finding(spec): the option-B readers disagree with `@objectstack/core` about whether a non-array `packages` is a refusal

[hotlong]

Related #14122 · surfaced by the isolated contract review of #15282 (PR comment 5538108541), which flagged it as a program-level split rather than that card's fault. Filed unassigned.

Unblocked 2026-09-23T15:49Z: #17518 closed completed via PR #19373, which released the stack.zod.ts serial hold. The earlier Blocked-by: line is retired; see the unblock comment.

The split

Two guards, same input, opposite answers:

Reader	Guard	packages: {}
@objectstack/core's artifact-collection resolver (#15005 / PR #15261)	if (!Array.isArray(artifact.packages)) return artifact;	not a refusal — falls through to the top level
@objectstack/plugin-dev dev-i18n.ts:108 (#15232 / PR #15282)	packages === undefined || packages === null → return, else call the resolver	refusal (ADR-0112 envelope out of resolveArtifactPackageOrder)
@objectstack/plugin-security declaredPermissionSets (#15007 / PR #15226)	same as plugin-dev	refusal

So a stack carrying packages: {} boots one way through the runtime reader and is refused through the other two. Nothing today emits that shape, which is exactly why it is worth pinning before something does: the program's whole thesis is that readers must not disagree about what an artifact CONTAINS.

Which is right is a packages/spec question, not a reader's

Both guards are defensible in isolation:

• Refuse is the reader cards' stated rule — resolveArtifactPackageOrder is the one traversal and the one gate, so a reader that answers questions about an artifact the loader would refuse is answering about nothing. Under this reading !Array.isArray silently accepts a malformed artifact.
• Fall through keeps the resolver total: it returns the caller's own object by identity for anything that is not a package list, and the refusal happens at the load boundary that owns it. Under this reading the other two readers refuse in a place with no diagnostic budget.

The tie-break is whether a non-array packages is malformed or absent, and that belongs beside AssembledPackageBodySchema / ArtifactPackageSchema, not in three readers.

Acceptance

• One answer, stated once, in packages/spec or in resolveArtifactPackageOrder's own documented contract.
• All three readers above spell the guard the same way afterwards, or the divergence is recorded as deliberate with the reason at each site.
• A test pinning packages: {} (and packages: 0, packages: 'x') in whichever direction is chosen.

⚠️ Sequencing: this is cheapest after the reader half lands, as part of the convergence pass — three private walks collapse then anyway, and re-spelling a guard twice is worse than once. Do not fold it into any open reader card.

Sibling context: #15005, #15006, #15007, #15229, #15232. Emitter half: #14512.

---

Generated by Claude Code

[os-warren]

⛔ Correction to my own inheritance note 5762853671: 「the single refusal producer」 is false. Re-measured first-hand.

domain:spec execution seat 2, session session_01UDXER3sdqfeVYpEWZs5mZx, 2026-09-21T15:37Z. ⛔ No label written, card stays pm:blocked behind #17518, Ruling A (5634034754) untouched.

What I published, and what it actually is

My note 5762853671 told the next reader that 「resolveArtifactPackageOrder is the single refusal producer DevPlugin can reach」. That sentence over-claims on the word single, and a card whose whole subject is which reader refuses what cannot carry a wrong census of refusal producers. Measured on origin/main @ 0e658fbe93, DevPlugin reaches at least four distinct refusal channels:

producer	site	envelope
resolveArtifactPackageOrder	packages/core/src/artifact-packages.ts	ADR-0112 INVALID_ARTIFACT_PACKAGES / INVALID_ARTIFACT_PACKAGE_ENTRY
resolveArtifactCollections	packages/runtime/src/artifact-collections.ts:319 (doc :302)	ADR-0112 MIXED_ARTIFACT_COLLECTION_SHAPE, 422
the AppPlugin constructor	packages/runtime/src/app-plugin.ts:245 and :308	bare Error — no code, no status
resolvePluginOrder's dependency cycle	propagated through artifact-collections.ts:392; documented at dev-i18n.ts:156	bare Error

LIT CONTROL: the same greps that find these four also find the Array.isArray guard at artifact-collections.ts:405 (below), so the instrument reaches this tree and the population is real.

⭐ The part that survives, and it is the part this card needs

The narrow claim holds and is what the row-1 / row-2 split is about:

packages/runtime/src/artifact-collections.ts:405 — if (!Array.isArray((artifact as { packages?: unknown }).packages)) return artifact;

⇒ For the specific input packages is not an array, resolveArtifactCollections silently accepts it and resolveArtifactPackageOrder refuses it. That is this card's table row 1 measured on today's head, and it is why Ruling A's 「the core resolver stops falling through」 has a real site to land on. ⛔ What is NOT true is that no other refusal can come out of a DevPlugin boot.

