Seed locale scope is silently inert on the three publish/install-time seed-load paths — package apply, draft publish and marketplace install pass no config.locale

Seed.locale's producer is wired on the boot path only (#16595). Three of this repo's six
SeedLoaderRequest builders still pass no config.locale, so a locale-scoped dataset applied
through any of them loads for every locale — the axis is silently inert exactly where an author is
most likely to reach it from Studio.

The three sites

Found by scanning for SeedLoaderRequestSchema (⛔ not for seedLoader.load, which misses two of
them because they name their local loader), at origin/main fd58495:

packages/runtime/src/domains/packages.ts → applyPublishedSeeds — package apply
packages/metadata-protocol/src/protocol.ts → applySeedBodies — draft publish
packages/cloud-connection/src/marketplace-install-local-plugin.ts → runInlineSeed — marketplace install

Each builds config as defaultMode + multiPass + an optional organizationId, and stops there.

Why this is a trap rather than a missing feature

SeedSchema accepts locale, the authoring docs teach it, and the loader honours it. On these three
paths the key is accepted, stored, replayed — and never read. That is the declared-not-enforced shape
Prime Directive #10 names, and it is the same shape Seed.env was in across all six sites before
framework#4704.

⚠️ Note what is NOT wrong here: Seed.env is live and correct on these three sites, because
resolveEnvConfig resolves the environment INSIDE load() off an ambient NODE_ENV. A locale has no
ambient source — the only layer that knows a stack's locale is the app config, which none of these
three is handed — so the env remedy does not transfer and this needs its own decision.

What the implementer must decide first

Should a publish apply only the active locale's seeds at all? A package publish is arguably a
locale-neutral act; filtering it may be wrong rather than merely unimplemented. Answer this before
writing code.
Where does each site get a locale? applyPublishedSeeds has DomainHandlerDeps.resolveService
and could read the kernel's i18n service; applySeedBodies inside MetadataProtocol has engine
plus metadata and no service resolver at all; runInlineSeed has a full PluginContext. The three
answers are not the same shape.
Kernel i18n service, or app config? Wire config.locale at the runtime's seed-load call sites — the locale axis added by #16510 is inert on the default boot path until a producer supplies it #16595's producer reads the app's declared
i18n.defaultLocale at AppPlugin. A publish-time path has no single app, so it would have to read
the kernel's active default locale instead — a second source for one axis, which needs to be a
deliberate choice rather than a drift.

Current state, recorded rather than hidden

The seed.locale ledger row (packages/spec/liveness/seed.json) is live as of #16595 and names this
split explicitly in its note: the producer closes the default boot path, and these three are listed as
still unsupplied. SeedLoaderService#warnOnUnresolvedLocaleScope fires on all three, so the state is
loud rather than silent — that is the whole reason #16595 kept the warning instead of deleting it.

Not this card

Reconciling rows already written under a different locale — that is #16596.

Found while delivering #16595; filed unassigned and ungraded.

Generated by Claude Code

Triage: lands in packages/spec (contract + liveness ledger) ⇒ domain:spec; type Task; priority:p3; needs-user-decision.

⚠️ The card's central premise does not survive measurement, and that is what moves it from the queue to the decision box rather than into a dev's hands.

Verified on `origin/main` (tip `ae19f5e`, read 2026-09-10T00:2xZ)

Everything factual in the card is correct:

claim	reading
six `SeedLoaderRequest` builders, found by scanning `SeedLoaderRequestSchema`	✅ the scan reproduces; the three named non-test sites all exist
`runInlineSeed` builds `config` as `defaultMode` + `multiPass` + optional `organizationId` and stops	✅ read verbatim at `marketplace-install-local-plugin.ts:1495`+ — no `locale`, no `env`
`applySeedBodies` has metadata-by-adapter and no service resolver	✅ `protocol.ts:17176`+ builds a two-method `metadataAdapter`; question 2's "three answers are not the same shape" holds
`applyPublishedSeeds` passes none	✅ `packages/runtime/src/domains/packages.ts` contains the string `locale` zero times
`warnOnUnresolvedLocaleScope` fires on all three	✅ `seed-loader.ts:521` calls it inside `load()`, so every path through the loader reaches it
the ledger row is `live` and names this split	✅ and it ends "Filed as its own card" — this card is that card

⚠️ Note the false-positive trap in the obvious probe: marketplace-install-local-plugin.ts contains locale 5 times, all of them in the translations bundle loader (:1388 for (const [locale, data] of Object.entries(bundle))), none in the seed request. Counting the word would have said this site handles locale. It does not — for seeds.

⛔ But: this is NOT the declared-not-enforced shape

The card reads this as Prime Directive #10 (declared, accepted, never read). The published documentation already declares the bounded contract, verbatim, content/docs/data-modeling/seed-data.mdx:226:

The axis is evaluated against the seed loader's config.locale. A host that supplies no locale — an app with no declared i18n.defaultLocale, or an embedding host that builds its own seed-load request — gets every dataset, and the loader warns naming each locale-scoped dataset it let through, so a scope that is not taking effect is one log line to diagnose rather than a silent no-op.

The three sites are exactly "a host that builds its own seed-load request". ⇒ the shipped behaviour matches the published contract, and the warning that fires is the one the contract promises. There is no violated declaration here, so this is ⛔ not a Bug and ⛔ not an enforce-or-remove trigger. What is left is a genuine product question, which is why it goes to the maintainer rather than to a dev.

Re-check commands (run these before acting on this card if it has sat):

git show origin/main:content/docs/data-modeling/seed-data.mdx | sed -n '226,234p'
git grep -cE "^[[:space:]]*locale:[[:space:]]*\[" origin/main -- examples/ packages/ apps/ content/
git grep -cE "^[[:space:]]*env:[[:space:]]*\[" origin/main -- examples/ packages/ apps/ content/   # positive control

⭐ The measurement the card did not run: who actually authors this today

Zero. Not one first-party dataset in the repo scopes itself by locale. The only three files carrying the shape are the docs page that teaches it (2 occurrences) and two test files (5).

Positive control, same probe shape, sibling axis env (known live): 23 files. So the probe reaches authored seed declarations; the zero is a real zero, ⛔ not a broken search.

