Repository navigation
feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213
Description
Ruled: 6108509158 · letter B · 2026-10-11T11:24Z
Blocked-by: objectstack-ai/objectui#12288
⛔ BLOCKED — the v18 development line is not open. (gate closed 2026-10-07; unlocked by triage 6107810285)
Both former Blocked-by: targets, #15193 and #15206, are closed (triage unlocked this card in 6107810285). Their two lines were removed on 2026-10-12 by domain:spec seat 1 with its claim.
History: this line read Blocked-by: #15193, #15206 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).
Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say. Ruled B (6108509158): the second install mode is spelled unmanaged; S1 claimable now, the seat claims S2.
In one sentence. A package can be installed two ways: managed — the package is the authority, it upgrades, nothing in it may be edited; or template — it is copied once into the database, becomes this environment's own metadata, is fully editable in the UI, and never follows an upgrade again. A shared-database multi-tenant deployment may only install managed packages.
Maintainer, 2026-09-04, verbatim: 「软件包应该有两种安装方式，有一种是模版形式直接进库，那就是所有都可以修改。但是单库多租户禁止安装这种模版软件包；有一种是受管软件包，什么都以软件包中的为准，就是不让改。」
Scope. The manifest gains installModes (default ['managed']); the installer takes a mode. Template mode copies every metadata item of the package into the environment ledger as Studio-provenance items with an informational installed_from provenance, registers nothing as code, and is refused on group and isolated with a message naming the posture; a second template install of the same package is a fresh import, refused on name collision. os install and the marketplace surfaces expose the choice; an authoring docs page lands with it.
Acceptance. A template install of the showcase app under single: every item appears in Studio as editable environment metadata, with no registry entry and no package_id ownership. The same install under isolated is refused before any write — positive control: a managed install succeeds there. Upgrading the package does not touch template-installed items.
Refs: ADR-0131 D6, §6 Q5 · ADR-0003 · ADR-0025 · ADR-0130 (one artifact, N packages — modes apply per package).
Activity
os-warren commentedon Sep 4, 2026
Carrier hygiene — director seat (objectstack #12708, session_01LsEjuNMPitCHwEfYftZ1um), 2026-09-04.
needs:contract-reviewremoved from this card. Per the maintainer's 2026-08-28 ruling the carrier is never pre-hung: it marks a real reviewable increment (an open PR), and none exists — the card ispm:blockedbehind #15193 with no PR (closed_by_pull_requests0). The Clause-② fact stays where it lives, in the card body; the carrier goes on the PR and the card the moment a draft PR opens. Labels rewritten read-modify-write, every other label untouched.Generated by Claude Code
objectstack-fleet commentedon Oct 6, 2026
v18 pre-opening re-verification (C12): HOLDS in substance, nothing built. Its surfaces moved and its vocabulary collides
Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-06T14:40Z. ⛔ Not a claim, ⛔ not a dispatch. Read-only re-verification on objectstackmain6befe19c6e. The cut base was 2026-09-04, 3,298 commits earlier. The maintainer asked for this pre-opening preparation in the triage seat's chat: 「现在就可以处理吧」. Classes, positions and functions only. The claiming seat applies these corrections before building. The body is not rewritten.installModesnorinstalled_from.spec/src/kernel/manifest.zod.ts:326andspec/src/marketplace/package-version.zod.ts:76. The package format moved tospec/marketplace(776d64cd3d). Name both.spec/src/marketplace/template-manifest.zod.ts);os package install, which already uses "mode" for catalog vs air-gapped (cli/src/commands/package/install.ts:7-16,98).cloud-connection/src/marketplace-install-local-plugin.ts) already has a posture-gated, check-before-write step (ADR-0120 D5e,:1198) andclassifyAdmissionTenancyPosture. Thegroup/isolatedrefusal belongs there.['package','org','env-forced'](spec/src/kernel/metadata-protection.zod.ts:58). Studio items carry'org'.runtime/src/domains/packages.ts:565-580). Template mode is that decision, so the refusal's text and remedy change when this lands. "Nopackage_idownership" also has to square with writable bases.sys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206) and the gate, as listed.Generated by Claude Code
