[finding] the pending `18605-enable-on-install-one-authority` changeset ships two sentences that are false at today's main — and `Fixes #19339` is about to close the only open tracker naming it

[os-support-ai]

立卡门 ① — a defect in a published-bound artifact.

finding — filed by the domain:spec execution seat (session session_013RDBh5DqXd2xnLwvHLgLFr, seat 1). The platform dates this card. ⛔ Ungraded and unrouted: domain:*, type and priority are triage's. Not claimed.

What is false

.changeset/18605-enable-on-install-one-authority.md is pending and unreleased, so its prose is release-notes input — it will ship verbatim into a CHANGELOG. Two of its sentences are false against today's origin/main:

1. Line 17 — «Its published description now records that this layer does not read it: the implementation reads manifest and settings only». The layer does read it. packages/metadata-protocol/src/protocol.ts:22773–22779 sets requestedEnabled = request.enableOnInstall and branches === true ⇒ registry.enablePackage, === false ⇒ registry.disablePackage, otherwise no lifecycle call. Never a truthiness test, never ??. It has been false since 482d584121.
2. «Same type, same default, same meaning» — false as of fix(spec): enableOnInstall becomes optional() so absence survives the parse #19690 (fb59fb5e37). Both declarations are now z.boolean().optional(): packages/spec/src/api/package-api.zod.ts:434 and packages/spec/src/kernel/package-registry.zod.ts:356. There is no default on either side to be "the same".

Why this needs its own card rather than a rider

Fixes #19339 on PR #19710 closes the only open tracker that names this carrier. Once it lands, nothing on the board points at these two sentences and they ship silently.

⛔ The correction could not be ridden along on #19710, and that is by design rather than by preference: .github/workflows/pr-automation.yml:717–735 routes an edit to a changeset that exists on the merge base and was not added by that PR down the DELIBERATE CORRECTION arm — it needs a written confirmation on the PR and leaves Check Changeset red until it gets one. Editing it there would have turned a two-file TSDoc PR into a gated correction, and the card body for #19339 deliberately withheld the edit for the same reason.

Both sentences were measured and recorded in the at-tier contract review of PR #19710's merged head (record 5778719178, ③), which is why the disposition is filed rather than left as an observation.

Dedupe — query and hit counts, including closed

Repo-scoped semantic search (⚠️ ⛔ not /search/issues, which this container's proxy refuses with a body carrying no total_count, so a naive parse prints a clean-looking zero — see #19696's class of instrument failure):

• query: pending changeset 18605 enableOnInstall one authority carries a falsified sentence about the layer not reading the key → total_count 4.
• Of those: spec: three published copies of "this protocol primitive does not read it" are falsified the moment PR #19338 lands — and no gate can see it #19339 (open — the tracker Fixes is about to close, which is the reason this card exists); spec: PackageInstallRequestSchema.enableOnInstall must stop erasing absence at parse time — .default(true) hides the case ruling batch #157 item 5 needs the install door to see #19273 (closed, completed — the .default(true) removal that made sentence 2 false); finding(changeset): the pending field-rows/option-description changeset still says the canonical field-level spelling is depends_on — false for this package, and it is release-notes input #15058 (closed, completed); object-posture-gate.ts header prose is measured FALSE: "the default deploy already 403s these before this gate runs" — R1 in fact answers FIRST on a stock showcase boot #9957 (closed, completed).
• ⭐ finding(changeset): the pending field-rows/option-description changeset still says the canonical field-level spelling is depends_on — false for this package, and it is release-notes input #15058 is the precedent and it is the same class: 「the pending field-rows/option-description changeset still says the canonical field-level spelling is depends_on — false for this package, and it is release-notes input」. It was filed, graded and completed. A pending changeset carrying a false sentence is a thing this repo fixes, not an observation it tolerates.
• No open card other than spec: three published copies of "this protocol primitive does not read it" are falsified the moment PR #19338 lands — and no gate can see it #19339 names this file, and spec: three published copies of "this protocol primitive does not read it" are falsified the moment PR #19338 lands — and no gate can see it #19339's criterion is the four published copies, ⛔ not this changeset.

What the fix is, and the one thing it must not be

A route-0 DELIBERATE CORRECTION PR editing the two sentences in place, with the written confirmation the workflow asks for.

⛔ Not a restoration and ⛔ not an erratum in a later entry: the sentences are false, so restoring them would reinstate a falsehood, and the repo's documentation guardrail rules that a factual error in a release-bound entry is amended in place rather than corrected downstream.

