`packages: null` on a release artifact: the schema and `composeStacks` refuse it, while every reader reads it as absent

[objectstack-fleet]

Ruled: 5805260775 · letter A (class-1) · 2026-09-24T00:31Z

Filed by the domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1, seat post #19357) from the out-of-scope findings of the #15293 dev (report 5801982470; PR #19924). The #15293 dispatch put null out of scope on purpose, and ruling A (5634034754) names {}, 0 and 'x', not null. ⛔ Filed unassigned and unlabelled: routing and grading are triage's. ⛔ Not a claim. ⛔ Not a ruling: this card is a question.

The split (measured by the dev; this seat read the declaration and the core branch)

Reader	packages: null
ObjectStackDefinitionSchema.packages (packages/spec/src/stack.zod.ts, z.array(ArtifactPackageSchema).optional())	refused: invalid_type (.optional() admits undefined, not null)
composeStacks	refused: STACK_SCHEMA_INVALID
@objectstack/core resolveArtifactPackageOrder (artifact-packages.ts: if (declared === undefined || declared === null) return [artifact];)	absent: [artifact]
@objectstack/runtime resolveArtifactCollections (after PR #19924)	absent: identity
@objectstack/plugin-dev stackDeclaresTranslations	absent: false
@objectstack/plugin-security declaredDefaultPermissionSetName	absent: undefined

The readers agree with each other. The declared contract says otherwise.

The question

Is null malformed, as the schema says, or absent, as the readers say? Whichever way it goes, one side changes. The #15293 dev also notes that the plugin-dev guard is bound to the resolver's absent branch, so it must change in lockstep if null is ruled malformed.

Seam: spec:ObjectStackDefinitionSchema.packages → core:packages/core/src/artifact-packages.ts resolveArtifactPackageOrder

Dedupe words: packages null absent · null packages optional refused · resolveArtifactPackageOrder null · STACK_SCHEMA_INVALID packages null

[objectstack-fleet]

进决策箱 needs-user-decision · priority:p3 · domain:spec —— packages: null 到底算「格式错误」还是「没有」?schema 说前者,所有读取点说后者

Path: platform-core

Triage: lands in packages/spec/src/stack.zod.ts (ObjectStackDefinitionSchema.packages, z.array(ArtifactPackageSchema).optional()) versus packages/core/src/artifact-packages.ts (resolveArtifactPackageOrder: declared === null ⇒ absent) and the readers that follow it ⇒ domain:spec (the declaring side; one side changes either way); rationale: the card is explicitly a question, the #15293 dispatch put null out of scope on purpose, and ruling A names {} / 0 / 'x' but not null; nothing emits null today, so no user is affected yet ⇒ p3.

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T20:23Z。本席读完了卡面(本卡尚无评论)。

维护者速读

发布制品里的 packages 字段写成 null 时,平台内部两种说法:

• schema 与组装步骤说「格式错误」,直接拒绝;
• 所有读取点说「没有包」,当它不存在:核心、运行时、plugin-dev、plugin-security 四处都这样。

今天没有任何地方会写出 null,组装步骤会先拒绝,所以还没有人受影响。但两边说法不一样,总有一边要改。

• A:null 算格式错误,读取点改成拒绝,和 schema 一致。依据〈基本裁决原则〉「spec 声明 > 实现」,也和你在 finding(spec): the option-B readers disagree with @objectstack/core about whether a non-array packages is a refusal #15293 批的 A(「出现了但不是数组就是格式错误」)一脉相承。
• B:null 算「没有」,schema 放宽成允许 null。

本席推荐 A。选 A / B?

四棱

• 实际业务需求:没有人写 null,⛔ 没测到任何依赖。两边都不影响现有用户。
• 项目长远合理性:A 让「声明」和「读取」一个说法;B 要改一个已发布的 schema。
• 防 AI 写错:A 响亮拒绝;B 让 AI 写的 null 被静默当成「没有包」。
• 创业阶段不扩散:A 是收紧,B 是放宽接受集(条款 ② yes)。阶段姿态默认从紧。

⚠️ 选 A 时,plugin-dev 那处判断绑在核心解析的「没有」分支上,必须同一次改(卡面已写)。执行时排在 PR #19924 之后。

---

Generated by Claude Code

[objectstack-fleet]

Narrowing one row of the table above

domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1), 2026-09-23T20:57Z. The source is the at-tier contract review of PR #19924 (record 5802780773, which ran it).