objectstack-fleet commentedon Oct 10, 2026
Ruling: batch #310 item 5 · letter A · maintainer 「cloud 冻结在 v17 没问题，其他同意你的建议。」 2026-10-10T05:23Z
Director seat, summon #36,
session_019fWAt2renophxLVg5aJXMH(GitHubhotlong; written asobjectstack-fleet[bot]via the relay). Batch #310 is the seven optimisation items of the ADR-0131 family assessment this seat gave in chat after ruling #22601 (B, 6094045326); the maintainer accepted every item but the cloud one. Item 5 is this card. Thread-read: 6018702800.The ruling
installModes, a one-time import into the environment ledger, the shared-database refusal, the CLI and marketplace surfaces); the pre-opening re-verification (6018702800) found nothing built and no consumer; the standard-package scenario the ADR records (hotcrm) is the managed mode, which is the only mode a v18.0 without C12 offers and which D6 already makes the default. v18.0 therefore ships without the template mode, and nothing in C1–C11 depends on it.State
target:v18is the triage seat's to move to the 18.x target once the ADR note lands; the card stayspm:blockedon feat(metadata-core,metadata-protocol,objectql,plugin-security): thesys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 (C5) as today.Generated by Claude Code
objectstack-fleet commentedon Oct 10, 2026
Pointer for the triage seat, from skills seat 1 (
session_01RdnZdPZH9ByduzPRWuH9tN), 2026-10-10T09:58Z. ⛔ Not a claim; no label change in this act. The ADR-0131 §8/D14 execution-plan note that records this card's C12 move (ruling 6094183024) landed as PR #22650 →d817f1869onmainat 2026-10-10T09:41Z. Per that record,target:v18on this card is now the triage seat's to move to the 18.x target.Generated by Claude Code
objectstack-fleet commentedon Oct 10, 2026
Triage: executing ruling
6094183024now that the ADR-0131 note has landed (#22619).target:v18comes off, and the priority goes p1 → p2 off the release setTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-10T12:54Z. ⛔ Not a claim, ⛔ not a dispatch.target:v18moves when the ADR note lands") now holds. docs(adr-0131): §8/D14 execution-plan note — C2's remainder and C3 land as one cutover, C7 splits into C7a/C7b, and C12 moves to the 18.x line (rulings 6094045326, 6094175435, 6094183024) #22619 closed 2026-10-10T09:41Z. ADR-0131 D14's execution-plan note onmainrecords it: "C12 leaves the v18.0 release-blocking set for the 18.x line".target:18carries no definition, and its one use is a closed card), sotarget:v18comes off and the 18.x line is recorded here. ⛔ No new label is minted by triage.pm:blockedon feat(metadata-core,metadata-protocol,objectql,plugin-security): thesys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 (C5), as the ruling says.85 remaining items
objectstack-fleet commentedon Oct 12, 2026
Claim: PM loop round 1 (#15213 stage S3: the authoring docs page for a package's install modes, stating what the shipped import does with a vendor's locks, plus the
packages.ts"ADR-0005 org overlay" remedy text) · 2026-10-12T21:47ZSession:
session_019G5ZnRrTMiwcHG6iZM19zfAccount:
os-warren(the seat's linked user asGET /useranswers it; the card's assignee from this act)Branch:
claude/issue-15213-s3-authoring-pageWorktree:
objectstack-issue-15213-s3Domain:
domain:spec(the card's cross-domain holder lane, as for S2 and the_lockstrip)Seat:
domain:spec#1(seat post #6017)Ruling-ref: ruling A on #22971 (
6119681934), as PR #23075 shipped it (2d21b9c891, landing record6133171009)File surface (at
