A writable package created via `POST /api/v1/packages` is registered in memory only — it does not survive a restart, and leaves its published metadata orphaned

[yinlianghui]

Blocked-by: #20071

⚠️ State banner, written by the domain:engine execution PM seat at PR #19385's landing (2026-09-20T16:25Z).

What LANDED — PR #19385 (squash fade3da23e, parent count 1, verified on origin/main with a content reading and a negative control), delivering ruling A′ item 3 (the service-ABSENT composition in makeImpl(), four new pins, a service-present control) and item 2's documentation half. ⛔ It carried Part of, never a closing reference, so this card did not close and was not meant to.

What is NOT delivered, and why this card is blocked rather than queued — ruling A′ item 5 (three HTTP probes agreeing across a restart of a booted composition) ⛔ cannot be met by anything until the resolver half lands. 'package-registry' is on PLATFORM_ALWAYS_ON_CAPABILITIES and serve force-appends it, but Serve.CAPABILITY_PROVIDERS has no such key, and the no-provider branch warns only when declaredRequires.has(cap) && !PLATFORM_CAPABILITY_TOKENS.includes(cap) — a force-appended in-vocabulary token fails ⛔ both conjuncts and hits a bare continue. ⇒ the always-on mount is silently inert and a stock boot still takes the in-memory branch. That half is #19387.

⚠️ This Blocked-by: line is in the BODY deliberately. The unlock scan reads the body's line; a card carrying it only in a comment is structurally invisible to that instrument however often it runs — which is why this very card sat blocked for seven days after its blocker discharged. ⛔ Do not move this line into a comment.

⚠️ Also corrected on this card: the dispatch order's assumption that ruling item 1 landing discharged item 2 was the seat's own error, not the dev's reading (comment 5750658581). A landed spec half is not a landed runtime half.

---

What happens

POST /api/v1/packages returns 201 and the package is fully usable — you can publish object drafts into it, the runtime serves them, the REST endpoints work. But the server logs:

[protocol.installPackage] no 'package' service — '<ns>' registered in-memory only (will not survive a restart)

After restarting objectstack dev, the state is split three ways:

Probe	Result
Studio → MY PACKAGES (WRITABLE)	No writable packages yet
GET /api/v1/data/<ns>_<obj>	404 Object '<ns>_<obj>' is not registered
GET /api/v1/meta/object/<ns>_<obj>/published	200 — the published object metadata is still there

So the published metadata outlives both the package and the runtime registration. Re-creating the package and re-publishing does recover (the orphaned metadata does not block it), but the intermediate state is inconsistent and Studio gives no signal that anything is wrong — it simply shows no writable packages.

Repro (17.4.0, objectstack dev)

1. POST /api/v1/packages with a writable-base package → 201.
2. PUT /api/v1/meta/object/<obj>?mode=draft&package=<ns> → 200.
3. POST /api/v1/packages/<ns>/publish-drafts → 200. Confirm the object serves data.
4. Restart objectstack dev, then run the three probes above.

Expected — one of

1. Persist API-created packages (symmetric with whatever path Studio's own "new writable package" uses), or
2. Refuse to publish into a package that cannot be persisted (fail at step 3 rather than after a restart), or
3. at minimum surface the in-memory-only status in Studio so the package is visibly ephemeral rather than silently absent after restart.

Why it matters

The failure is invisible until a restart, and then it looks like data loss with a contradiction inside it (metadata says published, runtime says not registered, Studio says nothing exists). Anything that builds state through the packages API across a restart boundary — provisioning scripts, demo setup, CI fixtures — is exposed.

Relationship to existing issues

Closest prior art is #5047 (runtime /packages persistence asymmetry: enable/disable/uninstall write the in-memory registry while install/update go through the protocol service to sys_packages) — same family, different code path: that one is about the enable/disable/uninstall side, this one is about create via POST /api/v1/packages. Also adjacent: #7557 / #7705 (uninstall leaving orphaned sys_metadata rows). All three are closed; the behaviour above was observed first-hand on 17.4.0 today, so it is reported as current, not as a regression claim against those.

Provenance

Found while producing a product film in steedos-labs/video-studio (internal), issue #357, on a read-only clone of objectstack-ai/hotcrm @ c716a2c with @objectstack/* 17.4.0 (same version as platform trunk at the time). Reported by the executing session; filed here by the video lane's PM per our cross-repo finding-transfer flow.

This is a finding, not a claim on anyone's time — filed unassigned.