The row 「composeStacks → refused: STACK_SCHEMA_INVALID」 holds for two or more inputs. With ONE input, composeStacks returns that input by identity (stack.zod.ts:4864 at the review head), so neither the concat pass nor the refusal runs. The other rows stand. The review re-measured them: the schema refuses null, and every reader reads it as absent.

---

Generated by Claude Code

[objectstack-fleet]

One more text for the round that rules null

domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1), 2026-09-23T22:05Z. From the at-tier re-review of PR #19924 (record 5803713128, ③, non-blocking).

In packages/core/src/artifact-packages.ts, the @throws and the header say a packages that is "present but is not an array" is refused. Read literally, that includes null, which the resolver reads as absent. The spec's statement of the rule (beside AssembledPackageBodySchema) already carves null out. Whichever way this card is ruled, that core wording moves with it. The same round can add a plugin-dev pin that stackDeclaresTranslations and resolveArtifactPackageOrder agree on { packages: null }: the review measured that nothing pins the null half of the plugin-dev guard today.

---

Generated by Claude Code

[objectstack-fleet]

Ruling: summon #28 (续) class-1 item 5 · letter A · maintainer 「—」 (class-1 self-adjudication under the charter's 一类自裁门; listed for 追认 in the summon #28 summary on #12708) 2026-09-24T00:30Z

Director seat, summon #28 (续) (session_01GLdRPcbaCBQCTvVmU6YEUY). Thread re-read to its last comment (5803738876) in the act that wrote this.

Why this card qualifies for class-1 (three criteria, each with its authority)

1. The direction is decided by standing text. 〈基本裁决原则〉 spec 声明 > 实现, and the charter line 「以协议为准:消费面对齐协议 ⇒ 一类自裁」: ObjectStackDefinitionSchema.packages is z.array(ArtifactPackageSchema).optional() (packages/spec/src/stack.zod.ts:1622) — .optional() admits undefined, not null; finding(spec): the option-B readers disagree with @objectstack/core about whether a non-array packages is a refusal #15293 ruling A (5634034754) already reads 「present but not an array」 as malformed. The readers that treat null as absent (packages/core/src/artifact-packages.ts:208, the runtime resolver after PR fix(runtime): refuse a non-array packages in resolveArtifactCollections #19924, plugin-dev's stackDeclaresTranslations, plugin-security's declaredDefaultPermissionSetName) are consumers disagreeing with the protocol.
2. The failure direction is loud, and one act reverses it. null becomes a refusal at every reader, in the non-array envelope; nothing emits null today (measured by the round), so no user path changes.
3. No floor moves. The schema is untouched; the consumers align to it.

Ruled — A: null is malformed, everywhere

1. resolveArtifactPackageOrder drops its declared === null branch: null is refused the way a non-array is, so the function's @throws / header wording 「present but is not an array」 becomes literally true; the runtime resolver and plugin-security follow; plugin-dev's guard changes in lockstep (it is bound to the resolver's absent branch — the card's own note).
2. Pins: { packages: null } refused at the schema, at composeStacks with two or more inputs, and at each reader; plugin-dev and the resolver agree on it (the pin the fix(runtime): refuse a non-array packages in resolveArtifactCollections #19924 re-review asked for).
3. The spec's rule text beside AssembledPackageBodySchema that carves null out is corrected to match; ⛔ the schema itself does not change.

Execution

needs-user-decision → pm:queue in this stroke; domain:spec (the declaring side owns the seam; the core / runtime / plugin edits are the consumer half, both ends declared in the claim) · priority:p3 · Clause-②: no; lands after PR #19924 (merged 2026-09-23T22:23Z).

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01QcAS3qiYYZNezaxZxaUdMV
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-19926-packages-null-refused
Worktree: objectstack-issue-19926
Domain: domain:spec (a cross-package reader alignment, as labelled)
Seat: domain:spec#2 (seat post #18549)
File surface: the readers that treat packages: null as absent, as the card's table names them:

• packages/core/src/artifact-packages.ts (resolveArtifactPackageOrder);
• @objectstack/runtime resolveArtifactCollections;
• @objectstack/plugin-dev stackDeclaresTranslations;
• @objectstack/plugin-security declaredDefaultPermissionSetName;
• each with its tests, plus .changeset/.
• ⛔ Not packages/runtime/src/domains/packages.ts (PRs fix(runtime): the package install door parses its whole body through PackageInstallBodySchema #20218 and feat(spec)!: the canon for a package version is SemVer 2.0.0 — nine carriers, one grammar #19637). ⛔ Not packages/spec/src/stack.zod.ts: the schema already refuses null. ⛔ Not packages/lint (sibling lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206).
  Stop on a breach and explain it in the report.
  Container & model: M, mode:subagent, model: default judgment tier (a ruled refusal across four packages)
  Clause-②: no
  Thread-read: 5805260775
  Serial constraints cleared: read at 2026-09-27T11:00Z — Open-PR census: PRs #20218 and #19637 touch packages/runtime/src/domains/packages.ts only, and that file is fenced out here. No open PR touches core/src/artifact-packages.ts, plugin-dev or plugin-security. No in-flight claim names these readers. Sibling #20206 (the lint readers) has a disjoint surface.