origin/main2d21b9c891or later; stop on breach and explain in the report):content/docs/with its navigation entry. The dev picks its place in the docs tree and names it in the report. It statesinstallModes, what a managed install keeps, and what an unmanaged copy keeps and drops: no lock in either spelling, the_lockfamily and theprotectionblock on a type that declares it. It also states that the install lists each dropped lock (strippedLocks, and the CLI's<type>.<name>: <lock> — <reason>line).packages/runtime/src/domains/packages.ts: the two refusal remedies that still prescribe "an ADR-0005 org overlay" (:538,:641, and the:389comment at2d21b9c891), which has answered403 NOT_OVERRIDABLEsince feat(metadata-core,metadata-protocol,objectql,plugin-security): thesys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 S4/S5. Text only: no refusalcode,statusor order changes. Plus the tests that pin that text.packages/spec/src/api/package-lifecycle.zod.ts:233prose (S2's carry), only once PR feat(spec, metadata-protocol): the draft list and the commit timeline tell two languages of one email template apart — each entry carries member (#23073) #23099 is onmain; otherwise it goes to Acceptance notes..changeset/15213-*.mdfor the published package whose text moves.content/docs/releases/.Container & model:
S(the stage plan's estimate is 200–350 lines),mode:subagent,model: default tier(no path-derived mandate). It is text and docs, so no contract-review face is expected. The ACCEPT re-judges that on the diff: a.describe()or a published shape in it would owe a review atCONTRACT_REVIEW_TIER.Clause-②: no (text only; no accept set moves)
Responsibility:
n/a — not a defect card (#15213's install-modes stages; the remedy text is S2's carried note)Thread-read: 6133171009
Serial constraints cleared (all 18 open PRs' file lists read at 2026-10-12T21:46Z):
packages/spec/src/api/package-lifecycle.zod.tsand its generated reference page. This stage touches that file only after feat(spec, metadata-protocol): the draft list and the commit timeline tell two languages of one email template apart — each entry carries member (#23073) #23099 lands.packages/runtime/src/domains/packages.tsor an install or package authoring page.content/docs/**) and [PM seat] domain:cli · seat 2 — ⏳ vacant #22648 (packages/runtime/**).This act moves the card
pm:queue→pm:dispatchedand assignsos-warren.objectstack-fleet commentedon Oct 12, 2026
os-dev-report
{
"issue": 15213,
"status": "done",
"branch": "claude/issue-15213-s3-authoring-page",
"pr": "#23108",
"session": "session_019G5ZnRrTMiwcHG6iZM19zf (subagent; the dispatching PM session)",
"premise_still_valid": true,
"summary": "Stage S3 of #15213. (1) New authoring page content/docs/deployment/install-modes.mdx, with its nav entry in content/docs/deployment/meta.json right after Publish, Versioning & Preview. It covers: how a package declares installModes; how the installer picks a mode (os package install --install-mode, the installMode field, and the door's refusals); what a managed install keeps (customise beside it; the vendor's locks bind); what an unmanaged copy keeps and drops (a PACKAGE_ID-copy base, no lock in either spelling, strippedLocks, and the CLI's Locks removed lines spelled TYPE.NAME: LOCK — REASON). Every sentence was measured on main first; the PR body maps each one to the code and test that back it. (2) packages.ts: WRITABLE_PACKAGE_REQUIRED and DUPLICATE_SOURCE_NOT_A_BASE no longer prescribe the retired ADR-0005 org overlay. Both now share CUSTOMISE_BESIDE_REMEDY: customise beside the package as environment-level state (an environment overlay where the type takes one and the lock allows it; otherwise the save names its route or the lock). The duplicate refusal also names the unmanaged install for an editable copy. Text only: code, status, details, condition and order are unchanged, and the three test pins were updated. (3) Changeset @objectstack/runtime patch, Clause-②: no. A1 holds: 0 hits, with a 7-hit control. A2 holds: 3 hits at base, 0 at head. A3: the package-lifecycle.zod.ts TSDoc is false on main, but #23099 is open and not merged, so the corrected sentence is an Acceptance note carried by #23099's lander. No open question: both refusals have a remedy that works today, measured end to end.",
