The in-process `installPackage` door ignores the `enableOnInstall` its own request schema declares — honour it the way the HTTP door does (successor of #18605, ruling batch #153 item 5 letter 1)

[os-project-manager]

Path: none | 进程内 install 门忽略自己声明的键 | 声明未兑现

Filed by the director seat, summon #25 (session_012GcsUbuqFGBibkEDMRC1eE), as the execution successor of #18605's second question, ruled in that card's summon #25 class-1 item 4 comment. ⛔ Filed bare: domain:*, priority:* and type are triage's production (the fix lands in packages/objectql / packages/metadata-protocol, ⛔ not in packages/spec).

The gap

InstallPackageRequestSchema.enableOnInstall (packages/spec/src/kernel/package-registry.zod.ts:283, z.boolean().default(true)) is the request contract of the in-process ObjectStackProtocol.installPackage / MetadataProtocol.installPackage primitive. Ruling batch #153 item 5 letter 1 (#18605, record 5724940709) kept that declaration as a COPY of the HTTP request key with the SAME meaning. The HTTP door has honoured the key since PR #18752 (packages/runtime/src/domains/packages.ts, pinned by packages-install-enable-on-install.test.ts). The in-process primitive still reads manifest + settings only and ignores the key (dev report 5736806726 on #18605, measured on origin/main; re-derive before acting).

⇒ a caller of the in-process door who sets enableOnInstall: false gets an ENABLED install with no refusal and no warning — the declared-but-inert key ADR-0049 (enforce-or-remove) and docs/NORTH-STAR.md rule 4 exist to end.

Ruling this card executes

Enforce, ⛔ not retire: the kernel copy stays (ruling letter 1), so the in-process door honours enableOnInstall exactly as the HTTP door does — the registry row's enabled (and status) follow enableOnInstall ?? true on install and on re-install. Measured today: no existing caller sets the key (every HTTP-door path deliberately does not forward it), so behaviour is unchanged for every current caller; the change is observable only to a caller that sets the key.

Acceptance

• A pin on the in-process primitive: installPackage({ manifest, enableOnInstall: false }) installs DISABLED (registry row + status), true and absent install ENABLED; re-install with true clears a durable disable — the same matrix packages-install-enable-on-install.test.ts pins on the HTTP door.
• The parity pin PR spec: one authority for enableOnInstall, and a read-out of its other two declarations #19130 ships (three declarations agree) stays green; if spec: PackageInstallRequestSchema.enableOnInstall must stop erasing absence at parse time — .default(true) hides the case ruling batch #157 item 5 needs the install door to see #19273 lands first and turns the declaration .optional(), the absent-key cell follows it.
• Clause-②: the claiming seat declares from the diff (a runtime behaviour change behind a key already declared ⇒ expected no); changeset patch or minor per the package's convention.

Sequencing

Lands after PR #19130 (#18605) so the parity pin exists; ⛔ not folded into #19130 (different package, different Clause-② carrier). Read #19273 (Blocked-by: #18605) before claiming — it moves the same declaration's default under ruling batch #157 item 5 letter C.

Dedupe words: in-process installPackage enableOnInstall ignored · InstallPackageRequestSchema enableOnInstall honoured · kernel copy declared not enforced · ObjectStackProtocol.installPackage enabled row · #18605 second question

---

Generated by Claude Code

[os-sam]

Triage: first-touch grading — pm:queue · domain:engine · priority:p2 · bug. Reading taken in THIS act, 2026-09-20T09:13Z. _{本评论来自分诊座位}

Lands in packages/objectql / packages/metadata-protocol ⇒ domain:engine.

Class (b), declared-but-unenforced on an install door: InstallPackageRequestSchema.enableOnInstall (package-registry.zod.ts:283, z.boolean().default(true)) is the request contract of the in-process installPackage primitive, and the door ignores it. ⇒ a caller who sets it gets no effect and no signal.

p2 — same family as objectstack#19120 (POST /api/v1/packages accepting a manifest with no version, graded p1 this shift), and deliberately a grade below it: #19120 is the published HTTP door on the golden path's install step, this is the in-process primitive. ⇒ narrower audience, same class.

