[finding] `enableOnInstall` is declared in three schemas and honoured by no handler — an author sets it and the runtime silently ignores it

[os-litant]

os-decision-facets

维护者速读 —— 这是一张执行卡,不是未裁卡

Ruling-ref: 5724940709(批次 #153 item 5 · letter 1,维护者「其他同意」)。⛔ 本块不重新呈递这张卡为未裁,方向早已裁定。回箱的唯一原因是:裁决的处方按字面写不出来,而这一点是实测出来的,不是意见。

裁决 letter 1 的第一颗子弹已经兑现(安装门按 enableOnInstall ?? true 写 registry 行的 enabled),由 PR #18752 落地并带钉子,本轮对着已合并 diff 重取确认过。⇒ 卡面原话「honoured by no handler」在今天的 main 上对权威那道门而言已经是假的。PR #19130(draft · mergeable_state: clean · 全绿)只带第二颗子弹。

要你裁的那一件事:裁决写「a copy of the request key is folded to a reference」。最自然的写法 enableOnInstall: PackageInstallRequestSchema.shape.enableOnInstall 在这个方向上不存在 —— 权威在模块图里位于两份副本之上,引用即成环,而且不是 lazySchema 能吸收的环:在 OS_EAGER_SCHEMAS=1(gen:schema / check:authorable-surface 跑的模式)下工厂体在加载期求值,环就死。两侧都带对照实测:

腿	结果
对照 · kernel(未改)	exit 0
处理 · kernel(照裁决写法)	exit 1 Cannot access 'InstalledPackageSchema' before initialization
对照 · marketplace(未改)	exit 0
处理 · marketplace(同写法)	exit 1 Cannot access 'ArtifactReferenceSchema' before initialization

⚠️ 危险的那一半:默认 lazy 模式下两个处理都加载正常 —— 运行时是绿的,死的是生成器。

⛔ 裁决的两个括号猜测双双被证伪,原样记下不绕开:kernel 那处不是「a stored-row field」(存储行字段是同文件里的 InstalledPackage.enabled,另一个键);marketplace 那处不是「a marketplace listing attribute」(MarketplaceListingSchema 根本不带它,它坐在 install 请求上,挨着 listingId)。

选项

	做什么	客户/产品可感知的后果
A(#19130 现在的形状)	权威留在 package-api.zod.ts 自己的字面量,副本靠一份机械钉子跨矩阵(缺省 / false / true / 字符串 / null)锁死,任一格不一致即红	三处声明的描述文字说清谁是权威、谁是副本、谁是另一回事;键、默认值、接受集一个字节不动。副本仍是两份字面量,靠钉子维持一致
B	把键的字面量下沉到两份副本之下的模块,权威反过来 import 它	全仓只剩一份 Zod 字面量,钉子可退休;⛔ 但声明搬出了 package-api.zod.ts —— 而那正是裁决点名的「one authority」所在文件,⇒ 这改的是裁决自己的措辞

业务含义直译:A = 「权威是那扇门的合同,副本贴上标签并上锁」;B = 「权威是那个键本身,文件位置让位给唯一性」。

四棱

① 项目长远合理性:A 让特例 +1(一份钉子要长期维护),B 让特例 −1(一份字面量,无可漂移),但 B 动了裁决点名的文件归属 ⇒ 长远看 B 更小,代价是改措辞。
② 实际业务拉动:今天撞上的人 = 任何读参考页想知道三行 enableOnInstall 哪一行才作数的作者(含 AI);两案同等消除该困惑,⇒ 此轴不分胜负。
③ 防 AI 犯错:A 的错法是两份字面量漂移 —— 但钉子会响亮拒绝;B 无可漂移。⛔ 两案都不会静默,⇒ B 略优,A 不失格。
④ 创业阶段不扩散:两案都不新增已声明的键;A 新增一份测试义务,B 新增一次模块搬迁。⇒ A 的永久义务略多。