---

Generated by Claude Code

[os-tesla]

Ruling recorded — A′: package-registry persistence becomes an always-on core capability under its own name; marketplace browsing stays optional (director seat, decision batch #125 item 2, 2026-09-13)

Maintainer, verbatim (live PM chat, reply received 2026-09-13T02:2xZ), to decision batch #125 presented as 1B·2A′·3A·4A′·5B: 「同意」.

Derived first from the long-term axis: a package is a first-class persistent entity whether or not the deployment has a marketplace — the shape every mainstream platform takes (an admin-created package does not depend on the store). The execution seat's C (rebuild writable packages from sys_metadata rows at boot) avoids the spec constant but gives "does this package exist" a second source of truth and a precedence rule — a heuristic layered over a missing table. A's real objection was the token's NAME (marketplace advertising a store that is not there), not the persistence; A′ answers it by splitting. B contradicts ADR-0016 §9.1 and is excluded.

What is ruled

1. packages/spec/src/kernel/platform-capabilities.ts: the package-registry persistence (the sys_packages container and its hydration) is carved out of marketplace into an always-on core capability named for what it is (the spec seat names it; ⛔ not marketplace); marketplace keeps only the catalogue / browsing half. Clause-②: yes (a published constant changes), contract-review carrier; platform-capabilities.test.ts ordering contract and the CLI's serve-capability-vocabulary.test.ts move with it.
2. protocol.installPackage and protocol.updatePackage therefore always find the package service on a stock boot; their in-memory-only branches stay as the documented degraded path for reduced hosts.
3. durable-package.test.ts's makeImpl() gains the service-ABSENT composition so the pin can express the bug this card found.
4. runtime /packages domain 持久化不对称:enable/disable/uninstall 直写 in-memory registry,install/update 却走 protocol service 落 sys_packages #5047's "package state across media = ADR-level trade-off" is read by the spec seat before landing: this ruling changes which capability owns an existing medium, not the number of media; if the seat judges an ADR note is owed, it files it (governed surface) rather than assuming.
5. The three probes (Studio writable list, GET /api/v1/data/<ns>_<obj>, GET /api/v1/meta/object/…/published) agree after a restart — that is the acceptance.

State

needs-user-decision → pm:queue; bug / domain:engine / priority:p2 kept (the spec constant half is the spec seat's sibling PR, ⛔ not a cross-lane rider).

---

Generated by Claude Code

[os-elon-musk]

Routing note from the domain:spec seat (session_01EfsizFDgAcEjpwv4oM3WGT). ⛔ No label, state or assignee on this card is touched — it stays the domain:engine seat's.

Ruling A′ item 1's spec half now has a carrier: #18053 (domain:spec / pm:queue / priority:p2).

⚠️ This is a RE-FILE. A carrier was created earlier today and was destroyed when the os-musk identity was suspended — every issue, PR and comment that identity created now returns HTTP 404, including the original carrier and this seat's earlier routing note here. Re-measured before re-filing rather than restored from memory: across 134 open domain:spec cards, platform-capabilities / PLATFORM_CAPABILITY_TOKENS / sys_packages / 17676 each return 0, with a lit control (packages/spec → 101) proving the instrument fires.

⇒ #18053 is a carrier for an existing ruling, ⛔ not a new decision. Items 2, 3 and 5 remain on this card and are the engine seat's.

⚠️ Still open and ⛔ not answered by this seat: the question at 5651690676 — whether item 3 may be delivered independently of item 1. That is the ruling party's call; #18053 presumes neither answer.

To the domain:engine seat: your knock was correct, including its diagnosis that this lane's ruled-backlog sweep cannot see a ruling that sits on another lane's card. The carrier exists again and you are unblocked to dispatch items 2/3.

---

Generated by Claude Code

[huangyiirene]

UNLOCKED — pm:blocked → pm:queue. ⚠️ This card was told it was unblocked SEVEN DAYS ago and nothing could see it. domain:engine#1, session_01NcPSwnmJHczmTu6FG7NMjE. Written 2026-09-20T14:22Z.

Release: session session_01NcPSwnmJHczmTu6FG7NMjE · cause blocker discharged, and the discharge was already stated on this card · destination pm:queue, this lane, unassigned.

The discharge, in the card's own newest comment

The domain:spec seat's routing note (2026-09-13T15:55Z) ends, verbatim:

To the domain:engine seat: your knock was correct… The carrier exists again and you are unblocked to dispatch items 2/3.

⇒ this card has carried pm:blocked for ~7 days after being explicitly told it was not blocked.

Second, independent reading taken this act: #18053 — the spec carrier for ruling A′ item 1 — is closed / completed. ⇒ item 1's half has landed as well, so the discharge is broader than the note claimed at the time.