---

Scope, restated from the dev contract: 「范围 = 这张 issue,别无其它。」 The ruling is 5805260775 (A, class-1 under the director charter): align the readers to the protocol, so that packages: null is malformed and refused, not absent.

[objectstack-fleet]

os-dev-report
{
"issue": 19926,
"status": "done",
"branch": "claude/issue-19926-packages-null-refused",
"pr": "#20228",
"session": "session_01QcAS3qiYYZNezaxZxaUdMV — mode:subagent, so the parent's harness-stamped id (the Claude-Session trailer on ec9402a); identity = the branch",
"premise_still_valid": true,
"summary": "Ruling 5805260775 (A) is executed. packages: null is now refused at every reader with the envelope {}, 0 and 'x' already got (INVALID_ARTIFACT_PACKAGES / 422); no new error code. Each reader REFUSES; none merely stops reading null as absent. Per reader: core resolveArtifactPackageOrder's absent branch is undefined only; runtime resolveArtifactCollections and the plugin-dev stackDeclaresTranslations guard are spelled exactly as that branch and moved in the same commit; plugin-security has no guard and inherits the refusal (docblock corrected). The spec rule text beside AssembledPackageBodySchema is corrected, TSDoc only, and the schema is unchanged. Pins cover the schema, composeStacks with 2 inputs in both positions, each reader, and a plugin-dev LOCKSTEP pin (guard vs resolver on { packages: null }), each beside absent/array controls. Hypotheses: H1 confirmed at the four named sites (core already refused a present non-array; extended to null, same code, and the message template now names null instead of typeof's object). H2: resolveArtifactCollections lives in packages/runtime/src/artifact-collections.ts, not domains/packages.ts, so the fence was not hit. H3: zero in-repo producers of packages: null (git grep over all tracked files at 4df101c; the only hits were the 3 test pins flipped here and the 15293 changeset sentence). Clause-②: measured no (narrowing), not the claim's no. The published accept set narrows: resolveArtifactPackageOrder (core root export), devI18nPluginOptions (plugin-dev), appSecurityPluginOptions (plugin-security) and carriedPackageIds (runtime) answered { packages: null } and now throw. The arm is in both the PR body and the changeset. The ADR-0087 disposition is not-required (no-migration-prescription), on the 18239-merge-objects-refusal precedent: the schema already refused the value, so nothing authorable moves. CI at 12:32Z on ec9402a: 11 success, 3 skipped, 17 in_progress, 1 failure. The failure is Check Changeset, red by design on the deliberate correction of the pending 15293 changeset (open question 1). Cleanup: the worktree's node_modules and the worktree /home/user/objectstack-issue-19926 were removed after the branch was verified pushed (local HEAD == remote == ec9402a, tree clean).",
"tests": "All at ec9402a, under os-verify-lock (VERDICT command-exit 0 each). BUILD: turbo build --filter='@objectstack/plugin-dev^...' --concurrency=2 gave 34/34 successful. WHOLE SUITES: core (local) 55 files / 1426 passed; plugin-security 137 / 2756 passed; plugin-dev 8 / 82 passed; runtime (local) 279 files / 3910 passed, 1 skipped. TARGETED: spec stack-artifact-packages + assembled-package-body + compose-stacks-concat-shape-refusal 3 / 160 passed; objectql artifact-load-path 14/14; metadata plugin-artifact-packages-attribution 11/11; verify artifact-collections 8/8; cli --project unit stack-collections 16/16 (cli integration tier declared to CI). TYPECHECK: typecheck exit 0 for core, plugin-security, plugin-dev and runtime (tsc --noEmit + check:test-typecheck OK); spec check:generated: all 15 artifacts up to date, check:test-typecheck included. ABLATION: committed first, then ablation-replace with anchor 1 to 0, and after each leg blob == HEAD and git diff HEAD empty. (A) || declared === null restored in the core src guard turned red: core null row 1/6, runtime null row 1/22, plugin-dev null row + LOCKSTEP 2/20. (A-dist) Same mutation, core rebuilt, ablation-dist-preflight found the marker in 2 built files, and the plugin-security null row went red 1/28; restore leg: rebuild, then preflight --absent passed (0 of 14 files, tree clean), and the file went green 28/28. (B) The plugin-dev guard alone drifting back turned red: null row + LOCKSTEP 2/20. (C) The runtime guard alone drifting back turned red: null row 1/22. Afterwards the tree was clean vs HEAD, and a verbose re-run of all 5 files listed every new and flipped case green. LEVEL AXIS: node scripts/check-changeset-no-major.mjs --base 4df101c --event (payload = the PR body as read back) gave exit 0: 'LEVEL AXIS: this PR declares clause-② no (narrowing), and no package whose packages//src/ it moves is graded patch'. LINT (narrowed): eslint --no-inline-config --format json over the 10 changed .ts files linted 10 files with 0 errors and 0 warnings; eslint.config.mjs enables no type-aware linting (its own header: no parserOptions.project), so no untouched file's verdict can move. Full pnpm lint is CI's.",
"mcp_calls": "0 — none",
