spec: `PackageInstallRequestSchema.enableOnInstall` must stop erasing absence at parse time — `.default(true)` hides the case ruling batch #157 item 5 needs the install door to see

[huangyiirene]

Blocked-by: #18605

Filed by the domain:engine execution seat (session_01NcPSwnmJHczmTu6FG7NMjE, seat post #6367) as the sub-card the ruling on #18877 explicitly owes its claimant. Ruling: batch #157 item 5 · letter C (5727164909, maintainer 「其他同意」), director seat summon #24. Its item 5, verbatim:

5. If PackageInstallRequestSchema's enableOnInstall: z.boolean().default(true) erases absence at parse time so the door cannot see it, the declaration becomes optional() with its semantics written on the field (absent = keep the current state; a fresh install lands enabled) ⇒ that half is Clause-②: yes, @objectstack/spec patch changeset, a spec-lane sub-card by charter conflict: does a Clause-②: no PR that touches no contract surface still owe an in-seat review before it can land? #18536 rule 2; the engine half lands with or after it. ⛔ The door does not sniff the raw body around the schema.

⛔⛔ PREMISE CORRECTED 2026-09-20T10:12Z — read comment 5749156912 before acting on this card. The ruling's item 5 is a conjunction, and only its first half holds:

clause	verdict
(a) .default(true) erases absence at parse time	✅ TRUE — package-api.zod.ts:286; lit control package-api.test.ts:85 (parse({manifest}) ⇒ true)
(b) 「so the door cannot see it」	⛔ FALSE — nothing parses an install request through that schema on the serving path

(b), measured on origin/main: PackageInstallRequestSchema occurs in packages/runtime/src/domains/packages.ts only in a comment (no .parse/.safeParse anywhere in that file); the door reads the raw body at :796. PackageApiContracts, which declares the route's input, is defined at package-api.zod.ts:661 and occurs nowhere else but CHANGELOGs and generated api-surface artefacts ⇒ zero runtime consumers. ⚠️ Radius: packages/** + apps/** in THIS repo; a parser in objectui, cloud or a third party is ⛔ outside it and unestablished.

⇒ ⛔ Item 5's optional() prescription is NOT mechanically authorised here — the conjunction it rides on does not hold, and the filing seat ⛔ does not substitute its own direction.

⭐ The card is NOT obsolete — its reason INVERTED

The real divergence arrives when PR #19291 (card #18877) lands:

• packages/spec declares enableOnInstall: z.boolean().default(true) — 「absent means true」;
• the runtime implements ruling letter C — 「absent means preserve this row's current state」.

⇒ a published declaration stating a default the runtime deliberately stops applying — 「declared ≠ enforced」 on a published contract surface. ⛔ A different defect from the one this card was filed for, and it did not exist until letter C was ruled.

The open question, narrowed: once the runtime honours 「缺省 = 保持」, what should the published enableOnInstall declaration say? ⛔ It cannot keep claiming default(true). .optional() with the preserve semantics written on the field remains the obvious candidate — and is still exactly what flips PR #19130's 缺省 pin.

---

Original filing text follows, kept rather than erased.

The ruling makes this card conditional on a measurement. ⭐ The condition measures TRUE.

Measured — ref stated, ⛔ not recalled

Read on origin/main 1739f71879 (== this checkout's HEAD), 2026-09-20T08:45Z:

reading	value	instrument
the declaration	enableOnInstall: z.boolean().default(true) at packages/spec/src/api/package-api.zod.ts:286	git grep -n enableOnInstall origin/main -- 'packages/spec/src/**' ':!*.test.ts'
lit control — absence is really erased	PackageInstallRequestSchema.parse({manifest:{…}}) ⇒ expect(result.enableOnInstall).toBe(true) at packages/spec/src/api/package-api.test.ts:85	git show origin/main:packages/spec/src/api/package-api.test.ts

⇒ a request that omits the key and a request that sets it true are byte-identical after parse. The door at SchemaRegistry.installPackage cannot tell them apart, which is exactly the distinction letter C's rule 2 (「absent ⇒ no lifecycle call」) is built on.

⚠️ Instrument radius, per 「零命中须写仪器可达半径」: the greps above reach declaration sites under packages/spec/src/**. ⛔ Outside that radius, and so NOT established here: whether any non-packages/spec copy of this key also defaults, and what the two sibling declarations below are for. Two further .default(true) sites exist and are named, ⛔ not judged: packages/spec/src/kernel/package-registry.zod.ts:283 and packages/spec/src/marketplace/marketplace.zod.ts:494.

⛔⛔ This card COLLIDES with #18605, which is in the maintainer's decision box right now

This is the reason the card is filed pm:blocked rather than queued, and it is the part a taker must not discover late.

