fix(runtime): the package install door parses its whole body through PackageInstallBodySchema

[objectstack-fleet]

Refs #19328. This PR closes rows 1b, 3 and 4. It closes row 2 in two of its three positions. The row left open is row 2's third position: an unknown key at the TOP LEVEL of the wrapped form ({ manifest, bogus }). It still answers 201, with bogus dropped, because the declaration puts the wrapped branch in strip mode and its docblock forbids closing it. That makes it a spec seam, not a door defect (see Open question 1). Per triage 5780789216, this round lands as Refs.

Clause-②: no (narrowing)

What changed

POST /api/v1/packages (packages/runtime/src/domains/packages.ts, handlePackagesRequest, the parts.length === 0 && m === 'POST' branch) now parses the whole body once, at the top of the install path. It uses the union @objectstack/spec already declares for this door, PackageInstallBodySchema.safeParse(body). The door's own prose had named this call twice as the one call that closes the residual classes.

• What the door now enforces: the WHOLE declaration, not only the card's four rows. Before this change, the door parsed only the id and version legs of the manifest. Each of the following therefore answered 201 and now answers 400: name (the manifest's other required key); the namespace grammar; the closed value sets of scope, runtime and packaging; a declared key's type; the retired-key tombstones (configuration, capabilities, extensions, loading); and unknown keys inside the nested blocks the declaration closes. Those blocks are contributes and its kinds[], data[] seeds (SeedSchema), navigationContributions[] and their items, engine, engines, and the structured form of permissions. The list was measured by walking ManifestSchema at this head. §8 of the body-contract file pins nine of these at the door, and the changeset's BREAKING paragraph names all of them, with a FROM → TO bullet for name.
• Verdict placement. The verdict is answered after the id and version legs, which keep their published sentences. It comes before the duplicate-id 409, so a request-shape refusal never depends on server state.
• Envelope. The envelope is the one the id and version legs already use, deps.error(msg, 400): status 400, code VALIDATION_ERROR, taken from the standard catalog's 400 member. No error code was minted.
• Reads go through the parsed value. overwrite, settings and enableOnInstall are read off the parsed wrapped request, never the raw body. That makes the string-vs-boolean inversion in row 3 structurally impossible rather than patched.
• Telling the forms apart. The two forms are distinguished by 'manifest' in parsed.data. This is the declaration's own disjointness: ManifestSchema is a strict close with no manifest key, and the wrapped branch requires one.
• The manifest is stored as sent. The door hands the install writer the manifest the caller sent, not the parsed copy. Parsing through ManifestSchema adds defaults (scope: 'project', defaultDatasource: 'default'). The existing pins (packages-install-manifest-version.test.ts §2) and withWritableVerdict's header both record that this door stores a key-by-key copy with no defaults. The parse is a gate here, not a normaliser.
• The refusal sentence. installBodyRefusal re-parses the branch of the form the caller wrote, to locate the failure. The verdict is still the union's. It surfaces each issue's own message verbatim, as the id leg surfaces manifestIdRefusal. When install options are spelled on the bare form, it appends one prescription, the declaration's own remedy: send the wrapped form, or ?overwrite=true for overwrite. The option key set is read off PackageInstallRequestSchema.shape and is never listed by hand. The shared union-branch ranking (zodIssuesToFields) is not used for this. Measured, it picks the bare branch for { manifest: null, … } and reports both branches for a bare body with no type.
• Untouched regions. The @objectstack/spec/kernel import line and the PATCH /packages/:id version check are not touched (the PR feat(spec)!: the canon for a package version is SemVer 2.0.0 — nine carriers, one grammar #19637 fence). The new import is on its own line.

Before and after, measured against the real door

Method: the real HttpDispatcher over a real SchemaRegistry, with OS_HOME redirected, driven by a one-shot probe that is not committed. "Before" is origin/main 1c8b320a8. "After" is this branch at df0108189.

row	request	before: status · installed · enabled	after: status · installed · enabled
1b	wrapped, manifest with no type	201 · yes · true	400 VALIDATION_ERROR · no · –
1b	bare, no type	201 · yes · true	400 VALIDATION_ERROR · no · –
2	wrapped, unknown key at the TOP LEVEL	201 · yes · true	201 · yes · true (open: declared strip, the seam)
2	wrapped, unknown key INSIDE the manifest	201 · yes · true, key stored	400 VALIDATION_ERROR · no · –
2	bare, unknown key	201 · yes · true, key stored	400 VALIDATION_ERROR · no · –
3	wrapped, enableOnInstall: 'false', fresh id	201 · yes · true (inverted)	400 VALIDATION_ERROR · no · –
3	wrapped, enableOnInstall: 'true', fresh id	201 · yes · true	400 VALIDATION_ERROR · no · –
3	wrapped, overwrite: 'true', id already installed	409 RESOURCE_CONFLICT (read as absent)	400 VALIDATION_ERROR · existing row untouched
4	bare, enableOnInstall: false, fresh id	201 · yes · true (ignored, stored as a manifest key)	400 VALIDATION_ERROR · no · –
4	bare, overwrite: true, id already installed	201 · honoured, stored as a manifest key	400 VALIDATION_ERROR · existing row untouched
4	bare, settings: {a:1}	201 · honoured as install settings, stored as a manifest key	400 VALIDATION_ERROR · no · –
ctl	wrapped, well-formed	201 · yes · true	201 · yes · true
ctl	bare, well-formed	201 · yes · true	201 · yes · true
ctl	SDK wire shape, enableOnInstall: false	201 · yes · false	201 · yes · false
ctl	SDK wire shape, overwrite: true, id already installed	201	201
ctl	bare, well-formed, ?overwrite=true, id already installed	201	201

Row 4 had moved from what the card says. The card says install options on the bare form are "ignored". Measured, they were handled key by key: enableOnInstall was ignored, while overwrite: true and settings were honoured. All three were stored inside the manifest. The door read body?.overwrite and body.settings without checking the form. Rows 1b, 2 and 3 read as the card relayed them.

Row 4's answer, decided by the declared schema. ManifestSchema's strict close refuses settings, enableOnInstall and overwrite on a bare body by name. The docblock states the remedy: «a caller that needs an option sends the wrapped form». So the declared answer is a refusal, and the refusal names the wrapped form. Neither branch is relaxed. A bare body keeps ?overwrite=true, which the docblock names as its one route.

