spec/kernel: carve the package-registry persistence (`sys_packages` container + hydration) out of `marketplace` into an always-on core capability under its own name — the spec half of #17676 ruling A′ item 1

[os-elon-musk]

⚠️ Re-filed. An identical card existed and was destroyed when the os-musk identity was suspended — every issue, PR and comment that identity created now returns HTTP 404. This is a reconstruction from the ruling itself plus readings re-taken today; ⛔ not a new decision, and ⛔ nothing in the ruling is re-opened.

Filed by the domain:spec execution seat (session_01EfsizFDgAcEjpwv4oM3WGT), after a cross-seat knock from the domain:engine seat (session_01RuoNSXUbBoWHkNS4AknTrM). That seat is waiting on this card to exist before dispatching its own half.

Governing text

Director ruling 5650202813 on #17676 — "A′: package-registry persistence becomes an always-on core capability under its own name; marketplace browsing stays optional", decision batch #125 item 2, maintainer verbatim 「同意」.

Item 1, verbatim — this card's scope:

packages/spec/src/kernel/platform-capabilities.ts: the package-registry persistence (the sys_packages container and its hydration) is carved out of marketplace into an always-on core capability named for what it is (the spec seat names it; ⛔ not marketplace); marketplace keeps only the catalogue / browsing half. Clause-②: yes (a published constant changes), contract-review carrier; platform-capabilities.test.ts ordering contract and the CLI's serve-capability-vocabulary.test.ts move with it.

Item 4, verbatim — also this seat's:

#5047's "package state across media = ADR-level trade-off" is read by the spec seat before landing: this ruling changes which capability owns an existing medium, not the number of media; if the seat judges an ADR note is owed, it files it (governed surface) rather than assuming.

State line, verbatim: "the spec constant half is the spec seat's sibling PR, ⛔ not a cross-lane rider."

Why a separate card is needed — re-measured today

The ruling routes this half to the spec seat but leaves #17676 labelled domain:engine, so it is invisible to this lane's candidate query. Re-measured across 134 open domain:spec cards, 2026-09-13T15:5xZ:

probe	hits
platform-capabilities	0
PLATFORM_CAPABILITY_TOKENS	0
sys_packages	0
17676	0
lit control packages/spec	101

⇒ the instrument fires; the zeros are real negatives. ⭐ This lane's ruled-backlog sweep keeps lane cards whose last comment is a director ruling, so a ruling sitting on another lane's card is invisible to it by construction — an instrument-domain gap, ⛔ not an oversight by either seat.

The remedy is already director practice: for #16678 item 6 the same seat created carrier #17931 two seconds before posting the ruling, already labelled. #17676 item 1 missed that stroke.

Scope

• Clause-②: yes is pre-declared by the ruling (a published constant changes) ⇒ an in-seat contract review at CONTRACT_REVIEW_TIER is owed before this may enqueue.
• ⚠️ Naming the new capability is this card's substantive judgment — the ruling deliberately declines to name it and forbids marketplace. ⛔ Not a mechanical rename.
• ⛔ Items 2, 3 and 5 are the domain:engine seat's and stay on A writable package created via POST /api/v1/packages is registered in memory only — it does not survive a restart, and leaves its published metadata orphaned #17676.
• ⚠️ The engine seat separately asked the adjudicator whether item 3 can be delivered independently of item 1 (5651690676 on A writable package created via POST /api/v1/packages is registered in memory only — it does not survive a restart, and leaves its published metadata orphaned #17676). ⛔ That is the ruling party's call; this card presumes neither answer.

⚠️ Label provenance

domain:* is the triage seat's single-producer field. This card's domain:spec is transcribed from the ruling's own explicit routing ("the spec seat names it", "the spec seat's sibling PR") and matches the anchoring rule mechanically (the fix lands in packages/spec). ⇒ The triage seat should overrule it freely if it reads differently.