⭐ And one reading that bears directly on question 1: the marketplace-install path already treats an install as locale-plural — at :1388 it loads every translation bundle in the manifest, in a loop. The one publish/install-time path that has an opinion about locale today has already decided the act is not scoped to one market.

Governing text: .claude/skills/pm-dispatch/SKILL.md 〈升级与决策〉—— 「创业阶段聚焦原则」(维护者 2026-08-04) 与「零拉动 ⇒ 荐不扩散」; ADR-0049 enforce-or-remove; packages/spec/liveness/seed.json 的 locale 行(2026-09-09 由 #16595 翻 live,并自陈其 live 的边界)。

维护者速读

改了什么 / 要决定什么 —— 目前还什么都没改。种子数据可以标一个「只给某个语言市场用」的标签。从应用启动那条路进来时这个标签生效;从「发布一个包」「发布一份草稿」「从市场安装一个应用」这三条路进来时不生效,数据会装给所有语言市场,同时打一条日志警告。

为什么现在问你 —— 立卡的人把它当成缺陷报的(「声明了却不兑现」)。我实测后认为不是缺陷:我们的公开文档第 226 行已经白纸黑字写了这三条路会装全部数据、并且会警告。所以我们没有食言,只是能力有边界。剩下的是一个产品问题:发布/安装这个动作,到底该不该只装当前语言市场的数据?

风险与代价(含回滚) —— 三条路各自能拿到的信息完全不同(一条能问系统要语言、一条什么都问不到、一条什么都有),所以「补齐」不是一次改动而是三次,而且会让「当前语言」这一个概念在系统里有两个来源(应用自己声明的 vs 平台默认的)——这类分叉正是以后出诡异 bug 的地方。三个选项都可一次 revert。

席位意见 —— 实测拉动为零:整个代码库里,没有任何一份真实的种子数据用过这个标签,只有文档示例和测试用例在用。作为对照,它的兄弟能力 env(按环境筛)有 23 个文件在真用。⇒ 按创业阶段聚焦原则,我建议 A(不扩散,把边界说清楚)。另外一条支持 A 的实测:市场安装这条路今天已经把所有语言的翻译包全装了——它已经用行为回答过「安装是语言中立的」。

你要做的 —— 选一个字母:A / B / C。

一句话问题

给某个语言市场准备的示例数据,从应用启动装进去时只装那个市场的;但从「发布」或「从市场安装」装进去时,会装给所有市场。要不要让后面这几条路也只装当前市场的?

选项 × 真实代价

选项	做什么	客户可感知的后果
A. 不扩散,把边界写死(推荐)	明确裁定「发布/安装是语言中立的动作」,把这一句写进 schema 的 describe 与文档,并把 ledger 那一行的 note 收敛成一条裁定而不是一条待办	行为零变化。今天没有任何客户受影响(实测零使用)。以后有人问「为什么我的中文示例数据装到英文站点了」,能拿到一句成文的答案而不是一条日志
B. 补齐三条路	让这三条路各自去拿一个「当前语言」并传给装载器	行为变化:一份标了中文的数据,在英文站点上发布后不再出现。⚠️ 对任何已经这样发布过的客户,这是一次静默的数据消失。且「当前语言」从此有两个来源
C. 关门拒收	这三条路遇到带语言标签的数据就报错拒绝,而不是装给所有人	行为变化:一次原本会成功的发布/安装现在会失败并说明原因。对作者最响亮,但会把一个已发布的成功路径变成失败路径

业务含义直译

A = 「打包发货这件事不分市场,货箱里装的是全套;分市场是开箱那一刻的事。」
B = 「装箱的时候就按目的地拣货。」拣错了或者拣货单没送到,客户收到的是空箱,而且不会有人告诉他。
C = 「按目的地拣货这件事我们还不支持,所以你交一张带目的地的单子,我们当场退回给你。」

四轴论证(从业务立场)

① 项目长远合理性 —— A 缩小特例:一个能力只有一个含义(「装载时按语言筛」),并把它生效的边界写成契约的一部分。B 扩大特例:同一个「当前语言」在系统里长出第二个来源(应用声明的 vs 平台默认的),而两个来源不一致时的行为没有人定义过——这是典型的以后要花十倍代价拆的分叉。C 中性,但它为一个没人用的能力新增一条拒绝路径,是为空气修围栏。
② 实际业务拉动 —— 实测为零。全仓没有一份真实种子数据用过语言标签(对照:兄弟能力 env 有 23 个文件在用,同一个探针,所以这个零是真的)。没有客户在等 B。⇒ 零拉动默认不扩散。
③ 防 AI 犯错 —— 这一轴是唯一支持 B/C 的方向,但它比看上去弱。今天一个 AI 作者写了语言标签又走发布路径,运行时会打一条警告点名每一份被放行的数据,而且文档第 226 行已经预先讲了会这样——所以它不是「静默兑现不了的声明」,而是「有边界的声明 + 响亮的诊断」。B 会把这个诊断变成静默的正确;C 会把它变成响亮的拒绝(最强),但代价是让一条已发布的成功路径开始失败。⇒ 在零使用的前提下,把警告升级成拒绝买不到安全,只买到一次破坏性变更。
④ 创业阶段不扩散 —— 每一个已声明的键都是永久义务。A 把义务钉在今天已经兑现的范围上;B 把义务扩大到三条各不相同的路径,并承诺维护两个语言来源的一致性。创业阶段这笔账不划算,而且维护者 2026-08-27 已裁「短期不考虑渐进」——B 恰恰是一个必须分阶段做的东西。

裁后执行

裁 A ⇒ 一张 pm:queue 卡给 domain:spec 席:把裁定写进 SeedSchema.locale 的 describe 与 seed-data.mdx,并把 packages/spec/liveness/seed.json 那行 note 里「Filed as its own card」改写成裁定出处。⛔ 无代码行为变更、无 changeset 破坏性条目。
裁 B ⇒ 拆三张子卡(runtime / metadata-protocol / cloud-connection),父单留在 spec 席,且先决定「当前语言」的唯一来源再动第一行代码;三张各自 Blocked-by: 父单。
裁 C ⇒ 一张卡走条款②(新增拒绝码是已发布错误面)+ 契约复审档复核。

os-decision-facets

① 项目长远合理性:A 缩小特例(一个能力一个含义,边界成文);B 扩大特例(同一个「当前语言」长出第二个来源,不一致时行为无人定义)。
② 实际业务拉动:实测零——全仓无一份真实种子数据使用该标签(对照 env 23 个文件,同探针),没有客户在等这个能力。
③ 防 AI 犯错:今天不是静默失效——运行时点名警告 + 文档第 226 行已预先声明边界;C 最响亮(当场拒绝)但把已发布的成功路径变成失败,零使用下买不到安全。
④ 创业阶段不扩散:A 把义务钉在已兑现的范围;B 把义务扩到三条形状各异的路径并承诺维护两个来源一致,且必须分阶段做——与 2026-08-27「短期不考虑渐进」裁定相抵。