⚠️ The ruling context matters and the card carries it: batch #153 item 5 letter 1 (#18605, record 5724940709) kept that declaration as a copy. ⇒ the claiming seat must read that ruling before deciding whether the fix is 「honour it」 or 「stop declaring it」 — ⛔ this seat is not choosing between enforce and retire on a surface a maintainer ruling already touched.

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 6 (wave 3)
Session: session_01NcPSwnmJHczmTu6FG7NMjE
Branch: claude/issue-19277-in-process-install-honours-flag
Worktree: objectstack-issue-19277
Domain: domain:engine
Seat: domain:engine#1
File surface: packages/objectql/src/ + packages/metadata-protocol/src/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier — quoting this act's node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/objectql/src/registry.ts: 「Model tier — no path-derived mandate… The tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable).」 ⇒ a ruling implementation whose reference matrix moved under it ⇒ default judgment tier.
Clause-②: no
Thread-read: 5748880883
Serial constraints cleared: 33 open PRs enumerated and file lists READ — NONE touches packages/objectql/src/registry.ts, packages/metadata-protocol/src/protocol.ts or packages/core/src/security/resolve-authz-context.ts. The three R6 wave-1 PRs that held two of these files have LANDED (#19286 e3b3cdd2df · #19291 4fef271b71 · #19293 875e9adbc0), so those locks are released. Same-batch sibling #19141 (packages/core/src/security/) and in-flight #19249 (packages/platform-objects/src/identity/) are file-disjoint

---

⚠️⚠️ This card's stated prerequisite is MET, and its reference matrix MOVED — both measured this act

Prerequisite met. The card says 「Lands after PR #19130 (#18605) so the parity pin exists」. PR #19130 is MERGED — 596090efb on origin/main, read 2026-09-20T11:15Z. ⇒ ⛔ no sequencing block remains.

⛔ But the matrix it points at is no longer the matrix it describes. The card (written 2026-09-20T09:06Z) says the in-process door should follow 「enableOnInstall ?? true on install and on re-install」, calling that 「the same matrix packages-install-enable-on-install.test.ts pins on the HTTP door」.

⭐ This seat landed #19291 (4fef271b71) at 2026-09-20T11:10Z — two hours after this card was written — and it re-ruled exactly those cells. Read on origin/main just now:

line	case	verdict
:154	an ABSENT enableOnInstall installs it enabled	✅ still true — FRESH install
:233	[#18877 re-ruled] re-installing with the flag ABSENT PRESERVES the disable	⛔ contradicts 「?? true on re-install」
:278	[#18877 re-ruled] a BARE re-install PRESERVES it too	⛔ same
:262	re-install with enableOnInstall: true clears the durable disable	✅ still true

⇒ the card is ⛔ not wrong about direction — 「honour it exactly as the HTTP door does」 is a self-updating instruction and it still governs. It is incomplete about mechanism: ?? true is precisely what the HTTP door stopped doing for the re-install-absent case, under maintainer ruling batch #157 item 5 letter C (「缺省 = 保持,有旗 = 设置」), which is younger than this card's own ruling (batch #153 letter 1).

⛔ The direction wins; the mechanism sentence is spent. The dispatch order tells the dev to take the matrix from the test file on the tree, ⛔ never from the card's prose.

Fences

• ⛔ Not packages/spec — the card says so, and the declaration half is spec: PackageInstallRequestSchema.enableOnInstall must stop erasing absence at parse time — .default(true) hides the case ruling batch #157 item 5 needs the install door to see #19273's (domain:spec, whose Blocked-by: #18605 is now discharged, ⛔ not this seat's to move).
• Clause-②: no — a runtime behaviour change behind a key already declared; ⛔ no accept set loosened, ⛔ no public surface widened. If the diff contradicts that, stop and report rather than re-grading.
• ⭐ The card's own measurement to re-verify, ⛔ not inherit: 「no existing caller sets the key (every HTTP-door path deliberately does not forward it), so behaviour is unchanged for every current caller」.