Parent / origin: #17676 · Precedent: #17931

---

Generated by Claude Code

[os-bill]

Claim: PM loop round 8
Session: session_01JbZnqu8bt6YqfJsr9vaFb3
Branch: claude/issue-18053-package-registry-capability
Worktree: objectstack-issue-18053
Domain: domain:spec
Seat: domain:spec#2(座位贴 #18549;席 1 是 #6017,本认领不碰它)
File surface: packages/spec/src/kernel/platform-capabilities.ts 与 packages/spec/src/kernel/platform-capabilities.test.ts(顺序契约),以及 CLI 侧随之移动的 serve-capability-vocabulary.test.ts。⚠️ 开放并预先申报:.changeset/*.md 与任何门禁反向要求的派生物。⛔ 只读:docs/adr/**(受管面 —— 见下「第 4 项」,判要不要 ADR 注记是报回,⛔ 不在本 PR 里写)(stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgement tier
Clause-②: yes
Thread-read: none
Serial constraints cleared: packages/spec/src/kernel/platform-capabilities.ts 最近三次触碰是 c677cda816(#16215)· 177ebdca03(#11613)· 68e8b4b53c(#11416),无在飞持有者。本席同批在飞的 #18500 持 packages/spec/scripts/lib/schema-section.ts,open PR #18667 持 scripts/check-cross-package-test-inputs.mjs;席 1 持 migrations/registry.ts(#17534)· check-widening-tells.mjs(#17848)· check-clause2-carriers.mjs(#17919)· validate-translation-references.ts(#18203)· src/ui/component.zod.ts(#18305)。⇒ 逐条比对,与本卡文件面皆不相交。 ⏱️ 本条所有读数取自本评论同一动作:2026-09-17T14:24Z。

---

🚨 Clause-②: yes —— 由裁决预先申报,⛔ 不是本席的保守挂标

卡面逐字:「Clause-②: yes(a published constant changes),contract-review carrier」。⇒ 本卡入队前欠一次 CONTRACT_REVIEW_TIER 档的席内契约复核。

本席实测未达该档 ⇒ 按 #18511 ruling C(已合入 main):⛔ 不自审,起隔离达档复核子代理,档位证据取子代理自身 transcript 的逐请求 harness model,对实时 import 的常量比对;⛔ get_session 在 mode:subagent 里量的是派发会话,不作数。载体 needs:contract-review 同笔挂卡上;PR 一存在即挂 PR 侧。

⇒ dev 侧要知道的只有一句:你交付后本席会起一个独立复核,它只拿到卡片、既有裁决与 PR 本体,⛔ 拿不到本派发令、也拿不到本席的结论。所以把判据写进 PR 正文,别指望复核读得到这里。

本卡的实质判断在命名上,而裁决故意不给名字

卡面逐字:「an always-on core capability named for what it is(the spec seat names it;⛔ not marketplace)」。

⇒ 这是你要做的判断,不是本席替你定的。要求:

• 读 PLATFORM_CAPABILITY_TOKENS 的现有词汇,给出的新名要与那一套同一命名语法(报告里把现有词汇逐个列出来作为对照)。
• 名字要说出它是什么(包注册表的持久化:sys_packages 容器与其 hydration),⛔ 不得叫 marketplace、也⛔ 不得叫一个只有本仓库看得懂的缩写。
• 给出你没选的候选与弃选理由 —— 达档复核会逐项判这个,理由缺席就是判据缺席。

第 4 项:ADR 注记 —— 报回,⛔ 不自行落

卡面逐字引裁决第 4 项:#5047 的「package state across media = ADR-level trade-off」由spec 席在落地前读;本裁决改的是哪个能力拥有一个既有介质,⛔ 不是介质的数量;若席位判定欠一条 ADR 注记,由它立卡(受管面),⛔ 不得假设。

⇒ 你去读 #5047 与该 ADR,把你读到什么写进报告并给出你的判断;⛔ 不要动 docs/adr/**(那是受管面,PR 一旦碰它就要留 draft 等人批,会把本卡整条卡住)。本席按你的读数决定要不要另立卡。

⭐ 另一条车道正等着这张卡存在

卡面记着:domain:engine 席「正等这张卡存在才派它自己那一半」,而 #17676 挂的是 domain:engine,所以本车道的候选查询按构造看不见它 —— 那是仪器域的缺口,⛔ 不是谁的疏忽。⇒ 本卡不是可有可无的记账,它是另一条车道的解锁条件。

本席答不了的两件,写成给 dev 的问题,⛔ 不写成栅栏

1. marketplace 那一半怎么切才不改介质数量? 裁决说 marketplace「只留目录/浏览那一半」。⇒ 切开之后 PLATFORM_CAPABILITY_TOKENS 的长度、以及 always-on 边界的推导(68e8b4b53c 那次把 slice(0, 6) 换成了派生)会不会变?先测再改,并在报告里给出切前/切后的逐项对照。
2. CLI 的 serve-capability-vocabulary.test.ts 到底要跟着动什么? 卡面说它「随之移动」,但本席没测它读的是常量本身还是顺序。⇒ 读了再说,⛔ 别照抄这句话。 ⏱️ 补记取数时刻（巡检 H44 的补正，⛔ 非重测）：本段的树读数取于本评论自身的 created_at，由 API 实读回 2026-09-17T14:24:36Z。⛔ 未重新测量后冒充原读数。

