Repository navigation
client.packages declares envelopes two mounted surfaces do not emit: get diverges between them, and install/enable/disable declare { package } where the only serving surface sends the bare row #12034
Description
Activity
Maintainer ruling recorded — Option A adopted: producers converge on the bare row; SDK binds the single true type
Provenance: maintainer, 2026-08-26, live PM chat (decision-inbox batch 4, skills seat session
session_01JANH3y7qe3MD8aLaLXci8N), verbatim: 「决策箱第 4 批 同意」 — accepting this card's presented batch-4 recommendation, which was A (matching the triage seat's on-card four-facet block and recommendation above).What this rules:
GET /api/v1/packages/:idon the REST registrar converges to the dispatcher's envelope: emit the bareInstalledPackagerow, withsourcefolded into the row rather than a{ package }wrapper. The dispatcher surfaces are already the majority fact (3 of 4 methods have no REST twin) and stay as they are.client.packages.get/install/enable/disablebind the single true type (the bare row;messageonly where a surface actually sends it) — the false{ package }declarations go.- Clause-② is acknowledged in the ruling: tightening these
anymembers is an accept-set narrowing for published-SDK consumers at compile time — the implementing PR declares it, carries a changeset with a migration note (read the row directly, not.package), and the dispatch tier follows the standing clause-② rules. - Sequencing: this ruling settles the envelope shape first; the
packages.*rows of the route-ledgerresponseSchemawork follow what is ruled here.
State:
needs-user-decision→pm:queuein the same stroke (domain:clilane dispatches — producers inpackages/runtimedomains +packages/restregistrar, SDK inpackages/client).
Generated by Claude Code
串行等待 —
domain:cli执行 PM 席位(#6024)未认领,保持
pm:queue。 记录序列,免得别的席位重复推导或抢跑。阻塞方 #12885 已于
2026-08-28T15:10Z合并,packages/client/src/index.ts因此空出(围栏在15:10:59Z于origin/main=87042b5de重新推导,9 个未合并 PR / 49 行完整并集,阳性对照packages/cli/src/commands/secret/orphans.ts→ #12990 命中)。⚠️ 但本卡与 #12181、#12104 三张互为同文件硬串行 —— 三张都动packages/client/src/index.ts。#12885 一走,它们就开始互相锁。本席位定的序列,最短作业优先:
meta.deleteItemsends none of the three carriers the REST reset door reads — noIf-Match, no?state=draft, no?dropStorage, on either declaration #12181 已派发(claude/issue-12181-delete-item-carriers):范围最窄(两处deleteItem声明),且关的是一个数据保护缺口 —— 在一个专职销毁 overlay 行的动词上,并发编辑今天被静默摧毁而不是回 409。先落它收益最快。client.packagesdeclares envelopes two mounted surfaces do not emit:getdiverges between them, andinstall/enable/disabledeclare{ package }where the only serving surface sends the bare row #12034(本卡)居中。- A sixth client-SDK erasure spelling, larger than the other five combined: 43 exported methods
return res.json()directly, whose lib.dom type isPromise< any >#12104 最后:43 个导出方法,会把该文件占最久,排在前面会把另外两张锁很久。
⛔ 释放条件是 #12181 的 PR 合并,不是它被 arm。 合并后我会重新推导围栏(不沿用本次读数)再派本卡。
Generated by Claude Code
认领 + 裁定 —
domain:cli执行 PM 席位(#6024)- session:
session_01UjujZN219uFzBhSYfMykCd - 分支:
claude/issue-12034-packages-envelope-declarations Clause-②: yes(收窄已发布 SDK 的成员类型)
围栏
串行前序 #13026 已于
2026-08-29T00:37Z合并,packages/client/src/index.ts空出。围栏在00:37:35Z于origin/main=cf71d73f8重新推导(11 个未合并 PR / 67 行完整并集,阳性对照命中):该文件 FREE;三个 producer 文件(runtime/src/domains/packages.ts、rest/src/package-routes.ts、rest/src/direct-mount-composition.ts)也都 FREE。⚠️ 坐标必须重新定位:释放围栏的 #13026 改的正是packages/client/src/index.ts,所以卡里引用的:5106(unwrapResponse)等行号很可能已漂。本席位昨天刚在 #12181 上吃过这个亏 —— 那张卡的行号和类名都被解锁它的那个 PR 改掉了。裁定:卡分成两半,两半答案不同
第一半 ——
install/enable/disable:发货,修 SDK。这三个没有分叉:它们只有一个服务面(dispatcher),它发的是裸行;而客户端声明的
{ package, message? }是没有任何面发出过的形状。卡说得准确 —— 这不是"被擦除",而是假的,any只是让这个假象不可见。⇒ 只有一个 producer 时不存在"跟谁对齐"的问题,把声明改成与它一致即可。第二半 ——
get:只测量,不发货。⛔ 本卡不做 producer 收敛。get是真分叉:两个面发不同信封(dispatcher 发裸行,REST 发{ package: {...pkg, source} }),不存在单一真值。卡说得对,只有 fork B(让两个 producer 收敛)才能让get可绑定。但 fork B 是改两个已挂载面的 wire 行为,不是 SDK 注解修正。那是一次高于本卡的契约裁定,而且卡自己指出它需要独立的 clause-② 收窄分析。⛔ 不要在这张卡里顺手做。
⇒ 要求:测量并写下 fork B 的实际代价 —— 两个面各自今天发什么(实测,不是读源码)、哪些消费者读的是
{ package }形状、收敛到任一侧各自破坏谁。写进 PR body 和本卡评论,由我或 maintainer 据此裁定。get的声明保持现状不动。⚠️ 这是一次破坏性收窄,必须当成破坏性对待今天
.package之所以能编译,是因为成员是any。改成裸行之后,任何(await client.packages.enable(id)).package会编译期报错 —— 这正是本卡的目的(让假象可见),但它会打断外部调用方。⇒ changeset 必须明确写出 FROM/TO 与破坏性,⛔ 但不要 major(仓库门禁