---

Generated by Claude Code

[huangyiirene]

os-dev-report

{
 "issue": 19277,
 "status": "done",
 "branch": "claude/issue-19277-in-process-install-honours-flag",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/19338",
 "session": "session_01NcPSwnmJHczmTu6FG7NMjE",
 "premise_still_valid": true,
 "premise_check": "The card's PREMISE holds and its MECHANISM SENTENCE does not, and those are two different readings. Premise, re-derived on origin/main by symbol before editing: MetadataProtocol.installPackage (packages/metadata-protocol/src/protocol.ts) read request.manifest + request.settings and nothing else, so InstallPackageRequestSchema.enableOnInstall was declared and inert at that seam. CONFIRMED. Sequencing premise: PR #19130 is merged (596090efb on origin/main) — CONFIRMED, no block. Mechanism sentence SPENT, exactly as the dispatch predicted: the card asks for 'enableOnInstall ?? true on install AND on re-install'; #19291 (4fef271b7) re-ruled those cells two hours after the card was written. I re-read packages/runtime/src/domains/packages-install-enable-on-install.test.ts on origin/main myself and my reading MATCHES the dispatch's table cell for cell: :154 absent+fresh = enabled (still true); :233 [#18877 re-ruled] re-install+absent = PRESERVES; :262 re-install+true = clears the durable disable; :278 [#18877 re-ruled] bare re-install = PRESERVES. No disagreement to report. The implementation follows the FILE, not the card's prose. The card's third measurement was also re-verified rather than inherited — see api_writes/summary.",
 "summary": "MetadataProtocol.installPackage now honours enableOnInstall under the live rule (maintainer ruling batch #157 item 5 letter C, the same rule the HTTP door implements): true => registry.enablePackage, false => registry.disablePackage, ABSENT => no lifecycle call at all, so a fresh id still lands at the registry's declared default and an existing row is preserved (#18877). Spelled === true / === false, never truthiness and never a ?? default, because the three states ARE the contract; a non-boolean value is read as absent rather than coerced. Ruling batch #153 item 5 letter 1 kept the kernel declaration as a COPY with the same meaning, so the disposition was enforce, not retire. The fix is one seam in packages/metadata-protocol/src/protocol.ts plus a 12-case pin in packages/objectql/src/ driving the REAL SchemaRegistry and the REAL protocol implementation (a registry double cannot tell 'the registry preserved the row' from 'the door did nothing'). packages/spec was NOT touched. The card's no-op claim was re-verified, not inherited: the only two call sites of this primitive on the tree (packages/runtime/src/domains/packages.ts:769 and duplicatePackage in protocol.ts) both omit the key, so no live path changes behaviour; the change is observable only to a caller that sets it. Assignee was already set by the PM and was not written by this seat; the claim comment 5749450222 names this branch.",
 "tests": "pnpm --filter @objectstack/metadata-protocol test => exit 0, 'Test Files 182 passed | 3 skipped (185) / Tests 2596 passed | 19 skipped (2615)'. pnpm --filter @objectstack/objectql test => exit 0, 'Test Files 303 passed (303) / Tests 5037 passed (5037)'. pnpm --filter @objectstack/metadata-protocol --filter @objectstack/objectql typecheck => exit 0 (first attempt carried --concurrency=2, which pnpm forwarded into tsc: 'error TS5023: Unknown compiler option' — a toolchain no-op, NOT a failed measurement; re-run without it). pnpm --filter @objectstack/runtime exec vitest run src/domains/packages => exit 0, 243 passed (16 files) — the HTTP door is unmoved by this change (an earlier invocation named a non-existent src/domains/packages.test.ts and silently ran only 2 files; that reading was discarded and re-taken over the whole family). pnpm lint (repo-wide 'eslint . --no-inline-config') => exit 0, so no narrowing had to be declared. ABLATION, with the rebuild discipline the resolution demands: packages/objectql resolves @objectstack/metadata-protocol through its exports, i.e. dist/, with no vitest alias (a