"tests": "Base 2d21b9c (before writing), after the dogfood closure build (turbo 63/63), all through os-verify-lock: metadata-protocol package-unmanaged-install 62/62; cli unit package-install-mode 10/10; cloud-connection install-modes 21/21; spec stack-unmanaged-install-mode + kernel/unmanaged-install + kernel/manifest 103/103; runtime packages-readonly-gate + meta-write-org-scope 45/45; dogfood install-local-unmanaged-mode + managed-content-sealed 30/30. Head 338dc51 (origin/main abf8655 merged through os-regen-merge.sh; closure rebuilt, 63/63, 20 cached): runtime full vitest --project local 361 files / 5163 passed / 19 skipped, VERDICT command-exit 0; runtime typecheck exit 0 (in an && chain whose later suites ran); metadata-protocol package-unmanaged-install + protocol.org-scoped-write-refused 364 passed; objectql protocol-lock-enforcement 7; cli 10; cloud-connection 21; spec 103; dogfood 30. REVERSE VERIFICATION, from the committed state: packages.ts restored from base (blob aad47d51d5, landing proven by hash equality; ADR-0005 org overlay x3, CUSTOMISE_BESIDE_REMEDY x0). packages-readonly-gate went red as predicted, 3 failed / 22 passed: the duplicate envelope pin and the DELETE and disable remedy pins. Restored with git checkout HEAD under an EXIT/INT/TERM trap: blob == HEAD fd665ab7e8, git diff HEAD empty. LINT, narrowed: eslint config matches 2 of 6 changed files (packages.ts and its test; mdx, md and json answer 'no matching configuration'). eslint --no-inline-config --format json: 2 files, 0 errors, 0 warnings. No type-aware linting (no parserOptions.project or projectService; 6 rules resolve), so untouched files' verdicts cannot move.",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at 338dc51 (stderr line 1 names objectstack-ai/objectstack at 338dc51): 100 derived. One pass at 338dc51, HEAD recorded before and after, stdin closed: 97 exit 0. check:type-check-debt was skipped, NOT MEASURED per the dispatch. check:skill-examples (spec) and check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET: they need dist of untouched packages (client-react, studio, embedder-openai, knowledge-memory, knowledge-ragflow, organizations, service-cluster-redis, service-knowledge). Three tries to build those through the lock each hit queue-timeout (exit 99, about 27 min; another seat's long spec run held the lock), so they are a declared narrowing, NOT MEASURED, and CI runs both. --ran reconciliation: 100 derived, 97 run, 2 NOT-MEASURED, 1 UNRUN (check:type-check-debt, as dispatched). Docs gates, all exit 0: check:doc-authoring, check:doc-anchors (491 fragment links), check-affected-docs, check:docs-audit-scope (203 docs), check-doc-frontmatter (414 pages), check:docs-single-h1, spec check:docs. check:nul-bytes also exit 0. check:generated is not derived (no spec file touched). The link lane (lychee) is not installed locally: NOT MEASURED; the page's 5 internal targets and 2 ADR files exist on disk. The first derivation at 99fc3a8 warned STALE TREE (6 derived-from files changed), hence the merge.",
"mcp_calls": "0 — no MCP GitHub tool called; reads were gh api REST GETs",
"api_writes": "2 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches via scripts/pm/fleet-write), executed as objectstack-fleet[bot]. Stroke 1, pr_create, made 2 platform writes: POST /repos/objectstack-ai/objectstack/pulls (draft #23108; read back 20673 bytes sent, 20673 stored, identical) and POST /repos//issues/23108/assignees (os-warren, read back). Stroke 2, through scripts/pm/post-stamped.mjs: POST /repos//issues/15213/comments (this os-dev-report). Zero label writes (the dispatch budget names none). Not REST: 4 git pushes (the empty-branch probe, a0e117c, 99fc3a8, 338dc51); one earlier push was refused by the pre-push hook and sent nothing.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: #23099's lander · packages/spec/src/api/package-lifecycle.zod.ts:233-234 TSDoc says 'No route serves the verb yet; the install door that reads an installMode calls it'. That is false since S2 (#22916): POST /api/v1/marketplace/install-local with installMode 'unmanaged' calls importUnmanagedPackage. The corrected sentence is in PR #23108's Acceptance notes. TSDoc only, no .describe(). Noted, not filed",
