metadata: refuse to save or load a page whose `requires` names a plugin that is not loaded (1 key)

[objectstack-fleet]

Ruled: 5902378057 · letter A + E on #20542 — stage ① merged into stage ②: one domain:cli PR builds the channel (one constant service key exported by @objectstack/metadata-protocol, registered by os serve, read per publish) together with the save-time refusal; lane → domain:cli; dispatch pointer 5902497015 (ruling 5881821895 · letter A, staged ①②③, stands; stage ③ follows ②) · 2026-09-30T01:52Z

Filing gate: ① a declared≠enforced family, filed as one sweep card per family under ruling A′ item ④ on #18900 (5727134555). This is triage's standing request 5857165909 on the seat post. Family page-requires, seat verdict ENFORCE.

• reach: the declared authoring door. packages/spec parses this key and publishes it in the reference docs. The liveness ledger row cited below records it as not enforced, and the census re-measured the reader side (§5 cross-checks, each with a lit control).
• The criterion is the maintainer's: 「每族该问的是:主流平台有没有这个能力 —— 有 ⇒ 补消费端(一次做对);没有 ⇒ 退役,而不是看仓里有没有人读」.
• The maintainer's one word, per ruling A′ ④: ENFORCE (the seat's proposal: the mainstream has it, so build the consumer once, correctly) or RETIRE (retire the key together with its ledger row).

Census by the domain:spec execution seat 1 (session_01Rjy9MeetSfq34PKn81CRiN, seat post #6017), 2026-09-27. Bases: objectstack a9fb83ef, re-checked against 4d7e740d, where no ledger file or cited surface moved; objectui 6fa5f64a1 (pin f8a9d0fb); cloud 96eb092. ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim. This family's rank is 13 of 16. The sibling family cards filed so far are #20273, #20274, #20281, #20282, #20287–#20289, #20294, #20295 and #20299–#20301; the ledger fix is #20296.

Capability: Dependency check: a page that references a component namespace from a plugin that is not present is refused, not broken at render

key	ledger status	ledger row	what the ledger cites
page.requires	planned	packages/spec/liveness/page.json:9	note: Plugin namespaces the JSX source references (ADR-0080). Inferred at compile time; save/load enforcement of plugin presence is deferred (M3b) — declared, not enforced yet.

Mainstream evidence:

• Salesforce metadata deploy validation: a Lightning page that references a missing component fails deployment.
• Power Apps solution import runs a dependency check, and missing dependencies block the import.

Verdict: ENFORCE — the mainstream has the capability, so build the consumer once, correctly.

Reader that must exist / disposition: objectstack packages/metadata-protocol (save door) and runtime load: compare page.requires against the loaded plugin namespaces (ADR-0080 M3b). Today 0 reads (the only requires reads are stack-level config.requires, e.g. runtime/src/standalone-stack.ts:831).

User-visible risk (2): A page saved against a missing plugin fails only at render time, for the end user.

Acceptance: Every ledger row listed leaves dead/planned/experimental for live, citing the new reader as file#symbol (and a producer where the read depends on a supplied input); pnpm check:liveness green; the family's byStatus in state-counts.md regenerated.

Lane: domain:spec parent + metadata-protocol sub-issue (objectstack)

File surface: packages/spec/src/ui/page.zod.ts:903 · packages/metadata-protocol/src/* (save door) · packages/spec/liveness/page.json

Dedupe: page\.requires \| requires.{0,40}(plugin presence\|M3b) \| ADR-0080 → 5 open hits. None carries a key of this family:

• [Decision] may a kind:'html' page author intrinsic HTML tags (div, a)? The console manifest says no, 3 of 3 shipped html pages say yes, and #19922's fallback cannot go live until one side changes #20112 — keyword coincidence (ADR-0080): html-page intrinsic-tag decision
• #19188 split: 145 top-level zod-only keys need a RECORDED REASON, never a form row — and none can be recorded until the ledger learns a root path #19333 — form-offer axis ("no offer until enforced"); not an enforce-or-remove carrier
• [finding] metadata-form ↔ zod 对账门的 top-level zodOnly 方向**根本没接线**(只有嵌套列表有),这就是两个已声明键在全门禁绿的情况下缺席表单的原因 —— 本树实测 276 个 top-level zod-only 键 #19188 — census parent of #19188 split: 39 top-level zod-only keys are structured controls needing a designed widget, not a row #19332/#19188 split: 145 top-level zod-only keys need a RECORDED REASON, never a form row — and none can be recorded until the ledger learns a root path #19333 (form-offer axis)
• [finding] the shared symbol-anchor resolver refuses 8 anchors that name real declaration sites — an INLINE object-literal key, and a DATA identifier that heads a dotted string token #18101 — keyword coincidence (ADR-0080): symbol-anchor resolver finding
• objectui#10808(PR) — keyword coincidence (ADR-0080 amendment in a changeset list)

四轴:

• 实际业务需求: 安装包或页面依赖缺失时,在保存或部署阶段拒绝,是 Salesforce 与 Power Apps 的标准行为。
• 项目长远合理性: 依赖声明由编译期推断、在保存期校验,形成闭环,是 ADR-0080 已规划的 M3b。
• 防 AI 写错: AI 生成的 JSX 页面引用未安装的插件时,保存即报错,不会在用户那里白屏。
• 创业阶段不扩散: 单键、单个校验点。

[objectstack-fleet]

Path: changing a running app without code | 缺项 (no item saves a page whose requires names an unloaded plugin) | P1

Triage: first grade — enhancement · priority:p3 · domain:spec · area:studio · pm:queue. Verdict: ENFORCE, by the maintainer's criterion

Triage: the reader lands in packages/metadata-protocol (the save door) and the runtime load path: compare page.requires against the loaded plugin namespaces (ADR-0080 M3b) ⇒ domain:spec parent, with a metadata-protocol sub-issue. Rationale: a page saved against a missing plugin fails only at render time, for the end user. No measured author ⇒ p3.

Triage seat (objectstack-wide, seat post #6015) · session_01W89enF2dYV7K4N2Fbfj33f · 2026-09-27T22:18Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card (no comments), the criterion on #18900 (5727134555), and the family grades applied on #20273 onward.

Verdict. Dependency checks at save or deploy time are mainstream: Salesforce deploy validation fails a Lightning page that references a missing component, and a Power Apps solution import blocks on missing dependencies. ⇒ ENFORCE. One word from the maintainer reverses it before dispatch.

Execution notes.

1. Refuse at the save door, and report at load, a page whose requires names a namespace no loaded plugin provides, with a prescription naming the plugin.
2. Pin one refused save and one load report, with a page whose requires is satisfied as the control.
3. The ledger row flips to live.

[objectstack-fleet]

Claim: PM loop round 1
Session: session_014EJ1ED8X4MMrT18BhVx4tx
Account: os-tesla (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20312-page-requires-enforced
Worktree: objectstack-issue-20312
Domain: domain:spec (parent; the packages/metadata-protocol save-door half is carried in this one PR, as triage 5860357340 routes it: "domain:spec parent, with a metadata-protocol sub-issue")
Seat: domain:spec#2 (seat post #18549)
File surface, per the card and triage 5860357340 (ENFORCE):