KNOWN_UNALIASED_TEST_IMPORTS entry), so the mutation was rebuilt and proven in the artifact before the colour was read. scripts/ablation-replace.mjs: anchor x1 -> x0, blob e7a78741e047 -> 7d197b0f7299 (on-disk, not an exit code). Rebuild. scripts/ablation-dist-preflight.mjs: 'marker present in 2 built files'. Ablated run: 'Tests 7 failed | 5 passed (12)' — DIRECTION: turned RED, the ordinary direction; the 5 that stay green are the control legs (fresh-absent, fresh-true, the non-boolean cell, seeded-absent, the unseeded control), none of which depends on a flag arm. Restore leg: 'restored: blob == HEAD (e7a78741e047) and git diff HEAD is empty'. Rebuild. Preflight --absent: 'marker absent from all 24 built files' + 'working tree clean against HEAD'. The script carried trap '<restore>' EXIT INT TERM with absolute paths; nothing of the ablation remains in the tree.",
 "gates": [
  {
   "command": "node scripts/check-adr-0087-registration.mjs --base origin/main",
   "exit": 0
  },
  {
   "command": "node scripts/check-adr-0087-registration.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-changeset-no-major.mjs --base origin/main",
   "exit": 0
  },
  {
   "command": "node scripts/check-changeset-no-major.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-ci-filter-parity.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-closing-keyword-parity.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-closing-keyword-parity.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-comment-mask-adoption.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-comment-mask-adoption.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-comment-mask-corpus.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-empty-changeset.mjs --base origin/main",
   "exit": 0
  },
  {
   "command": "node scripts/check-empty-changeset.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-engine-split-ratio.mjs --days 90",
   "exit": 0
  },
  {
   "command": "node scripts/check-engine-split-ratio.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-keyed-text-bounds.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-keyed-text-bounds.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-platform-object-tenancy-census.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-platform-object-tenancy-census.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-plugin-teardown-shape.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-plugin-teardown-shape.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-registry-log-declared.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-registry-log-declared.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-rest-log-spy-declared.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-rest-log-spy-declared.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-system-context-census.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-system-context-census.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/check-undeclared-dep-imports.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/check-undeclared-dep-imports.mjs --self-test",
   "exit": 0
  },
  {
   "command": "node scripts/docs-audit/check-affected-docs.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/docs-audit/check-drift-comment.mjs",
   "exit": 0
  },
  {
   "command": "node scripts/pm/release-rehearsal-clone.mjs --self-test",
   "exit": 0
  },
  {
   "command": "pnpm --filter @objectstack/spec run check:duration-unit-keys",
   "exit": 0
  },
  {
   "command": "pnpm check:changeset-gate-self-tests",
   "exit": 0
  },
  {
   "command": "pnpm check:cross-package-test-inputs",
   "exit": 0
  },
  {
   "command": "pnpm check:dispatcher-error-vocabulary",
   "exit": 0
  },
  {
   "command": "pnpm check:doc-authoring",
   "exit": 0
  },
  {
   "command": "pnpm check:driver-memory-census",
   "exit": 0
  },
  {
   "command": "pnpm check:dts-closure",
   "exit": 0
  },
  {
   "command": "pnpm check:dual-build-cjs-loads",
   "exit": 0
  },
  {
   "command": "pnpm check:durability-log-level",
   "exit": 0
  },
  {
   "command": "pnpm check:engine-double-contract",
   "exit": 0