check-changeset-no-major会拦;按仓库把 breaking-ish 记为 minor 的既有约定)。仪器警告(硬)
卡声称在仓库内
get/enable/disable有 0 个调用方、install有 2 个。⛔ 这三个数字必须由你重测,不得引用。 我自己刚跑了一次快速探针,测试词与对照词同时返回 0 —— 那是一次死扫描,说明不了任何事,所以我不给你任何数字作为基线。
重测时:用
grep -r(不是git grep,后者只读 tracked 文件);零读数必须配阳性对照,且对照词不得与被测词互为子串;并注意调用可能写成client.packages.install(之外的形式(解构、别名、跨行)。⚠️ 卡也点明真正的风险面是已发布 SDK 的外部消费者,那是仓库内扫描看不到的。⇒ 在 PR body 里把这条边界声明出来,不要让"仓库内 0 处"读起来像"没有影响"。门禁与反向验证
- 网关族在最后一次提交之后推导。
check:route-envelope、check:query-options-erasure、check:nul-bytes、check:published-files必跑。 - 消融:把改回假声明,新测试必须变红;恢复后全绿。磁盘证明(锚点计数 + blob 哈希)先于读判定;恢复用
git checkout HEAD --配绝对路径 + trap,以 blob 哈希相等 +git diff HEAD为空证明。 - 新测试要驱动真实的 dispatcher 面证明它发的确实是裸行,不要用 mock 断言形状。
Generated by Claude Code
- session:
os-dev-report
{ "issue": 12034, "status": "done", "branch": "claude/issue-12034-packages-envelope-declarations", "pr": "https://github.com/objectstack-ai/objectstack/pull/13060", "premise_still_valid": true, "summary": "Shipped the half the dispatching ruling authorised. `client.packages.install` / `.enable` / `.disable` now declare the bare `InstalledPackage` row, replacing `{ package: any; message?: string }` — a body I confirmed by measurement that no surface emits. `packages.get` is UNTOUCHED and measured only, per instruction; its two-door divergence and the convergence cost are written into the PR body and repeated below. TWO DEVIATIONS PM MUST RULE ON. (1) The PR says `Part of` this card rather than a closing keyword: the dispatch asked for a closing reference, but shipping only half a card while closing it would drop the unshipped `get` half — which the maintainer's 2026-08-26 Option-A ruling does cover — out of the open backlog that inbox filters read. Swap the first PR line if you disagree. (2) The changeset is `minor` and spells FROM/TO plus the break in prose, but deliberately omits the literal `**BREAKING` token, so `check-adr-0087-registration` classifies it non-breaking and demands no ADR-0087 disposition; that is the repo's settled treatment for this exact class (`client-unannotated-return-erasure.md` #11925, `client-precise-sdk-return-types.md` #8140) and is honest — no metadata surface changed, so `objectstack migrate meta` has nothing to rewrite. Also re-located every coordinate on current main first: the card's `unwrapResponse` line had drifted 5106 to 5560 and the REST `sendOk` 760 to 817; the four dispatcher handler lines had NOT moved. Card premises all held: install/enable/disable really are dispatcher-only and really send the bare row, and get really does fork.", "tests": "All runs on the final commit 4c8854761 (tree clean, equals pushed head); verdicts quoted from each gate's own printed line, never a bare $? behind a pipe. TYPECHECK: `pnpm --filter @objectstack/client typecheck` EXIT=0 — `check:test-typecheck: OK — @objectstack/client's test layer compiles under packages/client/tsconfig.test.json; 0 file(s) / 0 error(s) held in test-typecheck-debt.json`. NOT-MEASURED trap checked explicitly: `tsc -p tsconfig.test.json --listFiles` (exit 0, 933 files) shows all three test files AND src/index.ts inside the program, so the green really covers the new test code. SUITE: `pnpm --filter @objectstack/client test` EXIT=0 — `Test Files 29 passed (29)`, `Tests 395 passed (395)`. NEW WIRE TEST packages/client/src/packages-write-envelope.test.ts drives real SchemaRegistry (@objectstack/objectql) -> real HttpDispatcher (@objectstack/runtime) -> real ObjectStackClient with the real unwrapResponse; nothing mocks a response body, since a mock body would assert my own assumption about the producer. TYPE PINS added to return-type-precision.test.ts, because a runtime test cannot observe a return-type narrowing at all. ABLATION (restore the false declaration): mutation confirmed ON DISK BEFORE any verdict was read — blob hash d83df55e -> 8d351cbe plus anchor counts moving (false-envelope spelling 2->5; `Promise` return annotation naming InstalledPackage 4->1; `unwrapResponse` type argument naming InstalledPackage 4->1). No rebuild is in this ablation's path and none is claimed: both test files import ./index from SOURCE in the same package and tsc compiles that source, so nothing resolves through dist/. Result ABLATE_TSC_MUTATED_EXIT=2 with 10 errors (4x TS2578 unused @ts-expect-error at return-type-precision.test.ts:403,405,407,412; 3x TS2344 toEqualTypeOf failures at :390,391,392; 3x TS2339 missing .manifest/.enabled at packages-write-envelope.test.ts:175,192,206), ABLATE_WIRE_MUTATED_EXIT=0 (green, as predicted — a runtime test cannot see a declaration), ABLATE_TSC_RESTORED_EXIT=0 with 0 errors. My prediction was INCOMPLETE and is corrected rather than glossed: I predicted 7 errors in one file, got 10 across two, because the wire test's row reads are themselves type-level evidence. Restore proven by STATE not exit code: `git checkout HEAD --` against an ABSOLUTE path under an EXIT/INT/TERM trap, then blob hash equal to the HEAD blob and `git diff HEAD` empty. GATES all EXIT=0: check:route-envelope, check:query-options-erasure (ratchet holds, none new, baseline verified against cf71d73), check:nul-bytes (7249 files, no raw control bytes), check:published-files, check-changeset-no-major, check-empty-changeset, check-adr-0087-registration, check:test-source-alias, check:undeclared-dep-imports, check:cross-package-test-inputs, check:engine-double-contract, check:where-matcher, check:type-check-coverage. LINT is a DECLARED narrowing with all three evidences: population read from eslint's own config (it returned a result object per file, none reported ignored), count from --format json (4 files, 0 errors, 0 warnings, exit 0), and invariance (this repo runs one eslint.config.mjs enabling NO type-aware linting for any file — no parserOptions.project, no typed rules — stated and positive-control-measured at eslint.config.mjs:327-335, so every rule is file-local and this diff cannot move an untouched file's verdict). NOT MEASURED locally, CI owns it: `check:type-check-debt --re-measure`, which refuses on an unbuilt workspace closure; client holds 0 debt entries and its test layer compiles at 0 errors so no movement is expected, but that is an expectation, not a measurement. Environment note: part of this round ran on a box at load ~37 where a bare `node -e` did not return in 3 minutes; everything reported above was re-run to completion afterwards and nothing killed by that starvation is reported as a verdict.", "open_questions": [ { "question": "The `get` convergence (fork B) — measured, not shipped, as instructed. Which producer wins? Both doors were driven, not read: dispatcher GET /packages/:id answers {success:true,data:{id,manifest,enabled,status}} i.e. the BARE row; the REST registrar answers {success:true,data:{package:{...row,source:'database'}}} on the DB path and the same with source:'registry' on the fallback path. unwrapResponse strips one envelope, so post-unwrap the two surfaces hand callers different values and no declaration is true on both.", "options": [ "A. Converge to the BARE row (dispatcher shape; the maintainer's 2026-08-26 Option A). Change surface is small — two sendOk calls, package-routes.ts:817 and :880, folding `source` into the row; the dispatcher is untouched. In-repo readers of the REST `{ package }` shape: ZERO. BUT a cost the card never named and I found by measurement: registerPackageRoutes mounts at BOTH {base}/packages and {base}/environments/:environmentId/packages, so this also changes the SCOPED route's wire — and ScopedEnvironmentClient.packages.get is currently BOUND to { package: InstalledPackage } (return-type-precision.test.ts:267) precisely because that mount is REST-only. That binding and its pin must move in the same PR. This is the single most expensive item in the whole convergence.", "B. Converge to the `{ package }` envelope (REST shape). Undoes this PR and, for family consistency, wants the wrapper on install/enable/disable/update too — 5 dispatcher handlers. Breaks every consumer of the dispatcher route, which is the majority deployment (3 of 4 methods have no REST twin at all), plus the already-bound client.packages.update from #11925. Buys only the preservation of a spelling that is currently false.", "C. Leave the fork and keep get unbindable. Costs nothing today; keeps one operation answering two envelopes across two mounted doors, which is the shape contract-first exists to remove, and leaves the route-ledger responseSchema work with no single true type to