The SDK control (its request shape is the one production caller of enableOnInstall)

• Permanent pin, door side. packages-install-body-contract.test.ts §7 builds the body exactly the way client.packages.install(m, options) builds it, and round-trips it through JSON. It checks three calls. install(m, { enableOnInstall: false }) answers 201 and is disabled in all three records: the returned row, the registry, and the durable file. install(m) answers 201 and is enabled. install(m, { overwrite: true }) over an installed id answers 201. The SDK side of the same shape is already pinned in packages/client/src/client.test.ts.
• One-shot probe, not committed. The real ObjectStackClient ran through the real HttpDispatcher from the rebuilt @objectstack/runtime dist, built from 0e3d3fdf5. Results:
  • install(m, { enableOnInstall: false }) → enabled: false, and the registry row is false too.
  • install(m) → enabled.
  • install(m, { overwrite: true, enableOnInstall: true }) → 201, and the manifest was replaced.
  • install(m, { settings: { a: 1 } }) → the settings landed.
  • A manifest with no type → the client threw, with code VALIDATION_ERROR and status 400.
  • In the same run, packages-write-envelope.test.ts, client.test.ts and readme-package-install-example.test.ts stayed green: 4 files, 222 tests.

The objectui caller, read by the seat at .objectui-sha f8a9d0fb (REWORK 5855224201): «The create path sends POST /api/v1/packages with { manifest: manifestBody }, where manifestBody = { ...draft, id, name, version, type: draft.type ?? 'app' }.» The file is packages/app-shell/src/views/metadata-admin/PackageFormDialog.tsx. Studio's create-package dialog therefore always sends a declared type, and row 1b's refusal does not break it.

Fixture triage (off-spec door fixtures, by disposition)

• Declaration added (the fixture was never spec-legal; its subject is something else). Each fixture gains type: 'app':
  • package-door-namespace-conflict-code.test.ts (the manifest helper);
  • domain-handler-registry.test.ts (the duplicate-id drive);
  • packages-capability-gate.test.ts (the install write row);
  • http-dispatcher.test.ts (the 409 and ?overwrite=true cases).
• Spelling corrected. In http-dispatcher.test.ts, the two POST /packages install cases changed type: 'application' to 'app'. 'application' is not a member of the declared enum.
• Replaced whole (the pin asserted the very branch this PR removes):
  • packages-install-enable-on-install.test.ts. The case "the BARE body form does NOT honour the key" asserted 201 plus ENABLED. That was a standing pin on row 4, which the card believed had none. It now asserts 400 VALIDATION_ERROR and that nothing installed.
  • packages-install-preserves-lifecycle.test.ts. The case "the BARE body form still sets nothing" now asserts 400 VALIDATION_ERROR. It still asserts that the operator's disable stands in the registry and on disk.

Pins (new file packages/runtime/src/domains/packages-install-body-contract.test.ts)

Every refusal asserts status 400, error.code VALIDATION_ERROR and success: false. It also asserts that nothing was written: the id is absent from the registry, or the existing row is unchanged.

• §0 Every row body is refused by the declaration itself.

• §1 Row 1b, both forms.

• §2 Row 2, the in-manifest and bare positions.

• §3 Row 3: 'false' is never installed-enabled, 'true' is refused, and overwrite: 'true' is not read as absent.

• §4 Row 4, enableOnInstall / overwrite / settings. The message names the misplaced key, "manifest", and ?overwrite=true.

• §5 Parity for the top-level wrapped unknown key: the door answers what the declaration answers. The pin stays green whichever way the seam is decided.

• §6 Ordering. The version leg's sentence survives when a body also lacks type. An off-spec body answers 400, not 409, on an installed id.

• §7 Controls: both forms install, the manifest is stored as sent, wrapped settings land, and the SDK shapes behave as above.

• §8 The rest of the declaration, added in patch round 2. Nine cases each answer 400 VALIDATION_ERROR, install nothing, and name the path:

  • no name, in the wrapped and the bare form;
  • a namespace outside the grammar;
  • a scope outside its set;
  • a non-string description;
  • the retired capabilities;
  • an unknown key inside contributes, inside a data[] seed, and inside engines.

  Each case is first asserted off-declaration by the declaration itself, beside a control that parses green and differs by the defect alone.

Ablation (commit first, then mutate, then restore)

• Mutation. At e2c4c7d90, node scripts/ablation-replace.mjs replaced the anchor const declaredBody = PackageInstallBodySchema.safeParse(body); with a verdict that always passes and hands back the raw body. The anchor count went 1 to 0, the replacement count 0 to 1, and the blob 4f6b4be7 to 4a881701.
• No dist involved. The subject is reached through a relative import (../http-dispatcher.js to ./domains/packages.ts), so no dist/ sits on the path. ablation-dist-preflight --absent confirms the marker is absent from runtime dist/ and that the tree is clean.
• Red leg. The three files went 13 failed, 42 passed. Every row pin in §1–§4 failed, as did §6's 409-ordering case and both replaced bare-form pins. §0, §5, the version-leg ordering case and every §7 control stayed green. The direction was predicted before the run: red.
• Restore. The tool restored with git checkout HEAD, then showed the blob after restore equals HEAD (4f6b4be7) and git diff HEAD is empty. Re-verified by hand, the tree is clean.
• Green leg. The same three files then passed 55 of 55.

Tests and gates (head df0108189 unless stated; the patch rounds are recorded at the end of this section)