查重

MCP search_issues 含 closed。⚠️ 卡面自述本卡是一次重建:同形的卡随 os-musk 身份停用而被销毁(其所有 issue / PR / 评论现返回 404)。⇒ 「查不到孪生」在这里部分地是身份销毁造成的,⛔ 不可读作干净的零;本席据卡面所引的裁决原文(5650202813 on #17676,决裁批 #125 item 2,维护者「同意」)核过方向,⛔ 不重开裁决。

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 18053,
  "status": "done",
  "branch": "claude/issue-18053-package-registry-capability",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18694",
  "session": "session_01JbZnqu8bt6YqfJsr9vaFb3",
  "premise_still_valid": true,
  "summary": "Ruling A' item 1 delivered as the spec-constant half. `packages/spec/src/kernel/platform-capabilities.ts` gains the token `package-registry` (vocabulary 28 -> 29), an open-edition provider row naming `@objectstack/service-package` (map stays 1:1 with the vocabulary), and a tail entry on `PLATFORM_ALWAYS_ON_CAPABILITIES` (10 -> 11); `marketplace` keeps its token and its row and stays OFF the slate. NAME RATIONALE (the card's substantive judgment): `package-registry` is not a new word in this tree -- `packages/spec/src/kernel/package-registry.zod.ts` already sits in the same kernel and opens '# Package Registry Protocol -- the runtime state and lifecycle operations for installed packages', so the token names the capability that PERSISTS exactly the protocol that module DEFINES; it matches the set's QUALIFIER-NOUN kebab grammar (`ai-studio`, `pinyin-search`, `hierarchy-security`); it says what the thing is; and it is the industry term (ADR-0016's own alignment list cites npm's 'Package registry'). Rejected: `marketplace` (forbidden, and the reason the ruling exists), `packages` (ambiguous with npm workspace packages inside a monorepo; names the noun not the service), `package-store` (re-imports the 'store' connotation the ruling removes), `package-state` (collides head-on with `packages/runtime/src/package-state-store.ts`, which is the OTHER medium of item 4), `package-persistence` (names a mechanism; no token in the set does), `sys-packages` (the table name -- a repo-private abbreviation the card forbids), `registry` (three registries already in this tree), `package-catalog` (that IS the half marketplace keeps). All rejection reasoning is in the PR body, because the at-tier reviewer does not see this report's dispatch. ASSIGNEE was already set (os-bill) by the dispatch; I wrote none. ⛔ `docs/adr/**` untouched -- item 4 is answered as a report-back below.",
  "tests": "ALL RUNS AT 37a112e0f2 IN worktree /home/user/objectstack-issue-18053; every build/test through `scripts/pm/os-verify-lock.sh` with OS_VERIFY_LOCK_SLOT=issue-18053. (1) RED BEFORE GREEN, the ordering contract: with only the declaration edited and no test touched, `pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/kernel/platform-capabilities.test.ts` = VERDICT command-exit 1, 1 failed / 26 passed, the failing case is '...and the rule is falsifiable -- a hostile slate is named, not shrugged off', assertion diff `+ \"package-registry\"`. That is the card's 'ordering contract moves with it' -- the only assertion in the tree that enumerates the slate tail literally. Green after updating it from the rule: 32 passed. (2) SUITES, all green: `pnpm --filter @objectstack/spec build` exit 0 (check-dts-emitted 34/34); `pnpm --filter @objectstack/spec test` exit 0 -- 485 files / 13873 tests; `pnpm --filter @objectstack/spec typecheck` exit 0 (tsc + scripts-typecheck + test-typecheck, 54 files / 259 errors / 144 pinned signatures held, unchanged); `pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 test/serve-capability-vocabulary.test.ts test/serve-defaults.test.ts test/capability-preflight.test.ts src/commands/serve-settings-ordering.pin.test.ts` exit 0 -- 4 files / 44 tests. The CLI leg required building the cli dependency closure (`turbo run build --filter=@objectstack/cli^... --concurrency=2`, 56 tasks, exit 0) because `packages/cli` carries NO vitest alias for `@objectstack/spec` and resolves it through `exports` to dist. (3) GATES, all exit 0: check:nul-bytes; check-empty-changeset --base origin/main; check-changeset-no-major --base origin/main; spec check:api-surface; spec check:export-origins; spec check:authorable-surface; check-spec-docblock-symbol-anchors; check:test-source-alias; check:cross-package-test-inputs; check:published-files; check-closing-keyword-parity. Every exit code captured with `cmd > file 2>&1; EXIT=$?` -- never through a pipe. (4) ABLATION (reverse verification), fix committed FIRST, trap on EXIT INT TERM, absolute REPO_ROOT: MUTATE leg reverted the whole declaration to the merge base -- on-disk proof `grep -c package-registry` 5 -> 0; `pnpm --filter @objectstack/spec build` exit 0; `node scripts/ablation-dist-preflight.mjs @objectstack/spec '\"package-registry\"' --absent` printed `dist/: marker absent from all 216 built files`; spec suite 5 failed / 27 passed (the 4 new carve-out cases + the ordering control); CLI pin 1 failed / 13 passed with `expected [ 'queue', 'job', 'cache', ...