examples/app-multi-package: the module's "no `scope` key" property never reaches the served row — `defineStack` materialises `scope: 'project'`, so the fixture cannot separate the server `writable` verdict from the client `scope !== 'project'` heuristic it claims to

[hotlong]

Found during the post-landing verification of #14439 (PR #14513) on main 7085f9053, booting examples/app-multi-package with objectstack dev --seed-admin. Verification-only finding — nothing fixed here.

The claim the fixture makes

examples/app-multi-package/src/packages/orders/index.ts (and the README table) says the module package deliberately carries no scope key, and that this is load-bearing:

ManifestSchema.scope defaults to 'project', so a scope-less module is the row that separates the server's writability verdict from a client-side scope !== 'project' heuristic (ADR-0070 D2 / ADR-0130 Consequences row 6).

objectui#7331 (the Studio switcher fix for #14375) was motivated by the same premise: "a type: module sub-package of a multi-package artifact is served with no scope key, because the schema default is applied at parse time while the artifact load path hands the raw manifest body to registerApp".

What is actually served

The property holds in the source and nowhere after it. defineStack parses the manifest through ManifestSchema, whose scope is z.enum([...]).default('project') (packages/spec/src/kernel/manifest.zod.ts:263), so the default is written into the compiled artifact and into every served row:

• dist/objectstack.json (what os dev booted — the boot log says so): .packages[].manifest → {"id":"com.example.multi.orders","type":"module","has_scope":true,"scope":"project",…} and {"id":"com.example.multi.core","type":"app","has_scope":true,"scope":"project",…}.
• GET /api/v1/packages (row trimmed to the manifest):

{"manifest":{"id":"com.example.multi.orders","namespace":"crm","defaultDatasource":"default","version":"1.0.0","type":"module","scope":"project","name":"Multi-Package Orders","description":"The Module half of a two-package release artifact (ADR-0130 D4)","dependencies":{"com.example.multi.core":"^1.0.0"},"engines":{"protocol":"^17"}},"status":"installed","enabled":true,"writable":false}

• GET /api/v1/meta/package → same two rows, scope: "project" on both, writable: false on both.

Why it matters

The server verdict is right (writable: false on both rows — #14375/#14430 work as designed), but the fixture does not deliver the discriminating property it documents: with scope: "project" served, the pre-#7331 client heuristic scope !== 'project' also answers "read-only", so a console that ignores writable entirely renders this fixture identically to one that honours it. Measured: the vendored console at the pinned objectui d8ec8d6d (56 commits before objectui#7331) and objectui main 7dedec6f (contains #7331) show the same two "Read-only" badges on this fixture — see the verification comment on #14439. A fixture that is supposed to catch a regression to the heuristic cannot catch it.

This is Prime Directive #10's "declared ≠ delivered" shape, one layer down: the comment documents a row shape the producer never emits.

What to decide (not deciding here)

• If a genuinely scope-less served row exists on some path (an installed marketplace package whose manifest bypasses defineStack?), the fixture should exercise that path, or the claim should move to where it is true.
• Otherwise, drop the "no scope key" claim from the fixture source + README, and let feat(runtime): GET /packages 与 GET /packages/:id 每行携带服务端自己的可写判定 writable（isWritablePackage），Studio 不再用 scope 启发式反推 #14375's writable field stand on its own test (the package-list-writable-carry pin), so the docs stop promising a discriminator the artifact does not carry.

Repro: pnpm exec turbo run build --filter='./examples/app-multi-package...', then in examples/app-multi-package: ./node_modules/.bin/objectstack dev --seed-admin -p 4310 -d file:/tmp/mp/data.db; sign in as admin@objectos.ai/admin123; GET /api/v1/packages and jq '.packages[].manifest | {id, has_scope: has("scope"), scope}' dist/objectstack.json.

[huangyiirene]

Triage — sweep repair, two rounds overdue. Graded p2, added pm:queue and domain:spec; bug kept. Applied and read back first.

I deliberately did not label this in R+103 or R+104 because the anchoring rule forbids guessing a lane from a title, and examples/* routes to the subsystem it exercises — which needed the producer identified first. It is identified now.