• [finding] enableOnInstall is declared in three schemas and honoured by no handler — an author sets it and the runtime silently ignores it #18605 (domain:spec, p1, needs-user-decision, needs:contract-review) carries draft PR spec: one authority for enableOnInstall, and a read-out of its other two declarations #19130, green, whose option A is described on that card as: 「键、默认值、接受集一个字节不动」 — the key, its default and its accept set do not move — with a mechanical pin locking the matrix 缺省 / false / true / 字符串 / null across all three declarations.
• The 「缺省」 cell of that pin asserts the very behaviour this card must change. .default(true) → .optional() makes 「absent」 stop resolving to true, so that cell flips.

⇒ ⭐ Two rulings meet here and the later one moves the earlier one's ground. Batch #153 item 5 letter 1 (5724940709, 2026-09-18T03:59Z) settled 「one authority = package-api.zod.ts, default true」. Batch #157 item 5 letter C (5727164909, 2026-09-18T08:10Z) — four hours later, on a different card — requires absence to become visible. ⛔ Nothing in the #157 ruling text mentions #18605 or PR #19130, so this seat reads the collision as unnoticed at ruling time, ⛔ not as a silent reversal already decided.

⛔ This seat does not resolve that. Per 「本卡 pin 断言兄弟卡在改的行为 ⇒ 派发令注明,并在用例内预登记翻转触发词,⛔ 不修绿」 the collision is declared, ⛔ not patched green. The sequencing call and any re-ruling belong to the domain:spec seat and the maintainer.

Executable criterion (one line, as the transfer rule asks)

PackageInstallRequestSchema.parse({ manifest }) leaves enableOnInstall undefined, while parse({ manifest, enableOnInstall: true }) still yields true and parse({ manifest, enableOnInstall: false }) still yields false — and the field's own describe/docblock states the semantics letter C fixes: absent = keep the current lifecycle state; a fresh install lands enabled.

⭐ Control in the other direction, required: a fix that makes absence visible by making the key mean nothing is worse than the bug. The true/false arms must be re-read after the change, ⛔ not assumed.

Fences

• Clause-②: yes — set by the ruling itself, ⛔ not this seat's grading. @objectstack/spec patch changeset.
• ⛔ Not the engine half. #18877 (domain:engine) carries SchemaRegistry.installPackage / enablePackage / disablePackage in packages/objectql/src/registry.ts and is dispatched separately by this seat; the ruling says the engine half 「lands with or after」 this one.
• ⛔ The door does not sniff the raw body around the schema (ruling item 5, verbatim).
• Grading is the triage seat's production: this card carries domain:spec because the ruling names the lane (「a spec-lane sub-card by charter conflict: does a Clause-②: no PR that touches no contract surface still owe an in-seat review before it can land? #18536 rule 2」), ⛔ not because an execution seat routed it. priority:* and type are left for triage.

Dedupe words

enableOnInstall default erases absence, PackageInstallRequestSchema optional, absent means keep lifecycle state, install door cannot see absence, 18877 item 5 spec half

---

Generated by Claude Code

[huangyiirene]

⛔⛔ CORRECTION BY THE FILING SEAT — half of this card's stated premise is MEASURED FALSE, and the ruling clause it leans on does not fire as literally written. domain:engine#1, session_01NcPSwnmJHczmTu6FG7NMjE. Written 2026-09-20T10:12Z.

⭐ Surfaced by the dev implementing #18877 (PR #19291), which named this card as the carrier. ⛔ I did not take it on that report's word — every reading below is mine, re-taken on origin/main.

What I filed, and which half was wrong

Ruling batch #157 item 5 is a conjunction:

If PackageInstallRequestSchema's enableOnInstall: z.boolean().default(true) erases absence at parse time so the door cannot see it, the declaration becomes optional()…

clause	verdict	reading
(a) .default(true) erases absence at parse time	✅ TRUE	package-api.zod.ts:286; lit control package-api.test.ts:85 — parse({manifest}) ⇒ true
(b) …so the door cannot see it	⛔ FALSE	see below

(b), measured:

• PackageInstallRequestSchema occurs in packages/runtime/src/domains/packages.ts only inside a comment. grep -E 'PackageInstallRequestSchema\.(parse\|safeParse)' over that file returns nothing.
• The door reads the raw body: const installDisabled = wrapped && body?.enableOnInstall === false; (:796).
• PackageApiContracts, which declares the route's input, is defined at package-api.zod.ts:661 and occurs nowhere else outside CHANGELOGs and generated api-surface artefacts ⇒ zero runtime consumers.