(7) ] to include 'package-registry'`. RESTORE leg: `git checkout HEAD -- PATH` (never a bare checkout, never a moving ref), `git hash-object` = b6c0292c5d2b5f0c012f12b8cacbdf97aed38ac7 = the HEAD blob (MATCH), rebuild exit 0, preflight (present) exit 0 `marker present in 8 built files` + `tree: working tree clean against HEAD`, spec suite exit 0, CLI pin exit 0, whole-tree `git status --porcelain` EMPTY. Direction observed: RED, as predicted. ⚠️ FIRST ABLATION ATTEMPT WAS VOIDED AND RE-RUN: the marker `package-registry` (unquoted) is NOT unique in spec's dist -- `packages/spec/src/kernel/package-registry.zod.ts` and a migration `surface:` string carry it -- so the `--absent` preflight refused with 14 residual hits. Re-run with the quoted marker `\"package-registry\"`, which is unique. The voided attempt is reported rather than silently replaced. (5) CONTROLS. LIT (must read > 0): token occurrences in the declaration = 5; preflight finds it in 8 built files; the ablation named 6 distinct failing cases. DARK (must read 0, and each does): `docs/adr/**` paths in the diff = 0; `packages/cli/src/**` paths in the diff = 0; `'marketplace'` inside PLATFORM_ALWAYS_ON_CAPABILITIES = 0. `serve-defaults.test.ts`'s own control runs over a FIXED synthetic slate, so it neither moved nor needed to -- it stayed green through every leg. (6) NOT MEASURED, stated as such: the 82-command derived family list from `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` was NARROWED to the 11 gates above (declared narrowing, per the local-verification-scope rule); the remaining families, the 50 artifact-roster families, the 11 wide-population families, the 5 path-scheduled CI jobs and the 5 workflow-valued commands are CI's. CI status at report time: in_progress (not waited on). `packages/cli` integration tier: NOT run -- the diff touches no integration-tier file, no `bin/` entry and no spawn helper; declared to CI.",
  "mcp_calls": "0 - no MCP GitHub tool was called at all (read or write). All GitHub traffic went through the REST proxy with curl + GITHUB_TOKEN.",
  "api_writes": "2 REST writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR #18694); POST /repos/objectstack-ai/objectstack/issues/18053/comments (this report). Plus 2 `git push` to the feature branch (the pre-edit empty-branch routing probe, then the commit) -- the probe returned 0, no 403. ⛔ ZERO label writes: `needs:contract-review` is the seat's by the standing clause (see open_questions #2). READING as asked: PR #18694 labels = [] (empty); `node scripts/pm/check-clause2-carriers.mjs --pair 18694` exit = 4, row C1 -- card #18053 carries `needs:contract-review`, the delivering open draft PR #18694 does not.",
  "open_questions": [
    {
      "question": "The runtime half of ruling item 1 is one row in `Serve.CAPABILITY_PROVIDERS`, and it is OUTSIDE this card's declared file surface. Measured on serve's resolver at c17ff70f3f: a slate entry is force-appended to every app's `requires`, and the CLI mounts it only if that registry keys the token; a known vocabulary token with no entry is skipped SILENTLY by design. That registry keys `marketplace` and not `package-registry`, and `PackageServicePlugin` has exactly ONE mount path in this repo -- that row. So after this PR a stock boot is exactly as capable as before: nothing breaks, and nothing new mounts. Who adds the row?",
      "options": [
        "A - the domain:engine lane adds it as part of #17676 items 2/3/5 (it is the precondition item 2's 'therefore always find the package service on a stock boot' rests on). The card says that lane is waiting on THIS card to exist, so the handoff is already the ruling's shape.",
        "B - a follow-up spec-lane card with `packages/cli/src/commands/serve.ts` declared in its file surface, dispatched right behind this one.",
        "C - amend this card's surface and let me add the row now (about 5 lines; `package-registry` -> `@objectstack/service-package` / `PackageServicePlugin` / identities ['package-service','PackageServicePlugin'] -- measured safe: identical identities to `marketplace`, so `hasPluginMatching` de-dupes and an app declaring both mounts the plugin once)."
      ],
      "recommendation": "A, because the ruling already routes the runtime consequences to the engine lane and item 2 is written as a consequence of the mount existing. I did NOT take C: the dispatch declares the surface and says stop on breach. The gap is stated in three durable places so the engine half is written against it rather than discovering it -- the slate declaration's own comment, the changeset, and the PR body's 'What this PR deliberately does NOT do' section. ⚠️ Until it lands, `package-registry` is the first token in the vocabulary that NO runtime resolves, which contradicts the module header's own definition of the vocabulary ('the union of every token the framework CLI and cloud's objectos-runtime resolve'). That is the strongest argument for dispatching the runtime half immediately rather than eventually."
    },
    {
      "question": "Label conflict, flagged rather than silently resolved. The dispatch's English preamble told me to hang `needs:contract-review` on the PR the moment it exists; the dispatch's own Chinese Clause-② section reads as the SEAT's action ('本席 ... 载体 needs:contract-review 同笔挂卡上;PR 一存在即挂 PR 侧'), and my standing instruction file is explicit: `needs:contract-review` 归席位, ⛔ 不挂不摘不等 -- report the PR's label state and the `--pair` exit code as readings. Which governs?",
      "options": [
        "A - the standing clause governs (agent file wins on conflict); I attach nothing and report the readings. This is what I did.",
        "B - the dispatch's preamble governs for this card and the seat wants the dev to hang it."
      ],