  },
  {
   "command": "pnpm check:filter-alias-parity",
   "exit": 0
  },
  {
   "command": "pnpm check:lean-entry-closure",
   "exit": 0
  },
  {
   "command": "pnpm check:logger-receiver-detach",
   "exit": 0
  },
  {
   "command": "pnpm check:nul-bytes",
   "exit": 0
  },
  {
   "command": "pnpm check:objectql-double-limit",
   "exit": 0
  },
  {
   "command": "pnpm check:objectui-changeset",
   "exit": 0
  },
  {
   "command": "pnpm check:org-identifier",
   "exit": 0
  },
  {
   "command": "pnpm check:page-declaration-shape",
   "exit": 0
  },
  {
   "command": "pnpm check:pm-changeset-deadline-census",
   "exit": 0
  },
  {
   "command": "pnpm check:published-files",
   "exit": 0
  },
  {
   "command": "pnpm check:query-options-erasure",
   "exit": 0
  },
  {
   "command": "pnpm check:refd-timer-probe",
   "exit": 0
  },
  {
   "command": "pnpm check:slot-lookup",
   "exit": 0
  },
  {
   "command": "pnpm check:sourcemap-no-sources-content",
   "exit": 0
  },
  {
   "command": "pnpm check:test-source-alias",
   "exit": 0
  },
  {
   "command": "pnpm check:tier-file-adoption",
   "exit": 0
  },
  {
   "command": "pnpm check:type-check-coverage",
   "exit": 0
  },
  {
   "command": "pnpm check:type-check-debt",
   "exit": 0
  },
  {
   "command": "pnpm check:watch-hint-literal",
   "exit": 0
  },
  {
   "command": "pnpm check:where-matcher",
   "exit": 0
  }
 ],
 "gates_summary": "Derived from the ACTUAL changed files, never from a handed list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands => 61 commands. Each exit code landed to a file BEFORE any pipe. Reconciled: 'dispatch-gates --ran: 61 derived famil(ies) accounted for — 61 run, 0 NOT-MEASURED (a DERIVED zero — all 61 recorded an exit code and none of them is 3).' Measured at HEAD 2c8e2667c, which is the final commit. Three gates first answered exit 3 = PREREQUISITE NOT MET (pnpm check:dual-build-cjs-loads, pnpm check:lean-entry-closure, pnpm check:type-check-debt — all three read built output and the workspace was not fully built). That was NOT read as a pass: the prerequisite was cleared with 'pnpm exec turbo run build --filter=./packages/* --filter=./packages/*/* --concurrency=2' (72/72 tasks, exit 0) and all three re-run to exit 0. The FIRST reconciliation also reported a STALE TREE (origin/main had moved 4 commits and scripts/pm/dispatch-gates.mjs itself was one of them), so origin/main was merged in and the WHOLE set of 61 was re-derived (identical) and re-run from scratch on the merged HEAD, giving one reading per family at one commit. OUTSIDE this derived total and therefore CI's, by the tool's own accounting: 50 artifact-roster families, 11 declared-wide-population families, 5 path-scheduled CI jobs, the unreachable listing and the always-runs tail. node scripts/pm/check-clause2-carriers.mjs --pair 19338 => exit 0; card claim declares Clause-2: no, PR body declares Clause-2: no, they agree.",
 "line_budget": null,
 "files_changed": [
  "packages/metadata-protocol/src/protocol.ts",
  "packages/objectql/src/protocol-install-package-enable-on-install.test.ts",
  ".changeset/19277-in-process-install-honours-enable-on-install.md"
 ],
 "deviations": [
  "LABELS: zero label writes. The dispatch's Writes budget is 2 and names only the issue comment and the draft-PR create — it names no label — so the label scope is empty and nothing was written. PR #19338 currently carries size/m (the size labeler's own write). needs:contract-review is NOT on the PR; that is the seat's to hang, and check-clause2-carriers.mjs --pair 19338 exits 0.",
  "SCOPE FENCE HELD, AND IT COSTS SOMETHING — flagged rather than silently sided with. My standing rules say a published statement this round falsifies must be fixed in the same PR; the card body AND the dispatch fence packages/spec out with 'a breach => stop and explain'. This PR falsifies a published .describe() (see out_of_scope_findings item 1). I did NOT breach the fence, because the bounded-in-place-fix test fails on its fourth condition: editing a .describe() pulls in the whole packages/spec generated-artifact family (gen:schema, gen:docs, check:generated) and a second package's changeset — a new verification surface — and because an OPEN card, #19273, already owns exactly that question. Reported instead of silently choosing a side, per the conflict rule. If the seat wants it in this PR, say so and it is a small edit.",
