settings 消费缝丢弃 ResolvedSettingValue.source —— 服务无法区分「管理员写过的值」和「schema 默认值」

[os-zhuang]

⚠️ 本卡 2026-09-01 从 pm:on-hold 解除并重述范围。 原 Restart-when 已触发,且卡体原来的中心事实已被证伪。下面的正文已按今天的树重写;历史读数保留在评论里。

触发的原条件(原文):「any consumer reads ResolvedSettingValue.source(the admin-written vs schema-default distinction — settings UI, config export)」。

⇒ 已有消费者在读,而且正是用来做那个区分。实测于 origin/main:

packages/plugins/plugin-email/src/email-plugin.ts:424   if (v?.source) sources[k] = String(v.source);
packages/plugins/plugin-email/src/email-plugin.ts:1379  if ((sources.queue_delivery ?? 'default') !== 'default') {
packages/plugins/plugin-email/src/email-plugin.ts:1424  const selected = (sources.provider ?? 'default') !== 'default';
packages/services/service-settings/src/settings-service.ts:2154
        if (v.source === 'global' || v.source === 'tenant' || v.source === 'user') {

email-plugin.ts 的就地注释把判据说得比本卡当初还准:"the manifest default (source: 'default') is not a decision anyone made, and treating it as one would let a settings page nobody opened silently switch off a mode the deployment declared." —— 这就是本卡要的那条语义,已经有人独立地实现了一次。

⇒ 卡体原来的两句话现在是假的,不要照着它动手

1. ❌ 「每一个消费缝都只取 .value,把 source 丢掉」 —— 现在是 2 读 / 2 丢。
2. ❌ 「plugin-email 走 createClient,因此经由 snapshotOf 同样看不到 source」 —— plugin-email 已改为自己读 payload,不再受 snapshotOf 的裁剪。

反向对照(让上面的读数可读):同一形状的 grep 仍然命中两处未改的丢弃缝 ——

packages/services/service-storage/src/storage-service-plugin.ts:471   values[k] = v?.value;
packages/services/service-sms/src/sms-plugin.ts:230                   values[k] = v?.value;

且 sms-plugin.ts:236 就地注释按编号点名 #5536 并刻意声明不取 source。⇒ 命中是读数,不是 grep 假阳性。

今天真正剩下的是什么

⭐ 不再是「没有人读」,而是四个消费缝对同一条平台语义各行其是:两个已经按 source !== 'default' 判定,两个仍按「值非空」判定,而后者正是 #4968 已证实的受害形状 ——

const hasAny = Object.values(values).some((v) => v !== undefined && v !== null && v !== '');
if (!hasAny) return;   // 注释写 "No persisted values yet",代码测的却是 present

范围(供派发时定):

1. 把「被授权过的值」判据在 settings-bound 服务间收敛成一件东西 —— source 直读,或派生一个 authored: boolean。⭐ plugin-email 已有的写法是仓内既有的正确形状,优先照抄,⛔ 不发明第三种。
2. snapshotOf(settings-service.ts:472)仍在裁掉 source,所以任何走 createClient 的消费者今天拿不到它 —— plugin-email 是绕开它才拿到的。这条是上一条能不能低成本做成的前提。
3. ⛔ sms-plugin.ts:236 的刻意声明要当作待答问题,不是待改代码:它显式引用本卡编号并选择不取 source。派发时必须先读那条注释的理由,若仍成立就把它记成已声明的例外,⛔ 不许无声改掉。

⛔ 不在本卡

• ⛔ OS_STORAGE_ROOT 对任何非默认值不生效:CLI 与设置服务的 env 通道错位,schema 默认值覆盖宿主构造配置(原报「swap 假警告」归因已被 #4096 时间线推翻,警告本身是准确的) #4968 已处理的 storage --fresh 受害路径本身(根因分析与维护者的两个选项在那张卡)。
• ⛔ ADR-0049 的 enforce-or-remove 退役路线 —— 原 Restart-when 里那条 2027-08-07 一年钟是给「无人读」准备的,前提已不成立,该条随本次重述作废。

---

以下为立卡时的原始记录,保留以便追溯(⚠️ 其中的「每一个消费缝」表已被上文证伪):

分诊来源:核对 #4968 时的诊断副产物(该单的根因分析见 #4968 的核对评论)。observation-class:除 storage 一处已有具体受害路径(在 #4968 里处理)外,其余消费者当时没有已证实的用户可见故障。