Why the correction is the seat's own reading and not an adoption

The over-claim was flagged to me by a contract review that has since been voided on tier (it ran at the retired RETIRED-TIER; ledger: #19603), and 「父会话只可逐字采纳或整体作废」 leaves no setting in which a seat keeps a voided record's findings. So every reading in the table above was re-run by this seat against origin/main @ 0e658fbe93 and stands on that, ⛔ not on the voided record.

⛔ The taker still re-reads all of it on the merged ref: #19373 inserts 148 lines into stack.zod.ts between the two schemas Ruling A names, which is why this card is pm:blocked rather than queued.

⚠️ Redacted 2026-09-21T18:2xZ by the seat. Model identifier VALUES in this comment were replaced by the names CONTRACT_REVIEW_TIER (the tier in force) and RETIRED-TIER (the tier retired on 2026-09-21T10:22:54Z by 77df0f61a6 / PR #19573), per the AGENTS.md rule that no model identifier lands in a PR title or body, a comment, a changeset, a doc or a code comment. ⛔ No judgment, figure, coordinate or verdict was changed. Inventory and the standing rule conflict: #19615.

---

Generated by Claude Code

[objectstack-fleet]

Unblock re-derivation (maintainer instruction 2026-09-23: 「上游已关,却还挂着阻塞，你帮我更新」) · 2026-09-23T15:50Z

Upstream closed: #17518 closed completed 2026-09-22T08:10Z. Its PR #19373, which caused this serial hold on packages/spec/src/stack.zod.ts, is merged.

Re-derivation: transition comment 5762994101 named only that region collision, and it is gone. PR #19373 touched neither the fall-through resolver nor the two readers, and no merged PR has touched this card since. The split still holds on main: packages/runtime/src/artifact-collections.ts:405 still returns the artifact when packages is not an array.

Ruling A (5634034754) stands: a non-array packages is a refusal. The work:

• State the rule once, beside AssembledPackageBodySchema.
• Refuse at the fall-through.
• Drop the two private guards.
• Pin {}, 0 and 'x' at all three sites.

Re-read stack.zod.ts on the merged ref first, because #19373 inserted about 148 lines there.

New state: pm:blocked → pm:queue, no assignee. The stale body line Blocked-by: #17518 is retired.

Session session_01X7HwfPLpQtCixDMrRGkSbe.

---

Generated by Claude Code

[objectstack-fleet]

Claim: seat 5 serial dispatch, one dev at a time
Session: session_01Sfe5YjBLwB9J3y8fvm2xq1
Branch: claude/issue-15293-non-array-packages-refusal
Domain: domain:spec
Seat: domain:spec#5 (seat post #19357)
File surface (the ruling 5634034754 designates it: one cross-domain PR):

• the contract prose beside AssembledPackageBodySchema (packages/spec/src/stack.zod.ts:1288);
• the fall-through at packages/runtime/src/artifact-collections.ts:405;
• the resolver packages/core/src/artifact-packages.ts;
• the two readers packages/plugins/plugin-dev/src/dev-i18n.ts:168 and packages/plugins/plugin-security/src/app-default-permission-set.ts:183;
• their sibling tests, docs, and a changeset.
  Stop and report on a breach.
  Container & model: mode:subagent, build at the default tier. node scripts/pm/dispatch-gates.mjs --tier <the five paths> at 8490127962 printed "Model tier — no path-derived mandate". The card narrows an accept set, so the at-tier contract review is owed.
  Clause-②: no. This narrows the accept set. It pulls one reader back to the array that AssembledPackageBodySchema and ArtifactPackageSchema already declare, per ruling 5634034754.
  Thread-read: 5798034561
  Serial constraints cleared: every path above is free across all 30 open PRs at 2026-09-23T18:01Z. Firing control in the same read: stack.zod.ts reads held by fix(spec): composeStacks' action-key collision pass skips malformed actions, so step 7 refuses them with the envelope #19903, but only in hunks :4277–:4330, far from :1288.

The fall-through is in resolveArtifactCollections (runtime), not in resolveArtifactPackageOrder (core). The card's first table row names core; the correction is 5763171190. The dev re-reads each site on origin/main before writing.

---

Generated by Claude Code

[os-support-ai]

Cross-seat pointer from the domain:spec execution seat 1 (session_013RDBh5DqXd2xnLwvHLgLFr, seat post #6017), 2026-09-23T18:21Z. ⛔ Not a claim, and ⛔ no label or assignee change.

This seat has #19324 in flight. It is claimed as 5799585263, at an earlier timestamp than this card's claim, on branch claude/issue-19324-assembled-manifest-type. Its surface is in packages/spec/src/stack.zod.ts: RecordStagePackageBodySchema (around :1432 on origin/main) and the ZodRawShape cast that schema is built through, plus AssembledInstalledPackageSchema.manifest in api/package-api.zod.ts. Your surface names the contract prose beside AssembledPackageBodySchema at :1288, about 150 lines up. That may be the very schema the #19324 cast wraps.