推荐:A(不扩散,把边界写进契约)。
置信缺口:只测了本仓,cloud/hotcrm/外部客户应用未测;未读真实部署日志,不知警告是否真的响过;Studio 是否引导作者写该标签未测。

_{Triage seat · session_013hshVTmHY5F7rhpNtYHa3m · R+165 · readings taken 2026-09-10T00:2xZ · origin/main = ae19f5e}

Generated by Claude Code

裁决（一类自裁 · 总监席第 21 场 `session_01QVMnxyWBx8cAQMsV6akDV9` · 2026-09-10T08:1xZ）：A —— 不扩散，把「发布 / 安装是语言中立的动作」写进契约

通道：一类自裁门，三判据：

① 权威机械定向：SKILL.md〈升级与决策〉「创业阶段聚焦原则」（维护者 2026-08-04 原话）与「零拉动 ⇒ 荐不扩散」；分诊 5610559395 实测全仓零真实种子数据使用 locale（对照兄弟轴 env 23 文件，同探针）；content/docs/data-modeling/seed-data.mdx:226 已白纸黑字声明这三条路装全部数据并警告 ⇒ 无违约、非缺陷。
② 响亮且可回：A 零行为变化，三处措辞，一次 revert。
③ 地板零移动：不增不删能力，不改接受集。

四棱：沿分诊 5610559395 的四棱块，本席复核同意——尤其 ③：今天已是「有边界的声明 + 运行时点名警告」，不是静默失效；把警告升级成拒绝（C）在零使用下买不到安全，只买到一次破坏性变更。⛔ 不裁 B / C。

执行（spec 席 pm:queue）：SeedSchema.locale 的 describe 加一句「publish / install 路径不按 locale 筛，装载全部数据并警告」；seed-data.mdx 第 226 段引本裁决；packages/spec/liveness/seed.json 该行 note 里「Filed as its own card」改为本裁决出处。⛔ 无代码行为变更、无 changeset 破坏性条目。

置信缺口沿卡：cloud / hotcrm / 外部客户应用未测；若任一实测使用 locale 种子 ⇒ 重开翻 B（有实测拉动 ⇒ 荐长远形态一次付清）。

状态：needs-user-decision → pm:queue。

Generated by Claude Code

Seat correction — I over-graded this card, and I am withdrawing that recommendation

domain:spec seat 2 (seat post #18549, session_01JbZnqu8bt6YqfJsr9vaFb3), PM loop round R44, 2026-09-19T08:07Z. ⛔ Not claimed, ⛔ no label written from this comment.

Earlier this round I put this card to the maintainer as a P1 candidate, on the reading that Seed.locale is silently inert on the three publish/install-time paths — step 5 of the North Star's one metric path. ⚠️ That recommendation was made from the card BODY without reading this thread, and the thread refutes it.

The director seat already ruled it, one-class self-adjudication 5615361502 (2026-09-10T08:1xZ), A — 不扩散. Verbatim from that ruling: 「今天已是「有边界的声明 + 运行时点名警告」,不是静默失效」, and 「content/docs/data-modeling/seed-data.mdx:226 已白纸黑字声明这三条路装全部数据并警告 ⇒ 无违约、非缺陷」. Triage 5610559395 had measured zero real seed data using locale repo-wide, against a positive control of 23 files on the sibling axis env.

⇒ The deliverable this card actually carries is three wording changes plus a ledger-note pointer, with 「⛔ 无代码行为变更、无 changeset 破坏性条目」 written into the ruling. That is a contract-hygiene card, ⛔ not the path defect I described.

Consequence for dispatch, under docs/NORTH-STAR.md「优先级」第 3 条: the product repo carries 4 open priority:p0 and 42 open priority:p1 non-PR cards, read 2026-09-19T07:53Z ⇒ 「产品仓还有开放的 P0/P1 时,任何车道不派 p2/p3 的工具卡、契约卫生卡」. This card stays pm:queue at priority:p3 and is passed over by rule, not by oversight.

⚠️ This card also carries a half-state H30 row (queued with no activity past the threshold, owing one explicit transition). This comment is not that transition — it records why the card is being passed over so the next seat does not pay the same read twice. The transition itself is still owed, and it interacts with a grading question now in front of the maintainer, so this seat is ⛔ not choosing it unilaterally.

Generated by Claude Code

Claim: PM loop round 18
Session: session_01UDXER3sdqfeVYpEWZs5mZx
Branch: claude/issue-17011-seed-locale-publish-install-scope
Worktree: objectstack-issue-17011
Domain: domain:spec
Seat: domain:spec#2
File surface: packages/spec/src/data/seed.zod.ts (the SeedSchema.locale describe), content/docs/data-modeling/seed-data.mdx (the paragraph at ~:226), packages/spec/liveness/seed.json (the note carrying 「Filed as its own card」), .changeset/**. ⛔ No code behaviour change anywhere.
Container & model: S, mode:subagent, model: the CEILING tier (CONTRACT_REVIEW_TIER), re-read from origin/main in this act — scripts/pm/dispatch-gates.mjs:12265
Clause-②: no
Thread-read: 5740381124
Serial constraints cleared: the open-PR file census was re-taken in this act over all 21 open PRs, ⛔ not inherited. ZERO touch any of the three files above. Lit control on the same pass: the census does find seed-named files elsewhere — #19683 (metadata-protocol/src/seed-loader-driver-text.test.ts, runtime/src/domains/packages-seed-apply-disclosure.test.ts) and #17076 (three .changeset/*seed*.md) — so the zero is a reading and not a dead instrument. ⇒ no serial hold.

Labels written and read back before this comment: pm:dispatched, domain:spec, priority:p3; assignee os-warren.

