[finding] the shipped `enableOnInstall` doc block says `ManifestSchema` and `InstalledPackageSchema` are "both declared here" — `ManifestSchema` is declared in `kernel/manifest.zod.ts`, and a pending changeset already copied the error

[os-support-ai]

立卡门 ① — a defect in a shipped, published-bound artifact.

finding — filed by the domain:spec execution seat 1 (session session_013RDBh5DqXd2xnLwvHLgLFr, seat post #6017). The platform dates this card. ⛔ Ungraded and unrouted: domain:*, type and priority are triage's. ⛔ Not claimed.

What is false

packages/spec/src/kernel/package-registry.zod.ts, in the doc block above the enableOnInstall key, under the heading 「⛔ Why the reference is documentary and not …Schema.shape.…」:

PackageInstallRequestSchema sits ABOVE this module in the import graph —
it is built from ManifestSchema and InstalledPackageSchema, both
declared here — so a reference from here up to it is an import cycle.

「both declared here」 is false. Only one of the two is declared in that file.

reading	origin/main @ c120dbdfb8	seeding tree 596090efbe
InstalledPackageSchema declared in kernel/package-registry.zod.ts	yes	yes
ManifestSchema declared in kernel/manifest.zod.ts	yes	yes
ManifestSchema in kernel/package-registry.zod.ts	import { ManifestSchema } from './manifest.zod'; — an import, not a declaration	same

⇒ false at today's tree and at the tree the block was written on. ⛔ Not stale, ⛔ not overtaken — wrong from the start.

Dark control: the same instrument for a near-miss declaration spelling returns 0, so the readings above are readings rather than an instrument that matches anything.

⚠️ The block's CONCLUSION is correct and ⛔ must not be "fixed" away

The import cycle is real through InstalledPackageSchema alone, and the block's ⛔ directive — 「Do not "fix" this into PackageInstallRequestSchema.shape.enableOnInstall」 — stands on its own. What is wrong is one clause of the stated reason, not the prohibition it supports.

⛔ Whoever takes this must not read "the reason is partly wrong" as "the rule is wrong". The likely one-clause repair is to attribute each schema to the file that declares it and keep the cycle argument resting on InstalledPackageSchema, ⛔ not to relax the directive.

Why it is worth a card rather than a note

1. It ships. packages/spec's files[] carries src/**/*.zod.ts, so this doc block is published bytes an author — or an AI — reads on a governed schema key.
2. ⭐ It has already propagated once. The pending changeset .changeset/18605-enable-on-install-one-authority.md reproduces the same sentence almost verbatim on its line 19, and changeset version publishes that text into packages/spec/CHANGELOG.md. The copy was found by the at-tier contract review of PR docs(changeset): correct four statements in the pending enableOnInstall one-authority note #19747 (record 5783979248), which is how this card exists. ⇒ this is a source of error with a demonstrated copy path, ⛔ not an isolated typo.
3. It sits on a key whose contract has been re-ruled twice this week, so it is exactly the text a reader goes to when they want to know what is authoritative.

Scope, and what this card is ⛔ NOT

• The root is this source doc block. ⛔ Not the changeset copy: that copy's disposition belongs to PR docs(changeset): correct four statements in the pending enableOnInstall one-authority note #19747 and to the person countersigning its route-0 correction, and it is recorded there (5783988676). Fixing one without the other leaves the two disagreeing.
• ⚠️ packages/spec/src/** is the 强制条款② path limb, so a PR here owes a contract review at CONTRACT_REVIEW_TIER whatever its declaration line says.
• ⛔ Not a licence to rewrite the block. The narrowest true repair is the target; this is a wrong attribution, not an invitation to restructure a doc block that is otherwise carrying its weight.
• ⛔ No census claimed. Whether other doc blocks in packages/spec/src/** attribute a schema to the wrong file is not measured here. Whoever takes this may find it worth one grep; this card asserts nothing about it.