• the save door in packages/metadata-protocol/src/**: refuse a page whose requires names a namespace no loaded plugin provides, with a prescription naming the plugin;
• the runtime load path: report the same at load (the dev measures where pages are loaded);
• packages/spec/src/ui/page.zod.ts (~:903): the requires describe text only, if it still says enforcement is deferred;
• packages/spec/liveness/page.json: the requires row flips to live, citing the reader;
• packages/spec/liveness/state-counts.md, regenerated;
• their tests and .changeset/20312-*.md.
  (stop on breach; explain in the report)
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate). The diff narrows what the save door accepts, so the at-tier review is owed before enqueue.
  Clause-②: no
  Thread-read: 5860357340
  Serial constraints cleared: read at 2026-09-28T16:31Z against origin/main 75b2169243. No open PR touches packages/spec/src/ui/page.zod.ts, packages/spec/liveness/page.json or packages/metadata-protocol/src/** (open-PR file lists read at this stamp). This seat's in-flight finding(metadata-protocol): a query carrying groupBy / aggregations silently drops search — grouped counts under a search are the unsearched counts #20358 edits packages/metadata-protocol/src/protocol.ts in findData's grouped branch: same-file ordinary concurrency if the save door is in that file too; the later lander merges. liveness/state-counts.md is the shared hot file (liveness/state-counts.md's shared total row makes every liveness-touching PR dirty whenever another lands, so its CI never starts until a merge-and-regenerate round #20361): expect a merge-and-regenerate round per sibling landing.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20312,
"status": "needs_decision",
"branch": "claude/issue-20312-page-requires-enforced",
"pr": null,
"session": "session_014EJ1ED8X4MMrT18BhVx4tx — the dispatching PM session (subagent = parent's); claim 5874283305, verified as the newest Claim: on #20312, names this branch",
"premise_still_valid": false,
"summary": "No code: the dispatch's own stop condition (mechanism hypothesis 2) holds — no registry answering 'is namespace N provided by a loaded plugin' is reachable from the save door or from the load path, so ENFORCE cannot be executed without a public-contract decision (open_questions). Measured at objectstack 75b2169 and the objectui pin dd3f7e1be3: page.requires holds objectui RENDERER namespaces taken from the SDUI manifest (17 in repo-root sdui.manifest.json: ui, record, page, element, action plus 12 plugin-*), not server plugin or package namespaces (manifest.namespace's regex admits no hyphen); the runtime save door saveMetaItem -> assertRuntimeAuthoringRules (metadata-protocol/src/protocol.ts:4972) -> evaluateRuntimeAuthoringGate (runtime-authoring-gate.ts:576) declares an sduiManifest input (:625) that its only caller (protocol.ts:5148) never passes, validateJsxPages is surfaces CLI_ONLY (lint/src/authoring-rules.ts:1049-1057, pinned off the runtime by runtime-lazy-deps.test.ts:403), no serving host resolves a manifest (resolveSduiManifest is CLI-only and its console leg resolves to nothing: @objectstack/console exports only ./package.json), and loadMetaFromDb (diagnose-never-drop) has the same absence. Producers 0 and readers 0: 0 of 25 .page. files and 0 of 41 page-defining source files author requires; sdui-parser/src/index.ts#compile infers it but both callers (lint validateJsxPages at build, objectui PageRenderer at render) discard it; the 3 in-repo html pages infer only ['ui']; every .requires read in packages//src is stack-level, and the objectui pin reads none. Consequence for every ENFORCE shape: a requires INFERRED against the manifest it is judged against is a subset of the provided set by construction (an absent plugin's tag is refused by compile()'s component whitelist and has no namespace to infer), so the save-time refusal the ruling wants is carried by the whitelist, and the one non-vacuous requires reader is the load-time check after the deployment's manifest shrank since save — the only reader that can name the missing plugin.",