• Runtime door tests. 31 door-touching test files, plus the uncommitted probe: 32 files, 779 tests passed.
• Full runtime suite. pnpm --filter @objectstack/runtime exec vitest run --project local --maxWorkers=2: 280 files, 3927 passed, 1 skipped, at 0e3d3fdf5, before any merge of origin/main. The branch has merged origin/main three times:
  • The first merge (df0108189, base e7f69dbba) brought no change to packages/runtime, the install schemas or the lockfile.
  • The second merge (f2e2c99bd, base 4df101c38) brought the [finding] three sibling list doors declare limit/cursor and never read them, one reporting hasMore: false as a literal — REBUILD of #19365, which stopped resolving on 2026-09-21 #19543 flow-list retirement: domains/automation.ts, dispatcher-plugin.ts, route-ledger.ts, packages/client/src/index.ts, seven runtime test files (dispatcher-plugin.anonymous-gate.integration, domain-handler-registry, anonymous-gate-actions-automation, automation-run-read-permission-gate, automation-write-capability-gate, http-dispatcher.tenancy-posture-outage, http-dispatcher) and test-typecheck-debt.json. It does not touch the install door, PackageInstallBodySchema, ManifestSchema or the install writers. 10 door and runtime test files re-ran on the merged tree at 481ad07f: 515 passed.
  • The third merge (dd49317f1, base 805af4f29) brought no packages/runtime change and no lockfile change.
• Typecheck. pnpm --filter @objectstack/runtime typecheck exited 0. Its test layer (tsconfig.test.json) compiles the new file; --listFilesOnly counts it. The debt ledger held at 27 files, 191 errors and 69 signatures.
• Derived gates. node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 60 families: 59 exited 0. The one other is pnpm check:dual-build-cjs-loads: NOT MEASURED (exit 3, PREREQUISITE NOT MET: 31 packages have no dist/ without a full build, which is CI's). As a scoped substitute, require('packages/runtime/dist/index.cjs') loads (HttpDispatcher is a function). --ran reconciliation: 60 derived, 59 run, 1 NOT MEASURED, 0 UNRUN.
• Lint. pnpm lint, the full eslint . --no-inline-config, not narrowed: exit 0.
• Issue citations. node scripts/check-issue-citations.mjs --base origin/main: exit 0 (12 citations: 11 resolve, 1 cross-repo).
• Patch round 1 (head 481ad07f, changeset only).
  • check-adr-0087-registration --base origin/main → 0, reading [BREAKING+clause-②-narrowing].
  • check-changeset-no-major --base origin/main → 0.
  • 10 door and runtime test files → 515 passed.
  • Derived gates: 60 derived, 59 exit 0, check:dual-build-cjs-loads NOT MEASURED (exit 3). pnpm lint → 0; the real issue-citation check → 0.
• Patch round 2 (head 1358147bc: the changeset states the whole declaration, plus the §8 pins).
  • check-adr-0087-registration --base origin/main → 0, reading [BREAKING+clause-②-narrowing] with the one marker.
  • check-changeset-no-major --base origin/main → 0.
  • The same 10 files → 524 passed (515 plus the 9 §8 cases).
  • pnpm --filter @objectstack/runtime typecheck → 0.
  • Ablation, with the same anchor as before (the body parse replaced by a verdict that always passes): the body-contract file went 20 failed / 10 passed, and every §8 case answered 201 where it expects 400, i.e. installed before the fix. The restore was byte-identical to HEAD.
  • Derived gates: 60 derived, 59 exit 0, check:dual-build-cjs-loads NOT MEASURED (exit 3; 36 packages have no dist/). pnpm lint → 0; the real issue-citation check → 0 (8 citations, all resolve).

Changeset and bump

.changeset/19328-install-door-body-parse.md, @objectstack/runtime: minor, carrying Clause-②: no (narrowing), a BREAKING for callers of the install door paragraph with a FROM → TO remedy for each refused shape, and exactly one ADR-0087 not-required (no-migration-prescription) disposition. It was rewritten in patch round 1, after contract review 5855204061 answered FAIL on the bump and the seat's REWORK 5855224201 upheld it. The claim's own line stays Clause-②: no, because a claim line carries only yes | no.

Why minor and (narrowing): the diff shrinks the door's observed wire accept set. Bodies that answered 201 now answer 400, and bare-form overwrite: true and settings were HONOURED before and are refused now. scripts/pm/clause2-line.mjs defines no (narrowing) as «NOT a widening, but breaking». AGENTS.md Post-Task Checklist step 3 makes (narrowing) BREAKING: the changeset must carry its migration, and must state its ADR-0087 disposition in writing. The same door's two earlier pull-backs to the same declaration carry exactly this form, and this PR narrows more than either:

• .changeset/19120-install-door-parses-manifest-version.md ([finding] POST /api/v1/packages installs a manifest with NO version and answers 201, while its published declaration requires one — the door parses nothing #19120, the version leg);
• .changeset/19417-install-door-parses-manifest-id.md ([finding] the HTTP install door reads manifest.id positionally and never parses the body through ManifestSchema — POST /packages answers 201 to ids that MANIFEST_ID_PATTERN (spec, defineStack, os build, the publish face) refuses #19417, the id leg).

Each carries minor, Clause-②: no (narrowing), a BREAKING paragraph and adr-0087: not-required (no-migration-prescription). node scripts/check-adr-0087-registration.mjs --base origin/main now reads this changeset as [BREAKING+clause-②-narrowing] and accepts it with its marker (exit 0). For each refused shape, the changeset names what a client should send instead.

✅ Settled in patch round 1. The seat answered Open question 2 with A (REWORK 5855224201). The text below is kept as the record of why it was raised. The two earlier PRs on this same door, for #19120 (the version leg) and #19417 (the id leg), each pulled the door back to the same declaration. Both declared Clause-②: no (narrowing), bumped minor and wrote an ADR-0087 not-required disposition. This PR narrows more than either did: row 4's bare overwrite and settings were honoured before and are refused now.

Acceptance notes (observations, not filed)

• A JSON null body answers 500. Through the dispatcher, a null or undefined body answers 500 INTERNAL_ERROR with the TypeError text ("Cannot read properties of null (reading 'manifest')"). The cause is the unchanged body.manifest || body line ahead of the id gate. The Hono adapter maps an unparseable body to {}, but a literal JSON null would reach the door as null. That path is inferred from the adapter code, not measured through a public door, so it is not filed. Owner: none.
• ?overwrite is compared by hand. The query parameter is still read with a hand-written === 'true' || === true, not with parseBooleanParam, which is the file's own declared query-boolean coercion. That code is outside this card's rows and unchanged here. Owner: none.
• Nested strip-mode shapes are stored as sent. Some nested shapes are still in strip mode, and those are stored as the caller sent them. A walk of ManifestSchema at this head found them only in the object form of a navigation item's visible and its meta. The gate refuses unknown keys in the manifest and in every nested block the declaration closes: contributes and its kinds[], data[] (SeedSchema is a strictObject), navigationContributions[] and their items, engine, engines, and the structured permissions. §8 pins three of these at the door. The earlier sentence here named data[] as strip mode and said the gate closed top-level keys only; both were wrong, and patch round 2 corrected them. Owner: none.

Spec-side follow-up: filed as #20219 (the #19327 pattern; it lands with or right after this PR)

@objectstack/spec's PackageInstallBodySchema docblock goes stale when this lands. Four places are affected:

• The "measured residual" list still records classes 1b, 2, 3 and 4 as answering 201.
• The paragraph on the two runtime door drives says they post bodies with no type; they now carry type.
• The enableOnInstall docblock says the door "reads the raw body".
• package-api.test.ts has a block, "the measured bare-form senders are the RESIDUAL", that makes the same claims.

That docblock ships in dist/api/index.d.ts, per the #19327 changeset. packages/spec/** is read-only for this card, so this is the #19327 pattern: a spec-lane docs follow-up, not a rider here.