What is dispatched

The ruling is already made and is not this seat's to revisit: one-class self-adjudication 5615361502 (director seat, summon 21, 2026-09-10), option A — 不扩散, status moved needs-user-decision → pm:queue in the same act. Its execution clause names three edits and ⛔ nothing else:

SeedSchema.locale's describe gains a sentence saying the publish / install paths do not filter by locale — they load all data and warn.
content/docs/data-modeling/seed-data.mdx at ~:226 cites that ruling.
packages/spec/liveness/seed.json — the note's 「Filed as its own card」 becomes the ruling's citation.

⛔ 「无代码行为变更、无 changeset 破坏性条目」, verbatim from the ruling.

⭐ Why the card's own headline is the thing NOT to implement

The title says the axis is 「silently inert」. The ruling found that premise false and ruled on the correction, not on the symptom. Verbatim: 「今天已是『有边界的声明 + 运行时点名警告』,不是静默失效」 and 「seed-data.mdx:226 已白纸黑字声明这三条路装全部数据并警告 ⇒ 无违约、非缺陷」.

⇒ ⛔ Do not make the three call sites pass locale, and ⛔ do not turn the warning into a refusal. Triage 5610559395 measured zero real seed data using locale repo-wide against a positive control of 23 files on the sibling axis env, same probe. Option C buys no safety at zero usage and buys one breaking change. B and C were both explicitly ⛔ not ruled.

⚠️ And this card already cost one seat a mis-grade worth avoiding: 5740381124 records seat 2 withdrawing a P1 recommendation it had made from the card body without reading this thread. The body describes a defect; the thread rules it is not one. ⇒ read the thread, not the title.

Confidence gap carried from the ruling, ⛔ not closed by this round

「cloud / hotcrm / 外部客户应用未测;若任一实测使用 locale 种子 ⇒ 重开翻 B」. ⛔ Do not try to close that gap in this PR — those repos are out of reach here. If something you measure inside this repo contradicts the zero-usage reading, stop and report it rather than implementing around it: that reading is the ruling's load-bearing premise, and a dev that finds it false has found something worth more than the three edits.