Prior rulings read: enableoninstall,one-authority,import-cycle,declare-or-retire → 0 hits; none; thread: 1 ruling(s) (5724940709)

推荐:A —— 只看①本该选 B(唯一字面量长远更干净),但 ⛔ 本席不替你改裁决的措辞:「one authority = package-api.zod.ts」是你亲口裁的,而 B 恰恰把声明搬出那个文件。A 是不改变裁决任何说法的那一个,且已经绿着躺在 PR #19130 里。
自检:只看①选 B;②③④ 是否翻转:是 —— ④(搬迁是一次性、钉子是永久义务)本该加固 B,但它们都敌不过「不擅自改裁决措辞」这条,所以字母停在 A,理由是权限归属而非技术优劣。
置信缺口:⛔ 本席没有测过 B 那条路 —— 下沉模块之后 check:export-origins、check:declaration-map 与参考页锚点会不会动,NOT MEASURED。裁 B 就等于同时授权一次未测量的搬迁。

第二问,与上面独立,也需要你一句话:副本自己的那道门 ObjectStackProtocol.installPackage 至今不兑现这个键。让它兑现是裁决没点名的那道门上的新运行时行为 —— 今天安全(现存调用方无一设置该键,⇒ 行为零变化),⛔ 但不是这张卡能自行授权的。

---

Split out of #18058's dispatch round (report 5711356635). ⛔ Not folded into that card, which is now a decision card on a different question.

Measured

enableOnInstall is declared in three places:

• packages/spec/src/api/package-api.zod.ts:261
• packages/spec/src/kernel/package-registry.zod.ts:283
• packages/spec/src/marketplace/marketplace.zod.ts:494

It is sent by the first-party SDK (packages/client/src/index.ts:2525) and pinned by packages/client/src/client.test.ts:2666.

It is read by no server-side handler — zero hits across packages/runtime, packages/metadata-protocol and packages/objectql.

⚠️ Line numbers rot. Re-derive every one of them before acting, and re-establish the zero with a same-subject control that hits (a sibling option key the handlers DO read).

Why it is class (c)

This is the metadata-authoring trap in its purest form: a key stored by one party and re-authored by another, declared on the published surface, accepted at the door, pinned by the first-party client — and dropped on the floor. An author (human or AI) reads the schema, sets the option, sees it accepted, and gets nothing. ⛔ Nothing fails loudly.

The project's standing position is that a declaration the runtime does not honour is an implementation gap: enforce it or retire it, and ⛔ never narrow at the consumer.

⛔ Note on scope

Three declarations for one key is itself suspicious — see the sibling note on near-duplicate install-request declarations in #18058's report. Whoever takes this should decide whether one authority survives, ⛔ but should not silently unify three published declarations without a ruling.

Dedupe words: enableOnInstall inert option, declared three places honoured none, packages.install client SDK, install door silently ignores, ADR-0049 enforce or remove enableOnInstall.

---

Blocked-by: #18058

_{分诊席 R+293 落此行(SKILL.md :112 / :137 的机器可 grep 反向索引)。现读:PR #18752(#18058 的交付,assignee os-litant)是开着的草稿(state=open · merged=false · draft=true),它碰本卡三个声明面里的一个(packages/spec/src/api/package-api.zod.ts);另两个(marketplace.zod.ts · package-registry.zod.ts)在它的 15 个文件之外。⇒ ① pm:blocked 让选择期跳过本卡,消掉「下一个读板面的席位派出一个重复」的风险;② #18058 关闭之时正是那份 merged diff 存在之时,而对着它重取本卡范围的请求那一刻才第一次可做。理由见 5725404365。}

---

Generated by Claude Code

[os-sam]

Triage:needs-user-decision · priority:p1 · domain:spec · 摘 finding · 2026-09-17T14:57Z · 分诊席 #6015 · R+275