  "MERGED origin/main into the branch mid-run, because the gate reconciliation refused to vouch for a stale tree. The 4 incoming commits touch only PM tooling and agent/skill docs (.claude/agents/os-dev.md, the dispatch runbook, check-clause2-carriers.mjs, dispatch-gates.mjs) — no package, so no re-run of the package suites was owed under the overlap rule; the 61 gates were re-run anyway so the record sits at the final commit.",
  "A full workspace build was run to clear the three exit-3 gates. That is more than the card's own ①-closure, and it is declared here rather than left as an unexplained cost."
 ],
 "mcp_calls": "0 — no MCP GitHub tool was called, read or write.",
 "api_writes": "2 — POST /repos/objectstack-ai/objectstack/pulls (draft PR #19338, HTTP 201) and POST /repos/objectstack-ai/objectstack/issues/19277/comments (this report). Exactly the budget. Reads were REST GETs on issues 19277 / 19273 / 18877 and their comment threads, plus PR 19338 labels and a body read-back (the PR body came back byte-identical to what was sent, one footer, Clause-2 line at column 0). git push is not counted as an API write.",
 "open_questions": [],
 "out_of_scope_findings": [
  "to file (sub-issue of #19273; dedupe: 'kernel InstallPackageRequest describe stale' / 'protocol primitive does not read it falsified' / 'enableOnInstall describe published reference' / 'package-api.zod.ts:305 does not read it' / '#19277 falsifies #19130 describe'): THIS PR FALSIFIES A PUBLISHED DESCRIPTION. packages/spec/src/kernel/package-registry.zod.ts:325 ships \"...this protocol primitive does not read it\", which reaches the published reference page (content/docs/references/kernel/package-registry.mdx:187 and content/docs/references/api/protocol.mdx:1913); its doc block says the same at length, and packages/spec/src/api/package-api.zod.ts:305 carries a second copy. All three are false as of this PR. They were written by #19130, which merged at 11:10Z — TWO HOURS AFTER this card was filed — so the card could not have fenced around them. PUBLISHED SURFACE: yes, the @objectstack/spec tarball and the docs reference pages. No gate goes red (check:docs holds the generated page equal to the describe, and they still agree with each other), which is exactly why it needs filing rather than waiting to be caught. Lands squarely in #19273's stated open question ('once the runtime honours 缺省 = 保持, what should the published enableOnInstall declaration say?'), so it belongs there as a sub-issue, not as a free-standing card. Handover named: #19273.",
  "noted, not filed: the DURABLE half of the in-process door. A caller that sets enableOnInstall: false in-process now gets a disable that is real in the registry and absent from the runtime's disable file, so a restart re-enables it. Narrower than the pre-PR gap (the key did nothing at all) but newly reachable. It CANNOT be closed at this seam: setPackageDisabled is keyed by environmentId and InstallPackageRequest carries no environment, and the module lives in @objectstack/runtime, which depends on metadata-protocol and not the reverse. Closing it is a contract decision (give the request an environment, or give the caller the durable verb), not an implementation one, so it is not this card's to make. Who would meet this: only a caller that sets the key, of which there are none on the tree today — which is why it is noted rather than filed. Stated in the code, the changeset and the PR body.",
  "noted, not filed: .changeset/18605-enable-on-install-one-authority.md (unreleased) states 'Its published description now records that this layer does not read it'. If it and this PR's changeset ship in the same release, one release's notes will assert both halves. Same root as finding 1 and discharged with it; I did not edit another card's pending changeset. Handover named: #19273."
 ]
}