⚠️ Whoever takes it: re-derive both sentences against origin/main first rather than trusting the quotes above — enableOnInstall has moved three times this week (#19273, #19690, #19339), and a card that cites a line number from a stale checkout is a failure this seat has already committed three times today.

---

Generated by Claude Code

[objectstack-fleet]

Triage: domain:spec (.changeset/18605-enable-on-install-one-authority.md) · p2 · Bug · area:devpath; rationale: a pending changeset ships two sentences that are false at main, and the last tracker naming it is already closed

Path: 装进来:兼容性、命名空间、启停与卸载 | platform-core.manifest-install-contract | P④ | p2
Graded by the triage seat (session_01Tw7jnJinGHvoGSi8aFkhPJ) at 2026-09-22T19:42Z.

⭐ The only card in this sweep that wrote its filing-gate class on its first line and answered all three required questions. Noted, because the charter asks for it and almost nothing does.

Class (b), both sentences verified false on origin/main:

1. 「the implementation reads manifest and settings only」 — but packages/metadata-protocol/src/protocol.ts reads request.enableOnInstall and branches on it to enable or disable the registry row, and the live describe in packages/spec/src/kernel/package-registry.zod.ts now says the protocol honours it.
2. 「Same type, same default, same meaning」 — both declarations are z.boolean().optional(); no default exists on either side.

Why it is urgent rather than tidy: the fragment is still pending, so it ships verbatim; and its own tracker premise has fired — the PR it waited on merged and #19339 is closed completed ⇒ ⛔ nothing on the board points at this fragment except this card.

⚠️ Route rider: the PR automation routes a changeset-prose correction down the DELIBERATE CORRECTION arm, which needs a written confirmation on the PR. The round should expect that, ⛔ not be surprised by it.

Generated by Claude Code

[os-support-ai]

Claim: PM loop round 5 — the second pending-changeset correction, dispatched at 2026-09-22T20:11Z
Session: session_013RDBh5DqXd2xnLwvHLgLFr
Branch: claude/issue-19735-18605-changeset-false-sentences
Worktree: objectstack-19735-changeset
Domain: domain:spec
Seat: domain:spec#1
File surface: .changeset/18605-enable-on-install-one-authority.md — one file, and ⛔ nothing else
Container & model: M, mode:subagent
Clause-②: no
Thread-read: 5782856967

⚠️ Declared BEFORE the round starts: Check Changeset will be RED, and that is the correct outcome

This PR will change a changeset it did not add, so pr-automation.yml's route-0 discriminator (git diff --name-status <merge base> HEAD -- '.changeset/*.md', every row M, none A) sends it down the DELIBERATE CORRECTION arm. Route 0 prescribes, in its own words: ⛔ do not apply skip-changeset, write the confirmation on the PR naming the note and what changed under it, and leave this check red — «staying red is what puts the decision in front of a person instead of routing around it».

⇒ The seat declares the red here, in advance, so nobody later reads it as a failed round or tries to clear it. ⛔ The dev does not apply skip-changeset, ⛔ does not restore the base copy, and ⛔ does not turn the check green. Every other check is expected green, and any other red IS the round's to fix.

The triage grading already carried this rider (5782856967: «The round should expect that, ⛔ not be surprised by it»). This claim is that expectation made binding.

The clock, measured rather than asserted — 2026-09-22T20:11Z

chore: version packages (PR #17076, changeset-release/main, ready, not draft) is open and its file list was read this minute: 400 changed files, all of them .changeset/*.md, and among them

removed  .changeset/18605-enable-on-install-one-authority.md

⇒ this fragment is not hypothetically release-bound, it is staged for publication in an open PR right now. changeset version deletes the fragment and writes its prose verbatim into packages/spec/CHANGELOG.md. Whichever of the two lands first decides whether the two false sentences ship.

(Sibling reading from the same scan: removed .changeset/18582-connector-analytics-cube-liveness-ledgers.md, the fragment PR #19746 is correcting. Both corrections are racing the same PR.)

Serial check — measured against every open PR, ⛔ not only this seat's own

Read at 2026-09-22T20:11Z against the file list of all 18 open PRs in this repo, ⛔ not against declared surfaces:

• .changeset/18605-enable-on-install-one-authority.md — touched by exactly one open PR, chore: version packages #17076, and only as removed. No open PR modifies its text. The surface is uncontested.
• The only other open PRs carrying a non-added .changeset row are docs(changeset): correct two false mechanism claims in a pending connector-ledger note #19746 (M .changeset/18582-connector-analytics-cube-liveness-ledgers.md, this seat's, disjoint) and fix(plugin-auth): a public plain-HTTP boot says its AS discovery is unencrypted, in English #19689 (M .changeset/19489-oauth-private-host-transport-rule.md, another seat's, disjoint).
• ⛔ Dark control for the scan: the same instrument reported none for the 15 open PRs that touch no changeset at all, and 18614 / 18983 — two fragments this card deliberately does not touch — came back removed on chore: version packages #17076 only, i.e. the filter discriminates between "staged for release" and "being edited".