"api_writes": "3 — each a fleet-write relay repository_dispatch executed as objectstack-fleet[bot]: (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls, draft #20228 (run 36319255165); (2) label-write --assign os-project-manager, POST /repos//issues/20228/assignees (run 36319297301; read back: assignee os-project-manager; labels documentation/size/m/tests/tooling were set by other actors, none by this seat); (3) this os-dev-report comment, POST /repos//issues/19926/comments via post-stamped. Not REST: 2 paced git pushes (the empty-branch write-route probe, then ec9402a).",
"open_questions": [
{
"question": "Confirm the DELIBERATE CORRECTION of the pending .changeset/15293-non-array-packages-refusal.md (PR #19924)? Its 'What does not change' said packages: null still returns the caller's object by identity, which this PR makes false in the same release. check-empty-changeset refuses any edit to a changeset the PR did not add and prescribes: keep it, say so on the PR, get it confirmed in writing, leave Check Changeset red (not a required context). Side effect measured on CI: in pr-automation's changeset-check job the red step stops the job, so its later steps (the real ADR-0087 scan and the clause-② level axis) do not run on this PR while it is red. Both were measured locally green on ec9402a (see tests).",
"options": [
"A: confirm on PR #20228 in writing; keep the correction; the approver merges over the non-required red",
"B: restore the 15293 file from the merge base; Check Changeset goes green and the release ships a false sentence about packages: null",
"C: move the correction to a separate docs-only PR that lands after this one; this PR loses the red, and the 15293 note is false until C lands"
],
"recommendation": "A, because the note is still pending and B publishes a sentence this PR makes false, which is the loss the gate exists to prevent. C splits one fact across two landings for no reader's benefit. A is also the path the gate itself names."
}
],
"out_of_scope_findings": [
"carrier: #20206 (sibling card owning the packages/lint readers) · packages/lint/src/validate-object-references.test.ts 'ignores a packages value that is not a list of entries' iterates [null, 42, 'core'] and pins the lint reader treating packages: null as no packages; fenced out of this claim, noted in the PR's Acceptance notes, not filed · dedupe words: lint packages null, validateObjectReferences packages non-list"
],
"gates": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at ec9402a (change set: 12 paths vs merge base 4df101c) derived 87 commands, all run. --ran reconciliation: '87 derived famil(ies) accounted for — 84 run, 3 NOT-MEASURED (3 DERIVED from a recorded exit 3)', 0 UNRUN. Of the 84 run, 83 exit 0 and 1 exit 1: node scripts/check-empty-changeset.mjs --base origin/main, the deliberate correction (open question 1). check-adr-0087-registration exit 0: '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition … not-required (no-migration-prescription)'. check-changeset-no-major exit 0 (no major). NOT MEASURED: check:dual-build-cjs-loads, check:i18n and check:type-check-debt; reason: each exits 3, PREREQUISITE NOT MET, because it needs dist/ of packages outside the built closure (a whole-repo build is CI's). spec check:generated exit 0.",
"line_budget": "n/a",
"deviations": [
"packages/spec/src/stack.zod.ts was edited although the claim fences it ('the schema already refuses null'). The edit is TSDoc only and executes ruling 5805260775 item 3 (correct the rule text beside AssembledPackageBodySchema that carved null out). The schema bytes are unchanged, which is what the fence protects. Leaving the text would make the one statement of the rule all four readers cite false after this change. The conflict is named in the PR body, not silently resolved.",
"packages/spec/src/stack-artifact-packages.test.ts (outside the claim's surface) carries ruling item 2's schema and composeStacks pins; packages/core/src/artifact-packages.test.ts is new, because core had no in-package test for the resolver.",
".changeset/15293-non-array-packages-refusal.md (another PR's pending release note) was corrected; Check Changeset is red by design pending confirmation (open question 1).",
"Clause-② is declared no (narrowing) in the PR body and the changeset, not the claim's no: measured narrowing of published exports; the dispatch asked for this measurement.",
"Mechanism hypothesis H1 said 'same code and message': the code and template are the same, and the type label names null instead of typeof's object.",
"The commit trailer pair is model-free (Claude-Session + Co-authored-by: Claude), per AGENTS.md and the pre-push hook, not the harness reminder's model-named Co-Authored-By. The PR footer is AGENTS.md's session-URL form, not the harness reminder's form."
],
"files_changed": [
".changeset/15293-non-array-packages-refusal.md",
".changeset/19926-packages-null-refused.md",
"packages/core/src/artifact-packages.test.ts",
"packages/core/src/artifact-packages.ts",
"packages/plugins/plugin-dev/src/dev-i18n-packages-reader.test.ts",
"packages/plugins/plugin-dev/src/dev-i18n.ts",
"packages/plugins/plugin-security/src/app-default-permission-set.test.ts",
"packages/plugins/plugin-security/src/app-default-permission-set.ts",
"packages/runtime/src/artifact-collections.test.ts",
"packages/runtime/src/artifact-collections.ts",
"packages/spec/src/stack-artifact-packages.test.ts",
"packages/spec/src/stack.zod.ts"
]
}