      "recommendation": "A, per 派发词与本文件冲突时以本文件为准. Consequence to act on NOW: the PR carrier is bare and `--pair 18694` is exit 4 / C1, so the pair is currently half-written -- the seat's own stroke ('PR 一存在即挂 PR 侧') is outstanding."
    },
    {
      "question": "Item 4 (ADR) -- report-back, no write. What I read: #5047 and its verification comment 5174777602, which is where the phrase comes from. The two media are (1) the operator's disabled-id set in a flat JSON file under the ObjectStack home directory, written by `packages/runtime/src/package-state-store.ts`, whose header states the choice outright -- 'intentionally a flat file rather than a sys_* object: package lifecycle state is runtime/operational state, not project metadata' -- recorded as ADR-0016 section 9.7 and reused by reference in ADR-0025; and (2) the package rows in `sys_packages`. MEASURED: no ADR names `marketplace` as the owner of `sys_packages`; the only ADR naming `sys_packages` at all is ADR-0087 (a row-level upgrade diagnostic, untouched here); no ADR names `PLATFORM_ALWAYS_ON_CAPABILITIES`. So no recorded decision becomes false and none is reversed -- the ruling's reading holds: this changes which capability OWNS an existing medium, not the number of media (still exactly two, neither added, removed nor relocated; my diff touches 4 files, none under packages/runtime, none under service-package, none under docs/adr). Is an ADR note owed?",
      "options": [
        "A - no ADR note owed now; revisit when the runtime half lands.",
        "B - file a card now proposing a one-line amendment to ADR-0016 section 9.7.",
        "C - no note at all, ever."
      ],
      "recommendation": "A, with B queued behind the engine half. The honest caveat is real but belongs to the runtime half, not to this diff: today medium (2) exists only on deployments that declare `requires: ['marketplace']`, while medium (1) is written unconditionally. Once the registry mounts on every stock boot, the drift window ADR-0016 section 9.7 knowingly accepted applies to EVERY deployment rather than to marketplace-enabled ones only. That is a change in the trade-off's EXPOSURE, not in its SHAPE -- worth one amended line in section 9.7, filed by the seat as its own card (governed surface), and ⛔ never assumed from here."
    }
  ],
  "out_of_scope_findings": [
    "to file (class a, dedupe words: ablation-dist-preflight / --absent / 'restore leg' / removal ablation / 'no dirty path carries the marker'): `scripts/ablation-dist-preflight.mjs` mis-identifies a REMOVAL-shaped mutate leg as a restore leg and exits 1 even when its own dist verdict is the green one. Repro (taken twice today, both legs of my ablation): mutate by DELETING the marker from the source, rebuild, run `--absent`. The dist half prints `dist/: marker absent from all 216 built files`, then the tree half prints `restore leg: no dirty path carries the marker, so the source you mutated is back -- but 1 path still differs from HEAD, so the TREE is not restored` and the process exits 1. The leg inference keys on 'does a dirty path carry the marker', which is false BY CONSTRUCTION for every deletion ablation -- and a deletion ablation is exactly the shape `--absent` exists for. Consequence: a dev following the discipline reads a correct mutate leg as a failed one, and the obvious repair is to stop using the tool.",
    "to file (class a/c boundary, dedupe words: PLATFORM_CAPABILITY_TOKENS header / 'vocabulary-drift test fails' / serve CAPABILITY_PROVIDERS / spec-to-serve direction / declared-not-enforced): the module header of `packages/spec/src/kernel/platform-capabilities.ts` instructs 'add its token HERE as well as to the runtime's provider registry -- the CLI's vocabulary-drift test fails if the registries and this list fall out of sync'. Measured: `serve-capability-vocabulary.test.ts` checks that direction only from serve to spec (it iterates `Serve.CAPABILITY_PROVIDERS` / `Serve.CAPABILITY_TO_TIER` keys). A token added to the vocabulary with no serve row fails NOTHING, and serve's resolver then skips it in silence -- so an author who follows the header's own promise is not caught. Pre-existing, not introduced by this PR, but this PR makes it live: `package-registry` is the first vocabulary token no runtime resolves. Closely related to open_question 1 -- if the engine half lands promptly the instance disappears while the missing pin does not.",
    "noted, not filed: the slate ordering rule is stated three times -- `platform-capabilities.test.ts`, `packages/cli/test/serve-defaults.test.ts` and `packages/cli/src/commands/serve-settings-ordering.pin.test.ts` each carry their own `BIND_TARGETS` + `orderingViolations`. All three docblocks already argue at length that they are complementary rather than duplicates (different surfaces, and only the third resolves real plugin classes), so this is a recorded design, not drift. Who will meet it: the next author adding an always-on entry, who must touch all three. 承接者: the engine lane's #17676 PR, if it appends a second slate entry.",
    "noted, not filed: `packages/spec/CHANGELOG.md` is 6078629 bytes and exceeds `check-closing-keyword-parity`'s 2097152-byte cutoff for UNREGISTERED files, so that gate reports it as 'not read' on every run in this repo (the gate still exits 0). Not a defect of this diff and not reachable by it. 承接者: none identified -- no PR or person is steered into this file by anything I touched; recorded only because the gate printed it during this card's run."
  ]
}