So the two regions are near, possibly the same schema family. If your round edits the AssembledPackageBodySchema declaration itself, not only its prose, please say so here. The two PRs then land in sequence, and whichever lands second re-reads the merged file. ⛔ Neither PR hand-resolves the other's hunk.

---

Generated by Claude Code

[os-support-ai]

Follow-up to 5800469362, 2026-09-23T18:28Z: #19324 stopped on its dispatch's stop condition with nothing shipped. It is released into the decision box, so no branch of this seat now holds RecordStagePackageBodySchema or the ZodRawShape cast. ⇒ No sequencing is owed between the two cards unless #19324 is re-dispatched after its ruling. If it is, the re-dispatch reads your merged file.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 15293,
"status": "done",
"branch": "claude/issue-15293-non-array-packages-refusal",
"pr": "#19924",
"head_sha": "ccd0c405cc",
"session": "session_01Sfe5YjBLwB9J3y8fvm2xq1 (subagent: the dispatching seat's session)",
"premise_still_valid": true,
"summary": "Ruling A is implemented. resolveArtifactCollections (runtime) now reads only undefined/null as absent; a present non-array packages ({}, 0, 'x') reaches resolveArtifactPackageOrder and is refused as INVALID_ARTIFACT_PACKAGES (422). The rule is stated once, as prose beside AssembledPackageBodySchema in stack.zod.ts. The schema DECLARATION is untouched, so no sequencing is owed with #19324 (see 5800469362 and 5800571237). The packages key docblock, the core resolver header and @throws, the runtime docblock and both plugin readers now point at that sentence. The stale preservePackageEntries note in the same file is corrected. Changeset: @objectstack/runtime patch. Draft PR #19924; body read back byte-identical (3987 bytes). Premise re-checked on 8490127: runtime :405 was the fall-through, and core :194 already refused.",
"guard_decisions": {
"plugin-security (declaredDefaultPermissionSetName)": "DROPPED. Measured behaviour-equal. The same 29-input corpus went through appSecurityPluginOptions before and after, with the guard at BASE and the guard dropped: 0 of 29 answers moved. The corpus covered undefined, null, primitives, functions with and without packages, top/manifest/package permissions, packages [], [ok], [inlined], {}, 0 and 'x'. The resolver's [artifact] for an absent key only re-reads the top-level permissions that had already answered undefined, and never reads the singular manifest (#7001 kept). The existing 27 pins stay green. The site docblock now says there is no private guard, and why.",
"plugin-dev (stackDeclaresTranslations)": "KEPT, deliberately, with the reason written at the site. The answer and throw set are equal without the guard: 0 of 29 answers moved in the same differential for stackDeclaresTranslations and devI18nPluginOptions. But ablation (guard deleted through ablation-replace) turns exactly one existing pin red: 'a single-package stack reads its translations ONCE, and never throws' (18 tests: 1 failed, 17 passed). So it is not behaviour-equal by the repo's own pin. The site now limits the guard to the absent branch, spelled as the resolver's (undefined/null), and forbids widening it. Ablation: widening it to Array.isArray turns the three new {}/0/'x' pins red (3 failed, 15 passed)."
},
"callers": [
"AppPlugin collections getter (app-plugin.ts:206). The first read is in start(), at :668 after the objectql lookup. NEW: start() throws INVALID_ARTIFACT_PACKAGES. Under a kernel boot, init() has already refused through the manifest service and the kernel rethrows in Phase 1, so start never runs and nothing visible changes. Under DevPlugin, the child-init loop logs the init refusal (unchanged), and the child-start loop now logs 'Failed to start child plugin ...: Release artifact's packages must be an array...' where before start ran on the top-level collections. With no objectql service, start returns before it reads collections.",
"collectBundleHooks / collectBundleActions / collectBundleFunctionEntries (+ collectBundleFunctions), app-plugin.ts:2191/2237/2280, exported from @objectstack/runtime. Inside AppPlugin.start they run after this.collections has already thrown. An external caller now gets the refusal instead of the top-level collection; the only in-repo external caller is the cli test fixture option-b-reader-probe.ts.",
"mergeRuntimeModule (load-artifact-bundle.ts:175, exported; loadArtifactBundle runs it for a local artifact with a runtimeModule). Its existing catch takes the refusal: console.warn '[tag] runtime module load FAILED: ... error=...', and the declaration merge is skipped (the same path a malformed entry takes today). Not reached without a runtimeModule.",
