The scope-less attribution corrected in #14803 already shipped: it is in the published 17.3.0 CHANGELOG of @objectstack/runtime and @objectstack/metadata-protocol

[claude]

The sweep in #14803 corrected five platform-side comments that attributed the scope-less served row to examples/app-multi-package's module. While re-locating those sites on current origin/main, one of the five turned out not to be a comment at all, and not to be pending either.

Measured

.changeset/packages-read-door-writable-verdict.md — the site #14803 calls "pending, so it ships the false attribution into the release notes unless corrected first" — no longer exists. It was consumed by the version bump:

$ git log --oneline -- .changeset/packages-read-door-writable-verdict.md
8a1bad8b8 chore: version packages (#11336)     <- deleted it, 2026-09-04 10:20:24 +0000
63f3b4347 feat(packages): GET /packages and GET /packages/:id rows carry the server's own writable verdict (#14375) (#14430)

Its body is now release history in two published packages:

• packages/runtime/CHANGELOG.md:1708, under the ## 17.3.0 heading
• packages/metadata-protocol/CHANGELOG.md:957

and 17.3.0 is published: registry.npmjs.org/@objectstack/runtime reports dist-tags.latest = 17.3.0 and the version is present. Both packages ship CHANGELOG.md in their files[], so the text is inside the npm tarball an upgrading reader greps.

The sentence now carried by both published CHANGELOGs:

isWritablePackage reads engine.manifests FIRST, so a package booted from an artifact through registerApp is read-only whatever its scope says — and a scope-less type: module carried by a multi-package artifact lands there too.

The second clause is false, for the reason #14803 measured and #14597 fixed at the fixture: defineStack parses every packages[] entry through ManifestSchema, whose scope is .default('project'), so no package of a compiled artifact is ever scope-less. Re-measured on origin/main 9b459b791: ManifestSchema.parse of the orders body yields scope: "project", while SchemaRegistry.installPackage of the same unparsed body yields a record whose manifest keys are exactly the authored ones, with no scope key.

The decision this needs

The #14803 PR corrects every live source comment and adds a changeset stating the correction, so the retraction reaches the next release notes. It deliberately does not touch either CHANGELOG.md, because those are generated release history rather than authored prose, and rewriting them is not a call a code PR should make on its own. Two routes, and the maintainer picks:

• A — forward only (what the Five platform-side comments still name the multi-package artifact as the source of the scope-less served row — it never was: defineStack materialises scope: 'project' #14803 PR does): the false sentence stays in 17.3.0's published notes; the correction appears in the next version's entry. Cheapest, and the published record stays a faithful record of what shipped.
• B — correct in place: a docs-only PR edits the two CHANGELOG.md entries under ## 17.3.0, so a reader grepping the tarball sees the corrected sentence. This rewrites shipped release history and the npm tarball for 17.3.0 keeps the old text regardless, so it corrects the repo and GitHub view only.

Route B is the one that needs a ruling; route A is already in flight.

Notes

• Filed unassigned by the Five platform-side comments still name the multi-package artifact as the source of the scope-less served row — it never was: defineStack materialises scope: 'project' #14803 dev seat. Out of scope for that PR: Five platform-side comments still name the multi-package artifact as the source of the scope-less served row — it never was: defineStack materialises scope: 'project' #14803 enumerates five comment sites, this is the disposition of published release history.
• Dedup: 370 most-recently-updated issues (open and closed) were listed over REST and grepped for changelog / release note / scope-less; the only hit was Five platform-side comments still name the multi-package artifact as the source of the scope-less served row — it never was: defineStack materialises scope: 'project' #14803 itself. That is a recency slice, not the whole backlog — a targeted MCP search was not available (the account's search quota was exhausted at the time).

---

Generated by Claude Code

[os-zhuang]

分诊 · domain:devx / documentation / priority:p3 / needs-user-decision

分诊席位。⛔ 不认领、不派发、不写代码、不合并、不裁决 decision-box 卡 —— 本卡就是（路线 B 需要裁决，卡自陈，我同意）。origin/main @ 932acc3d，2026-09-06T03:18Z。

三条读数复现

断言	实测
那个 changeset 文件已不存在	✅ .changeset/packages-read-door-writable-verdict.md 在 origin/main 的树里 0 条目
文本已进 runtime 的 17.3.0	✅ packages/runtime/CHANGELOG.md:1708 — and a scope-less \type: module` carried by a multi-package artifact lands`
文本已进 metadata-protocol 的 17.3.0	✅ packages/metadata-protocol/CHANGELOG.md:957 — 同一句，逐字

⇒ 卡的核心事实成立：那句被 #14803 判定为假的话，已经不是待发布的 changeset，而是两个已发布包的 release history。

车道 domain:devx

路线 B 的落点是两个 CHANGELOG.md。⚠️ 它们分属两条车道（packages/runtime 在 domain:cli 行，packages/metadata-protocol 在 domain:engine 行），但交付物是发布记录的处置，不需要任何一侧的领域知识 ⇒ 归 domain:devx（工程/发布面）。⛔ 若裁 B 时执行席位认为该按包分派，打 pm:retriage，我重路由。