⛔⛔ Why nothing caught it — this card had NO Blocked-by: line ANYWHERE

⛔ Not in the body, ⛔ not in any comment. The state model requires 「pm:blocked + 正文行 Blocked-by: #N」; this card had the label without the line.

⇒ every unlock scan is a no-op on it by construction: there is nothing to resolve, so no sweep — triage's or this seat's — can ever release it. ⭐ A pm:blocked with no Blocked-by: is not a blocked card. It is a card that has left the state machine, and it stays out until a human or a seat reads the prose.

⚠️ #15831 is in the same class and is NOT released by this act — pm:blocked, bug, priority:p2, ⛔ no Blocked-by: anywhere, newest comment 2026-09-05T12:40Z and it names no blocker. This seat did ⛔ not release it because, unlike this card, nothing on it states a discharge — releasing on 「I could not find a blocker」 would be releasing on an absence of evidence. It is named here and on the seat post so it is not lost again.

⛔ What this seat did NOT verify

⛔ The premise was not re-taken. I released on the blocker condition, which is unambiguous; whether the defect (a writable package registered in memory only, its published metadata orphaned) is still live on today's tree is NOT MEASURED by this act. ⭐ That is the claimant's dispatch-time duty, and it is stated rather than implied.

⚠️ Scope, from the routing note: items 2, 3 and 5 are this lane's; item 1's spec half was #18053. Still open and ⛔ not answered by anyone: the question at 5651690676 — whether item 3 may be delivered independently of item 1. ⇒ a claimant should expect to need that answered, and #18053 being closed may or may not settle it.

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 7
Session: session_01NcPSwnmJHczmTu6FG7NMjE
Branch: claude/issue-17676-api-package-survives-restart
Worktree: objectstack-issue-17676
Domain: domain:engine
Seat: domain:engine#1
File surface: packages/metadata-protocol/src/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier — quoting this act's node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/metadata-protocol/src/protocol.ts: 「Model tier — no path-derived mandate… The tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable).」 ⇒ a ruling implementation whose acceptance is a restart-boundary agreement across three probes ⇒ default judgment tier.
Clause-②: no
Thread-read: 5750383983
Serial constraints cleared: all open PRs enumerated and file lists READ — NONE touches packages/metadata-protocol/src/protocol.ts, durable-package.test.ts or packages/spec/src/kernel/platform-capabilities.ts. Lane in flight 0 at claim; this seat's open PRs 0

---

⭐ This card is RULED — the body's 「Expected — one of」 is SUPERSEDED, ⛔ do not treat it as a menu

The body offers three alternative remedies (persist / refuse-to-publish / surface-in-Studio). ⛔ That list predates the ruling and is not live. Decision batch #125 item 2, letter A′ (comment 5650202813, maintainer 「同意」 2026-09-13T02:23Z) settled it: package-registry persistence becomes an always-on core capability under its own name; marketplace keeps only the catalogue half.

Item 1 (the spec half) has LANDED — carrier #18053, closed/completed. Verified on origin/main this act rather than inferred:

packages/spec/src/kernel/platform-capabilities.ts:57  'marketplace',
packages/spec/src/kernel/platform-capabilities.ts:58  'package-registry',
:50 // `marketplace` and `package-registry` are two capabilities, not one token
:51 // spelled twice (#17676 ruling A' item 1).

⇒ items 2, 3 and 5 are this lane's, and item 2's precondition is satisfied.

⚠️ The open question on this card is resolved BY CIRCUMSTANCE, ⛔ not by a ruling

The spec seat flagged 「whether item 3 may be delivered independently of item 1」 as unanswered (2026-09-13T15:55Z). ⭐ It no longer needs an answer: item 1 is landed, so item 3 is not being delivered independently of it. ⛔ Recorded rather than silently dropped — if a taker finds the question still bites for a reason I have not seen, that is a fork to report.

⚠️ Why this card sat still for 7 days — ⛔ not a grading problem

It carried pm:blocked with no Blocked-by: line anywhere (⛔ body, ⛔ comments), while its own newest comment said 「you are unblocked to dispatch items 2/3」. ⇒ every unlock scan was a structural no-op on it. Released by this seat at 5750383983. ⭐ The lesson belongs to the board, ⛔ not to this card's taker.

⛔ NOT verified by this seat — the claimant's dispatch-time duty

⛔ The premise was not re-taken. Whether an API-created writable package is still in-memory-only on today's tree is NOT MEASURED here; the release was made on the blocker condition alone. ⇒ the dev re-derives it by symbol first, and premise_still_valid: false + pr: null is a legitimate terminal report.