"tests": "No suite owed (no diff). Measurements: sdui-parser build under os-verify-lock (VERDICT command-exit 0, waited 8m21s, held 3s). Scratch compile of the showcase html pages against repo-root sdui.manifest.json via sdui-parser dist: command-center-jsx ok=true requires=['ui'] unprovided=[]; start-here ok=true requires=['ui'] unprovided=[]; capability-map uses template interpolation so the regex extraction is invalid for it — its witness is lint validate-jsx-pages.production-witness.test.ts (validateJsxPages with the manifest answers []). Control: provided.has('plugin-kanban')=true, provided.has('plugin-nonexistent')=false. Producer census: git grep -c requires over the 25 .page. files = 0 hits, control git grep -c source lit on 5 files; over 41 page-defining source files 6 hits, each inspected: prose or stack-level. Reader census: .requires / ['requires'] reads in packages//src non-test = 13 hits, all stack-level (config, artifactStack, stack.zod d.requires) or sdui-parser's own return value; objectui at the pin: 0 page .requires reads, control compile(src, getJsxManifest()) lit (1). No ablation (nothing to ablate).",
"mcp_calls": "0",
"api_writes": "1 — POST /repos//issues/20312/comments (this os-dev-report, through scripts/pm/post-stamped.mjs). The empty-branch git push is not a REST write.",
"gates": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands -> EXIT=2, 'this branch changes nothing against origin/main (merge base 75b2169) — nothing to derive'; no gate owed, none run, --ran reconciliation not applicable. Cost reading only: the same tool over option B's 8 hypothetical paths (metadata-protocol protocol.ts and runtime-authoring-gate.ts, lint validate-jsx-pages.ts and authoring-rules.ts, cli serve.ts, console package.json, spec page.zod.ts and liveness/page.json) -> EXIT=0, 89 gate commands (74 excluding --self-test).",
"line_budget": "not applicable — no diff: 0 files, 0 lines; no governed surface touched",
"deviations": [
"No PR, code, changeset or ledger flip: dispatch hypothesis 2's stop condition met (no provided-namespace registry reachable from the save door or load path) => needs_decision, per the dispatch's instruction not to invent a second registry.",
"Branch pushed empty (the rule-1 write probe, identical to origin/main 75b2169); pr_create and label-write (PR assignee os-tesla) not spent — no PR exists. Worktree removed after this report; an ENFORCE round re-creates it from the pushed branch.",
"Hypothesis 2 falsified in part: requires is inferred by @objectstack/sdui-parser compile(), but NOT at save — nothing at the runtime save door compiles html source; compile's callers are the CLI build gate (os validate/build/lint, only when a manifest resolves) and objectui's render-time PageRenderer. Hypothesis 3 confirmed (0 page.requires reads). Hypothesis 4: save door = saveMetaItem -> assertRuntimeAuthoringRules (protocol.ts:4972); load = loadMetaFromDb in protocol.ts (convention: diagnose, never drop — [metadata_spec_invalid] warn, row still registered), so a load-side requires check would be a report, not a refusal."
],
"files_changed": [],
"open_questions": [
{
"question": "Q1 — Where does the runtime obtain the set of renderer namespaces this deployment provides (the SDUI manifest ADR-0080 §5 calls deployment-scoped), which both the save door and the load path must judge against? Today nothing holds it at runtime: the gate's sduiManifest input is unthreaded and no serving host resolves a manifest.",
"options": [
"(a) The serving host reads the manifest of the console it serves: @objectstack/console publishes ./dist/sdui.manifest.json in exports; os serve and the standalone host pass it through the metadata-protocol assembly into the gate's existing sduiManifest input; a host serving no console states none and prints ONE boot notice that page source and requires are unchecked, never a silent pass. Business: the one artefact that really is 'what this deployment renders'. Long-term: reuses the one registry ADR-0080 names; the deployment fact enters the way orgWallEnforced and judgeFilter do (gathered impurely, passed to a pure gate). Anti-AI: arms full compile at the only door a Studio, MCP or AI author has. Startup: M — cli serve, runtime standalone host, metadata-protocol assembly option, console exports; cloud per-project kernels owe their own threading.",
"(b) os build stamps the resolved manifest's namespace set into the compiled artifact, and the runtime reads it from there. Business: ties the check to the build rather than to the console actually served — the two diverge on a console pin bump without a rebuild. Long-term: a second copy of the manifest per artifact, a drift surface. Anti-AI: as (a) for artifact pages; runtime-authored pages judged against a build-time snapshot. Startup: M plus an artifact-format change.",
"(c) None — take Q2 option C and keep the manifest off the runtime."
],
"recommendation": "(a), because it is the only source that answers 'provided by THIS deployment' without inventing a registry, it follows the gate's established host-fact pattern, and its absence is made loud rather than a silent pass (AGENTS.md route-ownership rule 3)."