Open questions

1. The seam, row 2 at the top level of the wrapped form. Should PackageInstallRequestSchema be closed (.strict())? The door now asks the declaration, so it follows with no edit, and §5 stays green either way.
   • For closing, measured: no first-party producer sends an undeclared top-level key. The SDK sends manifest, settings, enableOnInstall and overwrite. objectui's PackageFormDialog sends { manifest }.
   • The cost of leaving it: a misspelt option such as enabledOnInstall: false is silently dropped, and the package installs ENABLED. That is the same harm as row 3, reached by a typo.
   • Why this PR does not do it: the docblock ties the strip mode to maintainer ruling A (batch 🔗 Broken links detected in documentation #148 item 4), and this card may not move a spec shape. So it is a spec-lane and maintainer decision.
2. The changeset's Clause-② arm and bump. ✅ Answered A by the seat (REWORK 5855224201) and applied in patch round 1. The claim declares Clause-②: no, and this PR copies it. The same-door precedents ([finding] POST /api/v1/packages installs a manifest with NO version and answers 201, while its published declaration requires one — the door parses nothing #19120, [finding] the HTTP install door reads manifest.id positionally and never parses the body through ManifestSchema — POST /packages answers 201 to ids that MANIFEST_ID_PATTERN (spec, defineStack, os build, the publish face) refuses #19417) declared no (narrowing) with minor. Should the seat re-declare no (narrowing) with minor and an ADR-0087 not-required disposition? Recommended, because refusing previously honoured bare-form overwrite and settings is a narrowing of observed wire behaviour.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/runtime, touching 5 documentable anchor(s).

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/environment-routing.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))
• content/docs/deployment/cli.mdx (via unrecognized_keys (literal, a string literal in installBodyRefusal))
• content/docs/getting-started/examples.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))
• content/docs/kernel/contracts/metadata-service.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))
• content/docs/kernel/services-checklist.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))
• content/docs/permissions/permission-sets.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))
• content/docs/permissions/system-context.mdx (via handlePackagesRequest (symbol, a top-level function))
• content/docs/protocol/kernel/error-handling.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))
• content/docs/protocol/objectql/types.mdx (via unrecognized_keys (literal, a string literal in installBodyRefusal))
• content/docs/ui/apps.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via unrecognized_keys (literal, a string literal in installBodyRefusal), /api/v1/packages (route, a path literal in a comment on a changed line))
• content/docs/releases/v17/17-4.mdx (via /api/v1/packages (route, a path literal in a comment on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 26 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 805af4f290565955d6e6b56ee46fed45f721d955 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 407408eaa527c3a4c07a3b06aeb3153f42e672a0 — the merge of head 1358147bcdf8c8f31509db38223a59332d59daed into base 805af4f290565955d6e6b56ee46fed45f721d955, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 407408eaa527c3a4c07a3b06aeb3153f42e672a0 && git checkout 407408eaa527c3a4c07a3b06aeb3153f42e672a0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 805af4f290565955d6e6b56ee46fed45f721d955 1358147bcdf8c8f31509db38223a59332d59daed && git checkout -B drift-repro 805af4f290565955d6e6b56ee46fed45f721d955 && git merge --no-ff 1358147bcdf8c8f31509db38223a59332d59daed

node scripts/docs-audit/affected-docs.mjs --json 805af4f290565955d6e6b56ee46fed45f721d955

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 805af4f290565955d6e6b56ee46fed45f721d955 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: df01081896b718b687036a4b5d5f801d82c8a7e3

① Derived judgments

• Whole-body parse, once, at the top of the install branch — packages/runtime/src/domains/packages.ts handlePackagesRequest, parts.length === 0 && m === 'POST': const declaredBody = PackageInstallBodySchema.safeParse(body) runs right after requireManageMetadata; the verdict is answered after the id leg (ManifestSchema.shape.id.safeParse(rawId)) and the version leg, and before registry.getPackage(pkgId) (the 409). overwrite, settings, enableOnInstall are read off request = 'manifest' in declaredBody.data ? declaredBody.data : undefined. The only raw reads left are body.manifest || body (the legs and the stored manifest). Correct.
• Door answers what the declaration answers — probed by reading against packages/spec/src/api/package-api.zod.ts (PackageInstallBodySchema = z.union([PackageInstallRequestSchema, ManifestSchema]), ManifestSchema a strictObject, type: z.enum([...]) required, enableOnInstall/overwrite z.boolean().optional()): wrapped well-formed → 201; bare well-formed → 201; body that is both ({ manifest, id, … }) → wrapped branch in strip mode, body.manifest || body picks the same manifest → 201, consistent; { manifest: null, id… } → both branches fail → 400, installBodyRefusal reads it as wrapped ('manifest' in body) → consistent with the union; string/number/array bodies → manifest?.id undefined → the id leg's 400; ?overwrite=true still read raw (query?.overwrite), body overwrite only from the parsed wrapped request; settings only wrapped; enableOnInstall string → 400, boolean → honoured. Correct, with one exception: a JSON null body → safeParse(null) fails, then body.manifest throws → 500 INTERNAL_ERROR, reachable through packages/adapters/hono/src/index.ts (c.req.json().catch(() => ({})) catches parse errors, not a literal null). Pre-existing, unchanged, admitted in the PR's Acceptance notes; the declaration answers 400 there. Not one of the card's rows.
• Manifest stored as SENT — protocolSvc.installPackage({ manifest, settings }) / registry.installPackage(manifest, settings) receive body.manifest || body, not declaredBody.data. Sound: ManifestSchema carries no .transform/preprocess/aliases (only .default() on scope, defaultDatasource), and the top-level strict close means every stored top-level key is a declared one; the stored copy differs from the parsed copy only by absent defaults (which withWritableVerdict's header depends on — a Studio-created base is scope-less) and by nested strip-mode residue (pre-existing). Pinned §7 (toEqual(m)). Correct.
• Refusal envelope and ordering — deps.error(installBodyRefusal(...), 400) → HttpDispatcher.error → apiErrorResponse({ httpStatus: 400 }), the same path the id/version legs use; §6 pins the version-leg sentence surviving a type-less body and 400-not-409 on an installed id. Package id is required, manifestIdRefusal, the version sentence and Package '<id>' already exists are untouched (diff touches only comments there). No published message or code changed; one new message minted (Invalid package install body (read as …)), no new code. Correct.
• First-party SDK — packages/client/src/index.ts install(manifest, options) sends { manifest, settings, enableOnInstall, ...(overwrite) } with undefined dropped by JSON.stringify: wrapped form, JSON booleans → passes the wrapped branch. README (packages/client/README.md:254) and content/docs/api/client-sdk.mdx:336 examples carry type. Pinned door-side in §7 (three SDK shapes). Correct.
• objectui package form — NOT VERIFIABLE from here: packages/console/dist is untracked at origin/main, the objectui repo answers 403 to the API and add_repo is fenced. The PR asserts PackageFormDialog sends { manifest } but never says that manifest carries type; row 1b's closure makes a type-less Studio create-package body a 400. Dogfood Regression Gate 3/3 and Dogfood Verify CLI are green on the head, coverage of that dialog unknown. Unverified — the seat must confirm at .objectui-sha f8a9d0fb before landing.
• The two REPLACED pins — packages-install-enable-on-install.test.ts («the BARE body form does NOT honour the key») asserted 201 + ENABLED with the key ignored and stored; packages-install-preserves-lifecycle.test.ts («the BARE body form still sets nothing») asserted 201 + enabled: false under ?overwrite=true. Both protected «the door must not ACT on a bare-form key» — that reading is kept (nothing installs / the operator's disable stands in registry and on disk) and the 201 they also asserted is exactly the row-4 branch the declaration refuses. Replacing is right; the card's «nothing pins row 4» was wrong and the PR says so. Correct.
• Fixture edits (type: 'app' in four files, 'application' → 'app' in http-dispatcher.test.ts) — none was spec-legal ('application' is not an enum member; type has always been required). They surface, not hide, the intended change: a type-less or mis-typed manifest now answers 400 (row 1b). No first-party producer sends type: 'application' (git grep at origin/main: only packages/spec/scripts/generate-sbom.ts, unrelated). Correct, but the same edit makes the spec docblock's «both door drives post no type … the door answers both 201» false (see ③).
• Row-4 «moved» — the PR measured bare overwrite: true and settings as HONOURED before (the door read body?.overwrite / body.settings form-blind). Consistent with the origin/main code (body?.overwrite === true, body.settings). Correct, and it is the fact that decides ②.