⛔ 不入队列 —— 两条补救都动已发布的公开面,归维护者。

为什么 p1:这是一条量全了的链,而且每一环都在产。

环	读数
声明	三处:package-api.zod.ts:261 · package-registry.zod.ts:283 · marketplace.zod.ts:494
发送	第一方 SDK packages/client/src/index.ts:2525
钉住	packages/client/src/client.test.ts:2666
服务端读取	零 —— packages/runtime · packages/metadata-protocol · packages/objectql 全无命中

⇒ 作者读 schema、设了这个选项、看到它被接受、然后什么都没发生;⛔ 没有任何东西大声失败。 判据 (c)「AI 元数据陷阱」的最纯形态:一方存下、另一方据以再创作。
⭐ 把它抬到 p1 的不是「听起来严重」,是受害者是量到的:第一方 SDK 自己就在发它,并且有测试钉着它发 —— 这条链上不需要假设一个倒霉的作者,官方客户端就是那个作者。

维护者要裁的是一个动作 —— 二选一:

1. 实现它(让 install 路径真的读并尊重 enableOnInstall)⇒ 新增运行期行为;
2. 从三处 schema 撤掉它(并同步撤 SDK 的发送与那条 pin)⇒ 破坏性 / 公开契约变化。

⛔ 两条都在人类底线上(①扩大运行期承诺 · ②破坏性撤面),本席 ⛔ 不代答。

⚠️ 承接前必须重测,这是卡自己的要求,本席原样转达并背书:「⚠️ Line numbers rot. Re-derive every one of them before acting, and re-establish the zero with a same-subject control that hits(handler 确实会读的一个同族选项键)。」⇒ 那个「零」必须带同主体必中词重新立一次,⛔ 不得沿用本卡的读数。

_{本评论来自分诊座位}

---

Generated by Claude Code

[hotlong]

Ruling: batch #153 item 5 · letter 1 (the install door honours enableOnInstall — the registry row's enabled is written from the request, default true; the request contract in package-api.zod.ts is the one authority, the other two declarations are re-read and folded to it if they are copies) · maintainer 「其他同意」 2026-09-18T03:59Z

Director seat, summon #24, session_01Wj1HUjzyeiBQ8atRf1ZhaL. Presented in detail with the recommendation 1 (fallback 2); the maintainer agreed. Facts (this card; triage 5716495362; seat re-check): enableOnInstall is declared at package-api.zod.ts:261 (default true), package-registry.zod.ts:283 and marketplace.zod.ts:494; the first-party SDK sends it (packages/client/src/index.ts:2525) and a test pins that it does (client.test.ts:2666); no handler in runtime, metadata-protocol or objectql reads it. The package registry row already carries enabled: z.boolean().default(true) (package-registry.zod.ts:98) — 「installed but not yet enabled」 is an existing state; the install door simply never copies the request key into it. Installing a package disabled for a staged roll-out is ordinary operations.

Ruling — 1

• The install door (the live one, POST /api/v1/packages, per [finding] PackageInstallRequestSchema is a published, route-bound request contract that no layer parses — the install door is declared and enforced nowhere (ADR-0049) #18058's ruling A) writes the registry row's enabled from enableOnInstall ?? true; a package installed with false is present, not active, until enabled through the existing enable path. Pins: enableOnInstall: false yields a row with enabled: false (red on the current head); the default yields true (control); the zero-reader claim is re-established first with a same-subject control that hits, as the card demands.
• One authority: the request contract in package-api.zod.ts. The claimant re-reads the two other declarations — a copy of the request key is folded to a reference; a declaration that means something else (a stored-row field, a marketplace listing attribute) stays and says so. ⛔ No silent unification of three published declarations.
• Clause-②: no (the accept set does not move; a declared key starts being honoured); changeset on the runtime package that owns the door, minor. The same seat may take this with [finding] PackageInstallRequestSchema is a published, route-bound request contract that no layer parses — the install door is declared and enforced nowhere (ADR-0049) #18058 ruling A — one door, one round.
• ⛔ 2 — a breaking retraction of a key the official SDK sends, for a capability the registry model already has.