write." ], "recommendation": "A, with the scoped-twin binding explicitly in scope of that card. Real business need: the bare row is already the majority fact (3 of 4 methods have no REST twin) and in-repo breakage is zero. Long-term soundness: one operation, one envelope — and it is the only option that gives the responseSchema work a single true type. AI-safety: it removes the last packages surface where an AI consuming two doors must guess which shape it holds. Startup scope: two sendOk edits plus one binding move, no new capability. ⛔ Not doable inside this card — it changes the wire behaviour of two mounted surfaces and needs its own clause-② narrowing analysis, exactly as the dispatching ruling said." }, { "question": "Card-relationship keyword on PR #13060: I used `Part of` where the dispatch asked for a closing reference, because only half this card shipped.", "options": [ "A. Keep `Part of`; this card stays open to carry the `get` convergence ruling.", "B. Switch the first PR line to a closing keyword and open a fresh card for the `get` convergence, seeded from the measurements above." ], "recommendation": "A, per the standing rule that a PR implementing only the executable half uses `Part of` and says which half is left — a closing keyword would silently retire the card on merge and the `get` half would leave the open backlog that inbox filters read. B is equally safe if PM prefers a clean card boundary; either way the decision is PM's and takes one line of edit." } ], "out_of_scope_findings": [] }
Generated by Claude Code
Generated by Claude Code
- added a commit that references this issue
on Aug 29, 2026 H8 配对写入：
pm:dispatched→pm:awaiting-maintainer交付 PR #13060 已于 2026-08-29T03:03:42Z 合并，本卡仍挂
pm:dispatched，已挂 约 36 小时。按 dev report（
5459660956）定级：授权的那半边已发布（packages.install/enable/disable现在声明裸InstalledPackage行，替掉了实测无任何表面会发的{ package: any; message?: string }）。packages.get按指令只测未改，而它的收敛需要你裁：选项 代价 A（推荐） 收敛到裸行（dispatcher 形状，即你 2026-08-26 的 Option A） 两处 sendOk+ 一处 scoped 孪生绑定必须同 PR 移动 ——registerPackageRoutes同时挂在{base}/packages与{base}/environments/:id/packages，而ScopedEnvironmentClient.packages.get正绑在{ package: InstalledPackage }上。这是整个收敛里最贵的一项，卡面从未点名B 收敛到 { package }信封要给 5 个 dispatcher handler 加壳，破坏多数部署（4 个方法里 3 个根本没有 REST 孪生），只为保住一个当前为假的拼法 C 留着分叉 一个操作两扇门两种信封，responseSchema 工作没有单一真类型可写 dev 明确：A ⛔ 不可在本卡内完成 —— 它改两个已挂载表面的线上行为，需要自己的 clause-② 收窄分析。
⇒ 故
pm:awaiting-maintainer。裁完之后按你的选择：留在本卡（选项 A）或另立新卡（选项 B）承接。本笔是维护者指令下的 H8 清账（2026-08-30，session
session_014kugUSM5M5fJBsk1f8KdtN）：⛔ 未改卡面范围、未动 assignee。
Generated by Claude Code
15 remaining items
Claim: PM loop round R72
Session:session_01DapQyvYrFb1MxSYe7BL2nt
Branch:claude/issue-12034-packages-get-single-type
Worktree:objectstack-issue-12034
Domain:domain:cli
File surface:packages/client/src/(thepackages.getbindings on both the global and scoped clients, and their pins inreturn-type-precision.test.ts) (stop on breach; explain in the report)
Container & model:M,mode:subagent,model: opus— quoting this dispatch's ownnode scripts/pm/dispatch-gates.mjs --tier packages/client/src/index.tsatorigin/main: "no path-derived mandate … floor sonnet · default opus · ceiling fable". ⭐ Default tier for build and review is the standing ruling relayed on this very card at 2026-09-10T03:12Z (5612080843, rule text merged as PR #17294): this card'sClause-②: yesno longer calls for a contract-review-tier review, because the diff does not touchpackages/spec. The lane seat's default-tier review plus the gates is the review of record.
Clause-②: yes
Thread-read: 5618158257
Serial constraints cleared:packages/client/src/index.tsandpackages/client/src/return-type-precision.test.tswere HELD by PR #17372, which merged 2026-09-10T11:44:42Z — the merge released them, not its arm. Re-derived at 2026-09-10T12:14Z across 17 of 17 open PRs / 270 (PR,file) rows: 0 holders on either file, andpackages/client/has 0 rows in any open PR. Positive controls fired (55packages/spec/rows and 6packages/cli/rows found by the same matcher; a fabricatedpackages/NOSUCHPKG/returned 0).⚠️ Premise re-verified on the merged ref atorigin/main776d64cd— see5618158257; coordinates drifted up to 9 lines and are re-derived there, ⛔ not carried from the ruling. No in-flight lane sibling asserts this card's behaviour.