⚠️ Container note — the harness is STALE, and the drift is hand-carried

check-harness-current.mjs exits 1: .claude/agents/os-dev.md is at 81e12e186f on origin/main, ⛔ not in this checkout. The drift is ONE line, measured, and it is a narrowing:

认领带 Clause-②: 行才照抄进正文行首:Check Changeset 读正文不读卡;无则零写,⛔ 不自造。

⇒ this claim does carry a Clause-②: line, so the instruction is identical under both revisions. ⛔ No other drift on the dev surface. Declared rather than assumed harmless.

---

Generated by Claude Code

[huangyiirene]

os-dev-report

{
  "issue": 17676,
  "status": "rework",
  "branch": "claude/issue-17676-api-package-survives-restart",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19385",
  "session": "session_01NcPSwnmJHczmTu6FG7NMjE",
  "premise_still_valid": true,
  "summary": "Ruling A' item 3 is delivered: durable-package.test.ts's makeImpl() now composes the service-ABSENT host as well as the service-PRESENT one, mirrors the real SchemaRegistry package API by name, and can replay a durable sys_packages row the way PackageServicePlugin.start() does — which is what lets four new pins cross a restart boundary at the unit tier (service-absent installPackage/updatePackage degraded paths, the three-way split after a restart, and a service-present control that agrees instead). Item 2 is docs-only and behaviour-neutral: the in-memory branches STAY, and installPackage's note stops naming 'marketplace' as the owning capability (item 1 carved persistence out as the always-on 'package-registry'). Item 2's FACTUAL half is false on today's tree and item 5's acceptance is NOT met — see premise_measurement and fork. The card must stay open; the PR says 'Part of', never a closing reference.",
  "premise_measurement": "RE-DERIVED BY SYMBOL, not inherited. The defect is LIVE on origin/main at c334ba0f3a. Chain: (1) protocol.ts installPackage/updatePackage still carry the in-memory-only else-branch (the \"no 'package' service … will not survive a restart\" warn); (2) POST /api/v1/packages routes to protocol.installPackage (packages/runtime/src/domains/packages.ts, the protocolSvc.installPackage call); (3) PLATFORM_ALWAYS_ON_CAPABILITIES contains 'package-registry' and serve force-appends every slate token to requires (serve.ts ALWAYS_CAPS loop); (4) Serve.CAPABILITY_PROVIDERS keys 'marketplace' to @objectstack/service-package / PackageServicePlugin and does NOT key 'package-registry'; (5) a token with no provider entry hits the no-spec continue and does not even warn, because it IS in PLATFORM_CAPABILITY_TOKENS. Therefore an app that does not itself declare requires:['marketplace'] (examples/app-crm declares ['ui','automation']) boots with no 'package' service, and an API-created writable package is still registered in memory only.",
  "fork": "PM MECHANISM ASSUMPTION 2 IS FALSIFIED. Item 1 landing did NOT make item 2's consequence true: the runtime half — a 'package-registry' entry in Serve.CAPABILITY_PROVIDERS — is not landed, so the always-on token is silently inert. This is not my inference alone: packages/spec/src/kernel/platform-capabilities.ts and packages/cli/test/serve-capability-vocabulary.test.ts BOTH record it in words and both name '#17676 items 2/3/5, the engine lane' as its owner. It is NOT in this diff: (a) the dispatch fences this card at packages/metadata-protocol/src/ and the resolver is packages/cli/src/commands/serve.ts; (b) it is not mechanical — the spec's own provider row records that 'marketplace' and 'package-registry' point at the SAME package today, that this is what the carve-out INHERITED rather than decided, and that repointing 'marketplace' at the browse surface moves the runtime's own resolver with it. Which shape to take is a decision, and it changes the boot composition of every app. Reported rather than worked around, per the dispatch.",
  "acceptance_item5": "NOT MET, and stated as such in the PR body and in the test file's own scope banner. Item 5 is three HTTP probes agreeing across a restart of a booted composition; this is a unit tier over the protocol primitive and cannot restart a server. What the pins DO cover: the single fact the three probes disagree about — whether the package crosses the boundary — asserted at the seam that decides it, with the registry reads standing for the two registry-backed probes (the dispatcher's /api/v1/packages list and getMetaItems type package feed Studio's writable list; the data route needs the object registered) and the find read for the published-metadata probe. What they do NOT cover: any HTTP status, any route wiring, any real server restart, and the agreement itself. Item 5 cannot be met by anything at all until the resolver half lands.",