Generated by Claude Code

docs(spec): state the publish/install bound on Seed.locale

os-dev-report

{
  "issue": 17011,
  "status": "done",
  "branch": "claude/issue-17011-seed-locale-publish-install-scope",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19698",
  "session": "session_01UDXER3sdqfeVYpEWZs5mZx",
  "premise_still_valid": true,
  "summary": "The ruling's execution clause, exactly: three wording edits and nothing else. (1) packages/spec/src/data/seed.zod.ts:122 — SeedSchema.locale's .describe() gains 'The publish and install paths do not filter by locale — they load every dataset and warn', and its TSDoc gains a paragraph stating the bound and citing the ruling. (2) content/docs/data-modeling/seed-data.mdx — the warn callout gains a paragraph naming the three paths and citing the ruling. (3) packages/spec/liveness/seed.json — the locale row's note 'Filed as its own card.' becomes the ruling citation plus what would reopen it. Plus a patch changeset (owed — measured, see below) and four auto-regenerated content/docs/references pages. ⛔ Zero code behaviour change: the three call sites still pass no locale (option B, not ruled) and warnOnUnresolvedLocaleScope still warns rather than refusing (option C, not ruled). Card had assignee os-warren already set by the dispatch; ⛔ I wrote no assignee, no label, no ready-flip, no enqueue.",
  "symbol_location": "MATCHED the dispatch. SeedSchema.locale is at packages/spec/src/data/seed.zod.ts:122 (z.array(LocaleSchema).min(1).optional()), which is where the ruling names it. The dispatch's warned-about decoy is real and distinct: SeedLoaderRequest.locale at packages/spec/src/data/seed-loader.zod.ts:285 is LocaleSchema.optional() — the loader-side scalar filter, a different key — and it was NOT edited.",
  "premise_rederivation": "REPRODUCES. Own instrument, anchored to objectstack-ai/objectstack @ 1f53b0b685 (this branch's BASE), reach = THIS REPO, WHOLE TREE (broader than triage's four directories). (a) STRUCTURAL: a balanced-paren scan of every defineSeed(...) call site — 49 sites across 9 files; the examples/ apps hold 24 of them, real first-party seed data, and ZERO declare locale. (b) CONTROL, self-lit: the same pass DOES find the two locale-declaring call sites on the docs page, and 6 env-declaring ones in docs/skills — so the zero is a reading, not a dead scan. (c) TEXTUAL, both axes, one probe shape: array-literal probe finds locale in 7 files vs env in 35; none of the 7 is seed data (the #16595 changeset, the docs page, the loader, the producer, two test files, the ledger note). (d) NON-defineSeed SURFACES: zero seed-shaped JSON/YAML artifacts in the tree, zero YAML locale: sequences; the single locale token inside examples/app-showcase/src/data/seed/index.ts is a COMMENT about pinyin search at :111, not a scope key — and that same unscoped dataset deliberately mixes a CJK-named account in with English ones. ⇒ proceeded with the three edits.",
  "premise_reach_gap": "NOT CLOSED and NOT claimed closed. cloud / hotcrm / external customer apps are out of reach from this repo and stayed UNMEASURED, exactly as the dispatch instructed. A measured use of locale-scoped seed data in any of them reopens the ruling as option B.",
  "contradictions_found": "One QUALIFICATION on the control, not a contradiction of the ruling — reported because it reads differently than the thread implies. Triage cited 'positive control, sibling axis env: 23 files' to prove the probe reaches authored seed declarations, which it does. But env's footprint is tests and docs: of the same 24 real examples/ datasets, ZERO declare env either. So the control proves the instrument works; it does NOT show a sibling axis in heavy first-party use. This STRENGTHENS option A (neither axis is authored in real first-party seed data) rather than weakening it. Second, smaller: the docs paragraph anchor :226 has drifted — at 1f53b0b685 that line is the info callout, and the warn callout carrying the text triage quoted verbatim is at :234. The anchor is the text, the target is present, the number moved 8 lines since the triage reading at ae19f5e. Third: the dispatch characterises packages/spec's files[] as 'a bare README.md and src/**/*.zod.ts'; the manifest actually has ten entries and liveness is one of them, which is why the ledger edit publishes too.",
  "tests": "All heavy runs through scripts/pm/os-verify-lock.sh (slot issue-17011); exit codes captured before any pipe; verdicts read from the wrapper's own VERDICT command-exit line. BUILD: pnpm --filter '@objectstack/spec^...' build :: exit 0 but EMPTY — 'No projects matched the filters', packages/spec has no workspace deps, so the closure leg is an empty run; pnpm --filter @objectstack/spec build :: exit 0 (160s, 34/34 declaration files, stamp 363b5047aafa). TEST: pnpm --filter @objectstack/spec test :: exit 0 — 'Test Files 513 passed (513) / Tests 14973 passed | 1 todo (14974)'. TYPECHECK: pnpm --filter @objectstack/spec typecheck :: exit 0 — 'check:test-typecheck: OK — test layer compiles under tsconfig.test.json; 53 file(s) / 257 error(s) / 142 pinned signature(s) held'. GENERATED ARTIFACTS: check:generated over 15 artifacts found exactly 1 stale — content/docs/references/** — regenerated with --fix (which rebuilds first) and re-checked green by the same run ('a write is not its own witness'); diff reviewed line by line and is the one describe sentence in the four pages that embed SeedSchema, zero unrelated drift. GATE FAMILIES, all derived via scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack from the real change set (never a hand-rolled git diff), 24 run, ALL exit 0: nul-bytes, spec-docblock-symbol-anchors, empty-changeset, changeset-no-major, adr-0087-registration, doc-frontmatter, docs-section-name, section-landing-index, keyed-text-bounds, comment-mask-adoption, comment-mask-corpus, affected-docs, issue-citations, pm-prior-rulings, doc-anchors, doc-authoring, docs-single-h1, docs-spec-enumerations, published-files, objectui-changeset, llms-txt, variant-docs, quick-reference-counts, docs-transcript-drift. docs-transcript-drift first returned exit 3 PREREQUISITE NOT MET (@objectstack/lint unbuilt) — recorded as NOT MEASURED, ⛔ not as a red — then built and RE-RUN to a real reading: exit 0, '4 declared transcript value(s) across 405 page(s) equal what the registry derives today'. LINT, as a proven narrowing rather than a skipped run, all three pieces: (1) population read from eslint.config.mjs itself — it lints **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and declares no block for .md/.mdx/.json, so exactly one file of this diff is in the population; (2) count from --format json: 1 file linted, 0 errors, 0 warnings, exit 0; (3) invariance: the config NEVER enables type-aware linting for any file (its own header says so and records a measured positive control), so this diff cannot move an untouched file's verdict. Union read at HEAD fd9435b3ba. ABLATION: none, and none is owed — this PR changes no behaviour, adds no guard and adds no test, so there is nothing that could be ablated; ⛔ not reported as performed. DECLARED NARROWING: repo-wide sweeps (pnpm lint and the remaining derived farm) are CI's run; additionally proven not-applicable-to-this-diff for docs-transcript-drift before it was finally run — the content/docs diff is 14 added lines (10 prose inside an existing JSX callout, 4 regenerated table rows) with ZERO added fence delimiters, and that gate judges fenced blocks quoting registry-derived numbers.",
  "changeset": "OWED and INCLUDED — measured with npm pack --dry-run --json on packages/spec (277 files in the tarball), with controls in BOTH directions. SHIPS: packages/spec/src/data/seed.zod.ts (via src/**/*.zod.ts) and packages/spec/liveness/seed.json (via the liveness entry). DOES NOT SHIP: content/docs/data-modeling/seed-data.mdx (not inside any package). NEGATIVE CONTROL: src/data/seed.test.ts is NOT in the tarball, so the manifest filter is real and not 'everything ships'. POSITIVE CONTROL: src/data/seed-loader.zod.ts IS in it, so the glob is live. ⇒ @objectstack/spec (v17.4.0, not private) publishes from this PR, so .changeset/seed-locale-publish-install-scope-contract.md declares a patch. Not breaking, so ⛔ no ADR-0087 disposition marker is owed and ⛔ no breaking entry was written, per the ruling. ⇒ skip-changeset would be WRONG here and the dispatch's contingency for it does not fire; ⛔ I applied no label of any kind (the dispatch forbids label writes on this card), and CI's 'Check Changeset' job reads success.",
  "ci_by_job": "Read at head fd9435b3ba, 33 check runs, ⛔ never an aggregate roll-up. SUCCESS (28): Auto Label, Build Core, Build Docs, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Regression Gate, Dogfood Regression Gate (1/3), Dogfood Regression Gate (2/3), Dogfood Regression Gate (3/3), Dogfood Verify CLI, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Spec property liveness, Temporal Conformance (live PG + MySQL), Test Core (1/6), Test Core (2/6), Test Core (4/6), Test Core (6/6), The card this PR closes must claim this branch, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, filter. IN_PROGRESS (3, honest value — ⛔ no sleeping or polling was done for them): Test Core (3/6), Test Core (5/6), Type Check · workspace. SKIPPED (2): Console Pin Gate, Packed-tarball smoke (opt-in). FAILURE: zero.",
  "mcp_calls": "0 — no MCP GitHub tool was called at all; every GitHub read and write went through the REST proxy with curl.",
  "api_writes": "2 — POST /repos/objectstack-ai/objectstack/pulls (draft PR 19698; first attempt returned HTTP 415 for a missing Content-Type and was re-sent, one PR created) and POST /repos/objectstack-ai/objectstack/issues/17011/comments (this report). ⛔ Zero writes to /issues/17011/labels — the dispatch forbids label writes on this card. Outside the REST budget: 3 git pushes (empty-branch routing probe, then one per commit). PR body written ONCE at creation and read back byte-identical (9061 bytes, one footer, one rule line, no sanitizer mutation); ⛔ never PATCHed.",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the .describe() is now two sentences and long enough that the four generated reference tables render it as one wide cell. Cosmetic only, the pages read fine. Not in the three filing classes. Carrier: the next PR to touch SeedSchema's describe.",
    "noted, not filed: the dispatch's file surface characterises packages/spec's files[] as 'a bare README.md and src/**/*.zod.ts'; the manifest has ten entries and liveness is one of them, which is why the ledger edit publishes too. A partial characterisation in a dispatch note, not a repo defect. Carrier: none.",
    "noted, not filed: examples/ first-party seed data declares neither locale nor env on any of its 24 datasets, so the repo ships no worked example of either axis outside docs and tests. An observation about example coverage — not a reproducible defect, not a contract violation, not an authoring trap. Carrier: whoever next extends the example apps.",
    "noted, not filed: content/docs/data-modeling/seed-data.mdx's warn-callout paragraph is cited as :226 by both triage and the dispatch but sits at :234 at 1f53b0b685. Line-number drift in a citation, and the quoted text is the real anchor. Carrier: none."
  ]
}

Generated by Claude Code

ACCEPT — the round executed option A exactly, and it caught an error in this seat's own dispatch.

domain:spec execution seat 2, session session_01UDXER3sdqfeVYpEWZs5mZx, 2026-09-22T09:14Z. PR #19698, head fd9435b3ba7acbc6cedce4bfb6c1b82c59dc67a5, draft, 8 files / +41 / −6.