},
{
"question": "Q2 — Given a runtime manifest, which ENFORCE shape does page.requires take? Measured constraint: an INFERRED requires is a subset of the manifest it is judged against by construction, so a save-time requires check can only fire on an author-typed entry; the non-vacuous reader is the load-time check after the manifest shrank since save.",
"options": [
"A — keep requires authorable: the save door refuses (422 INVALID_METADATA, a new rule id) an author-typed entry the manifest does not provide, naming the namespace; load reports the same (warn, diagnose-never-drop). Business: fires only on hand-typed entries, and 0 in-repo producers type one. Long-term: an author-writable projection of source that can disagree with it (two sources of truth). Anti-AI: invites an AI to author the value, then polices only half of the disagreement. Startup: M on top of Q1.",
"B — ENFORCE as ADR-0080 §5 specifies: cross validateJsxPages onto the runtime page write door (sdui-parser has zero runtime dependencies, so RUNTIME_HEAVY_SOURCE_PARSE's typescript/sucrase reason is measured not to apply; the runtime-lazy-deps pin moves with it), so the component whitelist refuses an absent plugin's block at save; the save door STAMPS requires from compile() (source is truth; an authored value that disagrees is refused); load (loadMetaFromDb and artifact load) reports a stored page whose requires names a namespace the booted manifest lacks, naming that plugin. Business: the mainstream capability end to end (Salesforce deploy validation, Power Apps import-time dependency check). Long-term: requires becomes a derived cache like compiledTree, one source of truth. Anti-AI: strongest — an unknown or absent-plugin tag is refused at save, and an AI cannot author a requires that disagrees with its source. Startup: L — Q1(a) plus the rule crossing (every active html page save starts paying a full compile and can newly 422, so the precedent that crossed the object rules owes a false-positive measurement first) plus the describe change; 89 derived gate commands on its 8-path surface.",
"C — RETIRE page.requires (the maintainer's one-word reversal under ruling A′ ④): tombstone per the spec-property-retirement playbook, ledger row to its retired disposition, the published 'validated at save and load' claim removed (page.zod.ts:904, content/docs/references/ui/page.mdx:187); the save-time dependency check itself (whitelist against the deployment manifest) filed as its own card on Q1(a). Business: 0 producers, 0 readers, value derivable at any time from source plus the manifest. Long-term: no stored projection to drift; loses only the load-time naming of a vanished plugin. Anti-AI: removes a declared-never-enforced key an AI can fill today. Startup: S-M, immediate.",
"D — build door only, now: judge author-typed requires inside validateJsxPages when a manifest resolves (os validate/build/lint) and narrow the describe to that. Business: rarely fires — most projects resolve no manifest (the console leg is unreachable). Long-term: leaves the save and load halves open. Anti-AI: weak — Studio, MCP and AI authors never reach it. Startup: S, but the ledger row cannot honestly become live for save and load."
],
"recommendation": "B via Q1(a), because it is the only shape whose reader is both non-vacuous and names the missing plugin (load), and whose save-door refusal is the whitelist ADR-0080 §5 already ruled server-side — the 'build the consumer once, correctly' reading of the maintainer's criterion. If the maintainer judges the runtime manifest too wide for this stage, C is the honest alternative; never D, which keeps a published claim the runtime does not honour."
}
],
"out_of_scope_findings": [
"carrier: #20312's own decision (Q2 option B crosses it) · noted, not filed — validateJsxPages is held CLI_ONLY under RUNTIME_HEAVY_SOURCE_PARSE ('parses authored source through typescript/sucrase', lint/src/authoring-rules.ts:423-425), a reason shared with validateReactPages that does not apply to it: @objectstack/sdui-parser declares no runtime dependencies and every src import is type-only or package-local (measured), so the runtime save door runs no html source parse, against ADR-0080 §5 '[ruled] Authoritative parse + sanitize + validate + compile runs server-side at save'. Seam: spec:PageSchema.source (kind html) -> runtime:assertRuntimeAuthoringRules (protocol.ts:4972) | renderer:objectui PageRenderer (compile at render). Dedupe words: validateJsxPages runtime surface, RUNTIME_HEAVY_SOURCE_PARSE, html page save compile, ADR-0080 server-side save"
]
}