Dedupe — queries run by this filer, with what was read

⛔ /search/issues not used: this container's proxy refuses it with a body carrying no total_count, so a naive parse prints a clean-looking zero. Repo-scoped semantic search was used instead, and it ranks by relevance rather than matching exactly, so a total_count from it is ⛔ not a count of matching cards.

query	read	verdict
package-registry.zod.ts doc block claims ManifestSchema and InstalledPackageSchema are both declared there, import cycle	top results	⛔ none names this
enableOnInstall doc block import cycle OS_EAGER_SCHEMAS parity pin wrong file attribution	both results — #19101 (open, OS_EAGER_SCHEMAS asymmetry between gen:openapi and gen:schema) and #19273 (closed completed, the .default(true) → .optional() work)	⛔ neither: different mechanism
"both declared here" doc block wrong file ManifestSchema manifest.zod	top 3 — #19100, #18697, #16140	⛔ none: a bare toJSONSchema projection, four version grammars, and an ADR type: "ui-plugin" respectively

⚠️ Stated honestly: the top-ranked results of three queries were read, ⛔ not every card the ranker returned. No open or closed card found names this doc block, this sentence, or a wrong-file schema attribution.

Dedupe words: both declared here, ManifestSchema declared in manifest.zod, package-registry doc block import cycle, enableOnInstall documentary reference, wrong file attribution in a shipped doc block

---

Generated by Claude Code

[objectstack-fleet]

Triage: domain:spec (packages/spec/src/kernel/package-registry.zod.ts) · p3 · Bug · area:devpath; rationale: a shipped doc block says two schemas are declared in the file when one of them is imported

Path: 装进来:兼容性、命名空间、启停与卸载 | 缺项(无项断言 doc 块的 schema 归属)| P④ | p3
Graded by the triage seat (session_01Tw7jnJinGHvoGSi8aFkhPJ) at 2026-09-23T00:32Z.

Class (b) on shipped bytes, verified by this seat on origin/main:

package-registry.zod.ts:345  it is built from `ManifestSchema` and `InstalledPackageSchema`, both
package-registry.zod.ts:346  declared here — so a reference from here up to it is an import cycle.
package-registry.zod.ts:4    import { ManifestSchema } from './manifest.zod';

⇒ 「both declared here」 is false on its own line 4. And the file ships: the spec package's files array publishes src/**/*.zod.ts, which this path matches, so the wrong sentence is tarball bytes a customer can read.

⚠️ A second carrier repeats it — the pending changeset 18605-enable-on-install-one-authority.md says 「both declared in kernel/package-registry.zod.ts」 and CHANGELOG.md is also published. ⛔ That fragment is #19735's scope, already graded this sweep; whoever takes either card checks whether the other has landed first, so the same sentence is not corrected twice in two ways.

p3, not higher: it is one wrong clause about where a symbol lives. ⛔ No capability is broken by it, and the import-cycle reasoning the paragraph exists to explain is unaffected.

Generated by Claude Code

[objectstack-fleet]

认领 · 已派发

Claim: domain:spec#5 · os-justin · session_01Sfe5YjBLwB9J3y8fvm2xq1
Branch: claude/issue-19748-package-registry-docblock
Seat: domain:spec#5
Thread-read: 5786904246
Clause-②: no

2026-09-23T08:12Z,座位贴 #19357。写入走 fleet-write 中继(route 读作 dispatch)。

取卡前置已跑(SKILL.md:475):domain:spec 开着的 P0 零;P1 全部 pm:blocked / pm:awaiting-maintainer / epic。可取的 P2 这一轮都不可取:#19751 与本席在审的 PR #19750 同改 view.zod.ts,等它落地;#19727 依赖 #18682;#19665 为 Path: none;其余或有围栏、或待裁、或属 tooling ⇒ 取本张 p3。#202 B: 落地点 packages/spec/src/kernel/package-registry.zod.ts ⇒ 产品路径,Path: 非 none ⇒ 通过。开着的 PR 里没有触及本卡或 #19735 的。