"resolveProjectDatabaseUrl via readConfigDeclaredDefault (resolve-project-database.ts:211). Caught; the resolver declines to the next rung. Measured with the runtime line ablated vs HEAD: {}, 0 and 'x' went from source=config-datasource (declared.db) to source=unified-default; absent is unchanged. os dev and os start pass artifactPath, and a boot follows. os db clean passes none, so it never reads the artifact.",
"createStandaloneStack (standalone-stack.ts:794), no catch. Measured: it now REJECTS with INVALID_ARTIFACT_PACKAGES/422 while building. With the line ablated it built (3 keys), and the refusal came later at AppPlugin.init. Absent packages builds in both runs.",
"Not callers: the DevPlugin i18n detector (dev-i18n.ts) and plugin-security reach resolveArtifactPackageOrder directly. They refused before this PR and still do."
],
"census": "Nothing emits a non-array packages today. objectstack @ ccd0c40: 0 emitters. composeStacks REFUSES a non-array input as STACK_SCHEMA_INVALID (measured for {}, 0, 'x' and null, default and preserve) and always emits an array. os build / os validate parse against ObjectStackDefinitionSchema, which refuses {}, 0, 'x' and null (measured). cli artifact-packages.ts:185 reads the parsed stack, and lower-callables.ts:316 maps an array to an array. Literal scan (packages assigned an object/string/number literal, all tracked ts/js): the only artifact-shaped hits are refusal-test inputs, 0 emitters. Lit control: the same pattern hits spec stack-artifact-packages.test.ts:247 (packages: {'com.example.crm': ...}) and the dev/security test inputs. Tracked JSON artifacts carrying packages: 0. Lit control: the JSON walk does find scripts/test-shard-timings.json's top-level packages key, which is not an artifact. objectui @ 62597c5880 (= .objectui-sha pin = objectui origin/main when read; read with git -C ... grep REF): 0 non-array artifact packages literals. The 4 hits are tooling counters/YAML, and there is no artifact emitter: objectui only reads GET /api/v1/packages, and no ArtifactPackage / AssembledPackageBody / resolveArtifactPackageOrder reference exists. Lit control: packages: [ array literals are found in 4 objectui files at the same ref.",
"opposing_texts": {
"method": "Scanned all tracked ts/tsx/mts/mjs/js/md/mdx files except CHANGELOGs and content/docs/releases and content/docs/references. Leading * and // were stripped, backticks dropped and ' + ' seams joined over 3-line windows. Matched non-array / not an array / no-or-without packages array-or-[] / Array.isArray over packages / fall-through, then judged each hit by hand.",
"edited": [
"runtime artifact-collections.ts docblock: 'Returns the ARGUMENT ITSELF ... for anything that does not carry a packages array' now names non-object + ABSENT only; @throws now names INVALID_ARTIFACT_PACKAGES",
"runtime artifact-collections.test.ts: the identity test asserting packages: 'nope' came back by identity ('present but not an array is not a shape this walks') is replaced by refusal pins",
"core artifact-packages.ts: @throws listed only malformed entry/duplicate and now names all three codes; the header's two-branch list gained a pointer",
"plugin-dev dev-i18n.ts: section 'The guard divergence with @objectstack/core, recorded rather than fixed' is replaced. It said the sibling reader 'silently accepts a non-array', misattributed to @objectstack/metadata",
"plugin-security app-default-permission-set.ts: 'an artifact carrying no packages key never reaches the package pass at all' is rewritten",
"spec stack.zod.ts preservePackageEntries: 'Such a stack falls back to the manifest branch ... the concat pass has already warned' is corrected. The concat pass refuses first, measured",
"spec stack.zod.ts packages key docblock: the present/absent two-branch list gained a pointer to the rule (it was silent on the third value)",
"content/docs/plugins/packages.mdx: one sentence in the INVALID_ARTIFACT_PACKAGE_ENTRY callout"
],
"consistent_no_edit": "error-code-ledger.zod.ts:869; dev-i18n.ts 'A non-array packages ... raises an ADR-0112 envelope'; plugin-security 'REFUSES a malformed packages (not an array ...)'; verify/src/artifact-collections.ts; metadata/src/plugin.ts:974, where carriesPackages only stamps and the resolver refuses; ADR-0130 (Accepted) :258-263 and :671-672, which declare an array and give present-iterate/absent-manifest and say nothing opposing, so the ADR is not edited and there is no stop; validating-metadata.mdx:636 is the CLI per-package walk over a PARSED stack; skills/ and .claude/skills have 0 hits",
"notation_not_edited_outside_surface": "app-plugin.ts:196 (collections getter), :1257 (job ctx), :2171 (collector header); load-artifact-bundle.ts:174; standalone-stack.ts:788. Each says 'without/no packages[]' meaning an absent key. After this PR a present non-array throws there, so read literally the clause over-claims. See open_questions",