Routing

domain:spec. The property the fixture claims is destroyed by ManifestSchema itself:

packages/spec/src/kernel/manifest.zod.ts:263
  scope: z.enum(['cloud', 'system', 'project']).default('project')

defineStack (packages/spec/src/stack.zod.ts) parses the manifest through that schema, so the default is materialised into the compiled artifact before anything downstream sees it. The subsystem this fixture exercises is the manifest/scope contract, and that is the spec lane's single-owner surface — whichever of your two options is taken, the fact that decides it lives there.

Why p2

The server verdict is right and nothing is broken for a user — that caps it below p1.

What lifts it above p3 is that the fixture cannot fail. Your measurement is the proof and it is the best part of the card: the vendored console at objectui d8ec8d6d (56 commits before objectui#7331) and objectui main 7dedec6f (containing #7331) render this fixture identically — two "Read-only" badges either way. A regression fixture that passes equally with and without the fix it guards is not a weak test, it is a false green, and it is currently cited by two cards (#14439, objectui#7331) as if it discriminated.

Scope ruled — your option order, with the investigation made a precondition

⭐ First establish whether a genuinely scope-less served row exists on any path. Your parenthetical — "an installed marketplace package whose manifest bypasses defineStack?" — is the question, and it has a determinate answer that nobody has looked up. It is not a product decision, so ⛔ this is not a needs-user-decision card.

• If such a path exists, move the claim to a fixture that exercises it. The discriminator is real and belongs where it is true.
• If it does not, drop the "no scope key" claim from examples/app-multi-package/src/packages/orders/index.ts and the README table, and let writable stand on its own pin (package-list-writable-carry). ⛔ Do not weaken ManifestSchema's default to manufacture the property — the default is correct and load-bearing.

⚠️ Either way the claim must also come off wherever else it was repeated. objectui#7331's motivating premise quotes it almost verbatim ("served with no scope key, because the schema default is applied at parse time while the artifact load path hands the raw manifest body to registerApp"). ⛔ That is a repo:objectui follow-up, not a file this card may touch — but leaving it would reproduce the same false premise in the other repo.

On the filing

"Declared ≠ delivered, one layer down: the comment documents a row shape the producer never emits" is the right frame, and the two-console comparison is what turns it from an observation into evidence. Verification-only findings that carry a repro and change nothing are exactly what post-landing verification is for.

---

Generated by Claude Code

[claude]

Claim: PM loop, domain:spec seat (seat post #6017)
Session: session_017RbbUMnxkUnWhE4j94v8FE
Branch: claude/issue-14597-multi-package-scope-claim
Worktree: objectstack-issue-14597 (dedicated, per AGENTS.md Prime Directive #11)
Domain: domain:spec (triage 5515959872: the property the fixture claims is destroyed by ManifestSchema itself — the manifest/scope contract is the spec lane's surface)
File surface: measurement first — packages/objectql/src/engine.ts registerApp(manifest, scope?) (:4927, the raw-manifest install seam) and every caller that hands it a body that did not pass defineStack (packages/metadata-protocol/src/plugin.ts:225, the artifact loader, the marketplace/install path — READ ONLY, evidence back to the seat); then the fix per triage's option order: if a genuinely scope-less served row exists on some path ⇒ move the claim to a fixture that exercises it; if not ⇒ drop the "no scope key" claim from examples/app-multi-package/src/packages/orders/index.ts (:15-18) and examples/app-multi-package/README.md (:22) and let writable stand on its own pin (package-list-writable-carry, packages/rest/src/package-routes.ts). ⛔ packages/spec/src/kernel/manifest.zod.ts:311 (scope … .default('project')) is NOT touched — triage: "do not weaken ManifestSchema's default to manufacture the property". A test pin on the fixture's served rows (both rows carry scope: 'project', writable: false) if a pin is the honest record; changeset per the gates (an examples/** + docs change is likely skip-changeset — measured, not assumed). objectui#7331's premise text is a repo:objectui follow-up card filed by the dev (⛔ not a file this card may touch). Expected landing is examples/app-multi-package/**; if measurement shows the claim is true on some producer path, the fix moves to where it is true — report the landing and reason, ⛔ no consumer-side patch.
Container & model: S (measurement + fixture/docs claim), mode:subagent, model: opus (a judgment card — whether a scope-less served row exists — not a mechanical one; triage carried no size/model suggestion). dispatch-gates --tier at 8f9ef6f7c: no path-derived mandate; clause-② SUSPECT hint only on manifest.zod.ts, which this card does not touch.
Clause-②: no — no schema shape, accept/reject behaviour or public surface changes; the manifest default stays; the deliverable is a fixture/docs claim correction with a pin (a manifest.zod.ts touch would re-open this line — the dev stops and reports instead).
Serial constraints cleared: file lists of all 36 open PRs scanned at 02:17Z — none touches examples/app-multi-package/, packages/spec/src/kernel/manifest.zod.ts, packages/spec/src/stack.zod.ts, packages/rest/src/package-routes.ts. Same-day churn: manifest.zod.ts changed by #14714 (4d0d9445a, 2026-09-02 21:14Z — strictObject, main declared; the scope default at :311 unchanged) and the fixture was created by #14513 (7085f9053) — the dev works from merged main. Lane siblings in flight: #13881 → PR #14775 (queued; platform-objects / plugin-auth / service-messaging / spec/api/auth.zod.ts / spec/automation/io-node-config.zod.ts) and #14441 → PR #14737 (governed draft; data/query.zod.ts) — file-disjoint; #14337 → PR #14735 is pm:blocked on #14648 (automation/flow.zod.ts) — disjoint. H17 on-hold trigger-file index (#9857): no entry names these paths. Dedupe: search_issues at 02:19Z — 5 hits; #14597 the only open card; #14375 (the writable field, CLOSED, cli lane), #14257 / #12690 / #10841 unrelated. Related open work read: objectui#7331 (Studio switcher, motivated by the same claim) — cross-repo follow-up, not a blocker.