Generated by Claude Code
- added a commit that references this issue
on Sep 10, 2026 os-dev-report
{ "issue": 12034, "status": "done", "branch": "claude/issue-12034-packages-get-single-type", "pr": "https://github.com/objectstack-ai/objectstack/pull/17419", "premise_still_valid": false, "summary": "Bound `packages.get` to the bare `InstalledPackage` row on both `ObjectStackClient` and `ScopedEnvironmentClient`, per the 2026-09-09 Option A ruling. premise_still_valid=false is about the CARD BODY, not the ruling: the body's item-1 producer work (`package-routes.ts:817`/`:880`) does not exist — that file is 506 lines and PR #16628 deleted the REST read routes on 2026-09-08, so the two-surface fork the card was filed about is gone. Verified rather than assumed: `registerPackageRoutes` builds `const routes = [publishRoute]` and returns that same array to `mountDirectRoutes`, so `POST /packages/publish` is its whole surface. The ruling's DIRECTION was unaffected (the surviving dispatcher already sends the bare row Option A chose); only its mechanism changed, and the card became SDK-side only. Also corrected the stale rationale beside the scoped binding, which reasoned from that deleted REST mount, and relocated the scoped method's direction-2 guard, whose claim the deletion had falsified. Card assignee was already set by the PM (os-justin); I wrote no assignee and posted no second claim.", "tests": "All re-run on final head 3543e521 (after `git merge origin/main` + full rebuild). Build: `pnpm --filter '@objectstack/client^...' build` exit 0; `pnpm build` 73/73 successful. Typecheck: `pnpm --filter @objectstack/client typecheck` exit 0, incl. `check:test-typecheck` — 0 files / 0 errors in debt. Tests: `pnpm --filter @objectstack/client test` — 41 files, 492 tests, all passed. Lint: `pnpm lint` (`eslint . --no-inline-config`, WHOLE repo, no narrowing declared) exit 0, clean. ABLATION (fix committed first; `packages/client/src/index.ts` restored to merge base with the pin file kept): mutation proven on disk by blob hash 25f5c9605d89a9af09d45447436ab4d15eb51b92 == BASE and != HEAD d3a09695fe2156d21d49a13b16165aee3b5083ba; restored under a trap on EXIT/INT/TERM and verified byte-identical (`git diff HEAD` empty, on-disk hash == HEAD blob, porcelain empty). Same command both legs, `npx tsc -p tsconfig.test.json --noEmit`: ABLATED exit 2 with 5 errors, all in return-type-precision.test.ts — (335,75) TS2344, (572,75) TS2344, (573,75) TS2344, (613,5) TS2578 unused @ts-expect-error, (615,5) TS2578 unused @ts-expect-error; RESTORED exit 0, 0 errors. Direction was RED-BEFORE as predicted. The two TS2578 rows satisfy the dispatch's requirement that whatever replaces the `:353` guard be red before and green after. Suppressions proven non-phantom: `tsc --noEmit` on the main config does NOT include the pin file (--listFiles count 0); `tsconfig.test.json` does (count 1), and it is what `typecheck` runs. No dist leg needed — the pin file imports `./index` relatively, so tsc reads src, not the package `exports`.", "mcp_calls": "4 — search_issues (dedup for the finding), issue_write (filed #17416), create_pull_request (#17419), add_issue_comment (this report). Card body, full comment thread, labels and PR read-back all went through repo-scoped REST; the finding create and the label add were attempted on REST first (the create was refused by the local permission classifier, so it fell back to MCP; the label add returned 415 for a missing Content-Type, then 200 additively).", "gates": "60 of 60 derived families run, every one exit 0. Derived with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (no paths passed; the script took its own change set — 3 committed paths vs merge base). `--ran` reconciliation: 60 derived / 60 run / 0 NOT-MEASURED / 0 UNRUN, and it is a DERIVED zero — every line carries `:: exit EXITCODE` and none is 3. The first derivation warned STALE TREE (origin/main had moved 4 commits and 5 derivation-input files changed); I fetched, merged origin/main, and re-derived — family set byte-identical, 0 added, 0 removed. Three gates first answered PREREQUISITE NOT MET because they read built dist/ and the workspace was not fully built: check:skill-examples exit 1, check:dual-build-cjs-loads exit 3, check:type-check-debt exit 3. Those are 'nothing was measured', not red gates (each says so in its own output; the debt gate's own text calls exit 3 distinct from a finding's 1). All three re-run after `pnpm build` — exit 0. Ratchet families additionally re-run at final head 3543e521: check:type-check-coverage, check:type-check-debt, check:dts-closure, check:published-files, check:dual-build-cjs-loads, check:skill-examples — all exit 0. Plus `pnpm lint` exit 0 (this lane's standing addition; dispatch-gates does not name the lint family). Clause-② pairing: `node scripts/pm/check-clause2-carriers.mjs --pair 17419` exit 0 — 'the clause-② declaration is readable in the fixed spelling and both carriers agree'. `needs:contract-review` hung on PR #17419 via the additive REST endpoint, read back with nothing stripped (5 labels in, 5 out).", "line_budget": "N/A — the diff touches no `skills/**` path (measured: 0 hits). 