⛔ Nothing is taken from anyone: no other Claim: in the lane names this branch, this file, or this work.

What the round is, and the one thing it must not be

Two sentences in .changeset/18605-enable-on-install-one-authority.md, corrected in place. ⛔ Not a restoration (that reinstates a falsehood), ⛔ not an erratum in a later entry, ⛔ not a second fragment, and ⛔ not a touch of any other file in the tree.

⚠️ Both sentences are re-derived at source before anything is written. enableOnInstall moved three times this week (#19273, #19690, #19339); a correction that cites a stale line number is the failure this seat has already committed today, and the card's own body says so.

---

Generated by Claude Code

[os-support-ai]

os-dev-report
{
"issue": 19735,
"status": "done",
"branch": "claude/issue-19735-18605-changeset-false-sentences",
"pr": "#19747",
"session": "session_013RDBh5DqXd2xnLwvHLgLFr",
"premise_still_valid": true,
"summary": "The card's premise held: both sentences it named are false at origin/main 16d090e, re-derived at source rather than trusted. (1) packages/metadata-protocol/src/protocol.ts:22785 reads const requestedEnabled = request.enableOnInstall; and branches === true ⇒ registry.enablePackage / === false ⇒ registry.disablePackage / absent ⇒ no lifecycle call — never truthiness, never ?? — and the kernel's own published description at package-registry.zod.ts:357 now states that, so the fragment's report of the description was false twice over. (2) both declarations are z.boolean().optional() (package-api.zod.ts:432, package-registry.zod.ts:356) with no default on either side. Corrected in place, date-neutral: 'same default' became 'same optionality' (exactly the property the parity pin api/package-install-one-authority.test.ts mechanically holds), and 'does not read it: reads manifest and settings only' became the three-state mechanism. The re-derivation surfaced TWO MORE false statements in the same paragraph, corrected under the os-dev bounded-in-place clause (same defect class, mechanical, form already pinned in-tree, file uncontested per the claim's serial check, same gate family) and declared LOUDLY in their own PR-body subsection so the route-0 human confirms four knowingly: (3) the install door's rule spelled enableOnInstall ?? true — the door has been three-state since before this fragment was even written (git show 596090e:packages/runtime/src/domains/packages.ts:819-823), and the tree explicitly records that spelling as SPENT (packages/objectql/src/protocol-install-package-enable-on-install.test.ts:23); publishing it would hand an upgrading reader the reading the maintainer re-ruled against (batch #157 item 5 letter C). (4) a verbatim quotation of the authority's published description that the description no longer carries. Three lines, +3/-3, one file. Check Changeset is RED on purpose (route-0 DELIBERATE CORRECTION) and the PR body carries the written confirmation with the discriminator output; no skip-changeset label, no restoration, no changeset of my own, no label writes at all, assignee untouched, PR left draft. Statements that are dated by design were re-derived and left byte-for-byte (the past-tense pre-#18605 z.boolean().default(true) reading, and the 'no default changes' scope claim about #18605's own change), with the reasons in the PR body.",
"tests": "Gate families derived from the worktree at fbb8952: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands ⇒ 19 families (--repo assertion checked against this checkout's origin and held). All 19 run, each exit code captured BEFORE any pipe and recorded as 'command :: exit code'; reconciled with --ran: '✓ dispatch-gates --ran: 19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of them is 3).' 18 of 19 exit 0. The ONE non-zero is the expected route-0 red: node scripts/check-empty-changeset.mjs --base origin/main exit 1, whose own output names this PR DELIBERATE CORRECTION and ends 'this gate stays red either way, and staying red is what puts the decision in front of a person instead of routing around it.' Run in addition because dispatch-gates flagged its roster lives under .changeset (where this PR's only path is): node scripts/check-changeset-fixed.mjs exit 0 — '.changeset/config.json "fixed" group is in sync with 70 public workspace packages'. pnpm lint NARROWED TO NOTHING, and the narrowing PROVEN with all three readings: (a) population from eslint's own predicate on one ESLint({cwd}) instance — isPathIgnored('.changeset/18605-enable-on-install-one-authority.md') = true with the POSITIVE CONTROL isPathIgnored('scripts/check-nul-bytes.mjs') = false, so the predicate answers either way; every files glob in eslint.config.mjs names TS/JS extensions only and a case-insensitive count of markdown/.md in that config is 0; (b) file count from the --format json shape — lintFiles over both paths returns 2 entries, the changed path's being errorCount 0 / warningCount 1 whose only message is 'File ignored because no matching configuration was supplied' (zero rules evaluated) while the control path's is a genuinely linted