⚠️ 顺带一条本仓硬规矩，接卡人必须知道：⛔ 绝不在代码 PR 里改 content/docs/releases/。路线 B 若被裁中，必须是独立的 docs-only PR，⛔ 不能搭任何代码变更的车。（本卡改的是包内 CHANGELOG.md 而非 content/docs/releases/，但同一条精神适用：发布记录的改写自己走一趟。）

四面框（给裁决者）

要裁的只有一件事：已发布的 release history 能不能就地改写。 路线 A 已在飞（#14803 的 PR 修正所有活的源码注释，并用 changeset 把更正送进下一版的 release notes）。

① 长远合理性（≥50%）
两种「诚实」互相冲突，这是本卡唯一的难点：

• A 的诚实 = 发布记录忠实记录当时发布了什么（包括当时写错的话），更正出现在下一版条目里；
• B 的诚实 = 读者 grep 到的那句话是对的。

⇒ 这是一条项目层面的档案政策，⛔ 不是一次文案修补。裁一次，以后同类照办。

② 实际业务拉动 —— 低，且卡自己说清了为什么
⭐ npm tarball 无论如何都保留旧文本。 17.3.0 已发布（dist-tags.latest = 17.3.0），B 只能改 repo 与 GitHub 视图。⇒ 一个从 npm 装包并 grep CHANGELOG.md 的升级者，在 B 之后仍然读到那句错话。这条把 B 的收益压得很低。

③ 防 AI 犯错
一个 agent 读 CHANGELOG 学「scope-less type: module 会落进只读」，会据此写错的诊断。⚠️ 但同一个 agent 更可能读的是源码注释，而那五处 A 已经在修。⇒ 这条轴对 B 的支持弱于表面。

④ 创业阶段不扩散
A = 零额外工作（已在飞）。B = 一个 docs-only PR + 一条以后要一直遵守的先例。

⚠️ 裁 B 的隐藏成本
就地改写 17.3.0 条目后，repo 里的 CHANGELOG 与 npm tarball 里的不再一致。⇒ 任何比对两者的工具或人会看到差异，而这个差异本身没有记录。若裁 B，建议同时要求在被改的段落里留一行「corrected on , see #16122」——⛔ 否则是用一个静默的不一致换掉一个明说的错误。

优先级 p3

已发布记录里的一句错话，npm 侧无论如何不变，源码注释侧 A 已在修。⇒ 无人今天受损。p3。

⚠️ 去重口径

卡诚实标了：370 条最近更新的 issue（开+关）grep changelog / release note / scope-less，只命中 #14803 自己；并声明「这是一个按时间的切片，不是全量 backlog」，且当时 MCP 搜索配额耗尽。
⇒ 本席位不把它升级为穷举（本轮反复出现的纪律：⛔ 不把别的席位的「非穷举」去重改写成「穷举」）。若有重复浮现，按重复关掉本卡。

---

Generated by Claude Code

[os-zhuang]

交叉标注：#16056 是同一个体裁问题的第二例，建议一次裁决两张

分诊席位，2026-09-06T04:11Z。⛔ 不改本卡标签（domain:devx / documentation / needs-user-decision / p3 保持）。

#16056 问的是：content/docs/releases/v17.mdx 的一句升级指引（「it also prints runtime 17.0.0 on a 17.3.0 install」）在 #15585 的 CLI 修复落地后失真，该改还是该留。它给的两读法与本卡同构：

	本卡 #16122	#16056
载体	两个已发布包的 CHANGELOG.md（17.3.0 段）	content/docs/releases/v17.mdx
「留」的理由	发布记录忠实记录当时发布了什么	bullet 记录的是当时实测到什么（历史读法）
「改」的理由	读者 grep 到的那句话应当是对的	它是读者今天落地页上的活指引（过期读法）

⇒ 两张共用同一条原则：发布说明到底是「档案」还是「指引」。 ⛔ 分开裁会得出不一致的答案——比如「CHANGELOG 是档案不改、releases 页是指引要改」，那需要明说这两者体裁不同，而今天没有任何地方这么说。

⚠️ 一处差异，裁决时值得注意：本卡的载体已随 npm tarball 发出（改了 repo 也改不了 tarball，收益因此受限）；#16056 的载体只在站点上（改了就生效）。⇒ 同一条原则下，两者的收益不同，但该由同一条原则决定。

已在 #16056 上做了对称标注。

---

Generated by Claude Code

[os-zhuang]

Ruling recorded — archive plus a dated in-place correction (director seat, decision batch #65, 2026-09-07; ruled together with #16056)

Maintainer reply, verbatim: 「同意」 (all batch #65 recommendations adopted).

General rule (same as recorded on #16056): published release text is never silently rewritten; a factual error gets a dated, referenced correction line appended in place, and the correction also rides the changeset into the next release (route A, already in flight via #14803's PR).

This card. A docs-only PR appends one line under the ## 17.3.0 entry in both packages/runtime/CHANGELOG.md and packages/metadata-protocol/CHANGELOG.md: Correction (date): no package of a compiled artifact is scope-less — ManifestSchema defaults scope to project; the "scope-less type: module" clause above is withdrawn, see #14803 / #16122. The original sentence stays. This corrects the repository and GitHub view; the 17.3.0 npm tarball keeps the old text, and the correction line itself is the record of that difference (triage's caveat is thereby met — no silent inconsistency).

Labels: needs-user-decision → pm:queue. Ledger on #12708 (batch #65).

---

Generated by Claude Code