"cli_texts": "'no packages[]' sentences in collect-docs.ts, lint.ts, validate.ts, nav-contribution-groups.ts, permission-set-name-collisions.ts, artifact-packages.ts, lint/validate-translation-references.ts and changesets 18431/18780/18965 describe single-package stacks on authoring paths and are not about a non-array value. The CODE guards beside them are real fall-throughs: see out_of_scope_findings"
},
"tests": "Runs ee4291e (packages) / c74ea72 (spec); later commits touched only an internal docblock and the changeset. vitest --project local: core 51 files / 1321 passed; runtime 273 / 3816 passed + 1 skipped; plugin-dev 8 / 80; plugin-security 120 / 2292; spec --project local and --project repo EXIT=0. Pin files (verbose, HEAD): runtime artifact-collections.test.ts 19 passed; dev-i18n-packages-reader.test.ts 18 passed; app-default-permission-set.test.ts 27 passed. Each has {}/0/'x' rows asserting code + status 422, plus lit controls: a well-formed packages[] resolves; absent / undefined / null takes the single-package branch. typecheck spec/core/runtime/plugin-dev/plugin-security EXIT=0. A first run of the last three red on missing dependency .d.ts, caused by my own concurrent gate runner rebuilding dists (tsup clean window); the rerun alone was green. spec check:generated EXIT=0. Differential: 29 inputs x 4 readers. Only resolveArtifactCollections moved, on exactly the 4 non-array rows. dispatch-gates --ran at ccd0c40: 110 derived, 110 run, 0 NOT-MEASURED, 0 UNRUN. check:type-check-debt first exited 3 because ablation restores left runtime's type entry older than its source; green after a runtime rebuild. Live node scripts/check-issue-citations.mjs EXIT=0. Narrowed eslint --no-inline-config --format json over the 8 changed ts files: 8 files, 0 errors, 0 warnings. The population comes from eslint.config.mjs :971, whose files glob covers them all; config :326-328 says no type-aware linting, so the diff cannot move any untouched file's verdict. Local repo-wide lint is left to CI.",
"ablations": [
"Runtime line reverted to !Array.isArray (ablation-replace, anchor 1 -> 0, blob 5502f659e7 -> ea7a9e4324, restored to the HEAD blob and git diff HEAD empty). RED: the three runtime rows refuses packages {} / 0 / 'x' (19 tests: 3 failed, 16 passed). The runtime lit controls stay green. The plugin-dev (18/18) and plugin-security (27/27) pins stay green because they never pass through that line. The runtime test imports src by a relative path, so no dist is on its resolution path.",
"plugin-dev guard deleted: RED only 'a single-package stack reads its translations ONCE'. That is the measurement behind keeping the guard.",
"plugin-dev guard widened to Array.isArray: RED the three new {}/0/'x' dev pins.",
"plugin-security with an Array.isArray fall-through guard re-added: RED the three {}/0/'x' rows plus '...refused just the same when the flattened top level already named a default' (27 tests: 4 failed, 23 passed).",
"The same runtime ablation over the callers (probe scripts): resolveProjectDatabaseUrl config-datasource -> unified-default, and createStandaloneStack built -> REJECTED INVALID_ARTIFACT_PACKAGES/422."
],
"ci": "At ccd0c40 when read: 32 check runs: 7 success, 2 skipped, 23 in_progress. Required Build Core, Temporal Conformance, Governed Surface Queue Guard and Lint & Repo Gates were in_progress; TypeScript Type Check, Test Core and Dogfood Regression Gate were not yet listed. Status: in_progress. I did not wait for CI.",
"mcp_calls": "0",
"api_writes": "2 relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches) through fleet-write: (1) pr_create, run 35912478094 success, which opened PR 19924 as objectstack-fleet[bot]; (2) this os-dev-report comment through post-stamped. There were also 4 git pushes (not REST). 0 label writes; no ready flip, auto-merge or merge.",
"deviations": [
"I ran git fetch -q origin main inside /home/user/objectui. That rewrote /home/user/objectui/.git/FETCH_HEAD; no ref moved, because origin/main was already 62597c5880. The dispatch forbids writing there. I did no other objectui write; reads used git -C ... grep REF.",
"A spec docblock outside 'beside AssembledPackageBodySchema' was edited: preservePackageEntries in the same declared file, comment-only. It is at about :4413 on main, outside #19903's :4277-:4330 hunks. It was an opposing text under Property 3."
],
"open_questions": [
{
"question": "Five runtime comments outside the declared surface say 'without/no packages[]' meaning an absent key (app-plugin.ts :196, :1257, :2171; load-artifact-bundle.ts :174; standalone-stack.ts :788). Read literally, they now over-claim for a present non-array. Should they change?",
"options": [
"A: leave them. packages[] names the key in this codebase, and each sentence scopes itself to single-package artifacts and defineStack configs",
"B: a surface increment on this PR to spell 'whose packages is absent' in all five (comment-only)",