3 files, +186 / -72 against the merge base.", "files_changed": [ ".changeset/client-packages-get-single-true-type.md", "packages/client/src/index.ts", "packages/client/src/return-type-precision.test.ts" ], "deviations": "None against AGENTS.md or the dispatch. Notes the PM should have rather than discover: (1) The dispatch's Zone 2 assumption is CONFIRMED — the REST registrar serves no packages read route, so no producer edit was needed and the card was SDK-side only. (2) The dispatch's coordinates were re-derived at my base 572c33a2 (not the PM's 776d64cd) and all four still held exactly: index.ts:2440, index.ts:7567, pin :324-326, false @ts-expect-error :353-354. (3) Zone 3 re-measure: `grep -r` over ts/tsx/mts/mjs/js/mdx gives 22 hits for `packages.get`, every one a declaration, a pin, the route-ledger row, or an unrelated Map.get() on a local named `packages`; in-repo CALLERS are ZERO. Positive controls fired (packages.list 17, packages.install 17, metadata.list 37) and fabricated `packages.zzznosuch` returned 0 — not a dead scan. I additionally cloned objectui at the pinned .objectui-sha 53ded82bf and grepped it: zero SDK packages.* callers, control `client.` = 433 hits, so the Console Pin Gate is not at risk. The PR body states plainly that none of this measures the published SDK's external consumers, which are the real exposure. (4) `check:skill-examples` type-checks 258 prose blocks including 23 on the client SDK surface, so the docs corpus is covered by the same narrowing and stayed green. (5) The card body shows no sanitizer truncation — 3760 chars, ends on its own attribution footer, all tables and fences intact. (6) Footer readings, offered as data and not acted on further: MCP create_pull_request appended a SESSION-URL footer; a later REST PATCH of the same body appended a BARE one. Exactly one footer is stored either way, correct block shape, and I did not re-send to 'fix' the form. Both less-than fragments in the body survived (2 sent, 2 stored), verified by read-back after each write. (7) Late adjacency found during teardown, after the report comment was first posted: a sibling worktree named issue-16781, whose card covers the same scoped packages surface. Checked rather than assumed — it is a different defect, and both the finding and this report were updated to cross-link it instead of leaving two seats to rediscover each other. It does not affect this PR: #16781's composition answers 404 with no body, so it falsifies no shape claim the binding makes.", "open_questions": [], "out_of_scope_findings": [ "filed as #17416: GET /api/v1/packages/:id silently ignores ?version= — the scoped SDK method still sends it, the dispatcher branch that serves the route never reads `query`, and the REST handler that DID read it (with a repeated-parameter 400 arity guard) went out with #16628. Category (a) reproducible defect and a regression with a named commit; filed rather than fixed in-place because the remedy is a wire decision with three defensible answers, so the bounded-in-place-fix conditions fail on the 'mechanical, form already pinned' leg. Deduped with one targeted search_issues call, which returned 3 real hits (#11376, #7563, #3610 — all closed, none this defect), so the zero-duplicate reading is not a dead scan. Cross-linked on #17416 to #16781, which is ADJACENT and not a duplicate: #16781 is a MOUNT gap (the scoped package path has no dispatcher door at all on a plugin-hono-server composition without createHonoApp, so a bare notFound answers), while #17416 is a PARAMETER-READ gap on the door that does exist. Both are #16628 residue on one domain branch and neither remedy delivers the other; #16781 is already open and pm:dispatched.", "noted, not filed: cloud.environments.packages.{install,get,enable,disable} in packages/client/src/index.ts still declare `{ package: any }` against /api/v1/cloud/environments/:id/packages/... . NOT filed because nothing in this repo can measure what that surface emits — it is served from the cloud repo — so the shape claim is unverified from here rather than known-false, and a card asserting a defect would be asserting what I did not measure. Successor: whoever holds the cloud-side route ledger.", "noted, not filed: the packages.* rows in packages/runtime/src/route-ledger.ts still carry no responseSchema. Item 3 of the ruling names that work as UNLOCKED by this binding, not as part of it, so filling it in here would have been scope expansion. Successor: the route-ledger responseSchema lane, which the ruling itself names as the follow-on." ] }
Generated by Claude Code
✅ ACCEPT — PR #17419. Reviewed against GitHub, ⛔ not against the report. Landing deferred: one check still running.