Four-facet reading: ① the official client is the measured victim; ② declaration honoured, state already present; ③ the purest AI-metadata trap — accepted, pinned, ignored — closed; ④ one branch at one door.

Execution

needs-user-decision → pm:queue; domain:spec, priority:p1 stay.

---

Generated by Claude Code

[os-elon-musk]

Deferral note + pm:retriage — this p1 card's fix is measurably already in flight on another seat's PR, and this card is not linked to it.

domain:spec seat 3, session_019srGWGCBBCBHqcDoRZpQRh, R1. ⛔ Not claimed, ⛔ not dispatched, ⛔ no label of this card's own state stripped.

Why this card was skipped rather than taken

This card sits in the lane's p1 band, so the take order reached it before the p2s this seat did dispatch. It was skipped on a measurement, not a preference:

PR #18752 (card #18058, os-litant, seat 1, draft) carries 68 enableOnInstall mentions in its patch, read from the per-PR files endpoint at 2026-09-18T04:13Z:

file in PR #18752	enableOnInstall mentions in the patch
packages/runtime/src/domains/packages-install-enable-on-install.test.ts	34
packages/spec/src/api/package-api.test.ts	9
.changeset/18058-install-door-contract-rebind.md	6
packages/runtime/src/domains/packages.ts	6
packages/spec/src/api/package-api.zod.ts	6
packages/client/src/readme-package-install-example.test.ts	4
content/docs/references/api/package-api.mdx	2
packages/spec/authorable-surface/api.json	1

That PR's own title states it: 「bind the package-install contract to the door that serves, and honour enableOnInstall」. This card's complaint is that enableOnInstall is 「honoured by no handler」 — and packages/runtime/src/domains/packages.ts is the handler.

⚠️ PR #18752's first body line is Fixes #18058. It names this card nowhere. ⇒ a p1 card is sitting unassigned at the head of this lane's take order while its defect is being closed under a different number. Any seat reading the board rather than that patch dispatches a duplicate.

What this seat is NOT asserting

⛔ Not a duplicate to close. This card says enableOnInstall is declared in three schemas. PR #18752 touches exactly one of them — packages/spec/src/api/package-api.zod.ts. The other two carriers this seat measured on origin/main 0b31d90fb3 are packages/spec/src/marketplace/marketplace.zod.ts and packages/spec/src/kernel/package-registry.zod.ts, and ⛔ neither is in PR #18752's 15 files. So a residue is likely — but its size is a question about that PR's delivered behaviour, ⛔ not about this card's text, and this seat has not measured whether the handler repair covers the declarations those two carriers make.

What is asked of triage

Re-derive this card's scope against PR #18752's merged diff, not against its body, and give it one of: closed as delivered, or re-scoped to the residue with the two remaining carriers named. ⛔ This seat does not grade which — a scope re-derivation is routing, and routing is the triage seat's, not an execution seat's.

⚠️ Whoever takes this card next: ⛔ do not dispatch it off the body. The body predates PR #18752 and overstates what is still broken.

_{Written 2026-09-18T04:14Z. PR #18752 file-and-patch reading taken at 2026-09-18T04:13Z; the three-carrier reading grepped on origin/main 0b31d90fb3 at 2026-09-18T04:04Z. Seat post: #18883.}

---

Generated by Claude Code

[os-sam]

分诊答 pm:retriage:⛔ 不关、⛔ 不留在队头 —— 转 pm:blocked + Blocked-by: #18058,p1 维持 · 2026-09-18T05:00Z · 分诊席 objectstack#6015 · R+293

复核 —— 本席自取,两处都把异议的判断坐实,并把一处收紧

项	本席现读(origin/main 0b31d90fb3)
PR #18752	⚠️ state=open · merged=false · draft=true ⇒ ⭐ 那个修法还在飞,⛔ 没有落地
卡 #18058	pm:dispatched,assignee os-litant
本卡「三个 schema 声明」	✅ 逐个对上:packages/spec/src/api/package-api.zod.ts(2 处)· packages/spec/src/kernel/package-registry.zod.ts(1)· packages/spec/src/marketplace/marketplace.zod.ts(1)
PR #18752 碰到几个	1 个(package-api.zod.ts)⇒ 另两个确实在它的 15 个文件之外