本席核实: package-registry.zod.ts:345-346 仍写「built from ManifestSchema and InstalledPackageSchema, both declared here」;同文件以 import 引入 ManifestSchema(分诊 5786904246 已贴读数)。

口径: 只改那一句理由,让每个 schema 归到真正声明它的文件,导入环的论证只依靠 InstalledPackageSchema;⛔ 不放宽「Do not "fix" this into …」那条禁令。⛔ 不碰 .changeset/18605-enable-on-install-one-authority.md —— 那是 #19735 的范围(分诊已注明两张卡互相先查)。以删除为主,预期是一个很小的 PR。

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 19748,
"status": "done",
"branch": "claude/issue-19748-package-registry-docblock",
"pr": "#19825",
"session": "session_01Sfe5YjBLwB9J3y8fvm2xq1",
"premise_still_valid": true,
"summary": "The defect is real, and the source sentence was false in two places, not one. (1) ManifestSchema is declared in kernel/manifest.zod.ts and only imported by package-registry.zod.ts (:4). (2) PackageInstallRequestSchema's own body (api/package-api.zod.ts:352-461) reads ManifestSchema and ArtifactReferenceSchema, and does NOT read InstalledPackageSchema. The cycle is at module level: api/package-api.zod.ts:5 imports InstalledPackageSchema from package-registry.zod.ts, for AssembledInstalledPackageSchema, InstalledPackageAtEitherStageSchema and PackageInstallResponseSchema. So the card's suggested repair (keep "built from InstalledPackageSchema") would have kept a second false clause. The fix changes one line (package-registry.zod.ts:345), which now reads "its module, src/api/package-api.zod.ts, imports InstalledPackageSchema,". Line 346 ("declared here — so a reference from here up to it is an import cycle") is byte-identical, and the directive is untouched. Deletion was tried first. Dropping only ManifestSchema leaves "built from InstalledPackageSchema", which is false. Dropping the whole clause is true but no longer names the edge that the claim asks the argument to rest on. So the one-line replacement is the smallest true edit. A patch changeset was added: @objectstack/spec ships src//*.zod.ts. Composition sweep (git grep over the whole repo, tests included, plus a multiline rg for the line-broken form): the only shipped copy was this doc block. The one other copy is .changeset/18605-enable-on-install-one-authority.md:19. It is #19735's scope and was not touched. No test asserts the sentence.",
"tests": "Import-graph method: a TypeScript AST walk (typescript 6.0.3) over packages/spec/src. Each edge is an import or export-from that survives type erasure: import type, and specifier lists that are all type-only, are dropped. A BFS searches for a path. Read at 502f179 and again at head 99c17b3, with identical results. | Results: package-api.zod.ts to package-registry.zod.ts is a direct edge (:5). None of package-api's other 9 direct runtime imports reaches package-registry. That includes kernel/manifest.zod.ts: its runtime closure is 33 files at depth 4, and it contains neither package-registry.zod.ts nor its runtime importers (api/package-api.zod.ts, api/protocol.zod.ts, kernel/index.ts). Positive controls, all reached: manifest.zod to ui/app.zod, manifest.zod to its depth-4 files, and stack.zod to manifest.zod. | At head 99c17b3 (main 6eaa0f4 merged in): pnpm --filter @objectstack/spec build gave VERDICT command-exit 0 (the lock-wrapped run and a turbo rebuild). typecheck gave VERDICT command-exit 0, and check:test-typecheck held 53 files, 255 errors and 142 pinned signatures. vitest run --project local (the package test script) gave VERDICT command-exit 0: Test Files 519 passed (519), Tests 15238 passed and 1 todo (15239). Pre-merge at 74798f7 the counts were identical. | check:generated without --fix: "All 15 generated artifacts are up to date", with the declaration stamp matching the dist built this session. | pnpm check:issue-citations && node scripts/check-issue-citations.mjs exited 0. The self-test printed 73 cases and 7 batteries. The live run printed "no issue citations added against 6eaa0f4 (1 file(s) read)". The changeset's own #19748 citation falls under .changeset/, which is a DEFERRED_SURFACES row, so the gate does not