared case
+  asserts ONE outcome, and the correct outcome here differs by port BY DESIGN;
+  adding one could only be done by making some port wrong. Each half is pinned in
+  the port that owns it instead: TypeScript's in `sdk/test/config.test.ts`
+  (unknown top-level key ⇒ throws, alongside the nested `scopes`/`scopee` cases),
+  and the tolerant half in `SourceResolverTests.cs`,
+  `tests/config/test_source_resolver.py` and `SourceResolverTest.java`
+  (unknown top-level key ⇒ resolves normally). The
+  forward-compatibility cost is real and accepted: a config written by a NEWER
+  `meta` hard-fails an OLDER one. That is what `schema_version` is for, and a loud
+  failure beats a `scope` that silently matched everything.
 
 ## Order is deliberately NOT pinned
 
 
@@ -42,4 +42,45 @@ public void TwoUnresolvablePaths_ReportsTheContentFirstOne()
             Directory.Delete(root, recursive: true);
         }
     }
+
+    /// <summary>
+    /// A genuinely unknown top-level key resolves normally here, and THROWS in
+    /// TypeScript. That asymmetry is ruled INTENDED in the source-resolution corpus
+    /// README: TypeScript owns this file and models its whole vocabulary, so only it
+    /// can tell a typo from a key a sibling owns. This port models the neutral subset
+    /// (`schema_version` + `sources`), for which every other key is indistinguishable
+    /// from a TypeScript-owned one — imitating strictness would mean carrying TS's key
+    /// list and rejecting a config a newer `meta` had just written.
+    /// </summary>
+    /// <remarks>
+    /// Deliberately NOT a shared corpus case: a shared case asserts one outcome and
+    /// the correct outcome differs by port, so adding one could only be done by making
+    /// some port wrong. This is the tolerant half.
+    /// </remarks>
+    [Fact]
+    public void AnUnknownTopLevelConfigKey_IsIgnored_NotRejected()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "source-resolver-unknownkey-" + System.Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        try
+        {
+            var model = Path.Combine(root, "model");
+            Directory.CreateDirectory(model);
+            File.WriteAllText(Path.Combine(model, "meta.a.json"), "{\"metadata.root\":{\"children\":[]}}");
+
+            var dotMo = Path.Combine(root, ".metaobjects");
+            Directory.CreateDirectory(dotMo);
+            File.WriteAllText(Path.Combine(dotMo, "config.json"),
+                "{\"schema_version\":1,\"sources\":[{\"path\":\"model\"}],\"foo\":1}");
+
+            var resolved = SourceResolver.ResolveCollection(root);
+
+            Assert.Single(resolved);
+            Assert.Equal(Path.Combine(model, "meta.a.json"), resolved[0]);
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
 }
@@ -21,10 +21,13 @@
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.Comparator;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Stream;
 
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
 
@@ -65,4 +68,50 @@ public void twoUnresolvablePathsReportsTheContentFirstOne() throws IOException {
             Files.delete(root);
         }
     }
+
+    /**
+     * The tolerant half of a ruled asymmetry. A genuinely unknown top-level key
+     * resolves normally here and THROWS in TypeScript. Intended, and ruled in the
+     * source-resolution corpus README: TypeScript owns this file and models its whole
+     * vocabulary, so only it can tell a typo from a key a sibling owns. This port
+     * models the neutral subset ({@code schema_version} + {@code sources}), for which
+     * every other key is indistinguishable from a TypeScript-owned one — imitating
+     * strictness would mean carrying TS's key list and rejecting a config a newer
+     * {@code meta} had just written.
+     *
+     * <p>Deliberately NOT a shared corpus case: a shared case asserts one outcome and
+     * the correct outcome differs by port, so adding one could only make some port wrong.
+     */
+    @Test
+    public void anUnknownTopLevelConfigKeyIsIgnoredNotRejected() throws IOException {
+        Path root = Files.createTempDirectory("source-resolver-unknownkey-");
+        try {
+            Path model = Files.createDirectory(root.resolve("model"));
+            Path file = model.resolve("meta.a.json");
+            Files.writeString(file, "{\"metadata.root\":{\"children\":[]}}");
+
+            Path dotMo = Files.createDirectory(root.resolve(".metaobjects"));
+            Files.writeString(dotMo.resolve("config.json"),
+                    "{\"schema_version\":1,\"sources\":[{\"path\":\"model\"}],\"foo\":1}");
+
+            List<Path> resolved = SourceResolver.resolveCollection(root);
+
+            assertEquals(List.of(file.toAbsolutePath().normalize()), resolved);
+        } finally {
+            deleteRecursive(root);
+        }
+    }
+
+    private static void deleteRecursive(Path dir) throws IOException {
+        if (!Files.exists(dir)) return;
+        try (Stream<Path> walk = Files.walk(dir)) {
+            walk.sorted(Comparator.reverseOrder()).forEach(p -> {
+                try {
+                    Files.delete(p);
+                } catch (IOException ignored) {
+                    // best-effort temp-dir cleanup
+                }
+            });
+        }
+    }
 }
@@ -92,6 +92,30 @@ def test_collection_with_no_config_and_no_default_raises(tmp_path: Path) -> None
     assert e.value.code == ErrorCode.ERR_COLLECTION_NOT_FOUND
 