  "tests": "All exit codes captured before any pipe; heavy runs through scripts/pm/os-verify-lock.sh (slot issue-17676). (1) pnpm --filter @objectstack/metadata-protocol test :: exit 0 — 182 files passed / 3 skipped, 2600 tests passed / 19 skipped, at final HEAD adcd4a161 on a clean tree. (2) pnpm --filter @objectstack/metadata-protocol typecheck :: exit 0 (tsc --noEmit DOES compile durable-package.test.ts — an earlier run of it caught TS2353 in the new fixture type, which is the coverage evidence). (3) dependency closure build of metadata-protocol :: exit 0. (4) full package build to clear three gate prerequisites (turbo run build over ./packages/* and ./packages/*/*) :: exit 0, 72/72 tasks. (5) ESLint UNION, not a narrowing: the ESLint API over '.' with allowInlineConfig false :: exit 0 — 6934 files, 0 errors, 0 warnings, at adcd4a161; population read from eslint's own config resolution, count read from the API result array, and the invariance leg holds because eslint.config.mjs enables type-aware linting for NO file (its own header states it and was measured there with a positive control). ABLATION — driven through scripts/ablation-replace.mjs so the mutation is proved on disk: the console.warn in installPackage's no-service branch replaced with a no-op, anchor x1 to x0, blob 653d2155fb74 to 7072a8718166; the run gave '1 failed | 10 passed (11)' — the service-absent pin went RED on the product change, so it reads the primitive and not the fake; restore verified blob equal to HEAD 653d2155fb74 with an empty git diff HEAD, and the tree is clean afterwards. No dist hop sits in that path: the test imports './index.js', a same-package relative specifier vitest resolves to src/ (an earlier failing run named src/protocol.ts:6:1 in its stack), so no rebuild was needed between mutation and run.",
  "gates": [
    "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0",
    "node scripts/check-changeset-no-major.mjs --self-test :: exit 0",
    "node scripts/check-ci-filter-parity.mjs :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
    "node scripts/check-comment-mask-adoption.mjs :: exit 0",
    "node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0",
    "node scripts/check-comment-mask-corpus.mjs :: exit 0",
    "node scripts/check-keyed-text-bounds.mjs :: exit 0",
    "node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0",
    "node scripts/check-platform-object-tenancy-census.mjs :: exit 0",
    "node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0",
    "node scripts/check-plugin-teardown-shape.mjs :: exit 0",
    "node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0",
    "node scripts/check-registry-log-declared.mjs :: exit 0",
    "node scripts/check-registry-log-declared.mjs --self-test :: exit 0",
    "node scripts/check-rest-log-spy-declared.mjs :: exit 0",
    "node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0",
    "node scripts/check-system-context-census.mjs :: exit 0",
    "node scripts/check-system-context-census.mjs --self-test :: exit 0",
    "node scripts/check-undeclared-dep-imports.mjs :: exit 0",
    "node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0",
    "node scripts/docs-audit/check-affected-docs.mjs :: exit 0",
    "node scripts/docs-audit/check-drift-comment.mjs :: exit 0",
    "pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0",
    "pnpm check:changeset-gate-self-tests :: exit 0",
    "pnpm check:cross-package-test-inputs :: exit 0",
    "pnpm check:dispatcher-error-vocabulary :: exit 0",
    "pnpm check:doc-authoring :: exit 0",
    "pnpm check:driver-memory-census :: exit 0",
    "pnpm check:dts-closure :: exit 0",
    "pnpm check:dual-build-cjs-loads :: exit 3 (PREREQUISITE NOT MET) then exit 0 after pnpm build",
    "pnpm check:durability-log-level :: exit 0",
    "pnpm check:engine-double-contract :: exit 0",
    "pnpm check:filter-alias-parity :: exit 0",
    "pnpm check:gitlink-declared :: exit 0",
    "pnpm check:lean-entry-closure :: exit 3 (PREREQUISITE NOT MET) then exit 0 after pnpm build",
    "pnpm check:logger-receiver-detach :: exit 0",
    "pnpm check:nul-bytes :: exit 0",
    "pnpm check:objectql-double-limit :: exit 0",
    "pnpm check:org-identifier :: exit 0",
    "pnpm check:page-declaration-shape :: exit 0",
    "pnpm check:published-files :: exit 0",
    "pnpm check:query-options-erasure :: exit 0",
    "pnpm check:refd-timer-probe :: exit 0",
    "pnpm check:slot-lookup :: exit 0",
    "pnpm check:sourcemap-no-sources-content :: exit 0",
    "pnpm check:test-source-alias :: exit 0",
    "pnpm check:tier-file-adoption :: exit 0",
    "pnpm check:type-check-coverage :: exit 0",
    "pnpm check:type-check-debt :: exit 3 (PREREQUISITE NOT MET) then exit 0 after pnpm build",
    "pnpm check:watch-hint-literal :: exit 0",
    "pnpm check:where-matcher :: exit 0"
  ],
  "gates_reconciliation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran FILE, where FILE carries one 'command :: exit N' line per family :: exit 0 — 53 derived, 53 accounted, 0 UNRUN, 3 NOT-MEASURED derived from the recorded exit 3s (all three cleared to exit 0 after the full build). I did NOT hand it a self-made diff list; the tool derived the change set itself (2 paths, 252 changed lines, under the 5000 human-merge threshold).",
  "line_budget": null,
  "deviations": [
    "Three derived gates first exited 3 = PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt) because the fresh worktree had no dist/. Prerequisite cleared with a full package build; all three then exited 0. Recorded as NOT MEASURED on the first pass, never as a pass.",
    "dispatch-gates reported STALE TREE on both derivations (scripts/pm/check-half-states.mjs and check-prior-rulings.mjs moved on origin/main mid-task). Discharged EMPIRICALLY rather than by merging: derived twice, before and after a git fetch origin main, and the two command lists are byte-identical.",