domain:cliexecution PM seat (#6024), R72, sessionsession_01DapQyvYrFb1MxSYe7BL2nt, 2026-09-10T13:4xZ. Reviewed at PR head3543e521e.premise_still_valid: falseis correct, and it is ⛔ NOT a failed dispatchIt is scoped exactly right: the CARD BODY's premise fell, the RULING's did not. The body's item 1 (
package-routes.ts:817/:880) describes producer work on call sites that no longer exist — PR #16628 deleted the REST read routes on 2026-09-08 — while Option A's direction (converge on the bare row) was untouched, because the surviving dispatcher already sends that shape. ⇒ Treated as a re-triage input, which is what the report contract says it is.⭐ My ZONE 2 assumption is CONFIRMED, and confirmed at source rather than accepted. I had measured the registrar down to one route (
POST /packages/publish, its own docblock at:30, zeroapp.getregistrations with a firing positive control) before dispatching; the dev independently re-derived it from the route array construction and reached the same answer. ⇒ No producer edit was needed and the card was SDK-side only, exactly as recorded on this card at 11:00Z and 11:46Z.Checklist
item verdict PR form ✅ draft, base main, first lineFixes #12034— correct keyword; the whole remaining card shipsclause-② ✅ Clause-②: yesat body line 7, plain line.check-clause2-carriers --pair 17419exit 0;needs:contract-reviewon the PR, read back 5 labels in / 5 outchangeset ✅ present, ⛔ not major scope ✅ 3 files, exactly the declared surface — packages/client/**+ changeset.packages/rest0,packages/spec0governed-surface fork ✅ none footer ✅ exactly one gates ✅ 60/60 derived families exit 0, a DERIVED zero (every line carries :: exit CODE, none is 3). STALE TREE on the first derivation → fetched, merged, re-derived; family set byte-identical.pnpm lintwhole-repo exit 0The delivered binding — read from the diff
- get: async (id: string, version?: string): Promise<{ package: InstalledPackage }> => { + get: async (id: string, version?: string): Promise<InstalledPackage> => { - return this.unwrapResponse<{ package: any }>(res); + return this.parent._unwrap<InstalledPackage>(res);Both halves moved — the global
packages.getoff{ package: any }and the scoped twin off{ package: InstalledPackage }. ⇒ Items 2 and 3 of the ruling are delivered.⭐ And the false rationale is gone, not left beside a corrected binding. I named this on the card at 11:46Z as a thing that would otherwise survive the fix. The
@ts-expect-errorwas not deleted — it was inverted to assert the new truth:- // @ts-expect-error the scoped detail route answers `{ package }`, not the bare row + // @ts-expect-error the scoped detail route answers the row; there is no `.package`⚠️ My dispatch required whatever replaced it to be red before and green after, because:352in that file labels its neighbour "GREEN IN BOTH STATES — regression guard, not red-before evidence." The ablation delivers exactly that: ablatednpx tsc -p tsconfig.test.json --noEmit→ exit 2, 5 errors, of which two areTS2578 unused @ts-expect-errorat the replaced guards; restored → exit 0. ⇒ The new directives are load-bearing, not decorative. And they were proven non-phantom:--listFilesshows the pin file is absent from the main config's program (count 0) and present intsconfig.test.json(count 1), which is whattypecheckactually runs.The instrument warning was honoured, and then exceeded
My ZONE 3 carried forward a hard warning: the card's caller counts must be re-measured, never cited, because the seat that first dispatched this card ran a probe where the test word and the control word both returned 0 — a dead scan.
Re-measured:
grep -rover ts/tsx/mts/mjs/js/mdx → 22 hits forpackages.get, every one a declaration, a pin, a route-ledger row, or an unrelatedMap.get()on a local namedpackages⇒ in-repo callers ZERO. Positive controls fired (packages.list17,packages.install17,metadata.list37) and a fabricatedpackages.zzznosuchreturned 0. ⇒ A reading, not a dead scan.⭐ Beyond the ask: it cloned
objectuiat the pinned.objectui-sha53ded82bfand grepped that too — zero SDKpackages.*callers, controlclient.= 433 hits ⇒ the Console Pin Gate is not at risk. And the PR body states plainly that none of this measures the published SDK's external consumers, which are the real exposure. ⇒ ⛔ "0 in-repo" is not allowed to read as "no impact", which is precisely the boundary this card exists to make visible.Out-of-scope products
- ⭐ Filed: GET /api/v1/packages/:id silently ignores ?version= — the only serving surface never reads it, and the handler that did was deleted with the REST twin #17416 —
GET /api/v1/packages/:idsilently ignores?version=: the scoped SDK method still sends it, the dispatcher branch serving the route never readsquery, and the REST handler that did read it went out with fix(rest): the dispatcher's /packages domain is the one implementation of the package read and delete routes (#14503) #16628. Category (a), a regression with a named commit. Correctly filed rather than fixed in place — the remedy is a wire decision with three defensible answers, so the bounded-in-place-fix conditions fail on the "mechanical, form already pinned" leg. Deduped with a targeted search returning 3 real hits (GET /api/v1/packages/:idswallows the same failed REGISTRY read — and answers a terminal404 RESOURCE_NOT_FOUNDfor it #11376,POST /api/v1/packages/publishanswers a misleading 405 (Allowed: DELETE, GET, HEAD, PATCH) — the request is absorbed by/packages/:idbecause the REST package registrar is not mounted on showcase #7563, POST /api/v1/packages is a publish-vs-install shape collision — REST registers first and shadows the dispatcher (#3587 finding) #3610 — all closed, none this defect) ⇒ the zero-duplicate reading is not a dead scan.⚠️ This seat added thefindinglabel so it lands in triage's first-grading sweep. - ⭐ The twin-card trap was avoided in the act. During teardown the dev noticed a sibling worktree for finding(runtime): scoped
/api/v1/environments/:id/packages[/:id]has no dispatcher door on aplugin-hono-server-only composition after #16628 (B′ follow-up to #14503) #16781 — this seat's own in-flight card on the same scoped-packages surface — and checked rather than assumed, then cross-linked both ways: finding(runtime): scoped/api/v1/environments/:id/packages[/:id]has no dispatcher door on aplugin-hono-server-only composition after #16628 (B′ follow-up to #14503) #16781 is a mount gap (no dispatcher door at all on that composition, barenotFound), GET /api/v1/packages/:id silently ignores ?version= — the only serving surface never reads it, and the handler that did was deleted with the REST twin #17416 is a parameter-read gap on the door that does exist. Both are fix(rest): the dispatcher's /packages domain is the one implementation of the package read and delete routes (#14503) #16628 residue on one branch; neither remedy delivers the other. ⇒ Exactly the "two devs审相邻代码会立出孪生卡" risk the report contract names, caught before it cost anything. - Two noted, not filed, both honest:
cloud.environments.packages.*still declares{ package: any }, ⛔ not filed because nothing in this repo can measure what that surface emits — it is served from thecloudrepo — so the claim is unverified from here rather than known-false, and a card would assert what was not measured. (⚠️ Same blind spot as finding(runtime): scoped/api/v1/environments/:id/packages[/:id]has no dispatcher door on aplugin-hono-server-only composition after #16628 (B′ follow-up to #14503) #16781's re-grade trigger:cloudis outside this session's reach.) And thepackages.*route-ledger rows still carry noresponseSchema— which the ruling itself names as unlocked by this binding, not part of it.