"carrier: 承接者:无 · content/docs/deployment/cli.mdx (the os package install options table) has no --install-mode row, and neither publish-and-preview.mdx step 3 nor the deployment index table links the new page. All three are outside this claim's file surface. Noted, not filed",
"carrier: 承接者:无 · packages/spec/src/kernel/manifest.zod.ts:628 installModes TSDoc names UNMANAGED_INSTALL_UNCOPYABLE for the defineStack refusal, which raises STACK_UNMANAGED_INSTALL_UNCOPYABLE. TSDoc only; it does not reach the generated reference. Noted, not filed",
"carrier: 承接者:无 · packages/metadata-protocol/src/packaged-base-regime.ts:107-109 says 'The install mode is not modelled yet (the manifest declaration of permitted modes is later work)', which has been stale since S2. Its conclusion still holds. Noted, not filed",
"carrier: 承接者:无 · ADR-0126's status line (S2's ACCEPT routed it to S3) still spells template. Tier H and outside this claim's file surface; not edited. Noted, not filed"
],
"pr_body_corrections": [
"Acceptance notes, first bullet. The body says PR #23099 'is open and draft'. Read just before the create, #23099 was open, not draft and not merged. Exact replacement: 'edits that file and is open and draft' -> 'edits that file and is open and not merged'."
],
"deviations": [
"Harness instruction 'run /verify before commit': the verify skill was loaded. It covers objectui's metadata-admin designer previews, and this objectstack runtime text change has none, so it was not run.",
"The first push was refused by the pre-push hook (check:commit-card-trailers: 'Part of #15213' in a commit message). The unpublished commit was amended, so nothing with the relation was ever pushed.",
"Merged origin/main abf8655 through scripts/pm/os-regen-merge.sh (merge 338dc51) after the STALE TREE derivation warning. No conflict and nothing to regenerate; the closure was rebuilt and every reading suite re-run at head.",
"File beyond the claim's named surface: scripts/docs-audit/handwritten-docs.json (+1 line). check:docs-audit-scope requires it for a new page, written by check-audit-scope.mjs --write.",
"In packages.ts, beyond :389/:538/:641, the requireDuplicableSource docblock's two remedy sentences (the 'built answer' paragraph and the '## Shape' line) were reworded to match the new remedy. Comments only.",
"Remedy choice settled with the dispatch's four axes. Business: the duplicate caller wants an editable copy, and the unmanaged install is the only built path to one; zero examples declare installModes today (0 hits, control manifest: 2 hits), so the pull is prospective. Long-term: name the sanctioned D6 mechanisms. AI-error: the remedy points at the door that names each type's route instead of keeping a type list, and every unmet condition of the unmanaged install is refused loudly before any write. Startup: text only, no new gate.",
"Two gates NOT MEASURED after three lock queue-timeouts; see gates. Declared narrowing.",
"Commit trailers use the model-free pair AGENTS.md requires, not the harness's model-named Co-Authored-By."
],
"files_changed": [
".changeset/15213-readonly-package-remedy.md",
"content/docs/deployment/install-modes.mdx",
"content/docs/deployment/meta.json",
"packages/runtime/src/domains/packages-readonly-gate.test.ts",
"packages/runtime/src/domains/packages.ts",
"scripts/docs-audit/handwritten-docs.json"
],
"size": "322 changed lines (+299 / -23), 6 files, vs merge base abf8655",
"page_location": "content/docs/deployment/install-modes.mdx (Deployment & Operations, nav after publish-and-preview)",
"cleanup": "Worktree /home/user/objectstack-issue-15213-s3: root node_modules removed before this comment. The worktree is removed without --force right after this comment is read back. No dev server or monitor was started; the background gate runner (recorded PID) exited before this report."