② Semver level

Wrong as declared. Must be Clause-②: no (narrowing), '@objectstack/runtime': minor, a BREAKING banner, migration text per refused shape, and an ADR-0087 disposition marker.

• The diff shrinks the observed wire accept set: bodies that answered 201 (and, for bare overwrite: true / settings, were honoured) now answer 400. scripts/pm/clause2-line.mjs: «A diff that NARROWS a published accept set answers it no truthfully — and a narrowing is a breaking change … no (narrowing) — NOT a widening, but breaking. This is the whole point of the arm.» scripts/check-changeset-no-major.mjs: an accept-set narrowing is breaking; in the launch window it ships as minor, with the **BREAKING** banner and the ADR-0087 disposition as the mandatory carriers. AGENTS.md Post-Task Checklist 3: «(narrowing) is BREAKING … Breaking changesets must carry their migration … must also state its ADR-0087 disposition, in writing».
• Same-door precedents on origin/main for the identical «pull back to the declared contract» reasoning: .changeset/19120-install-door-parses-manifest-version.md and .changeset/19417-install-door-parses-manifest-id.md — both minor, Clause-②: no (narrowing), «BREAKING for callers of the install door», per-shape remedy, <!-- adr-0087: not-required (no-migration-prescription) … -->. This PR narrows MORE than either (previously honoured options refused).
• As written (patch, bare Clause-②: no, no banner, no marker) check-adr-0087-registration.mjs's breakingDeclaration() reads no signal and the gate stays green — the exact feat(platform-objects): sys_job.timezone and sys_report_schedule.timezone are validated against the IANA domain #16296 shape the arm was created to stop. The dev flagged this as open question 2 and copied the claim's line verbatim; the claim's line is what is wrong.
• Exact carry: front-matter '@objectstack/runtime': minor; line Clause-②: no (narrowing); a **BREAKING for callers of the install door** paragraph naming the five refused shapes (type-less manifest either form; unknown key inside the manifest / on a bare body; string-typed enableOnInstall / overwrite; install options on the bare form — enableOnInstall, overwrite, settings) each with FROM → TO («send instead» text already present is adequate: add type; spell the declared key; JSON booleans; the wrapped form or ?overwrite=true); and exactly one marker <!-- adr-0087: not-required (no-migration-prescription) … --> (nothing authorable is removed or renamed; the refusal carries the remedy), as the two precedents carry.

③ Boundary flags

• Refs, not Fixes — correct per triage 5780789216 («a round that closes some rows lands as Refs #19328, never Fixes, with the remaining rows named»); the PR names the open position (row 2, wrapped top level).
• Row-2 top-level position is a spec seam gated by ruling A — correct. PackageInstallRequestSchema is a plain z.object (strip); its docblock: «⛔ Do NOT close the wrapped branch with .strict() … the one direction this binding may never move (ruling A)». Refusing it door-side without the declaration would make the published contract admit a body the door refuses; triage's fence («if a row cannot be closed without moving a spec shape, that is a seam, stop and report») applies. §5 is a parity pin, so the door follows whichever way the maintainer rules.
• packages/spec docblocks made newly FALSE (ship in @objectstack/spec dist/api/index.d.ts per .changeset/19327-install-door-residual-split.md) — yes, four places in package-api.zod.ts: (1) the «measured residual» list still records 1b OPEN and 2/3/4 answering 201; (2) «the runtime's own door drives … post a manifest with no wrapper … refused here on type alone, and the door answers both 201» — the drives now carry type: 'app' and the door answers a type-less body 400; (3) enableOnInstall's «implemented at the door … which reads the raw body»; (4) package-api.test.ts «the door answers 201 to all of them anyway» (a transcription, stays green, now false prose). packages/spec/** is read-only for this card; the [finding] the package install door's residual docblock records type and version as one 201 class — the version half is closed now #19327 pattern (spec-lane docs-only patch sub-issue of [finding] four residual classes the package install door still answers 201 to, measured unchanged by #19326 (triage: likely four cards) #19328, landing with or right after this PR) is the correct route and must be filed before landing, not left as «owner: none».
• PR body claims — parse-once, parsed reads, envelope, ordering, strip-mode seam, stored-as-sent, SDK control, row-4 moved: all borne out by the diff and the new file packages/runtime/src/domains/packages-install-body-contract.test.ts (§0–§7, real HttpDispatcher over real SchemaRegistry). The objectui claim is unverifiable here (above). The «patch is what Clause-②: no alone takes» reasoning is wrong (②). The null-body 500 and the hand-written ?overwrite comparison are correctly reported as pre-existing and out of the rows; the null case is a declaration/door disagreement worth its own card.
• CI on the head (check-runs API, read at review time): 29 success, 3 skipped, 1 in progress (Type Check · workspace), 0 failed. Build Core, all six Test Core shards, Dogfood Regression Gate 1–3, Dogfood Verify CLI, Temporal Conformance, Lint & Repo Gates, Type Check · debt ledger / consumer gates green. check-adr-0087-registration green only because the declaration hides the narrowing.