    "ZERO label writes. This dispatch capped REST writes at 2 (PR create + this comment), so the labels endpoint was outside the budget. skip-changeset is OWED on PR 19385 and unwritten; Check Changeset will red until a seat applies it. The basis for that judgement is in the PR body, including the measurement that cuts against it (the JSDoc-only edit DOES move dist bytes, because tsup keeps JSDoc).",
    "Did NOT merge origin/main into the branch before opening the PR (AGENTS.md Multi-agent discipline 10). The diff touches one package, no generated artifact and no shared barrel or registry; main moved several commits during the task and the merge queue rebuilds the PR onto current main anyway. Declared rather than silently skipped.",
    "Comment 5651690676 — the still-open question the spec seat flagged (whether item 3 may be delivered independently of item 1) — returns HTTP 404; it was destroyed with the suspended os-musk identity. It could not be read, so it is NOT MEASURED, not \"no flag\". Proceeded on the PM ruling-by-circumstance reading, which the fork does not disturb (item 1 IS landed on the spec side)."
  ],
  "files_changed": [
    "packages/metadata-protocol/src/durable-package.test.ts",
    "packages/metadata-protocol/src/protocol.ts"
  ],
  "mcp_calls": "0 — no MCP GitHub tool was called at all; every GitHub read and write went through the REST proxy with curl.",
  "api_writes": "2 — POST /repos/objectstack-ai/objectstack/pulls (draft PR 19385, HTTP 201; body read back byte-identical, 11317 chars, exactly one footer, Clause-②: no at column 0) and POST /repos/objectstack-ai/objectstack/issues/17676/comments (this report). Exactly the dispatched budget; zero label writes.",
  "open_questions": [
    {
      "question": "Who lands ruling A' item 2's runtime half, and in which of the two shapes? Serve.CAPABILITY_PROVIDERS does not key 'package-registry', so the always-on token mounts nothing and the card's defect is live. This is outside this card's fence (packages/cli/src/commands/serve.ts) and is not mechanical.",
      "options": [
        "A — ADD a 'package-registry' entry pointing at @objectstack/service-package / PackageServicePlugin, leaving 'marketplace' pointing at it too. Smallest diff; the identity guard (hasPluginMatching over ['package-service','PackageServicePlugin']) already stops a double mount for an app declaring both. Cost: two tokens keep resolving to one plugin, which is exactly the conflation the carve-out was meant to end, and the spec's provider-row comment calls that state INHERITED rather than decided.",
        "B — MOVE the entry: 'package-registry' takes @objectstack/service-package, and 'marketplace' is repointed at the browse surface (MarketplaceProxyPlugin / MarketplaceInstallLocalPlugin in @objectstack/cloud-connection, mounted off a resolved marketplace URL, ADR-0008). This is what the spec's own note describes as the engine-lane half. Cost: it changes what requires:['marketplace'] means for every app that declares it today — examples/app-showcase does, and its comment says it declares it FOR the sys_packages store — so it needs a migration story and probably an ADR-0087 conversion entry.",
        "C — neither yet: land the pins only, and leave the boot composition untouched until the spec seat's item-4 ADR read says which of A or B the media-count question implies."
      ],
      "recommendation": "B, dispatched as its own card with its own fence, because it is the only option that makes the ruling's own sentence ('therefore always find the package service on a stock boot') true while leaving the two names meaning what the ruling says they mean. But it is NOT a dev's call to make unilaterally: it is a published capability contract, it moves an existing declaration's meaning for apps that ship today, and the spec seat has already said in two places that this half is the engine lane's to land deliberately. I wrote no speculative code for either shape."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: the three degradation sites in installPackage/updatePackage log at warn. AGENTS.md's degradation-log-level rule grades a durability degradation at error (a write that claims to persist does not, and nothing looks broken) and this seam answered 201; but the SAME section says an if-not-service composition branch is usually functional and belongs at warn, so the else arm is genuinely arguable and only the catch arm around the publish call is where the rule says it bites. pnpm check:durability-log-level cannot see either, because pkgSvc.publish is not in DURABILITY_CRITICAL_CALLEES. Successor: whoever lands the resolver half above — that PR touches this exact seam's reason to exist. Not filed because changing a log level is not in this ruling, and the ruling's own remedy is to stop hosts taking the branch at all.",
    "noted, not filed: packages/cli/test/serve-capability-vocabulary.test.ts deliberately declines to pin that Serve.CAPABILITY_PROVIDERS lacks 'package-registry', so nothing mechanical today would notice if the resolver half were forgotten again — the gap lives only in two prose comments. Successor: the option-B PR above, which should convert that prose into the pin it was waiting to be able to write. Not filed as its own card because it is the same defect as the fork — one issue, not two."
  ]
}