---

Generated by Claude Code

[os-bill]

MERGED 确认 —— PR #18694。⏱️ 本条每一段的读数都取自同一动作：2026-09-17T16:57Z。

⏱️ 本块均读于 2026-09-17T16:57Z
git log --oneline origin/main | grep -F '(#18694)'
  51297e9ee1 spec/kernel: carve the package-registry persistence out of `marketplace`
             into an always-on core capability (#18694)
parents: 1   ← 单亲 squash

主题探针
  'package-registry' 在 platform-capabilities.ts 上     3 处
  ⭐ LIT  同一把 grep 找已有 token 'marketplace'   1
  ⭐ DARK 伪造 token 'package-ziggurat'              0

os-regen 面：0 条 ⇒ ⛔ 不欠落地后重生成核验

卡被 Fixes 代关（closed / completed），同笔摘 pm:dispatched 并清 assignee，回读为 priority:p2 · domain:spec。⚠️ 定级未动 —— 定级是分诊的字。

⭐ 本卡的达档契约复核记录是 PR 评论 5717148298（PASS，盖章 92/92 在档），provenance 在 5717266067。它升级上来的那两件已另行落卡：#18705（发布 skill 的计数陈旧且无门禁，并带上了那条 marketplace provider 行无人拥有的缺口）。

---

Generated by Claude Code