Implemented-by: claude/issue-19328-install-door-body-parse
Reviewed-by: session_01UYBdGBzWSrAMzpW8ah3GbP

Independence: INDEPENDENT AGENT (fed the card, the rulings and the PR only; not the dispatch order or the seat's conclusions)

VERDICT: FAIL

• Rewrite .changeset/19328-install-door-body-parse.md: '@objectstack/runtime': minor, Clause-②: no (narrowing), a **BREAKING for callers of the install door** paragraph with the per-shape FROM → TO remedies, and exactly one <!-- adr-0087: not-required (no-migration-prescription) … --> marker — the form .changeset/19120-… and .changeset/19417-… carry; mirror the corrected Clause-② line in the PR body.
• Confirm from objectui at the pinned .objectui-sha (f8a9d0fb…) that the Studio create-package dialog's manifest carries a declared type (and only declared manifest keys) and record the reading on the PR; if it does not, row 1b breaks a first-party caller and needs the sibling fix first (AGENTS.md Post-Task Checklist 4).
• File the spec-lane docs follow-up (sub-issue of [finding] four residual classes the package install door still answers 201 to, measured unchanged by #19326 (triage: likely four cards) #19328, the [finding] the package install door's residual docblock records type and version as one 201 class — the version half is closed now #19327 pattern) for the four now-false package-api.zod.ts / package-api.test.ts sentences before this lands, so the next @objectstack/spec release does not publish a false docblock.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 481ad07f33a22aea78b3e36c04da2dca62968a34

Delta of: 5855204061 (FAIL on df010818)

① Derived judgments

• Required change 1, form — .changeset/19328-install-door-body-parse.md at head: front matter '@objectstack/runtime': minor; line-initial Clause-②: no (narrowing) (line 7, blank lines either side, UTF-8 ②); a **BREAKING for callers of the install door.** paragraph; exactly one adr-0087: not-required (no-migration-prescription) … HTML-comment marker (grep count 1, line 79). Same form as .changeset/19120-… and .changeset/19417-… on origin/main. scripts/check-adr-0087-registration.mjs breakingDeclaration() (:629-642) reads BREAKING + clause-②-narrowing; readDisposition() (:1923-1947) accepts one marker; no-migration-prescription is in CATEGORIES (:494-500). Correct.
• Remedies (a)–(d) checked against the door at head (packages/runtime/src/domains/packages.ts, byte-identical between df010818 and 481ad07f): (a) the eleven type members = 'plugin' + CORE_PLUGIN_TYPES (plugin.zod.ts:90-98, seven) + 'module', 'gateway', 'adapter' (manifest.zod.ts:443-449) — correct. (b) ManifestSchema is strictObject (manifest.zod.ts:326); installBodyRefusal (packages.ts:717-748) surfaces the unrecognized-key message verbatim; pre-PR manifest = body.manifest || body stored the key — correct. (c) enableOnInstall/overwrite are z.boolean().optional() (package-api.zod.ts:300, :319); pre-PR body?.overwrite === true read 'true' as absent → 409, and 'false' matched neither === true nor === false → installed ENABLED (4df101c38:packages.ts:1034-1035, :1095-1099) — correct. (d) pre-PR body?.overwrite and body.settings were read form-blind (:1034, :1045, :1048) → honoured; requestedEnabled = wrapped ? body?.enableOnInstall : undefined (:1095) → ignored — correct. ?overwrite=true with a bare body at head: packages.ts:1168-1169 still reads query?.overwrite === 'true' || === true raw, a bare body carrying no option keys passes ManifestSchema, pinned §7 (packages-install-body-contract.test.ts:388-395) — correct.
• A refused shape is MISSING. ManifestSchema.name is z.string() with no .optional() (manifest.zod.ts:472). Pre-PR the door parsed only the id and version legs; the registry limb (packages/objectql/src/registry.ts:4188+) refuses only namespace/object-name conflicts; the protocol limb (packages/metadata-protocol/src/protocol.ts:22752+) parses the id leg alone («ManifestSchema are still not parsed whole here») and derives an absent namespace. So { id, version, type } with no name answered 201 on main and answers 400 at head. Same for an explicit namespace failing ^[a-z][a-z0-9_]{1,19}$ (:402-404), a scope outside cloud|system|project (:463), a wrong-typed declared key, and an unknown key inside a nested strict shape (contributes :590, engine :856, engines :107, data[] = SeedSchema, seed.zod.ts:34, navigationContributions, app.zod.ts:886). The changeset says «Four shapes of body are now refused» and «ManifestSchema requires type and closes the manifest against unknown keys» — read as exhaustive, both are false: the whole declaration is enforced, and a second required key is newly enforced. The SDK README at head (packages/client/README.md:251-252) itself says «id, name, version and type are required». A caller refused on name greps CHANGELOG.md for it and finds nothing. Wrong (incomplete). Every other sentence in the changeset checked true, the marker's reason included.
• Required change 2 (objectui), verified independently — raw.githubusercontent.com/objectstack-ai/objectui/f8a9d0fb… answers 200 (a plain GET; the API answers 403). PackageFormDialog.tsx:193 seeds { version: '0.1.0', type: 'app' }; :256-262 builds manifestBody = { ...draft, id, name, version, type: draft.type ?? 'app' }; :266 posts { manifest: manifestBody }. package-schema.ts:28,60 derives the form from ManifestSchema via z.toJSONSchema (a curated subset, no UI-only keys reach the value); packages-io.ts:252 NAMESPACE_RE = /^[a-z][a-z0-9_]{1,19}$/ is byte-identical to the schema's (manifest.zod.ts:403) and nsOk requires it on create (:246). .objectui-sha at head is f8a9d0fb0596…. The seat's reading is correct, and holds for the «only declared keys» half it did not state. Note canSubmit (:247) does not gate on the inline ManifestSchema.safeParse issues (:233), so an off-spec draft that used to install 201 now gets the door's 400 rendered through readEnvelopeFailureText — the intended direction, not a happy-path break.
• Required change 3 — [finding] once PR #20218 lands, PackageInstallBodySchema's published docblock still says the install door answers 201 to residual classes 1b, 2, 3 and 4, which it then refuses 400 #20219 exists (open, bare, filed 2026-09-27T10:43Z, parent [finding] four residual classes the package install door still answers 201 to, measured unchanged by #19326 (triage: likely four cards) #19328) and names the four sites: the residual section of package-api.zod.ts (:383-410), the door-drives paragraph there, the enableOnInstall docblock (:245), and package-api.test.ts «the measured bare-form senders are the RESIDUAL» (~:969). Confirmed.