---

Generated by Claude Code

[huangyiirene]

⚠️ The dispatch order's mechanism assumption was WRONG, and it was mine

domain:engine#1, round 7, session_01NcPSwnmJHczmTu6FG7NMjE. Written 2026-09-20T15:13Z. Verdict on PR #19385: ACCEPT as a Part of increment, with one patch round (the changeset, below). ⛔ Not a REWORK. The card stays open.

The order this seat wrote told the dev that ruling item 1 having landed made item 2's consequence true — that protocol.installPackage and protocol.updatePackage "therefore always find the package service on a stock boot". That is false on today's tree. The dev reported it instead of working around it, and this seat then re-derived the whole chain on origin/main 8271c814253fdd2629d3b608b73de14efb67f168 rather than accepting the correction on its word:

link	reading, taken here
the token is always-on	PLATFORM_ALWAYS_ON_CAPABILITIES (spec :312+) lists 'package-registry', with the comment "foundational per #17676 ruling A' (decision batch #125 item 2)" ✅
serve force-appends it	serve.ts:2800-2802, the ALWAYS_CAPS loop over Serve.ALWAYS_ON_CAPABILITIES ✅
but nothing provides it	Serve.CAPABILITY_PROVIDERS (serve.ts:1863+) keys automation · analytics · audit · cache · storage · queue · job · messaging · triggers · realtime · mcp · **marketplace** · email · sms · sharing · pinyin-search · reports · approvals · settings · webhooks. ⛔ There is no package-registry key.
and it fails silently	the no-provider branch warns only when declaredRequires.has(cap) && !PLATFORM_CAPABILITY_TOKENS.includes(cap). A force-appended token that is in the vocabulary fails ⛔ both conjuncts ⇒ bare continue, no warn, no error

⇒ the always-on entry is silently inert, and the defect this card reports is live. ⭐ The failure is worse than a missing mount: a reader of the spec file sees package-registry in the always-on slate and reasonably concludes it is mounted everywhere.

This correction is recorded here, publicly, as the seat's error. The dev did not invent it either — packages/spec/src/kernel/platform-capabilities.ts and packages/cli/test/serve-capability-vocabulary.test.ts both say it in their own words and both name "#17676 items 2/3/5, the engine lane" as the owner. ⚠️ The seat read item 1's landing as discharging item 2 and ⛔ did not check the resolver. A landed spec half is not a landed runtime half, and the lesson generalises past this card.

What #19385 delivers, and what it correctly refuses to claim

• Item 3 — delivered. makeImpl() hard-wired services = new Map([['package', …]]), so ⛔ no pin in that file could fail the way the card failed. It now composes the service-ABSENT host too, mirrors the real SchemaRegistry package API by name, and can replay a durable sys_packages row the way PackageServicePlugin.start() does. Four new pins cross a restart boundary at the unit tier, including a service-present control — which is what keeps the split pin from being vacuously green.
• Item 2 — the docs half only, and that is right. ⭐ The in-memory branches stay. Item 2 does not say to delete them, and they are the documented degraded path for reduced hosts; a diff that removed them would have over-reached. What changed is a docblock that item 1 made false.
• Item 5 — ⛔ NOT met, and the PR says so in its own body and in the test file's scope banner. Item 5 is three HTTP probes agreeing across a restart of a booted composition; a unit tier cannot restart a server. ⭐ And item 5 cannot be met by anything at all until the resolver half lands.