---

Generated by Claude Code

[objectstack-fleet]

Back to the decision box — premise falsified · domain:spec seat 2 (session_014EJ1ED8X4MMrT18BhVx4tx) · 2026-09-28T16:58Z

Release: session_014EJ1ED8X4MMrT18BhVx4tx (claim 5874283305) · cause: premise falsified — the dev report 5874605425 measured that no set of provided plugin namespaces reaches the save door or the load path, so the ENFORCE execution note has no reader to compare against · destination: needs-user-decision; pm:dispatched is replaced and the assignee os-tesla cleared in this act. Nothing is in flight: the pushed branch claude/issue-20312-page-requires-enforced carries no commit of its own.

The seat re-ran the report's load-bearing readings on origin/main 8e02859185 (commands below) before writing this. The analysis that follows is the seat's own; it does not adopt the dev's lettering.

---

维护者裁决(一个字母)· page.requires 怎么兑现

一句话问题:平台对外说「页面依赖的插件会在保存和加载时校验」,实际上从不校验。在 Studio、MCP 或 AI 保存一个用了本部署没装的插件组件的页面,保存照样成功,等最终用户打开页面才坏。原定的修法是「保存时拿 requires 去比对已加载插件」,但运行时根本没有「本部署提供了哪些组件命名空间」这份清单,所以原修法无从下手。

背景:本卡是 ruling A′ ④(#18900 5727134555)下的 declared≠enforced 族卡。分诊按维护者判据给了 ENFORCE,原文写明「维护者一个字即可在派发前推翻」(5860357340)。本席派发后,dev 实测证伪了执行前提(5874605425):requires 里放的是 objectui 渲染器的命名空间,来自 SDUI manifest(ui、record、plugin-kanban 等),不是服务端插件名;而服务端任何宿主都拿不到这份 manifest。

Governing text:

• ADR-0080 §5 [ruled](ADR 整体仍是 Proposed,且自注「save-time … pipeline NOT wired」):「Authoritative parse + sanitize + validate + compile runs server-side at save … Store { source, compiledTree, requires } — source is truth, tree is derived cache.」
• ADR-0080 :110:「requires is inferred at parse and validated at save and load (plugin presence …)」;:142:「the manifest and requires validation are deployment-scoped (a page referencing an absent plugin's block fails the gate, not the render — loud-not-silent)」。
• 维护者判据(本卡正文引):「每族该问的是:主流平台有没有这个能力 —— 有 ⇒ 补消费端(一次做对);没有 ⇒ 退役,而不是看仓里有没有人读」。
• 对外声明:packages/spec/src/ui/page.zod.ts:904 与 content/docs/references/ui/page.mdx:187:「validated at save and load」;账本 packages/spec/liveness/page.json:9 为 planned。

协议声明与是否改协议:A 兑现现有声明,不改协议;B 退役一个已发布键,属改协议(也改 ADR-0080 的存储形状);C 把 requires 从「派生」改成「作者可写」,改协议语义。

前提(每条带 re-check,本席已在 8e02859185 上跑过):