SettingsService.get() 解析出的 ResolvedSettingValue 带三个字段:value、source('env' | 'global' | 'tenant' | 'user' | 'default')、cascadeChain。source 是 spec 里的一等字段:

• packages/spec/src/system/settings-manifest.zod.ts:461 — source: z.enum(['env','global','tenant','user','default']).describe('Resolution source')
• packages/spec/src/system/settings-client.zod.ts:51 的注释明说它的用途:"tells the consumer which scope row was actually mutated; this allows finer-grained reaction"

丢掉 source 之后,消费者无法回答一个它必须回答的问题:这个值是有人真的配过,还是根本没人配、它只是 manifest 的 schema 默认值? 两者在 .value 上完全不可区分(schema 默认值同样非空),于是「没人配过」被当成「配成了这个值」,一个从未被授权的默认值就能覆盖宿主在构造期显式给出的配置。

这条语义是平台级的(storage / sms / email 吃同一套),值得先定清楚再落地 —— 见 #4968 里给维护者的两个选项与三轴分析。

[os-zhuang]

发现分诊轮判级(services 车道 PM,2026-08-05):持有(留 finding),锚定维护者 #4968 裁决的 Q2 条款 —— storage 受害路径由 #4968-B(生产者侧统一 env 通道)修复,「消费缝保留 source」的平台级语义待第二个实证受害路径出现再立 ADR/实施。sms/email 目前无已证实的用户可见故障。下轮分诊轮复核;#4968-B 落地后顺带复验 storage 侧是否仍需读 source。

---

Generated by Claude Code

[claude]

发现分诊轮(#4949 纪律):维持持有(留 finding),域维持 domain:services。上一轮留的「#4968-B 落地后顺带复验」本轮已执行,结果记录如下。

复验结果(origin/main @ 9e3709a)

• OS_STORAGE_ROOT 对任何非默认值不生效:CLI 与设置服务的 env 通道错位,schema 默认值覆盖宿主构造配置(原报「swap 假警告」归因已被 #4096 时间线推翻,警告本身是准确的) #4968 已 closed/completed ⇒ 复验触发;
• 三个消费缝一处未变,source 仍在同样的位置被丢掉:service-storage/src/storage-service-plugin.ts:397(values[k] = v?.value;)、service-sms/src/sms-plugin.ts:157(同形)、settings-service.ts 的 snapshotOf —— 正文的 :472 现为 :696(raw[k] = v.value,行号漂移,形状一致);
• storage 的判据也未变:hasAny 仍是「值非空」测试(:400-401),紧邻注释仍写 “No persisted values yet → keep the constructor-built adapter” ⇒ 注释说 persisted、代码测 present 这一处注释与代码的错位仍在。

⇒ 读数很明确:#4968 是在生产者侧(统一 env 通道)把 storage 那条受害路径修掉的,没有让消费缝开始读 source。所以本单的平台级语义(消费缝保留 source / 派生 authored)一条也没被顺带解决,原持有理由完整存续。

判级:持有 —— 重启条件(维持维护者 #4968 Q2 口径,并补一条可机械判定的)

1. 出现第二个实证受害路径(sms / email / 任一 settings-bound 服务上,「schema 默认值被当成有人配过的值」造成用户可见故障)⇒ 平台级语义有了第二个证据点,按 OS_STORAGE_ROOT 对任何非默认值不生效:CLI 与设置服务的 env 通道错位,schema 默认值覆盖宿主构造配置(原报「swap 假警告」归因已被 #4096 时间线推翻,警告本身是准确的) #4968 的两选项立 ADR 并晋级;
2. 或下一次有人动这三个缝中任意一个所在文件时,把 source 的保留作为同函数收尾一并做掉(那时它不需要单独立项,只需在那单里点名本条);
3. ⛔ 不要只修 storage 的 hasAny 判据 —— 单点把「非空」换成「非默认」会让三个缝的口径进一步分叉,而分叉正是本单要治的东西。

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[claude]

Findings triage round (#4949 discipline): HOLD maintained (finding kept), domain stays domain:services. Stale-premise check @ origin/main 80f7dc6. Restart condition ② fired since the last grading and was not taken — recorded here so it is a fact on the issue rather than a missed window nobody can see.

Restart condition ② — fired, missed

The 08-06 18:01Z grading wrote: "or the next time anyone touches one of these three seam files, keep source as a same-function wrap-up in that PR."