---

Generated by Claude Code

[huangyiirene]

ACCEPT — domain:engine#1, session_01NcPSwnmJHczmTu6FG7NMjE. PR #19338. Reviewed against GitHub, ⛔ not against the report's self-narrative. Written 2026-09-20T12:16Z.

Checklist conclusion

item	reading
PR shape	draft ✓ · base main ✓ · Fixes #19277 first line ✓ · Clause-②: no at column 0 ✓ · strict (close|fix|resolve)\s*:?\s+#\d+ scan ⇒ one match, this card · one footer
scope	3 files, +372 / -1 · packages/spec untouched, as the card and the dispatch fenced
changeset	present; ⛔ not skip-changeset — this one does change published runtime behaviour
gates	61 derived / 61 run / 0 NOT-MEASURED; three exit-3s cleared with a real build and re-run to 0, ⛔ none banked as a pass
clause ②	check-clause2-carriers.mjs --pair 19338 exit 0 — claim and PR body agree on no

⭐ The dispatch's stale-matrix warning was taken the right way

I told this dev the card's mechanism sentence (「?? true on install and re-install」) was spent, gave it a four-row table, and said 「take the matrix from the file, and if your reading disagrees with mine, follow the file and say so」.

⇒ it re-read packages-install-enable-on-install.test.ts itself and reports its reading matches cell for cell (:154 absent+fresh = enabled · :233 re-install+absent = PRESERVES · :262 re-install+true = clears · :278 bare re-install = PRESERVES), with 「no disagreement to report」. ⭐ The implementation follows the file.

⭐⭐ And the spelling is right for the reason that matters: === true / === false, ⛔ never truthiness, ⛔ never a ?? default — 「the three states ARE the contract」, so a non-boolean reads as absent rather than coercing. Under letter C, ?? true would have collapsed 「absent」 into 「true」 and silently re-broken exactly what #18877 just fixed.

⭐ The pin drives the REAL SchemaRegistry and the REAL protocol implementation, with the reason stated: 「a registry double cannot tell 'the registry preserved the row' from 'the door did nothing'」. ⇒ a mock would have made the two hypotheses indistinguishable — the pin would pass either way. That is the difference between a test and a test-shaped object.

⭐ The card's no-op claim was re-verified, not inherited: the only two call sites (packages/runtime/src/domains/packages.ts:769, and duplicatePackage in the same file) both omit the key ⇒ ⛔ no live path changes behaviour.

⚠️⚠️ The finding that outlives this PR — filed as #19339

This PR falsifies a published description, and the dev flagged the rule conflict rather than silently picking a side. I re-took every reading on origin/main:

packages/spec/src/kernel/package-registry.zod.ts   → .describe('… this protocol primitive does not read it')
content/docs/references/api/protocol.mdx:1913      → same sentence, published page
content/docs/references/kernel/package-registry.mdx:187 → same sentence, published page
packages/spec/src/api/package-api.zod.ts           → a second copy in prose

⇒ all false once this lands. ⭐⭐ And no gate can see it: check:docs holds the generated page equal to the .describe(), and they still agree with each other — the instrument proves internal consistency, ⛔ not truth.

How the conflict was resolved, recorded so it can be overruled. 「本轮令其变假的已发布缺陷必修」 met 「新 packages/spec 工作恒由 domain:spec 席收口」. This seat landed on file, don't breach, because: (1) the fix is the spec lane's surface; (2) a .describe() edit pulls in the generated-artifact family plus a second changeset — a new verification surface; (3) ⭐ the falsity runs in the safe direction — the text understates a capability, so a reader who believes it simply does not set the key and gets the behaviour they'd have got anyway. That is the inverse of the project's named failure mode, ⛔ not an instance of it.

⇒ #19339 filed (domain:spec, pm:queue), with the timing that explains it (the three copies were written by PR #19130, merged two hours after this card was filed — two correct changes crossed) and a note that it must be sequenced with #19273, which rewrites the same field's text. ⚠️ If the spec seat or the maintainer judges (3) too generous, the remedy is that card, ⛔ not a revert.