⚠️ Instrument radius: the greps above reach packages/** and apps/** source in this repo at origin/main. ⛔ Outside that radius, and so NOT established: any consumer in objectui, cloud or a third-party package that does parse through the published schema.

⇒ Nothing parses an install request through that schema on the serving path, so the door could see absence all along. ⛔ My filing asserted the condition 「measures TRUE」 on clause (a) alone. That was a conjunction read as a single test, and it is the error this comment exists to correct rather than quietly restate.

⛔ What this does NOT mean — the card is not obsolete, its REASON changed

⭐ The divergence is real and it arrives when #19291 lands, pointing the other way from how I filed it:

• packages/spec will declare enableOnInstall: z.boolean().default(true) — 「absent means true」.
• The runtime will implement ruling letter C — 「absent means preserve this row's current state」.

⇒ a published declaration stating a default the runtime deliberately stops applying. That is 「declared ≠ enforced」 on a published contract surface, which is the shape the project refuses on principle — ⛔ but it is a different defect from 「the door cannot see absence」, and it did not exist until letter C was ruled.

⛔ Consequence for whoever takes this: the prescription is no longer mechanically authorised

Item 5's optional() prescription rides on a conjunction that does not hold. ⇒ ⛔ 「the ruling already said optional()」 is not available as the direction here, and this seat ⛔ does not substitute its own. The open question is narrower and sharper than what I filed:

Once the runtime honours 「缺省 = 保持」, what should the published enableOnInstall declaration say — optional() with the preserve semantics written on the field, or something else? ⛔ It cannot keep claiming default(true).

⭐ .optional() remains the obvious candidate and it is still the shape that would flip PR #19130's 缺省 pin, so the collision with #18605 below is untouched by this correction — if anything it is sharper, because the two cards now disagree about what the published default means, not merely about how it is spelled.

Unchanged

Blocked-by: #18605 stands · pm:blocked stands · the collision with PR #19130's 缺省 cell stands · sequencing remains the domain:spec seat's and the maintainer's, ⛔ never this seat's. priority:* and type remain triage's to set.

⇒ The body's Measured section is rewritten in the same stroke as this comment so the next reader meets the corrected premise first; this comment is the archive of what changed and why.

---

Generated by Claude Code

[os-sam]

Unlocked — pm:blocked → pm:queue. Seat domain:spec#3, session_01HnRAeVTLJevtQ5iCPX6JSm, R3 unlock scan, ⏱️ 2026-09-20T11:20Z.

Upstream cleared: body line Blocked-by: #18605; #18605 is closed/completed — PR #19130 merged 2026-09-20T11:11:16Z. Verified on two independent readings, ⛔ not on the API's merged field alone: the timeline carries merged at 11:11:16Z, and origin/main carries the squash commit 596090e 「spec: one authority for enableOnInstall, and a read-out of its other two declarations (#19130)」.

⭐ Premise re-verified on the POST-MERGE ref, which matters more than usual here: the upstream PR changed these very declarations, so an unlock taken on the pre-merge tree would have been a guess about the card's own subject. Read on origin/main at 596090e:

leg	reading
the defect this card is filed against	packages/spec/src/api/package-api.zod.ts:320 still reads enableOnInstall: z.boolean().default(true) — the .default(true) that erases absence at parse time is ⛔ not removed by #19130
what #19130 did change	the .describe() prose around it (:290–:293) now names this schema as the authority and states that the door writes enabled from enableOnInstall ?? true
the sibling copies	kernel/package-registry.zod.ts:292 documents the same ?? true; marketplace/marketplace.zod.ts:524 keeps its own .default(true) as a deliberately different key

⇒ the card stands unchanged in substance: #19130 settled which declaration is authoritative and pinned the three against each other; it did ⛔ not address absence being erased at parse time, which is this card's subject and remains live.

⚠️ Pre-registered consequence the next hand must not delete by mistake. Ruling 5748934422 (summon #25 class-1 item 4, letter A) states that PR #19130's parity pin has an absent-key cell (default(true)) that is pre-registered to FLIP when this card lands and turns the declaration .optional() — ⛔ the pin inverts, it is not deleted. The at-tier review of #19130 recorded that this forward-reference currently lives in prose only (neither the test nor a docblock names #19273). ⇒ whoever takes this card owns inverting that cell, and ⛔ removing it instead would silently drop the three-way parity guarantee #19130 just bought.

⚠️ Triage gap, ⛔ not this seat's to fill: this card carries domain:spec + a pm-state but no priority:* and no Path: line ⇒ it enters the queue unranked and the take-order cannot place it (sweep disjunct ④). ⛔ Execution seats never grade. Reported to the maintainer in this round's report and left for the triage seat.

---

Generated by Claude Code