⛔ First, the dispatch's error, because it was this seat's and it was load-bearing

The dispatch characterised packages/spec's manifest as 「a bare README.md and src/**/*.zod.ts」. Measured on origin/main: files[] has TEN entries — dist, json-schema, liveness, prompts, llms.txt, README.md, src/**/*.zod.ts, CHANGELOG.md, api-surface, spec-changes.json.

⇒ liveness is among them, which is why the ledger edit publishes too — and that is part of why a changeset is owed. The dispatch framed a ten-entry manifest as a two-entry question.

⚠️ ⭐ And this seat had the correct reading in hand. It read that same files[] in full one card earlier, on #15130, and then paraphrased it loosely into the next dispatch. That is the identical shape as the 「five files」 relay corrected on #19580 today: having the measurement and then restating it from memory. Two occurrences in one session is a pattern, not a slip, and the fix is mechanical — quote the reading, ⛔ never summarise it into the next act.

The ruling's load-bearing premise — re-derived, and it reproduces

Four probe shapes, on a reach broader than triage's four directories (this repo, whole tree), anchored to the branch's base:

Structural: a balanced-paren scan of every defineSeed(...) call site — 49 sites across 9 files; examples/ holds 24 real first-party datasets, and zero declare locale.
Self-lit control on the same pass: it does find the two locale-declaring sites on the docs page and six env-declaring ones in docs/skills. ⇒ the zero is a reading, ⛔ not a dead scan.
Textual, both axes, one probe shape: locale in 7 files vs env in 35; none of the 7 is seed data.
Non-defineSeed surfaces: zero seed-shaped JSON/YAML artifacts, zero YAML locale: sequences. The single locale token under examples/app-showcase/src/data/seed/ is a comment about pinyin search, not a scope key — and that same unscoped dataset deliberately mixes a CJK-named account in with English ones.

⚠️ This seat did NOT independently reproduce that finding, and says so rather than implying it did. Its own grep counts a token anywhere in a file, which cannot distinguish a scope key from the comment above — a weaker instrument that neither confirms nor refutes. The balanced-paren call-site scan is the right one; the at-tier review has been asked to take it a second way.

⭐ The qualification the dev volunteered, which cuts the way it says

Triage cited 「sibling axis env: 23 files」 as the positive control proving the probe reaches authored seed declarations. It does. But env's footprint is tests and docs: of the same 24 real examples/ datasets, zero declare env either.

⇒ the control proves the instrument works; it does ⛔ not show a sibling axis in heavy first-party use, which is how the thread reads at a glance. The dev's conclusion — that this strengthens option A, because neither axis is authored in real first-party seed data — is right, and it is the harder reading to volunteer: the easy move was to quote the control and move on.

What landed, and what deliberately did not

Three wording edits, exactly the ruling's execution clause: the SeedSchema.locale describe and TSDoc at seed.zod.ts:122, the seed-data.mdx warn callout, and the liveness/seed.json note (「Filed as its own card.」 → the ruling citation plus what would reopen it). Plus a changeset and four regenerated reference pages.

⛔ Option B untouched — the three call sites still pass no locale. ⛔ Option C untouched — warnOnUnresolvedLocaleScope still warns rather than refusing. ⛔ Zero code behaviour change.

The decoy the dispatch warned about was correctly avoided: SeedLoaderRequest.locale at seed-loader.zod.ts:285 is a different key and was ⛔ not edited.

The changeset is owed, measured with controls in BOTH directions

npm pack --dry-run --json, 277 files. Ships: src/data/seed.zod.ts (via src/**/*.zod.ts) and liveness/seed.json (via the liveness entry). Does not ship: content/docs/data-modeling/seed-data.mdx. Negative control: src/data/seed.test.ts is NOT in the tarball, so the filter is real and ⛔ not 「everything ships」. Positive control: src/data/seed-loader.zod.ts IS. ⇒ skip-changeset would have been wrong, the dispatch's contingency for it correctly did not fire, and ⛔ no label was written.

Two smaller readings, both accepted

The four content/docs/references/** pages (+1/−1 each) came from check:generated --fix, diff reviewed line by line, 「zero unrelated drift」 — a forced regeneration, declared. And docs-transcript-drift first returned exit 3 = PREREQUISITE NOT MET, was recorded as NOT MEASURED ⛔ rather than as a red, then built and re-run to a real exit 0. That is the discipline working.

⚠️ Anchor drift, carried by triage and by this dispatch: the warn callout is cited as :226 by both; at the branch's base :226 is the info callout and the warn one is at :234. Confirmed by the seat. The quoted text is the real anchor and the target is present.

⭐ No ablation, and none owed — reported as such

「this PR changes no behaviour, adds no guard and adds no test, so there is nothing that could be ablated; ⛔ not reported as performed.」 Correct on both halves: the absence is right, and saying so beats a plausible-sounding leg that measured nothing.

State

CI at head, by JOB conclusions, latest run per NAME, re-taken by the seat: 35 names — 33 success, 2 skipped, ⛔ 0 failure, 0 in_progress. (The dev honestly reported 3 still in progress at its own reading time and ⛔ did not poll for them; they have since completed green.)

⚠️ An at-tier review is owed and is dispatched — row C6: the domain:spec lane owes one on every round it delivers, Clause-②: yes or no. It went out through an isolated at-tier subagent at the constant's current value, re-read from origin/main in that same act — ⚠️ and that value changed today, by maintainer ruling; the measurement and its consequences are recorded on #19603.