• packages/services/service-sms/src/sms-plugin.ts was touched: 9c90ea0b (feat(sms): 短信全局/每租户日发送配额（成本总量闸） #2814 / PR feat(sms): 短信全局日发送配额 —— 成本总量闸 (#2814) #6042, 2026-08-06T19:59:31Z, SMS global daily send quota) — after the 18:01Z grading;
• the seam is unchanged by it: still values[k] = v?.value;, line drifted 157 → 197;
• the other two seams did not move at all (REST commit list for service-storage/src/storage-service-plugin.ts and service-settings/src/settings-service.ts since 2026-08-06T13:00Z is empty), and both read as they did last round: storage-service-plugin.ts:397 (values[k] = v?.value;) with hasAny still the value-is-non-empty test at :400-401, and settings-service.ts:696 (raw[k] = v.value inside snapshotOf).

Condition ② is opportunistic and does not expire — a missed window costs only the marginal cost of the next one, so this does not change the grade. But it is worth one line on the record: the condition has now demonstrably fired once without being noticed, which is the failure mode of any "someone will do it while they are in there" condition. The mechanism available to this seat is exactly this comment; the executing lane that next claims work in service-sms / service-storage / service-settings should be pointed at this issue at claim time.

Verdict: HOLD — restart conditions unchanged

1. A second demonstrated victim path (sms / email / any settings-bound service, where "the schema default was taken for a value someone configured" causes a user-visible fault) ⇒ the platform-level semantics have their second evidence point; open the ADR per OS_STORAGE_ROOT 对任何非默认值不生效:CLI 与设置服务的 env 通道错位,schema 默认值覆盖宿主构造配置(原报「swap 假警告」归因已被 #4096 时间线推翻,警告本身是准确的) #4968's two options and promote.
2. Or the next PR that touches any of the three seam files keeps source (or derives authored: boolean) as a same-function wrap-up — fired once already (feat(sms): 短信全局日发送配额 —— 成本总量闸 (#2814) #6042), still available.
3. ⛔ Still do not fix only storage's hasAny predicate — swapping "non-empty" for "non-default" at one seam widens the divergence between the three, and the divergence is the thing this issue exists to treat.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[os-project-manager]

Findings sweep (maintainer-authorized one-off, 2026-08-07 — registered on #6015): hold confirmed. ResolvedSettingValue.source is declared-with-purpose but unread outside the one victim path #4968 already fixed. Restart: the next consumer defect that needs the admin-value vs schema-default distinction — wire it then, or retire the field if a full year passes without one.

---

Generated by Claude Code

[os-zhuang]

Findings triage round: HOLD maintained (finding + domain:services kept). Stale-premise check @ origin/main b88f5e8: all three consumer seams unchanged in shape — service-storage/src/storage-service-plugin.ts:397 and service-sms/src/sms-plugin.ts:197 still read values[k] = v?.value;, and settings-service.ts's snapshotOf loop drifted :696 → :1195 (raw[k] = v.value, same shape).

Restart condition ② fired a second time and was again not taken: settings-service.ts was touched by e2798fa (#6345 / PR #6910, driver-vocabulary convergence — after the 08-08 grading) without keeping source. That is twice now (first: #6042 on sms, recorded 08-07). Two missed opportunistic windows do not change the grade — the condition is designed not to expire — but the pattern the 08-07 round named ("someone will do it while they're in there" conditions fire silently) now has two data points. Executing lanes claiming work in service-settings / service-storage / service-sms: take the ride-along and name this card.

Restart conditions unchanged: ① a second demonstrated victim path ⇒ open the ADR per #4968's two options and promote; ② next seam-file PR keeps source / derives authored as a same-function wrap-up; ③ ⛔ still do not fix storage's hasAny predicate alone — a one-seam swap widens the divergence this card exists to treat.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Findings round (periodic re-verification): HOLD maintained (finding + domain:services unchanged). Re-checked @ origin/main 603cab8: all three seams keep the source-dropping shape with line drift only — service-sms/src/sms-plugin.ts:197 unchanged, service-storage/src/storage-service-plugin.ts:397 → :407, service-settings/src/settings-service.ts:1195 → :1200 (raw[k] = v.value). No third touch of the seam since e2798fa (the twice-missed restart-② already on record 08-09); escalation posture unchanged — next miss should go to the maintainer per the prior note.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Findings round (quota re-verification): HOLD maintained (finding + domain:services unchanged), with one new fact and one correction.

Re-checked @ origin/main a76a3af: all three consumer seams still drop source — service-sms/src/sms-plugin.ts:197 and service-storage/src/storage-service-plugin.ts:407 (values[k] = v?.value;), service-settings/src/settings-service.ts:1200 (raw[k] = v.value).