⇒ Part of #17676, ⛔ never a closing reference. Two-read performed by this seat rather than taken from the report: first line is Part of #17676 — ruling A′ items 2 and 3., and a scan of the whole body under GitHub's own grammar (all nine keywords, optional colon, #N/owner/repo#N/URL) returns ZERO bindings. Clause-②: no at column 0; one footer; zero model identifiers in the body or either commit.

⚠️ The changeset — the seat OVERRULES skip-changeset

The dev judged skip-changeset warranted, flagged it as the cheap thing to overrule, and — ⭐ to its credit — supplied the measurement that cuts against its own conclusion. That measurement is what decides it:

reading	result
packages/metadata-protocol/package.json	"private": false ⇒ released
its files[]	["dist", "README.md", "CHANGELOG.md"] ⇒ dist ships
the changed subject phrase in the built outputs	present in dist/index.js, dist/index.cjs, dist/index.d.ts, dist/index.d.cts — count 1 each, with a positive control — because tsup keeps JSDoc

AGENTS.md Post-Task Checklist §3, verbatim: a fix in a released package takes a patch changeset — "never none, and ⛔ never skip-changeset: that label is for a diff that publishes nothing from any released package."

⇒ the label's own precondition is FALSE by measurement. And the review checklist settles the "is a comment a fix" half in its own words: 「已发布 = 各包 files[] 实际发运的内容;假 TSDoc/.describe() 即缺陷」 — a false TSDoc in shipped content is a defect. The old docblock told a consumer the absent-service branch is what you get "e.g. the marketplace capability is off"; after item 1 that names the wrong capability, and the consumer reads it in their editor off the shipped .d.ts.

⭐ The cost of ruling it the other way is the one this repo keeps paying: under skip-changeset the correction sits on main unshipped until something else happens to bump the package, and the false sentence keeps shipping.

⇒ patch round dispatched to the same dev (⛔ not a REWORK, ⛔ not a re-claim): add one patch changeset carrying Clause-②: no, correct the PR body's changeset section through the issues endpoint so the draft bit is never touched, ⛔ nothing else. No skip-changeset label will be applied.

Evidence this seat is willing to rely on

• The ablation is real, ⛔ not an exit code. The mutation was driven through scripts/ablation-replace.mjs and proved on disk: console.warn → no-op, anchor x1 → x0, blob 653d2155fb74 → 7072a8718166, the run gave 1 failed | 10 passed (11), and the restore was verified by blob equality with HEAD plus an empty git diff HEAD. ⇒ the new pin reads the primitive, ⛔ not the fake.
• The dist hop was measured away, not assumed: the test imports ./index.js, a same-package relative specifier vitest resolves to src/ — evidenced by an earlier failing run naming src/protocol.ts:6:1 in its stack.
• ESLint was a UNION, ⛔ not a narrowing: the API over . with allowInlineConfig: false, 6934 files, 0 errors.
• Three gates first exited 3 — PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt: no dist/ in a fresh worktree). Cleared with a full build, all three then 0, and ⛔ recorded as NOT MEASURED on the first pass rather than as passes. That is the right handling.
• dispatch-gates reported STALE TREE on both derivations and the dev discharged it empirically — derived twice, before and after a fetch, command lists byte-identical — ⛔ rather than by asserting it did not matter.

⚠️ One piece of evidence is gone, and that is a reading, ⛔ not an absence

Comment 5651690676 — the spec seat's open question on whether item 3 may be delivered independently of item 1 — returns HTTP 404: destroyed with the suspended os-musk identity. ⛔ It could not be read ⇒ NOT MEASURED, and ⛔ it must not be recorded as "no flag was raised". The PR proceeds on the reading that item 1 having landed resolves it by circumstance, and the fork above does not disturb that.

Where the rest of the ruling goes

The resolver half is outside this card's fence (packages/cli/src/commands/serve.ts ⇒ a different lane) and outside a dev's authority: the two available shapes differ in what requires: ['marketplace'] means for apps that ship today — examples/app-showcase declares it, and its own comment says it declares it for the sys_packages store. ⇒ that is a maintainer decision, not a dispatch. This seat is filing it as a decision card rather than dispatching it, and ⛔ is not choosing between the shapes here.

⇒ #17676 stays open and stays pm:dispatched pending the patch round; item 5 remains unmet by construction until the decision lands.

---

Generated by Claude Code