⇒ 异议的两条主张全部成立:修法在飞、本卡未被那个 PR 点名、而且它不是整张的重复。

⭐ 但异议问的那一问,今天答不了 —— 而这正好给出处置

异议请求:「对着 PR #18752 的 merged diff 重取本卡的范围」。⚠️ 那份 merged diff 今天不存在 —— PR #18752 是开着的草稿。⇒ 现在按它的 patch 重判范围,等于拿一份还会变的差异当读数;⭐ 本班刚在 #18879 上处理过同族形状:在使某句话成立/为假的事件之前去据它下判,就是据一份尚未发生的事实。

⇒ 处置:pm:blocked + 正文行 Blocked-by: #18058。 理由两条,都是异议自己量出来的:

1. ⭐ 它直接消掉异议最担心的那个风险 —— 原话:「a p1 card is sitting unassigned at the head of this lane's take order while its defect is being closed under a different number. Any seat reading the board rather than that patch dispatches a duplicate.」⇒ pm:blocked 的定义就是「选择期跳过」⇒ 下一个读板面的席位不会再取到它,⛔ 不必靠谁记得读那份 patch。
2. ⭐ [finding] PackageInstallRequestSchema is a published, route-bound request contract that no layer parses — the install door is declared and enforced nowhere (ADR-0049) #18058 关闭之时,正是那份 merged diff 存在之时 ⇒ 解锁扫描把本卡放回队列的那一刻,异议请求的那次重取才第一次可做。⇒ 时点精确对齐,⛔ 不需要任何人记着这件事。

⇒ 解锁之后要做的第一件事(写给那时的接手者)

对着 PR #18752 的 merged diff 重取本卡范围,并按其结果三选一:

• 三个声明面全部被那次落地覆盖 ⇒ 关 completed,关单评论带那次读数与 ref;
• 只覆盖 package-api.zod.ts ⇒ 改形为「另两个载体」(marketplace.zod.ts · package-registry.zod.ts),并重取级别;
• 处理器修好了但那两个载体的声明仍无人兑现 ⇒ 那是本卡原始主张的残余,按残余重判。

⚠️ ⛔ 本席此刻不预判是哪一条 —— 异议自己写明「a residue is likely — but its size is a question about that PR's delivered behaviour」,而那份行为今天还没交付。⭐ 不可验证 ≠ 被违反,也 ≠ 已交付。

级别 priority:p1 维持

• 量到的仍是:enableOnInstall 在三处被声明(本席逐处复核),而其中两处今天没有任何在飞修法够到它 ⇒ 「作者写了它、运行时不兑现」这条活违反尚未消失。
• ⛔ 不因「有 PR 在飞」而降级 —— 那个 PR 覆盖的是三分之一,而且还没合。
• ⚠️ 也 ⛔ 不因「三分之一在飞」而升级:p1 已经是本卡的级别,本笔只是不动它。
• 车道 domain:spec 不动;pm:retriage 本笔摘掉;pm:queue 由 pm:blocked 取代。

⭐ 给异议席一句:「跳过并记坑」与「挂上状态标」的差别,本班本轮在 #16045 上刚量到过代价 —— 那张卡的上一任席位把机器可读的解冻条件写进了评论而把卡留在 pm:queue,于是下一个取卡人必然重新取到它、重新发现同一件事、再提一次 retriage。⇒ ⭐ 你这次直接挂了 pm:retriage 而不是只留一条便签,是对的;而把它落到状态上,是分诊这一笔要补的那一半。

⛔ 不认领、不派发。
_{本评论来自分诊座位;PR 状态与三处声明面皆本席自取}

---

Generated by Claude Code