 
+def test_an_unknown_top_level_config_key_is_ignored_not_rejected(tmp_path: Path) -> None:
+    """The tolerant half of a ruled asymmetry.
+
+    A genuinely unknown top-level key resolves normally here and THROWS in
+    TypeScript. Intended, and ruled in the source-resolution corpus README:
+    TypeScript owns this file and models its whole vocabulary, so only it can tell
+    a typo from a key a sibling owns. This port models the neutral subset
+    (``schema_version`` + ``sources``), for which every other key is
+    indistinguishable from a TypeScript-owned one — imitating strictness would mean
+    carrying TS's key list and rejecting a config a newer ``meta`` had just written.
+
+    Deliberately NOT a shared corpus case: a shared case asserts one outcome and the
+    correct outcome differs by port, so adding one could only make some port wrong.
+    """
+    (tmp_path / ".metaobjects").mkdir()
+    (tmp_path / ".metaobjects" / "config.json").write_text(
+        json.dumps({"schema_version": 1, "sources": [{"path": "model"}], "foo": 1})
+    )
+    (tmp_path / "model").mkdir()
+    (tmp_path / "model" / "meta.a.json").write_text("{}")
+    got = resolve_collection(tmp_path)
+    assert _rel(tmp_path, got) == {"model/meta.a.json"}
+
+
 def test_declared_sources_replace_the_default(tmp_path: Path) -> None:
     (tmp_path / ".metaobjects").mkdir()
     (tmp_path / ".metaobjects" / "config.json").write_text(
 
@@ -160,6 +160,20 @@ describe("ConfigSchema — phase-1 source resolution", () => {
       ConfigSchema.parse({ schema_version: 1, migrate: { d1: { bindingg: "DB" } } }),
     ).toThrow();
   });
+  test("rejects a genuinely unknown TOP-LEVEL key — TypeScript's half of a ruled asymmetry", () => {
+    // Java, C# and Python model only `schema_version` + `sources`, so they resolve
+    // this config successfully, ignoring `foo`. That divergence is INTENDED and is
+    // ruled in fixtures/source-resolution-conformance/README.md: TypeScript owns
+    // this file and is the only port that knows its whole vocabulary, so it is the
+    // only one that can tell a typo from a key a sibling owns. A partial reader
+    // could only imitate strictness by embedding TS's key list, and would then
+    // reject a config a newer `meta` had just written.
+    //
+    // Deliberately kept OFF the shared corpus: a shared case asserts one outcome,
+    // and the correct outcome here differs by port. This is TS's half; the tolerant
+    // half is pinned in each of the other three ports.
+    expect(() => ConfigSchema.parse({ schema_version: 1, foo: 1 })).toThrow();
+  });
   test("an existing config with no new keys still parses (back-compat)", () => {
     const p = ConfigSchema.parse({
       schema_version: 1, pending_in_git: true,