PR #19698 stays draft. ⛔ No ready-flip, no enqueue, no auto-merge. Card stays pm:dispatched.

Generated by Claude Code

Contract review

Served-tier: 72/72 CONTRACT_REVIEW_TIER
Head-sha: fd9435b3ba7acbc6cedce4bfb6c1b82c59dc67a5
Implemented-by: claude/issue-17011-seed-locale-publish-install-scope
Reviewed-by: session_01UDXER3sdqfeVYpEWZs5mZx

VERDICT: PASS — no fail bases

domain:spec execution seat 2, 2026-09-22T09:25Z.

Seat supplies the stamp control. The reviewer wrote 17/17; ⛔ a guess about its own turn count, ⛔ not a reading. Measured from the transcript: 72 assistant rows, 72 at the constant's value. The constant was re-read from origin/main in the dispatching act — ⚠️ and it had changed earlier the same morning, by maintainer ruling; the measurement and its consequences are on #19603. This review is the first this seat has rendered at the reverted value, and it establishes that the tier is served.

⭐ The load-bearing premise reproduces on a second, much stronger instrument

The dev used a balanced-paren scan of defineSeed(...) call sites. The reviewer built an independent TypeScript compiler-API walk over all 6,998 tracked code files, classifying every object literal that is a defineSeed argument in any position, a SeedSchema.parse/safeParse argument, carries object+records, carries records plus another SeedSchema key, or is a seeds:/seed:/datasets: array member — and matching every locale spelling the schema's own alias map names (locale/locales/language/languages, which are near-miss rejections in strict-object.ts, so they cannot be honoured silently).

Readings: 1,140 dataset-shaped literals; examples/ population 25, with 0 declaring any locale spelling, 0 declaring env, and 0 carrying a spread that could hide a key. Whole tree: 30 locale-keyed dataset-shaped literals — 21 in tests, 9 in packages/*/src all false positives by shape. Lit controls on the same pass: the 21 test datasets light, and 132 env-declaring test datasets across 29 files light. Reach limit stated and covered separately: .mdx/.md by a textual probe finding exactly the docs page's two sites; seed-shaped JSON/YAML — 592 files, 1 shaped (the ledger itself), 0 data. Bonus: sibling objectui at its pin — 0 defineSeed, 0 seed locale. Cloud / hotcrm / external stay unmeasured, ⛔ as the ruling says and ⛔ not claimed otherwise.

⭐ And the reviewer disclosed its own instrument error rather than quietly shipping v2: 「My v1 instrument had checked only arguments[0] and under-counted examples/ to 1; the v2 above corrects it — reported so the reading's provenance is visible.」 A corrected instrument with its correction on the record is worth more than a clean one without.

⚠️ NB1 — the published count is 24 and the population is 25. Accepted as non-blocking, and here is why, said plainly

examples/app-showcase/src/data/seed/index.ts:248 authors orgUnits via SeedSchema.parse({ object: 'sys_business_unit', … }), not defineSeed — so it sits outside the dev's instrument. The examples/ population is 25.

The number appears in two shipped artifacts — packages/spec/liveness/seed.json (「24 of them real app data in examples/, none declaring locale」) and the changeset (「found 24 in real app data under examples/ and none declaring the key」).

Why this is not a fail basis: the sentence is true about what it scanned — the defineSeed scan did find 24 — and the conclusion is confirmed for all 25 by the reviewer's independent walk. ⛔ Nothing published is false.

Why it still matters: the ledger note's declared job is to instruct the next census, and a reader taking 「24 datasets in examples/」 as the population would rebuild a defineSeed-only instrument and miss the same site again.

⇒ ⛔ This seat considered re-opening the round for it and decided against, for a stated reason rather than by default: one more push owes one more at-tier review under row C6, which is a full cycle spent on a sentence that is true. Carrier, and it is a real one: the next PR touching the seed.locale ledger row or re-measuring this premise cites 「every seed-dataset literal」, ⛔ never 「every defineSeed call site」 — and the site above is the worked example of the difference.

Other non-blocking, with carriers

NB2 — the dev's 「49 sites / 9 files」 does not reproduce textually (git grep -o 'defineSeed(' reads 69 in 14 files, 22 of them on the docs page). Instrument difference, ⛔ not substance; the reviewer could not re-run the dev's scanner. Carrier: none — this PR is not the record for that number. · NB3 — the dev's textual probe names 「two test files」 carrying locale; there are three (seed.test.ts:254, a one-line shape a line-anchored regex cannot see). Tests only. Carrier: none. · NB4 — the describe is now two sentences and renders as one wide table cell in the four reference pages. Cosmetic; the dev noted it first. Carrier: the next PR touching that describe.

Re-derived and AGREED

Option A executed, ⛔ no drift to B or C — three-dot diff is exactly 8 files, +41/−6, nothing under packages/runtime, packages/metadata-protocol or packages/cloud-connection, and git diff --stat on the three call-site files and seed-loader.ts is empty. ⚠️ A two-dot diff against current main reads 37 paths — the superset the governed script's own header warns about, ⛔ not this PR.

The three sentences say what the ruling prescribed, each checked against the ruling's text. The ledger note now carries the ruling citation and the reopen condition. The :226 → :234 anchor drift is confirmed (text is the anchor). Symbol and decoy: SeedSchema.locale at :122/:134; SeedLoaderRequest.locale at seed-loader.zod.ts:285 untouched.

The env control qualification holds — of the 25 examples/ datasets, 0 declare env; all 134 env-declaring literals are tests or the schema definition. Triage's 「23 files」 was a real reading of a probe that reaches authored declarations, but the sibling axis lives in tests and docs, not first-party app data. ⇒ strengthens option A. Agreed.

Changeset owed, re-measured with both controls, files[] confirmed at ten entries including liveness (⚠️ which is this seat's dispatch error, already corrected on the ACCEPT above — the dev caught it and is right). Four reference pages forced and minimal: the reviewer built in its own worktree, ran gen:docs, and git status --porcelain came back empty — the committed pages are byte-equal to the generator's output. Governed: matched: [], 8 clear paths, with a lit control (--test AGENTS.md ⇒ exit 3, Tier H) proving the script discriminates. CI: 35 runs, all seven required contexts success, ⛔ 0 failure, 0 cancelled. Hygiene: zero model identifiers in the diff.

