Function load_sealed_package 

pub fn load_sealed_package(
    files: &[(String, Vec<u8>)],
) -> Result<Schema, SchemaLoadError>

Load a sealed schema package from its (relative-path, bytes) file list — the shape every sealed surface carries: a published .mem archive’s .memstead/schema/ tree, the git-branch __MEMSTEAD:schemas/<name>@<version>/ tree, a built-in version directory. Paths are package-relative (schema.yaml, types/<stem>.yaml, schema-format.json); anything else is ignored.

One function so the surfaces that admit a sealed package (the archive validator) and the surfaces that later read it back (the local schema source the install stages into) can never disagree — a package valid to publish stays valid to install. The metadata polarity comes from the package’s own format marker, and keys retired after the package was sealed read with their written meaning instead of refusing.

Authoring content takes load_schema_from_dir instead, which refuses retired keys loudly so the author can act.