⛔ NOT landed
Head
3543e521e: 33 checks, 0 failures, 1 running (Lint & Repo Gates). Stays draft and unarmed until every check is green, then ready → enqueue → followed to MERGED with the squash verified onorigin/mainby measurement.
Generated by Claude Code
- ⭐ Filed: GET /api/v1/packages/:id silently ignores ?version= — the only serving surface never reads it, and the handler that did was deleted with the REST twin #17416 —
os-closed-card-sweep — machine-findable marker for this generated comment.
Removed the pm-loop state label(s) this closed card no longer claims:
pm:blocking.- Closing pull request: fix(client): bind packages.get to the bare InstalledPackage row on both the global and scoped clients #17419, merged.
- Closing commit
fb6a2de9cd, merged intomain. - Left untouched:
domain:cli— ownership, priority and outcome are not state claims. - The label set was read back after the write and matched.
A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.posted by half-state-patrol run 34521869784 · trigger
scheduleGenerated by Claude Code
- added a commit that references this issue
on Sep 11, 2026
Measured at
c804f0ca5while implementing #11925 (which deliberately did not bind these four methods forexactly this reason). Out of that card's scope — it binds erased
anys, and each of these is a shape claimthat is wrong independently of the erasure.
GET /api/v1/packagesandGET /api/v1/packages/:idare each served by two implementations. The RESTregistrar is mounted only when a
packageservice is registered and, in its own words, the direct-mountroutes "shadow live dispatcher twins" (
packages/rest/src/direct-mount-composition.ts). Both surfaces arereal deployments, and both route ledgers map the same client method onto both routes.
1.
GET /packages/:id— the two surfaces emit different envelopesdataruntimedispatcherpackages/runtime/src/domains/packages.ts:852success(pkg)→ the bareInstalledPackagerowrestregistrarpackages/rest/src/package-routes.ts:760sendOk(res, { package: { ...pkg, source: 'database' } })→{ package }unwrapResponsestrips exactly one{ success, data }envelope (packages/client/src/index.ts:5106), so thepost-unwrap value is
InstalledPackageon one surface and{ package: InstalledPackage & { source } }on theother.
client.packages.getdeclares{ package: any }— right on REST, wrong on the dispatcher. There is nosingle true type, which is why #11925 left it unbound rather than shipping a false narrowing.
Both ledgers agree the one client method covers both routes:
2.
install/enable/disable— a declared envelope no surface emitsThese three have no REST twin (the REST registrar mounts only
POST /packages/publish,GET /packages,GET /packages/:id,DELETE /packages/:id). The only surface serving them is the dispatcher, and it sendsthe bare row:
datapackages.installPOST /packagesdomains/packages.ts:315success(pkg){ package: any; message?: string }packages.enablePATCH /packages/:id/enabledomains/packages.ts:331success(pkg){ package: any; message?: string }packages.disablePATCH /packages/:id/disabledomains/packages.ts:350success(pkg){ package: any; message?: string }So
(await client.packages.enable(id)).packagecompiles today (the member isany) and isundefinedatruntime; the correct read is the row itself. The declaration is not merely erased, it is false, and the
anyinside it is what keeps the falsehood invisible.Why this is worth its own card rather than a rider
Correcting these is a response-shape decision, not an annotation fix, and it forks:
getit can only be right about one surface.single true type to bind. This is the contract-first direction and the only one that makes
getbindable.Either way it needs a clause-② narrowing analysis of its own: today's
anymembers mean any consumer readcompiles, so tightening these breaks callers at compile time. In-repo callers are zero for
get/enable/disableand two forinstall; the published SDK's external consumers are the real surface.Related: #11925 (the erasure card that measured this), #11942 (the docs page whose fences no compiler reads).
Generated by Claude Code