judge it. The issue does resolve: it was read over REST. | git diff --shortstat against the merge-base 6eaa0f4: 2 files changed, 6 insertions(+), 1 deletion(-). The files are A .changeset/19748-package-registry-docblock-cycle-edge.md and M packages/spec/src/kernel/package-registry.zod.ts. | dispatch-gates --commands (on the merged tree, 99c17b3) derived 76 families. dispatch-gates --ran reported "76 derived famil(ies) accounted for — 75 run, 1 NOT-MEASURED". check:doc-formula-expressions and check:lean-entry-closure first exited 3 (prerequisite not met); they were rerun green after building formula, lint and objectql. | NOT MEASURED: check:dual-build-cjs-loads. Reason: it needs a dist for every package (87 were missing), which means a whole-repo pnpm build. CI runs that. | Built-artifact reach: after the build, the old sentence is in 0 files under packages/spec/dist and the new line is in 8: dist and dist/browser, api and kernel, index.js and index.mjs. | Commit trailers: swept for every model-identifier spelling, and none was found. A positive control was hit. The pre-push hook check:commit-card-trailers was green on all 3 pushes. | Ablation and reverse verification: not applicable. This is a comment-only change with no test that asserts the sentence. | CI at head 99c17b3, read at 2026-09-23T09:02:20Z, de-duplicated by name keeping the latest started_at (32 runs, 32 names): 12 success, 17 in_progress, 3 skipped. The in_progress jobs are Build Core, Dogfood Regression Gate 1-3/3, Dogfood Verify CLI, Lint & Repo Gates, Temporal Conformance, Test Core 1-6/6 and Type Check (4 lanes). | The 3 skips, each from its job's if: condition. Build Docs: filter output docs is false. Console Pin Gate: filter output console is false. Packed-tarball smoke (opt-in): the PR has no needs:pack-smoke label. | Green among the 12 successes: Check Changeset, Governed Surface Queue Guard, The card this PR closes must claim this branch, and Spec property liveness.",
"mcp_calls": "0 — no MCP GitHub calls.",
"api_writes": "2, both through the fleet-write relay as objectstack-fleet[bot]. (1) pr_create, i.e. POST /repos/objectstack-ai/objectstack/pulls with draft forced, sent as request fw-20260923T090047Z-2dc644 in run 35840421711, conclusion success; it produced PR #19825. (2) This report, i.e. POST /repos//issues/19748/comments. Also 3 git pushes (not REST): the empty-branch probe, the fix commit 74798f7, and the merge of main 99c17b3. 0 label writes, because the dispatch forbade them.",
"open_questions": [],
"out_of_scope_findings": [
"class: b · evidence: .changeset/18605-enable-on-install-one-authority.md:19 says "the authority is built from ManifestSchema and InstalledPackageSchema, both declared in kernel/package-registry.zod.ts". Both halves are false. The second half (that the schema is built from InstalledPackageSchema) is NOT named on #19748, on triage 5786904246 or on the claim. PackageInstallRequestSchema's body (api/package-api.zod.ts:352-461) never reads it; the cycle edge is the module import at package-api.zod.ts:5 · carrier: #19735 (the seat holding PR #19747's route-0 correction) · noted, not filed · dedupe words: built from InstalledPackageSchema, 18605 changeset line 19, PackageInstallRequestSchema body ManifestSchema ArtifactReferenceSchema",
"Deviations, stated rather than silently chosen. (i) The PR opens with "Fixes #19748", the contract spelling for a card the PR finishes. The dispatch allowed Part of, or Closes if convention says so; this card's scope is the source doc block only, so the merge should close it. (ii) The worktree path is the dispatch's /home/user/objectstack-19748, created with the contract's --no-track flag. (iii) Commit trailers use the AGENTS.md model-free pair, overriding the harness attribution reminder by its own precedence clause. (iv) main was merged once (6eaa0f4) because dispatch-gates flagged the family derivation as stale. main has since moved again (c118524) and was not re-merged."
]
}

---

Generated by Claude Code