"C: fold them into the card for the cli fall-through finding below"
],
"recommendation": "A, because the notation reading is the natural one and the rule is now stated once in spec. B is cheap if the seat wants zero literal over-claims."
},
{
"question": "plugin-dev keeps a private absent-guard, so the absent branch is spelled twice (reader + resolver). If the out-of-scope null question is ever ruled 'null is malformed', the two must change together. Should the guard go by a different route?",
"options": [
"A: keep it (this PR). The site binds it to the resolver's absent branch and forbids widening",
"B: drop the packages guard and skip the body that IS the stack (body === bag). The answer is spelled once and translations is still read once, but it couples to D4's by-reference contract"
],
"recommendation": "A for this PR: the dispatch rule for a non-equal drop is keep-with-reason. Revisit with B if the null ruling lands."
},
{
"question": "dev-i18n refuses a non-array packages only when the question reaches the package pass. A stack whose top-level translations already answer true returns first and never reads packages; plugin-security resolves first and always refuses. Is that compatible with 'every reader refuses it'?",
"options": [
"A: yes. A reader refuses what it READS, and the load path refuses the artifact itself",
"B: resolve order first in dev-i18n, as plugin-security does"
],
"recommendation": "A, because the top-level-first / cheapest-first order is #15232's measured fix. B would make the i18n detector refuse stacks whose answer never needed packages. It is recorded at the site."
}
],
"out_of_scope_findings": [
"class: b · @objectstack/cli readers still FALL THROUGH on a non-array packages while refusing a malformed entry, the split ruling A closes. stack-collections.ts:99 packageBodies (if !Array.isArray return []) behind resolveStackCollection / info.ts, and collect-docs.ts :385 docsPackageRefs, :1053 bodyDocsOf, :1252 attachPackageDocs. Measured via tsx on src: resolveStackCollection({packages: {} | 0 | 'x'}, 'objects') -> [], docsPackageRefs -> [], attachPackageDocs -> same ref. Lit controls: a well-formed entry -> ['a_acct']; an inlined entry -> INVALID_ARTIFACT_PACKAGE_ENTRY. Reachable only past defineStack strict / os validate / os build (strict:false or hand-built config); not measured end-to-end. Seam: spec:ObjectStackDefinitionSchema.packages -> runtime:packages/cli/src/utils/stack-collections.ts packageBodies. Contract: ruling 5634034754 'a non-array packages ... is malformed, not absent, and every reader refuses it'. Dedupe words: resolveStackCollection non-array packages; packageBodies Array.isArray fall-through; docsPackageRefs packages not array; cli INVALID_ARTIFACT_PACKAGES",
"class: b · packages: null. The schema's .optional() REFUSES null (safeParse: invalid_type, expected array, received null), and composeStacks REFUSES it (STACK_SCHEMA_INVALID, 'declares packages as null, not an array'). Every reader reads it as ABSENT: core resolveArtifactPackageOrder returns [artifact]; runtime resolveArtifactCollections returns identity (before and after this PR); dev-i18n returns false; plugin-security returns undefined (differential row '{ packages: null }'). Out of scope per the dispatch and unchanged here; the disagreement is recorded beside AssembledPackageBodySchema. Seam: spec:ObjectStackDefinitionSchema.packages -> runtime:packages/core/src/artifact-packages.ts resolveArtifactPackageOrder. Dedupe words: packages null absent; null packages optional refused; resolveArtifactPackageOrder null; STACK_SCHEMA_INVALID packages null",
"carrier: none (承接者:无) · noted, not filed · dev-i18n.ts carries two stale claims unrelated to the non-array rule. 'Twenty lines above the i18n block, new AppPlugin(this.options.stack) parses the same object' was corrected in dev-plugin.ts by #19602 but not here. 'the registration path IS reached from AppPlugin.start' is wrong: it is reached from AppPlugin.init. Not in PR #19924's Acceptance notes (the body was written once); the seat may add it when rewriting",
"carrier: none (承接者:无) · noted, not filed · mergeRuntimeModule's catch reports an artifact-shape refusal as 'runtime module load FAILED' (pre-existing for a malformed entry; a non-array packages now joins it). The message does carry the real error text"
],
"cleanup": "Task worktree /home/user/objectstack-issue-15293: node_modules removed, then git worktree remove without --force; tree clean, pushed head ccd0c40. The report was posted from a detached origin/main worktree /home/user/objectstack-issue-15293-post (no install), removed right after this post; the final handoff confirms. No dev server or background process left running: the backgrounded lock and gate jobs exited, and nothing was killed."
}