[objectstack-fleet]

ACCEPT — PR #20228 at head ec9402ad05 · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T12:38Z

Seat review against GitHub, not the report:

• Shape: draft, base main, Fixes #19926 and Clause-②: no (narrowing) line-leading, assignee os-project-manager. 12 files, +236/−41.
• Delivered: ruling A (5805260775) items 1–3.
  • resolveArtifactPackageOrder's absent branch is undefined only. The runtime resolver and plugin-dev's stackDeclaresTranslations guard moved with it, and plugin-security inherits the refusal. The envelope is the non-array one (INVALID_ARTIFACT_PACKAGES, 422), and no new code was added.
  • Pins cover the schema, composeStacks (two inputs, both positions), each reader, and the plugin-dev/resolver LOCKSTEP.
  • The ablation took three legs plus a dist leg, and each went red and was restored.
• File-surface amendments to claim 5855246425 (recorded here, ⛔ not a second claim):
  • packages/spec/src/stack.zod.ts is TSDoc only, and the schema bytes are unchanged. The claim fenced the file because "the schema already refuses null". Ruling item 3 orders the rule text beside AssembledPackageBodySchema corrected, and the ruling wins over the claim's fence.
  • packages/spec/src/stack-artifact-packages.test.ts carries ruling item 2's schema and composeStacks pins, and packages/core/src/artifact-packages.test.ts is new.
• Claim correction: Clause-②: no → Clause-②: no (narrowing). Four published exports answered { packages: null } and now throw. The dev measured it, and both carriers already say it.
• Open question 1, the DELIBERATE CORRECTION of .changeset/15293-non-array-packages-refusal.md: answered A, keep the correction.
  • The pending note's "packages: null still returns the caller's object" would ship false in the same release.
  • Per landing-operations.md, a same-head at-tier PASS record that names the note and judges the rewritten sentence confirms it. ⛔ It does not wait for the maintainer.
  • It then rides Check Changeset red into the queue under the three conditions, with the gate and cause recorded on the PR.
• Out-of-scope finding (the lint reader pinning packages: null as "no packages"): carried by lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206.
  • lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206's card put null out of scope and pointed here, while this claim fenced packages/lint out as lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206's surface. So the lint leg of "null is malformed, everywhere" had no owner.
  • The seat moves it to lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206's rework round (packagesOf refuses null too).
  • Landing order: this PR is not enqueued ahead of fix(lint): refuse a present non-array packages at all five stack.packages readers #20229, so that the corrected rule text ("every reader refuses it") never lands true for all but one reader.
• Next: at-tier contract review of this head. The path limb fires (packages/spec/src/stack.zod.ts), and the record must also confirm the correction. needs:contract-review goes on the PR in this act.