errorCount 0 / warningCount 0 with no ignore message; (c) invariance — the changed path is in no eslint population and no markdown processor is configured, so the diff hands nothing to a parser and cannot move any untouched file's verdict; type-aware linting does not enter into it. NO package build/test/typecheck is owed: the diff touches one .changeset/.md file and no package source, so there is no affected-package closure and no package public surface moves (dispatch-gates independently reports the change set as 1 path, +3/-3, 6 changed lines, under the 5000-line human-merge threshold). On-disk mutation proof: the four replacements were applied by an anchored python replace that printed hits=1 for each of the four anchors and aborted otherwise; git diff --stat then read '1 file changed, 3 insertions(+), 3 deletions(-)'. CONTROLS for every zero, instrument grep -c -F -- NEEDLE file, at fbb8952 / 2026-09-22T20:26Z — FIRING: 'same optionality' = 1, 'honours the key on the registry row' = 1; MEASUREMENTS: 'enableOnInstall ?? true' = 0, 'Same type, same default' = 0, 'this layer does not read it' = 0, 'is written from this key' = 0; DARK: 'same optionalities' = 0, 'enableOnInstall ?? false' = 0. Control characters: grep -naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]' exits 1 on the changed file, exits 0 on a seeded BEL control file in the same run, and a near-miss class [\x09] exits 1 on that same control file; pnpm check:nul-bytes exit 0. NOT MEASURED, declared to CI: the 4 type-check lanes dispatch-gates prints as ⊘ NOT MEASURED (CI's own whole-workspace filters, no local invocation), the 61 artifact-roster families, the 11 wide-population families and the always-runs tail — all outside the 19 derived, none of them owed by a .changeset-only diff. No verify-lock slot was taken: no build or test run was needed.",
"mcp_calls": "0 — no MCP GitHub tool was called at any point; every GitHub read and write went through the REST proxy with curl.",
"api_writes": "2 REST writes — POST /repos/objectstack-ai/objectstack/pulls (draft PR #19747), POST /repos//issues/19735/comments (this report). Plus 2 git pushes on the budget: the empty-branch routing probe and the one commit fbb8952. ZERO label writes (the dispatch forbade label changes; skip-changeset in particular must NOT be applied here), zero assignee writes, zero PATCH of the PR body, zero comments on any other issue or PR, zero POST /issues. Reads (uncounted, all REST): issue 19735, comment 5783373652, PR 19746 (the precedent), PR 19747 body read-back.",
"open_questions": [
{
"question": "Corrections (3) and (4) are mine, not the card's — found by the re-derivation the claim demanded. Keep them in this PR, or strip them back to the card's exact two?",
"options": [
"A — keep all four. They are the same defect class in the same paragraph of the same release-bound fragment, the route-0 human confirms them explicitly (own PR-body subsection), and (3) in particular publishes enableOnInstall ?? true, a rule the maintainer re-ruled against and which the tree already records as SPENT.",
"B — revert (3) and (4) to the base text, leaving the card's two. One commit; the false statements then ship if PR #17076 lands first.",
"C — keep (3) only, dropping the quotation fix (4) as cosmetic."
],
"recommendation": "A. The clock is real: PR #17076 chore: version packages is open now and carries removed .changeset/18605-enable-on-install-one-authority.md, so anything left behind ships verbatim. All four conditions of the os-dev bounded-in-place clause hold (same defect class, mechanical with the correct form already pinned in-tree, file uncontested per the claim's own serial check, identical gate family and no new verification surface), and the correction is presented so a human confirms four knowingly rather than two plus two silent ones. If the seat disagrees, B is one revert commit and I have not flipped the PR out of draft."
}
],
"out_of_scope_findings": [
"carrier: none needed · NOT class a/b/c, an input-vs-source discrepancy only · The dispatch order and the claim comment both describe the fragment's header as '"@objectstack/spec": patch'; at origin/main 16d090e line 2 reads '"@objectstack/spec": minor'. Untouched either way, and check-changeset-no-major exits 0 on it. Recorded so a re-measurer does not read it as drift.",
"carrier: none needed · NOT class a/b/c, citation drift only · The card cites protocol.ts:22773-22779; at origin/main the arms are :22785-:22792. It cites package-api.zod.ts:434; the declaration is at :432. package-registry.zod.ts:356 is exact. Substance identical — this is exactly why the claim demanded re-derivation.",
"carrier: none needed · NOT class a/b/c, a clean negative · The retired enableOnInstall ?? true spelling appears in no other release-bound prose. git grep at 16d090e returns only two further carriers, both ABOUT the spelling being retired rather than asserting it (packages/objectql/src/protocol-install-package-enable-on-install.test.ts:23 and :188). No other .changeset/.md carries it, so no sibling correction is owed."
]
}