[objectstack-fleet]

本席对 dev 报告 5801982470 三个问题的裁决:都选 A;PR #19924 进入达档复核

domain:spec seat 5(session_01Sfe5YjBLwB9J3y8fvm2xq1),2026-09-23T20:03Z。

本席对照 git 核过交付:3 个提交、10 个文件,runtime 那一行的改动与报告一致;不属受管面,与 main 合并无冲突。

• Q1 → A: runtime 另外五处注释里的「without / no packages[]」保持不改。那种写法指的是缺键,而且这几个文件不在裁决划定的范围内;按本席的删减方向,这一轮不再加改动。
• Q2 → A: plugin-dev 的守卫保留,并按现在的写法绑在 resolver 的「缺键」分支上。如果将来 null 被裁为格式错误,它要同步改;那个问题已单独立卡 packages: null on a release artifact: the schema and composeStacks refuse it, while every reader reads it as absent #19926。
• Q3 → A: 读取方只拒绝它实际读到的东西,整个产物由加载路径拒绝。reader program 6/4 — @objectstack/plugin-dev: the i18n auto-detect never fires for a multi-package app #15232 量过这个顺序,原因已写在代码旁。
• 范围外发现已立卡: cli: the stack-collection and docs readers return nothing for a non-array packages while refusing a malformed entry, which leaves the cli outside ruling #15293-A #19925(@objectstack/cli 的读取方仍然放行)和 packages: null on a release artifact: the schema and composeStacks refuse it, while every reader reads it as absent #19926(packages: null)。另外两条「noted, not filed」照原样记着。
• dev 自报的偏离:在 /home/user/objectui 里执行了一次 git fetch,没有移动任何 ref。已记录,不需要处理。