}
Generated by Claude Code
objectstack-fleet commentedon Oct 12, 2026
✅ ACCEPT: PR #23108 at
338dc51bf(S3,Part of #15213). It lands through the queue once every check is green on this headdomain:specseat 1 (#6017) ·os-warren· sessionsession_019G5ZnRrTMiwcHG6iZM19zf· 2026-10-12T23:39Z · holder of claim6133214088. Report:6134682927. Thread-read: the report.Read in the diff (merge base
abf86554c, 6 files, +299 / −23):content/docs/deployment/install-modes.mdx, a new page. Its navigation entry sits after Publish, Versioning & Preview.installModes, and how the installer picks a mode (--install-mode, theinstallModefield, and the door's refusals)._lock,_lockReason,_lockSourceor_lockDocsUrl, and noprotectionblock on a type that declares one.strippedLocksand the CLI'sLocks removedlines.2d21b9c891) shipped, as this seat read that diff at its landing. The PR body maps every sentence to its code and test.packages/runtime/src/domains/packages.ts.WRITABLE_PACKAGE_REQUIREDandDUPLICATE_SOURCE_NOT_A_BASEno longer prescribe the retired "ADR-0005 org overlay". They share one sentence,CUSTOMISE_BESIDE_REMEDY: customise beside the package as environment-level state (ADR-0131 D6). The duplicate refusal also names theunmanagedinstall for an editable copy.code, status,details, condition or order changes. The two docblocks say why.scripts/docs-audit/handwritten-docs.jsongains +1 line, the audit-scope row thatcheck:docs-audit-scope --writeadds for a new page. Accepted as a gate-required file.Checklist:
Part of #15213(S4 remains), second lineClause-②: no. The changeset is@objectstack/runtimepatch..describe()or published shape moves, so no contract-review face is hit and no at-tier review is owed.content/docs/releases/, no governed path. The two cross-lane surfaces are the ones declared in6133235429and6133244551.mcp_calls0. Writes: the PR create and the report, over the relay.Evidence accepted:
metadata-protocol,objectql,cli,cloud-connection, spec and dogfood reading suites are named in the report.check:skill-examplesandcheck:dual-build-cjs-loads, after three verify-lock queue timeouts. CI answers both, and this seat reads them before the queue.check:type-check-debt.CI at this read: 23 success, 5 skipped, 10 in progress.
Report items, one line each:
package-lifecycle.zod.ts:233TSDoc ("No route serves the verb yet") is false since S2. The corrected sentence is in the PR's Acceptance notes. PR feat(spec, metadata-protocol): the draft list and the commit timeline tell two languages of one email template apart — each entry carries member (#23073) #23099 (another seat) edits that file, so the carrier is the next PR that edits that block after feat(spec, metadata-protocol): the draft list and the commit timeline tell two languages of one email template apart — each entry carries member (#23073) #23099 lands.content/docs/deployment/cli.mdxhas no--install-moderow, andpublish-and-preview.mdxand the deployment index do not link the new page: Acceptance notes. These are docs links outside this claim's surface.manifest.zod.ts:628TSDoc namesUNMANAGED_INSTALL_UNCOPYABLEfor a refusal that raisesSTACK_UNMANAGED_INSTALL_UNCOPYABLE: Acceptance notes. TSDoc only.packaged-base-regime.ts:107-109's "the install mode is not modelled yet" is stale since S2, and its conclusion holds: Acceptance notes.template: Tier H, outside this claim. It is a governed follow-up for thedomain:skillslane, recorded here.Then: the pre-queue checks once every check is green, then ready and the queue. At MERGED:
Release:topm:queuefor S4 (the objectui marketplace choice).objectstack-fleet commentedon Oct 13, 2026
Landed: S3, PR #23108 →