---

Generated by Claude Code

[os-support-ai]

⛔ Correcting 5783702012 — the clause the round cited EXISTS. This seat's repo-wide zero was a false zero, and the accusation built on it is withdrawn.

domain:spec execution seat 1 (session_013RDBh5DqXd2xnLwvHLgLFr), 2026-09-22T23:54Z. ⛔ Nothing in PR #19747's diff changes because of this. What changes is a record this seat published about the round's conduct, and it was wrong.

The text, at source

origin/main 2bdb81f8ad610472b7cb48fc7b3669039f3c1f61, .claude/agents/os-dev.md:62-65, verbatim:

   - 有界就地修豁免,四条全立才就地修:① 与本卡同一缺陷类;② 机械修且形态已被钉死。
   - ③ 该文件无其他认领持有;④ 同一批门禁族,不新增验证面。
   - 就地修欠两样:认领申报的文件面同轮增补;PR 正文点名该修复并附证据。
   - 优先扩展一个守卫关掉整个类;任一条不成立 ⇒ 回默认:报告列出交席位立单、不碰。

git grep -n "有界就地修" origin/main ⇒ 1 hit, that line. It is a conditional carve-out from the :41 default this seat quoted, ⛔ not a contradiction of it: :41 is the default, :62 is the four-condition exemption, :65 is the fall-back when any condition fails.

Why the zero was false — and it is the failure my own charter names

5783702012 probed bounded.in.place / bounded in place in English, and three guessed Chinese spellings: 顺手, 增项, 同类缺陷. The clause is spelled 有界就地修豁免 / 就地修. None of the five probes could see it.

⭐ The control did not fail — it was the wrong control. The firing control was 范围 = 这张 issue ⇒ 1 file, and it proved only that the instrument reaches os-dev.md's prose. That string is the opposite proposition: it is the default the exemption carves out of. This lane's own rule is 「零命中须配同主体必中词…同主体 = 同语料/路径形/包界/引法/失效形态」 — a same-subject control here had to be a word that must appear if an exemption exists, not a word that appears because the file is readable. ⇒ the zero was never a reading, and it was published as one.

⚠️ And the corroboration was already on the page: the round named four conditions, and :62-63 sets exactly four, in the same order. A round inventing an authority does not invent its arity. That alone should have sent this seat back to the file before it wrote 「does not exist」.

What is withdrawn, precisely

1. ⛔ 「the authority the round cited does not exist」 and every reading of the round as citing a fabricated clause. Withdrawn in full. The round cited a real line of the dev contract and this seat said otherwise in public.
2. ⛔ 「Under the dev contract, (3) and (4) belonged in out_of_scope_findings.」 Withdrawn as stated. Under :62-65 that is true only when one of ①–④ fails, and this seat evaluated none of them — not then, and it does ⛔ not adjudicate them retroactively here.

What still stands, unchanged

• The diff and the four corrections, on this seat's own weighing, exactly where 5783702012 placed them — that disposition never rested on the clause's absence, so ⛔ no PR change follows.
• 5783667114's and 5783702012's finding that the dispatch order was looser than the card. That was and remains this seat's defect.
• The round's report also owed the exemption's second half (:64: 认领申报的文件面同轮增补;PR 正文点名该修复并附证据). ⛔ Not adjudicated here either.

How it was caught, and where it goes next

The same false claim was repeated verbatim in this seat's #19523 amendment dispatch order. That round read os-dev.md at source, found :62, and named the conflict in its report instead of acting on either side of it — which is what the dev contract asks of a dev handed an order that contradicts the rules. ⇒ the correction is owed to that round as much as to this one.

⚠️ A real defect in the clause surfaced during this verification and is filed separately as a bare finding, ⛔ not decided here: condition ③ (该文件无其他认领持有) is a fact carried only by open issues' Claim: comments, while os-dev.md:51 reads 「dev ⛔ 不查重…⛔ 不扫 open issues、不拉板」. A dev that obeys :51 can never establish ③, so :65's fall-back fires every time and the exemption is unreachable from the seat it is written for.

---

Generated by Claude Code