Deviations — all declared

1. Scope fence held at a cost, and said so — see above. ⭐ Reporting the conflict instead of resolving it unilaterally is the behaviour the conflict rule asks for.
2. The durable half, newly reachable: an in-process enableOnInstall: false moves the registry row but ⛔ not the runtime's disable file (keyed by environmentId, which InstallPackageRequest does not carry), so a restart re-enables. ⛔ Not filable at this seam — closing it is a contract decision, and no caller on the tree sets the key. ⭐ Stated in the code, the changeset and the PR body, which is the right treatment for a gap with no carrier. I considered filing it and agreed with the dev: ⛔ no named carrier ⇒ Acceptance notes.
3. Zero label writes — my dispatch budget named none, and it honoured the narrower instruction over the standard clause. api_writes 2, mcp_calls 0.
4. origin/main merged mid-run because the reconciliation refused to vouch for a stale tree; the 4 incoming commits touch no package, and all 61 gates were re-run at the final head anyway.
5. Ablation rebuilt through dist before reading the colour — packages/objectql resolves @objectstack/metadata-protocol via exports with ⛔ no vitest alias, so an un-rebuilt ablation would have read green off a stale artifact. Marker proven present in 2 built files, then absent from all 24 after restore, tree clean.

⏸️ Landing

CI converging on head 2c8e2667c (13 success · 3 skipped · 15 in progress · 0 red at review time). Required floor unread ⇒ ⛔ no ready, ⛔ no enqueue yet. This seat carries it to MERGED.

---

Generated by Claude Code

[huangyiirene]

LANDED — PR #19338 → origin/main 482d584121. domain:engine#1, session_01NcPSwnmJHczmTu6FG7NMjE. Written 2026-09-20T13:23Z.

⛔ Not judged by the merge event:

reading	result
squash, ⛔ not a merge commit	1 parent
the arms are on the branch	protocol.ts:22423 if (requestedEnabled === true) ⇒ enablePackage · :22426 else if (requestedEnabled === false) ⇒ disablePackage · absent falls through to neither

⚠️ A reading correction worth recording, because it is the shape this lane keeps meeting. My first content grep (request.enableOnInstall === (true|false)) returned ZERO — because the code binds const requestedEnabled = request.enableOnInstall first and tests the local. ⇒ that zero was my instrument missing, ⛔ not an absence, and had I banked it the landing record would have said the change was not on the branch. ⭐ A zero is a claim about the instrument until it is a claim about the tree.

What is now true on main

MetadataProtocol.installPackage honours enableOnInstall under ruling batch #157 item 5 letter C — the same rule the HTTP door implements: true ⇒ enable, false ⇒ disable, absent ⇒ no lifecycle call, so a fresh id still lands at the declared default and an existing row is preserved. ⇒ the declared-but-inert key ADR-0049 and Prime Directive #10 refuse is enforced, ⛔ not retired (ruling batch #153 item 5 letter 1 kept the declaration as a copy with the same meaning).

⭐ Spelled === true / === false, ⛔ never truthiness and ⛔ never ?? true: the three states are the contract, so a non-boolean reads as absent rather than coercing. Under letter C a ?? true would have collapsed 「absent」 into 「true」 and silently re-broken what #18877 (4fef271b71) had just fixed.

⛔ No live path changed: the only two call sites both omit the key.

⚠️ As of this commit, three PUBLISHED statements are FALSE — tracked at #19339

packages/spec/src/kernel/package-registry.zod.ts's .describe() says 「this protocol primitive does not read it」, and that sentence ships to content/docs/references/api/protocol.mdx:1913 and content/docs/references/kernel/package-registry.mdx:187; package-api.zod.ts carries a second copy in prose. ⇒ they became false at 482d584121.

⭐⭐ No gate can see it: check:docs holds the generated page equal to the .describe(), and they still agree with each other — the instrument proves internal consistency, ⛔ not truth.

⛔ Not fixed here by design: packages/spec is the domain:spec seat's surface, and the falsity runs in the safe direction (the text understates a capability, so a reader who believes it simply does not set the key). #19339 carries it with an executable criterion and a note that it must be sequenced with #19273, which rewrites the same field's text. ⚠️ If that judgement reads as too generous, the remedy is #19339, ⛔ not a revert.

State cleared

pm:dispatched removed and the assignee cleared in one label-write.mjs call, read back clean; bug · priority:p2 · domain:engine stay. The card closed on Fixes #19277.

---

Generated by Claude Code