docs(spec,cloud-connection): the install-mode comments say what holds — the copy is the environment's own metadata, a shipped _lock carried; the walled refusal follows 1b-1c

Comments only, per the seat's round-3 order before the second contract
review:

- packages/spec/src/kernel/manifest.zod.ts, the INSTALL_MODES TSDoc (it
  ships in the .d.ts): "editable like anything authored there" becomes the
  environment's own metadata that the next save edits, with the _lock
  exception named in one clause, as the changeset says.
- marketplace-install-local-plugin.ts, the header docblock: the same edit
  for "editable and followed by no upgrade", and the walled refusal's order
  stated as the door has it — after the payload check and steps 1b-1c, none
  of which writes, before any write. The import comment and the 1e step
  comment carried the same "before anything else about the package" claim
  and say the same now.

Claude-Session: https://claude.ai/code/session_01KNKBCRDJCu5tGy3TEbvtrF
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/cloud-connection/src/marketplace-install-local-plugin.ts

@@ -54,12 +54,15 @@
  *              naming the base, before any write.
  *            - `unmanaged`: the package's metadata is copied ONCE into a new
  *              writable base in the environment ledger
- *              (`importUnmanagedPackage`), editable and followed by no upgrade;
+ *              (`importUnmanagedPackage`): the environment's own metadata,
+ *              which the next save edits (an item shipped with an authored
+ *              `_lock` keeps that lock on the copy), followed by no upgrade;
  *              nothing is registered, ledgered or rehydrated under the
  *              package's id, and its sample data is not loaded. Refused
  *              `409 UNMANAGED_INSTALL_WALLED_POSTURE` on a deployment whose
- *              REQUESTED tenancy posture walls organizations, before anything
- *              else about the package is judged.
+ *              REQUESTED tenancy posture walls organizations: after the
+ *              payload check and steps 1b–1c (package id, protocol
+ *              handshake; none of them writes), before any write.
  *          A mode the package's `installModes` does not permit answers
  *          `422 INSTALL_MODE_NOT_PERMITTED`, before any write.
  *
@@ -170,8 +173,8 @@ import type {
 } from '@objectstack/metadata-protocol';
 // [ADR-0131 D6] The `unmanaged` install mode's two shared judgements, imported
 // from their producer rather than restated: the walled-posture refusal the
-// import verb raises (answered here before anything else about the package is
-// judged), the read-only-package rule (a namespace held by a WRITABLE base is
+// import verb raises (answered here after the payload, id and handshake checks,
+// before any write), the read-only-package rule (a namespace held by a WRITABLE base is
 // this environment's own metadata), and the client-facing sentence rule.
 import { unmanagedInstallPostureRefusal, isWritablePackage, clientFacingFailureText } from '@objectstack/metadata-protocol';
 import { resolveThrownHttpError } from '@objectstack/types';
@@ -1275,8 +1278,9 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
             }, refusal.status);
         }
 
-        // 1e. [ADR-0131 D6] ⭐ THE INSTALL MODE — before anything else about the
-        //     package is judged, because nothing an author changes in the
+        // 1e. [ADR-0131 D6] ⭐ THE INSTALL MODE — after the payload, id and
+        //     handshake checks and before every other judgement of the package
+        //     and any write, because nothing an author changes in the
         //     package answers either refusal:
         //       - the package must PERMIT the requested mode: its manifest's
         //         `installModes`, parsed by reference

packages/spec/src/kernel/manifest.zod.ts

@@ -406,8 +406,10 @@ export function manifestIdRefusal(key: string, input: unknown): string {
  *    it (an environment overlay, disable + clone, extend).
  *  - `unmanaged`: every metadata item is copied ONCE into the environment
  *    ledger, under a new writable base whose id differs from the package's.
- *    From then on it is the environment's own metadata — editable like
- *    anything authored there — and it follows no upgrade. A deployment whose
+ *    From then on it is the environment's own metadata and the next save
+ *    edits it, except that an item shipped with an authored protection lock
+ *    (`_lock`) keeps that lock on the copy (an open question on #15213); it
+ *    follows no upgrade. A deployment whose
  *    tenancy posture walls organizations (`group`, `isolated`) refuses it,
  *    whatever the package permits.
  *