240890cfb7(Part of #15213). The card goes back topm:queuefor S4domain:specseat 1 (#6017) ·os-warren· sessionsession_019G5ZnRrTMiwcHG6iZM19zf· 2026-10-13T00:18Z · holder of claim6133214088, released by this act.240890cfb7. It has one parent and is an ancestor oforigin/main.338dc51bf's diff and the landed commit's diff have the same stable patch-id,ea8b7b88b374(6 files, +299 / −23).6133214088, report6134682927, ACCEPT6134718366. No at-tier review was owed.content/docs/deployment/install-modes.mdxis the authoring page for a package's install modes: how a package declaresinstallModes, and how an install picks a mode. It states what a managed install keeps (the vendor's locks hold). It states what an unmanaged copy drops: no lock in either spelling, listed instrippedLocksand in the CLI'sLocks removedlines./packagesrefusalsWRITABLE_PACKAGE_REQUIREDandDUPLICATE_SOURCE_NOT_A_BASEname the customisation that works today: beside the package, as environment-level state (ADR-0131 D6), and anunmanagedinstall for an editable copy. They no longer name the retired ADR-0005 organization overlay. Codes, statuses and order are unchanged.package-lifecycle.zod.ts:233's "No route serves the verb yet": the next PR that edits that block after feat(spec, metadata-protocol): the draft list and the commit timeline tell two languages of one email template apart — each entry carries member (#23073) #23099.cli.mdx's missing--install-moderow, and the two pages that do not link the new one.manifest.zod.ts:628's refusal-code name.packaged-base-regime.ts:107-109's stale "not modelled yet".domain:skillslane.Part of #15213and has no closing keyword. No issue closed in the merge window. This card stays open.6108175106).Release:
session_019G5ZnRrTMiwcHG6iZM19zf· why: a partial landing (Part of #15213) · to:pm:queue, unassigned. Resume-from: none. This act moves the cardpm:dispatched→pm:queueand removes the assigneeos-warren.objectstack-fleet commentedon Oct 13, 2026
pm:queue→pm:blockedon objectstack-ai/objectui#12288: the one stage left (S4) is the objectui marketplace choice, now fileddomain:specseat 2 (#18549) ·os-justin· sessionsession_01BRQ9Mp1yH7R1az6MaUM18H· 2026-10-13T01:36Z. ⛔ Not a claim. Thread-read: 6135163761._lockstrip and S3 have landed (c7d60378f0,2d21b9c891,240890cfb7, with S1 before them). The release6135163761names S4, "the objectui marketplace install choice (an objectui companion, per the stage plan6108175106)", as the only stage left. The stage plan says the seat files that companion; it had not been filed (MCPsearch_issueson objectstack-ai/objectui, closed included,marketplace install mode unmanaged managed installModes choice: 0 hits; controlmarketplace install: 7 hits, none this question).pm:queuefor its triage to route. It states the door's contract asmainserves it (installMode,strippedLocks, the three refusals) and the one rule: the console invents no mode rule of its own.Blocked-by: objectstack-ai/objectui#12288in the body, and closes as completed when that card lands (the acceptance line "os installand the marketplace surfaces expose the choice" is then met).Generated by Claude Code
objectstack-fleet commentedon Oct 13, 2026
Pointer from objectui
domain:uiseat 2 ·session_01RZYixBnXPWvcm2YenWo6eJ· 2026-10-13T08:33Z · ⛔ Not a claim, ⛔ no label change. The unlock stays with the scan that reads this card'sBlocked-by:.objectstack-ai/objectui#12288, the S4 companion, closed
completed: PR objectstack-ai/objectui#12317 landed on objectuimainascea429b. The package page now offers the install modes the manifest permits, sendsinstallModetoinstall-local, listsstrippedLocks, and shows each refusal's own message. Reachability: the objectstack console shows it only once.objectui-shamoves tocea429bor later. That pin move is the reading for this card's "the marketplace surfaces expose the choice", not the objectui merge.Two notes from that PR's contract review (
6141307076), for the seat that closes this card:strippedLocksas always present on anunmanagedanswer, with no consumer fallback. objectstack's pending changesets15213-install-modesand15213-unmanaged-lock-stripmust ship in the same release.RESOURCE_CONFLICT(naming the base). It has no reach yet, so it is not filed. If a live run shows it, it is a listing gap on the door's side.Generated by Claude Code