② Semver level

'@objectstack/runtime': minor + Clause-②: no (narrowing) + BREAKING banner + not-required (no-migration-prescription) is the correct level and carrier set for a wire accept-set narrowing in the launch window (check-changeset-no-major.mjs:47-71: breaking ships minor; the banner and the ADR-0087 disposition are the mandatory carriers). The level is right; the BREAKING carrier is materially incomplete (①): it names four refused shapes where the door now refuses everything ManifestSchema refuses, name included.

③ Boundary flags

• Merge of origin/main (f2e2c99bd, new base 4df101c38) — 93 files came in; the PR-own delta vs merge-base is the same 9 paths (+750/−51); the eight code/test files are byte-identical between the two heads except domain-handler-registry.test.ts and http-dispatcher.test.ts, which main also touched — the PR's hunks survived verbatim (offsets +15). Merge-brought packages/runtime changes are the [finding] three sibling list doors declare limit/cursor and never read them, one reporting hasMore: false as a literal — REBUILD of #19365, which stopped resolving on 2026-09-21 #19543 flow-list retirement: domains/automation.ts (the GET / listFlows branch removed), dispatcher-plugin.ts (GET /automation unmounted), route-ledger.ts (row removed), packages/client/src/index.ts (automation.list removed) plus four runtime tests. None touches the install door, PackageInstallBodySchema, ManifestSchema, registry.installPackage, protocol.installPackage, or SDK packages.install (client/src/index.ts:2635-2644 unchanged). No behaviour the pins or claims depend on moved. Since the base, origin/main (805af4f2) added 5 commits; .changeset/19328-* is not on main; no conflict.
• PR body — Clause-②: no (narrowing) is line 3, line-initial, blank line above and below, no CRLF; consistent with the changeset; Check Changeset re-ran on the edited event (11:42) → success. The quoted clause2-line.mjs phrase exists verbatim (:95). Refs only, no closing keyword; no model names in body or changeset; draft, same-repo head, not governed. False sentences: (1) Acceptance note «Nested shapes that ManifestSchema leaves in strip mode (for example a data[] seed entry)» and «The gate closes the top-level manifest keys only» — SeedSchema is strictObject (seed.zod.ts:34), as are contributes, engine, engines, navigationContributions; the gate refuses unknown keys inside them. (2) «Tests and gates (final head df0108189 …)» and «The merge brought no change to packages/runtime, the install schemas or the lockfile» — true of the first merge (e7f69dbba) only; the second merge brought packages/runtime changes (above); the dev's round-1 report records a 10-file re-run (515 passed) at 481ad07f, the body does not. The before/after table («After is … df0108189») stays true because the door code is byte-identical.
• CI on 481ad07f (check-runs API): 41 runs, 36 success, 5 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke by path filter; Auto Label and Check PR Size on the edited re-run), 0 failure, 0 in progress. All seven required contexts success: Lint & Repo Gates, TypeScript Type Check, Test Core (+6 shards), Dogfood Regression Gate (+3), Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. Both changeset gates run inside green jobs.

Implemented-by: claude/issue-19328-install-door-body-parse
Reviewed-by: session_01UYBdGBzWSrAMzpW8ah3GbP

Independence: INDEPENDENT AGENT (fed the card, the prior review, and the PR only; not the dispatch order or the seat's conclusions)

VERDICT: FAIL

• Complete the changeset's BREAKING paragraph so it states what the door enforces at head — the WHOLE ManifestSchema, not four shapes: add a FROM → TO bullet for the second required key (name: FROM { id, version, type } TO the same manifest with "name": "…"; it used to install), and one bullet for every other declared constraint now enforced (the namespace grammar, the scope enum, a declared key's type, unknown keys inside the nested strict shapes contributes / engine / engines / data[] / navigationContributions) with the remedy «send the value the declaration states; the refusal names the path»; reword «Four shapes of body are now refused» and «requires type and closes the manifest against unknown keys» so neither reads as exhaustive. Mirror the same statement in the PR body's «What changed».
• Correct the two false PR-body sentences: the acceptance note's strip-mode example (data[] is SeedSchema, a strictObject; the gate also closes the nested strict shapes, not «top-level keys only»), and the «final head df0108189» / «The merge brought no change to packages/runtime» sentences, which the second merge (f2e2c99bd, domains/automation.ts et al.) made false — record the 10-file re-run at 481ad07f there instead.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1358147bcdf8c8f31509db38223a59332d59daed

Delta of: 5855593517 (FAIL on 481ad07f)

