feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213

Ruled: 6108509158 · letter B · 2026-10-11T11:24Z

Blocked-by: objectstack-ai/objectui#12288

⛔ BLOCKED — the v18 development line is not open. (gate closed 2026-10-07; unlocked by triage 6107810285)

Both former Blocked-by: targets, #15193 and #15206, are closed (triage unlocked this card in 6107810285). Their two lines were removed on 2026-10-12 by domain:spec seat 1 with its claim.

_{History: this line read Blocked-by: #15193, #15206 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).}

Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say. Ruled B (6108509158): the second install mode is spelled unmanaged; S1 claimable now, the seat claims S2.

In one sentence. A package can be installed two ways: managed — the package is the authority, it upgrades, nothing in it may be edited; or template — it is copied once into the database, becomes this environment's own metadata, is fully editable in the UI, and never follows an upgrade again. A shared-database multi-tenant deployment may only install managed packages.

Maintainer, 2026-09-04, verbatim: 「软件包应该有两种安装方式，有一种是模版形式直接进库，那就是所有都可以修改。但是单库多租户禁止安装这种模版软件包；有一种是受管软件包，什么都以软件包中的为准，就是不让改。」

Scope. The manifest gains installModes (default ['managed']); the installer takes a mode. Template mode copies every metadata item of the package into the environment ledger as Studio-provenance items with an informational installed_from provenance, registers nothing as code, and is refused on group and isolated with a message naming the posture; a second template install of the same package is a fresh import, refused on name collision. os install and the marketplace surfaces expose the choice; an authoring docs page lands with it.

Acceptance. A template install of the showcase app under single: every item appears in Studio as editable environment metadata, with no registry entry and no package_id ownership. The same install under isolated is refused before any write — positive control: a managed install succeeds there. Upgrading the package does not touch template-installed items.

Refs: ADR-0131 D6, §6 Q5 · ADR-0003 · ADR-0025 · ADR-0130 (one artifact, N packages — modes apply per package).