fix(07): WR-05 document _apply_section dict/skip filters + lock contract

The original "skip nested tables (hook/eval/cache/mcp) — handled by
_apply_nested" comment in _apply_section was misleading: today none
of the _NESTED_TABLES first segments collide with a non-dict
ResolvedConfig attribute, so the inner skip_first_segments branch
is unreachable. Document it as defense-in-depth for future scalar
fields whose names collide with a nested table prefix.

Add regression test test_flat_classifier_rooms_under_supamem_is_ignored
to lock the documented behavior: a flat
"classifier_rooms = { ... }" under [supamem] is intentionally
dropped by the dict-typed filter, forcing users onto the canonical
[supamem.classifier.rooms] nested-table shape.

Author: dzmitrys-dev

src/supamem/config.py

@@ -183,13 +183,31 @@ def _apply_section(
     section: dict[str, Any],
     source: Source,
 ) -> None:
-    """Apply flat field overrides from a [supamem] / [tool.supamem] section."""
-    # For dotted nested keys (e.g. "mcp.caps") only the FIRST segment
-    # ("mcp") ever appears as a top-level key in the TOML data — skip that.
+    """Apply flat field overrides from a [supamem] / [tool.supamem] section.
+
+    Notes on the two filters below:
+
+    * ``isinstance(getattr(cfg, key), dict)`` — already excludes dict-typed
+      fields (e.g. ``classifier_rooms``). A user who writes a flat
+      ``classifier_rooms = { ... }`` under ``[supamem]`` (instead of the
+      canonical nested ``[supamem.classifier.rooms]`` table) has their
+      value INTENTIONALLY ignored here; the only supported shape is the
+      nested table consumed by ``_apply_nested``. See
+      ``test_flat_classifier_rooms_under_supamem_is_ignored``.
+
+    * ``key in skip_first_segments`` — defense-in-depth for a future
+      scalar field whose name happens to collide with a nested table's
+      first segment (e.g. someone adds a flat ``mcp`` attribute on
+      ``ResolvedConfig`` while ``[supamem.mcp.caps]`` already exists).
+      Today none of the entries in ``_NESTED_TABLES`` ("hook", "eval",
+      "cache", "mcp", "transcript", "classifier") match a non-dict
+      attribute on ``ResolvedConfig``, so this branch is unreachable,
+      but it stays as a guard against silent setattr accidents on
+      future schema additions.
+    """
     skip_first_segments = {sub.split(".", 1)[0] for sub, _ in _NESTED_TABLES}
     for key, value in section.items():
         if hasattr(cfg, key) and not isinstance(getattr(cfg, key), dict):
-            # skip nested tables (hook/eval/cache/mcp) — handled by _apply_nested
             if key in skip_first_segments:
                 continue
             setattr(cfg, key, value)

tests/test_config.py

@@ -197,3 +197,29 @@ def test_classifier_rooms_provenance_default(
     assert chain.classifier_rooms == "default"
     assert list(cfg.classifier_rooms.keys())[0] == "tests"
     assert list(cfg.classifier_rooms.keys())[-1] == "backend"
+
+
+def test_flat_classifier_rooms_under_supamem_is_ignored(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A flat ``classifier_rooms = { ... }`` under ``[supamem]`` is intentionally
+    ignored — only the canonical ``[supamem.classifier.rooms]`` nested table is
+    honored. Locks WR-05 contract: dict-typed fields are excluded by
+    ``_apply_section`` (``isinstance(..., dict)`` filter), so the user's
+    flat-form value is silently dropped and defaults remain in effect.
+    """
+    monkeypatch.delenv("SUPAMEM_CONFIG", raising=False)
+    cfg_dir = tmp_path / ".supamem"
+    cfg_dir.mkdir()
+    (cfg_dir / "config.toml").write_text(
+        "[supamem]\n"
+        'classifier_rooms = { backend = ["src"], tests = ["tests"] }\n',
+        encoding="utf-8",
+    )
+    cfg, chain = load_config(tmp_path)
+    # User's flat-form override is dropped — defaults still in effect.
+    assert chain.classifier_rooms == "default"
+    assert list(cfg.classifier_rooms.keys())[0] == "tests"
+    assert "backend" in cfg.classifier_rooms
+    # Default backend prefix list is the shipped one, not the user's ["src"].
+    assert cfg.classifier_rooms["backend"] != ["src"]