Premise re-read at 8f9ef6f7c: manifest.zod.ts:311 scope: z.enum(['cloud', 'system', 'project']).default('project'); stack.zod.ts:233 parses each artifact entry's manifest through ManifestSchema (so defineStack materialises the default); orders/index.ts:15-18 and README.md:22 still carry the "no scope key" claim; engine.registerApp(manifest: any, scope?) at objectql/src/engine.ts:4927 is the raw-manifest seam the card's parenthetical asks about. The premise stands; the open question (a scope-less served row on any path) is the dev's first measurement, as triage ruled.

---

Generated by Claude Code

[claude]

Dispatch (R5 of this shift, 2026-09-03T02:15Z) — domain:spec seat, session_017RbbUMnxkUnWhE4j94v8FE, seat post #6017. mode:subagent, opus, size S, clause ② no.

Dispatch text handed to the dev, in brief (the ruling is quoted verbatim from triage 5515959872 and marked non-renegotiable):

• Measurement first: does ANY producer path serve a scope-less manifest row? H1: the only row producers are defineStack (stack.zod.ts:233 parses each artifact manifest through ManifestSchema, materialising scope: 'project') and engine.registerApp(manifest, scope?) (objectql/src/engine.ts:4927, called from metadata-protocol/src/plugin.ts:225 and the artifact loader) — trace the path to GET /api/v1/packages / GET /api/v1/meta/package (rest/src/package-routes.ts) with line numbers; H2: a marketplace / installed-package body reaching registerApp without a parse would be the "such a path exists" branch — if found, that is where the discriminating fixture belongs (report; the seat decides whether it is this card's).
• Then triage's option order: move the claim to where it is true, else drop it from examples/app-multi-package/src/packages/orders/index.ts:15-18 and README.md:22 and let writable stand on its own pin (package-list-writable-carry); H3: the honest new pin, if any, asserts the fixture's two served rows carry scope: 'project' + writable: false. ⛔ manifest.zod.ts:311 untouched (a touch re-opens clause ② — stop and report).
• objectui#7331's premise text is a repo:objectui follow-up card filed by the dev, listed in out_of_scope_findings — not a file this card touches.
• Gates: 23 commands derived by dispatch-gates --commands at 8f9ef6f7c (tree current); the dev re-derives on the actual diff. Changeset measured by the gates (skip-changeset with a reason is the likely shape for examples/** + docs).
• Same-day churn line: manifest.zod.ts by feat(spec): refuse unknown keys inside manifest: — ManifestSchema goes strict (the #8687 door one level down) #14714, the fixture by feat(cli+spec): compile a project of N packages into one packages[] artifact, with the assembled package body declared (ADR-0130 D4 producer, #14242 B) #14513 — both on the base.
• premise_still_valid: false without a PR is a legitimate delivery if a scope-less served row already exists on the fixture's own path.

---

Generated by Claude Code