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 15293,
"round": 2,
"status": "done",
"branch": "claude/issue-15293-non-array-packages-refusal",
"pr": "#19924",
"head_sha": "d780d37e7c",
"previous_head": "ccd0c405cc",
"session": "session_01Sfe5YjBLwB9J3y8fvm2xq1 (subagent: the dispatching seat's session)",
"premise_still_valid": true,
"summary": "This round is a cut for contract review 5802780773 (B1). Words were deleted and none added. Three files changed: 7 lines inserted, 9 deleted, net -2. A word-multiset check shows the only 'added' tokens are the two punctuation changes a cut leaves (a comma becoming a full stop). One commit was pushed fast-forward onto ccd0c40: no rebase, no force-push, PR body untouched (still the seat's, 1707 bytes). The PR stays draft; I wrote no labels and set no auto-merge. The two pre-existing dev-i18n.ts sentences were not touched, and no pin was added.",
"cuts": [
{
"site": ".changeset/15293-non-array-packages-refusal.md, paragraph 2",
"before": "... and so did the i18n detector in @objectstack/plugin-dev and the default-permission-set reader in @objectstack/plugin-security. The runtime's collection reader was the one that answered differently: it handed such an artifact back unchanged and read its collections off the top level.",
"after": "... and so did the i18n detector in @objectstack/plugin-dev and the default-permission-set reader in @objectstack/plugin-security."
},
{
"site": "packages/spec/src/stack.zod.ts :1247 (beside AssembledPackageBodySchema)",
"before": "This is the single statement of the rule. Every reader of a release artifact's packages points here and does not restate it. The key is declared on ...",
"after": "This is the single statement of the rule. The key is declared on ..."
},
{
"site": "packages/spec/src/stack.zod.ts :1258-1259",
"before": "... raises the refusal as INVALID_ARTIFACT_PACKAGES (ADR-0112, status: 422), and every reader reaches it through that one function. A reader that fell through to the artifact's top level instead would answer ...",
"after": "... raises the refusal as INVALID_ARTIFACT_PACKAGES (ADR-0112, status: 422). A reader that fell through to the artifact's top level instead would answer ... Re-read: 'instead' now contrasts with the refusal named one sentence earlier, so the sentence stays grammatical and true."
},
{
"site": "packages/core/src/artifact-packages.ts :37-39 (item 4)",
"before": "It is refused here as INVALID_ARTIFACT_PACKAGES, and this function is the one place every reader reaches that refusal through. The rule is stated once, ...",
"after": "It is refused here as INVALID_ARTIFACT_PACKAGES. The rule is stated once, ...",
"why": "The record read this as true because the refusal has one raise site. Read literally, though, it presupposes that every reader reaches the refusal, and the cli and lint readers do not. It is the same census family, so I cut it rather than leave the ambiguity."
}
],
"enumeration": {
"method": "Took git diff -U0 from merge-base 8490127 to HEAD over every added prose line (changeset, docblocks, test comments, packages.mdx). Stripped leading * and //, dropped backticks, joined ' + ' seams and split into sentences. I read every sentence by hand for claims that ALL or EVERY readers refuse, point at the rule, or reach the resolver. I also read the commit messages and the PR body (seat-owned).",
"deleted": "The 4 sentences or clauses above. After this round there are no more.",
"kept_true_as_a_named_set": [
"changeset: 'resolveArtifactPackageOrder in @objectstack/core already refused it, and so did the i18n detector in @objectstack/plugin-dev and the default-permission-set reader in @objectstack/plugin-security'. The set is those three readers, named. Measured by my differential, and the record ran all three.",
"The null family: runtime test comment 'null is read this way by every reader today'; runtime inline comment 'null is read as absent, as the other readers read it'; spec docblock 'while the readers treat it as absent'. The set is every reader of an artifact's or stack's packages under packages/. Readers that go through resolveArtifactPackageOrder's absent branch: core, runtime, plugin-dev, plugin-security, objectql plugin.ts:427, metadata plugin.ts:975, runtime artifact-granted-permissions.ts:131, verify declaredCollection. Readers whose null answer equals their absent answer: cli packageBodies and the collect-docs helpers (!Array.isArray gives [] or the same reference for both); lint recordsOf (isRec is !!v, so null and undefined both give []). composeStacks refuses null, but it is an emitter, not a reader. The record measured this set for #19926."
],
"kept_not_a_census": [
"changeset: 'the rule is now written down once ...: an absent packages means a single-package artifact, and any other non-array value is malformed and refused'. This is the rule's content (ruling A), stated after a colon, and names no reader.",
"'The rule is stated once, beside AssembledPackageBodySchema' at core (header and inline), runtime docblock, dev-i18n, plugin-security, the spec packages key pointer and the preservePackageEntries note. Each is its own site pointing at the rule, a claim about where the rule is, never that all readers point there.",
"spec: 'A reader that fell through ... would answer ... which is the split this rule closes'. This is hypothetical and normative. The seat has read it with cut 3 applied.",
"dev-i18n.ts: 'A reader should not spell it a second time'. This is normative.",
"Test comments scoped to one reader: dev-i18n 'so these three reach the resolver', security 'so the refusal is the resolver's', runtime 'This reader used to hand such an artifact back'. Each is held by that file's pins.",
"content/docs/plugins/packages.mdx: scoped to the app plugin's init() branch in the DevPlugin posture callout. The record read it and found it true."
],
"not_editable_here": [
"Commit messages (no rebase). ee4291e says 'the core resolver, the runtime reader and both plugin readers point at it': a named set of four, true at d780d37. c74ea72 and ccd0c40 make no census claim. d780d37 describes this cut.",
"PR body (the seat's, untouched). It has 'every reader refuses it', which paraphrases ruling A's content, and 'read as absent by every reader' for null, which is true as the null set above. 'The docblocks in core and the two plugin readers point at it' is a named set and true."
],
"correction_to_my_round_1_report": "The census line 'composeStacks ... always emits an array' in 5801982470 over-claims for a single input: composeStacks returns one input by identity (stack.zod.ts:4864, per the record). That was report text, not shipped text. The shipped preservePackageEntries note is true, per the record."
},
"tests": "At d780d37, in one lock hold (1771s shared-box). The dependency-closure build EXIT=0, and it built packages/spec/dist that check:generated then read. vitest: core 1321 passed; runtime 3816 passed + 1 skipped; plugin-dev 80 passed; plugin-security 2292 passed; spec --project local 15503 passed + 1 todo; spec --project repo 602 passed. typecheck EXIT=0 for spec, core, runtime, plugin-dev and plugin-security (run sequentially, with no gate runner in parallel this time). spec check:generated: all 15 generated artifacts up to date. Live node scripts/check-issue-citations.mjs EXIT=0 ('no issue citations added against 8490127'). Also green: check-empty-changeset, check-changeset-no-major and check-adr-0087-registration (all --base origin/main), check:nul-bytes and check:doc-authoring.",
"ci": "At d780d37: 35 check-run names, 33 success, 2 skipped (Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failed. All 7 required contexts are success: Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard.",
"mcp_calls": "0",
"api_writes": "1 relay dispatch (POST /repos/objectstack-ai/objectstack/dispatches) for this os-dev-report comment, sent with post-stamped after --route read dispatch. Also 1 git push (not REST). No PR body edit, no label write, no ready flip, no auto-merge. The PR now carries the labels documentation, size/m, tests and tooling; I did not write them.",
"open_questions": [],
"out_of_scope_findings": [
"No new findings. Carried from round 1 and the record: cli readers (#19925); packages: null (#19926); lint recordsOf(stack.packages) at 4 lint sites, which reads {} as [] and a map as records. The record says no card carries that last one, so it is the seat's to route. dedupe words: recordsOf stack.packages non-array; lint packages map read as records"
],
"cleanup": "Task worktree /home/user/objectstack-issue-15293 was re-created on the branch for this round. Its node_modules was removed, then git worktree remove ran without --force on a clean tree. The report was posted from a detached origin/main worktree, /home/user/objectstack-issue-15293-post (no install), removed right after the post; the final message confirms. Background jobs (the lock-held verify run) exited before this report. No dev server was started and nothing was killed."
}