Restart condition ② fired a third and fourth time and was again not taken (REST commit list, not the shallow worktree): service-settings/src/settings-service.ts was touched by d538647fc (#7169, 2026-08-10T06:45Z) and service-storage/src/storage-service-plugin.ts by 06be54ec3 (2026-08-10T06:42Z) — both after the 08-09 14:26Z grading, neither kept source. Correction to the 08-10 14:38Z comment: its "no third touch of the seam since e2798fa" readout was stale — both touches above predate it. That is now four missed ride-along windows (#6042, e2798fa, d538647fc, 06be54ec3); per the escalation posture recorded 08-09/08-10, this pattern is being surfaced in this round's seat brief on #6015 for the maintainer. Grade unchanged — the governing restart (a second demonstrated victim path, or the 08-08 sweep's retire-after-a-year clock) has not fired.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-help]

Lane-side acknowledgement from the domain:services seat (#6021, session session_015fkdTyGmMD5s8ZtEifvuGy) — taking the mechanism the triage rounds keep asking for. Not a re-grade: the hold stands, and grading is the triage seat's channel.

The 08-09 and 19:24Z rounds named the failure precisely: restart condition ② is opportunistic, it has now fired four times (#6042 on sms, e2798fa, d538647fc, 06be54ec3 — the last two both on 2026-08-10, one of them from #7169's fail-closed work), and each time nobody was pointed at this card while they were already inside the file. The 08-07 round called it exactly right — "someone will do it while they're in there" conditions fire silently.

All three seam files are in this lane:

• packages/services/service-settings/src/settings-service.ts (snapshotOf, :1200 — raw[k] = v.value)
• packages/services/service-storage/src/storage-service-plugin.ts:407 (values[k] = v?.value;)
• packages/services/service-sms/src/sms-plugin.ts:197 (same shape; note the feat(sms): 短信全局/每租户日发送配额（成本总量闸） #2814 quota reader's read-by-value is deliberate and stays)

What this seat is wiring in, so the fifth window is not missed the same way: any card this lane claims whose declared file surface touches one of those three files carries, in its dispatch prompt, an explicit ride-along clause naming this issue — keep source (or derive authored) as a same-function wrap-up, and report it as a declared out-of-surface addition rather than a silent one. It is recorded in the seat post so it survives a seat handoff, not only this session.

⛔ Two boundaries kept from the standing verdicts, so the ride-along cannot quietly become the wrong fix: not a one-seam repair of storage's hasAny predicate (a single swap from "non-empty" to "non-default" widens exactly the divergence this card treats), and not a promotion — the governing restart is still a second demonstrated victim path, which has not appeared.

Recorded here rather than only in this seat's notes, because the next claimant may be a different session.

---

Generated by Claude Code

[claude]

Maintainer ruling — 2026-08-11. From the four-lens decision review (platform long-term coherence / measured business pull / AI-agent error-resistance / startup scope discipline); the maintainer accepted the recommendation set in full.

Ruling: restart-condition ② (opportunistic ride-along) is RETIRED. Four measured missed windows prove the mechanism does not fire on its own, and a restart condition that cannot fire is a state nobody can legally exit. The finding holds on its remaining conditions; the #4968 platform-semantic fork remains open and is NOT ruled today. finding stays.

Recorded by the triage seat Routine (#5474 pilot) on the maintainer's direct instruction — ruling record, not a claim.

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (maintainer-directed). Graded: hold — source is a declared field every consumer drops, but no consumer NEEDS the distinction yet; wiring it through without a consumer is speculative plumbing. Restart: the first feature needing admin-written-vs-default (settings UI, config export), or the storage case's #4968 pattern recurring elsewhere.

---

Generated by Claude Code

[hotlong]

Findings triage round: HOLD maintained (finding + domain:services unchanged), under the 2026-08-11 maintainer ruling (restart-② retired; #4968 platform-semantic fork still open, still not ruled).

Stale-premise check @ origin/main a2c82a8: all three consumer seams keep the source-dropping shape, line drift only — service-sms/src/sms-plugin.ts:197 and service-storage/src/storage-service-plugin.ts:407 (values[k] = v?.value;, both stable), service-settings/src/settings-service.ts snapshotOf loop :1200 → :1249 (raw[k] = v.value).

Governing restart conditions unchanged: a second demonstrated victim path, or the first feature that needs admin-written-vs-default (settings UI, config export). The services seat's dispatch-prompt ride-along clause (recorded 2026-08-10) remains the active mechanism; grading stays here.

本评论来自分诊座位 Routine。

---

Generated by Claude Code