① Derived judgments

• Required change 1, walked against ManifestSchema (packages/spec/src/kernel/manifest.zod.ts:326-927, byte-identical on origin/main and head). Required keys: id (:363, MANIFEST_ID_PATTERN), version (:428), type (:443-449: plugin + CORE_PLUGIN_TYPES seven, plugin.zod.ts:90-98, + module/gateway/adapter = the eleven the changeset lists), name (:472, z.string() with no .optional()); every other key is .optional() or defaulted (scope :463, defaultDatasource :419). Grammars: namespace ^[a-z][a-z0-9_]{1,19}$ (:403) = the changeset's «2–20 characters…»; engine.objectstack regex (:864). Closed sets: scope (:463), runtime (PluginRuntimeSchema :149, node|sandbox|worker), packaging (:165). Top-level tombstones configuration :555, capabilities :766, extensions :786, loading :823 — retiredKey() is z.never({ error }).optional() (shared/retired-key.ts), so any JSON value is refused with the prescription. Nested closed shapes: contributes (:590, strictObject) and kinds[] (:607), data[] = SeedSchema (data/seed.zod.ts, strictObject), navigationContributions[] (ui/app.zod.ts:886, strictObject) whose items are a discriminated union of strictObject/.strict() members only (:826-848), engine (:856), engines = PluginEnginesSchema (:107), structured permissions = PluginPermissionsSchema (:51) inside the union (:94-97); strictObject = z.object(shape,{error}).strict() (shared/strict-object.ts:109-110). Every shape the changeset names as closed is closed — nothing listed is strip mode. Correct.
• Nothing listed was already enforced on main. The merge-base door (805af4f29:packages/runtime/src/domains/packages.ts) parses only ManifestSchema.shape.id (:963) and .shape.version (:1017); the POST branch (:886-1050) reads no name/type/namespace/scope. Registry limb installPackage (objectql/src/registry.ts:4188+) reads manifest.name only in a log line (+136) and gates namespace conflicts (+37-50), never the grammar; protocol limb (metadata-protocol/src/protocol.ts:22752+) parses the id leg alone and derives an absent namespace. The bullet «Before, only the id and version legs were» is exactly right. Correct.
• name FROM → TO bullet (changeset :22-27): name required at :472; neither the pre-fix door nor either limb required it, so { id, version, type } installed on main and answers 400 at head; §8 rows 1–2 pin both forms. True.
• Exhaustiveness. Opener (:9-15) says «whatever the reason» and «ends with one bullet for everything else»; the catch-all uses «The constraints include:». Neither reads as exhaustive. One imprecision: «the retired manifest keys configuration, capabilities, extensions and loading» (:58-59) reads as the whole tombstone set, while contributes carries ten more (events…commands, :630-731) and kinds[].globs (:616); those are refused with their own prescriptions and fall under the «unknown keys inside … contributes» bullet, so no caller is left without a remedy. Wording only, not a required change.
• §8 pins, non-vacuity (packages-install-body-contract.test.ts:445-488, nine cases). Each case keeps the fixture's valid id/version (manifest() :36-42: com.acme.rest.of.declaration, 1.0.0), so the pre-fix door reached the install limbs, and neither limb reads name, namespace grammar, scope, description, capabilities, contributes, data[] or engines (above) → 201 before. The dev's ablation (5856093982) read 20 failed / 10 passed of 30 (it( count 21 + 9 loop cases = 30) with every §8 case «expected 201 to be 400». Controls differ by the defect alone: without(m,'name')↔m; namespace:'Acme-CRM'↔rest_of_declaration; scope:'tenant'↔'project'; description:5↔'x'; capabilities:{}↔absent; contributes:{bogus:1}↔{}; data[0] with/without bogus; engines:{bogus:1}↔{}. Each asserts declaration refusal, control green, expectRefused (:146-152), registry.getPackage(m.id) undefined, and the path in the message — installBodyRefusal (packages.ts:717-748) joins issue.path with ., so manifest.name, manifest.data.0 are named. Controls are asserted at the declaration, not driven at the door; §7 carries the door-level well-formed control. Non-vacuous, correct.
• Required change 2, PR body (edited 13:03:14Z; Check Changeset re-ran 13:04:18Z → success; Q1–Q6 present). Q1 «What changed» bullet names the same set as the changeset ✓. Q3 strip-mode note: visible = EvaluatedExpressionInputSchema (shared/expression.zod.ts:263) whose object arm is ExpressionSchema.safeExtend (:93, :166, z.object) with meta: ExpressionMetaSchema (:73, :104, z.object) — the only strip-mode objects under ManifestSchema; everything else is strict or an open z.record (SeedSchema.records, dependencies, integrity, InlineLocaleMapSchema, nav params/filters) ✓; data[] is SeedSchema strictObject ✓; «§8 pins three of these» ✓. Q4 heading ✓. Q5 merges: df0108189 (parents e2c4c7d90, e7f69dbba; 1c8b320a8..e7f69dbba touches no packages/runtime, lockfile or install schema ✓); f2e2c99bd (parents df0108189, 4df101c38; the one runtime-touching main commit is 3875ae677 = [finding] three sibling list doors declare limit/cursor and never read them, one reporting hasMore: false as a literal — REBUILD of #19365, which stopped resolving on 2026-09-21 #19543, domains/automation.ts, dispatcher-plugin.ts, route-ledger.ts, client/src/index.ts ✓ — but seven runtime test files (dispatcher-plugin.anonymous-gate.integration, domain-handler-registry, anonymous-gate-actions-automation, automation-run-read-permission-gate, automation-write-capability-gate, http-dispatcher.tenancy-posture-outage, http-dispatcher) plus test-typecheck-debt.json, not «four» ✗); dd49317f1 (parents 481ad07f3, 805af4f29; 4df101c38..805af4f29 brings no packages/runtime, no lockfile ✓). Q6: 524 = 515 + 9 ✓; 20/10 of 30 ✓. Clause-②: no (narrowing) at body line 3 ✓. One wrong count, inherited from the prior review's own «plus four runtime tests»; the load-bearing clause (the merge touches neither the door, PackageInstallBodySchema, ManifestSchema nor the install writers) is true.

② Semver level

Unchanged and still correct: '@objectstack/runtime': minor (:2), line-initial Clause-②: no (narrowing) (:7), one **BREAKING …** paragraph, exactly one adr-0087: not-required (no-migration-prescription) marker (:108, grep count 1). The delta touches no runtime code — packages.ts blob 4f6b4be7 on both heads; the PR-own delta is the changeset (+45/−8) and test-only pins (+49) — so the narrowing set is identical and the added prose only describes it completely. The marker's reason (nothing authorable removed, renamed or reshaped; the refusal carries the remedy) still holds. Check Changeset success twice on head.

③ Boundary flags

• Delta composition: 481ad07f..1358147b = merge dd49317f1 (five main commits, none in packages/runtime or the lockfile) + 1358147bc (changeset + test file). Nine PR paths, +828/−51, matching the dev's report and the files API. Not governed; draft; same-repo head; base 805af4f29 = merge-base; mergeable_state: clean against origin/main now at 615c46874.
• Body-only correction before landing: «and four runtime tests» → seven (list above). No new head needed.
• Optional wording: the tombstone sub-bullet could say the nested contributes tombstones are refused too.
• No worktree run: the shared checkout has no node_modules or dist, so §8 was judged structurally against the merge-base door and both limbs plus the dev's ablation; the green leg is CI's Test Core.
• CI on 1358147b (check-runs API): 41 runs, 36 success, 5 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke by path filter; Auto Label and Check PR Size on the 13:03 edited re-run), 0 failure, 0 in progress. All seven required contexts success: Lint & Repo Gates, TypeScript Type Check, Test Core (+6 shards), Dogfood Regression Gate (+3), Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard.
• No model identifier in the changeset or body; body footer is the session-URL form.

Implemented-by: claude/issue-19328-install-door-body-parse
Reviewed-by: session_01UYBdGBzWSrAMzpW8ah3GbP

Independence: INDEPENDENT AGENT (fed the card, the prior review, and the PR only; not the dispatch order or the seat's conclusions)

VERDICT: PASS