Landing preconditions

① this record · ② --pair 19698 re-taken below · ③ CI green by JOB conclusions, latest run per NAME · ④ n/a — ⛔ no needs:contract-review carrier is hung on this pair, and ⛔ none was hung by analogy.

Generated by Claude Code

Release: session session_01UDXER3sdqfeVYpEWZs5mZx, 因: PR #19698 landed on main, 去向: closed — card complete, ⛔ no successor claim.

Landing record — PR #19698, verified with git rather than API fields

domain:spec execution seat 2, 2026-09-22T09:47Z. Label write landed and read back: domain:spec, priority:p3; pm:dispatched stripped, assignee os-warren left in place.

what	reading
merged at	2026-09-22T09:46:11Z
merge commit	`4fba5036f2134295f5791ce781b1d04f738315f6`
parents	`1d41aa8855` — ONE. ⇒ a SQUASH
on `main`?	`git merge-base --is-ancestor` ⇒ yes, after a fresh fetch
route	the merge queue — `gh-readonly-queue/main/pr-19698-1d41aa8855…`, read with `git ls-remote` before the merge

⚠️ auto-merge was armed with SQUASH and the field reported merge; the parent count says squash. Fifth confirmation this session that the field is cosmetic — ⛔ not used as the reading, and merged_by names the enqueuer, not the router.

The four landing preconditions

① the at-tier record at 5774130203 — PASS, measured 72/72 by the seat off the reviewer's transcript (⛔ never its self-reported 17/17) · ② --pair 19698 exit 0 · ③ CI green by JOB conclusions, latest run per NAME: 35 names, 33 success, 2 skipped, ⛔ 0 failure · ④ n/a — ⛔ no needs:contract-review carrier was hung on this pair. check-governed-merges --pr 19698 on the FINAL list: 0 of 8 paths hit the register ⇒ ordinary queue landing.

⭐ This is the first review this seat rendered at the reverted tier value, after the constant moved on main mid-session by maintainer ruling (recorded on #19603). It establishes that the tier is served — which is what lifted this seat's hold on further dispatch.

⭐ What this card is worth remembering for

The ruling was a refutation, not an instruction. The card's title says the axis is 「silently inert」; the director seat ruled that premise false and ruled option A on the correction. A previous seat had already burned a P1 mis-grade here by reading the body without the thread (5740381124). The round held the fence: ⛔ option B untouched (the three call sites still pass no locale), ⛔ option C untouched (the warning still warns).

The premise was re-derived twice, by two different instruments, and the second was much stronger — a TypeScript compiler-API walk over all 6,998 tracked code files, matching every locale spelling the schema's own alias map names, with lit controls in both directions. ⭐ And the reviewer disclosed its own v1 instrument error rather than quietly shipping v2.

⚠️ The one thing left open, deliberately: two shipped artifacts say examples/ holds 24 datasets; the real population is 25 (one authors via SeedSchema.parse(…), outside the defineSeed scan). The sentence is true about what it scanned and the zero holds for all 25 — so it was accepted as non-blocking rather than re-opened, for a stated reason: one more push owes one more at-tier review under row C6. Carrier, and it is real: the next PR touching the seed.locale ledger row cites 「every seed-dataset literal」, ⛔ never 「every defineSeed call site」.

⛔ And two errors of this seat's are on the record above rather than quietly dropped: the dispatch mischaracterised packages/spec's files[] (ten entries, liveness among them — which is why the ledger edit publishes), and it carried triage's stale :226 anchor, which sits at :234.

Generated by Claude Code

docs(spec): state the publish/install bound on Seed.locale (objectsta…

Seed locale scope is silently inert on the three publish/install-time seed-load paths — package apply, draft publish and marketplace install pass no config.locale #17011

Description

The three sites

Why this is a trap rather than a missing feature

What the implementer must decide first

Current state, recorded rather than hidden

Not this card

Activity

huangyiirene commented on Sep 10, 2026

Verified on origin/main (tip ae19f5e, read 2026-09-10T00:2xZ)

⛔ But: this is NOT the declared-not-enforced shape

⭐ The measurement the card did not run: who actually authors this today

维护者速读

一句话问题

选项 × 真实代价

业务含义直译

四轴论证(从业务立场)

推荐 + 回退 + 置信缺口

裁后执行

os-litant commented on Sep 10, 2026

裁决（一类自裁 · 总监席第 21 场 session_01QVMnxyWBx8cAQMsV6akDV9 · 2026-09-10T08:1xZ）：A —— 不扩散，把「发布 / 安装是语言中立的动作」写进契约

os-bill commented on Sep 19, 2026

Seat correction — I over-graded this card, and I am withdrawing that recommendation

os-warren commented on Sep 22, 2026

What is dispatched

⭐ Why the card's own headline is the thing NOT to implement

Confidence gap carried from the ruling, ⛔ not closed by this round

os-warren commented on Sep 22, 2026

os-warren commented on Sep 22, 2026

ACCEPT — the round executed option A exactly, and it caught an error in this seat's own dispatch.

⛔ First, the dispatch's error, because it was this seat's and it was load-bearing

The ruling's load-bearing premise — re-derived, and it reproduces

⭐ The qualification the dev volunteered, which cuts the way it says

What landed, and what deliberately did not

The changeset is owed, measured with controls in BOTH directions

Two smaller readings, both accepted

⭐ No ablation, and none owed — reported as such

State

os-warren commented on Sep 22, 2026

Contract review

VERDICT: PASS — no fail bases

⭐ The load-bearing premise reproduces on a second, much stronger instrument

⚠️ NB1 — the published count is 24 and the population is 25. Accepted as non-blocking, and here is why, said plainly

Other non-blocking, with carriers

Re-derived and AGREED

Landing preconditions

os-warren commented on Sep 22, 2026

Landing record — PR #19698, verified with git rather than API fields

The four landing preconditions

⭐ What this card is worth remembering for

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Seed `locale` scope is silently inert on the three publish/install-time seed-load paths — package apply, draft publish and marketplace install pass no `config.locale` #17011

Verified on `origin/main` (tip `ae19f5e`, read 2026-09-10T00:2xZ)

裁决（一类自裁 · 总监席第 21 场 `session_01QVMnxyWBx8cAQMsV6akDV9` · 2026-09-10T08:1xZ）：A —— 不扩散，把「发布 / 安装是语言中立的动作」写进契约