1. 保存门调用门禁时不传组件清单:git grep -n "sduiManifest" origin/main -- packages/metadata-protocol/src → 只有声明 runtime-authoring-gate.ts:625 和透传 :697;唯一调用点 protocol.ts:5148 不传。
2. 服务端宿主拿不到 manifest:git show origin/main:packages/console/package.json 的 exports 只有 ./package.json。
3. 页面编译校验只在命令行:git grep -n -A9 "name: 'validateJsxPages'" origin/main -- packages/lint/src/authoring-rules.ts → surfaces: CLI_ONLY。
4. 零作者手写:仓内 25 个 *.page.* 文件,手写 requires: 0 处;仓内 3 个 html 页面推断出的只有 ['ui'](dev 实测)。
5. 对外声明仍在:git grep -n "validated at save and load" origin/main -- packages/spec/src content/docs → 2 处。

选项 × 真实代价:

选项	做什么	客户看得见的后果
A · 按 ADR-0080 §5 一次做对(推荐)	① 服务端宿主拿到本部署 console 的组件清单,传进保存门(没带 console 的宿主开机时打印一行「页面源码与依赖未校验」,不静默放行);② 页面写入时在服务端编译,组件不在清单里即拒,requires 由编译结果盖章,手写与源码不符即拒;③ 加载时若插件已被卸,报告并点名缺的插件;账本转 live	Studio、MCP、AI 保存引用了未装组件的页面,当场 422 并点名插件;部署卸掉插件后,启动报告点名受影响页面。代价 L:跨 console、cli、元数据协议、lint、spec,且上线前要先测已存页面的误拒率
B · 退役 page.requires	墓碑退役该键、账本行转退役、删掉「保存和加载时校验」的说法;「保存时校验组件存在」另立一卡(同样依赖 A 的第①步)	作者少一个不起作用的键;保存时的组件校验照样可以做,但插件被卸后只在渲染时暴露给终端用户,没有加载时点名
C · 保留手写 requires,保存门只拒「清单里没有」的手写项	同 A 第①步,再加一条只判手写值的规则	只对手填了依赖的页面起作用(今天 0 个);源码和手写清单可以互相矛盾
D · 只在命令行判	os validate / os build 在能解析到清单时判手写 requires,改 describe	Studio、MCP、AI 保存完全不受影响;声明依旧名不副实

业务含义直译:A = 像 Salesforce 部署校验、Power Apps 解决方案导入的依赖检查那样,缺组件就在保存那一刻拒掉,插件被卸时点名告警;B = 承认 requires 只是编译的副产品,不存也不承诺,只把「保存时查组件在不在」单独做;C = 让作者手填一份依赖清单再去核对,一件事两份真相;D = 只有用命令行的开发者受保护,AI 和 Studio 作者照旧踩坑。

四轴:

• ① 长远:A 落到 ADR-0080 §5 已写明的终态:源码为真,编译树与 requires 是派生缓存,服务端保存时权威校验。它兑现已有声明,不增契约。B 缩小契约,但丢掉加载时点名缺失插件的能力,并要改 ADR-0080 的存储形状。C 新增一份可与源码矛盾的手写清单,是特例增生。D 保留一个运行时不兑现的声明。
• ② 业务拉动:今天没有人手写 requires(0 处)。真实拉动在「AI 或 Studio 保存页面时组件在不在」这件事上,这正是 ADR-0080 要解决的场景,不在这个键本身。维护者判据明说不以仓里有没有人读来定。
• ③ 防 AI 犯错(出错时谁看到什么):A 下,AI 写了部署里没有的组件,保存当场被响亮拒绝;插件被卸时启动报告点名。B 下保存时同样能拒(靠另立的卡),但插件被卸后是终端用户在渲染时看到坏页面。C 引导 AI 去填一个值,却只管一半不一致。D 下 AI 和 Studio 保存完全静默。
• ④ 创业阶段不扩散:B 最省(S–M,立即);A 是 L;C 是 M 且新增永久义务;D 最省,但留下一个名不副实的声明。

os-decision-facets
① 长远:A 兑现 ADR-0080 §5 终态、零新增契约;B 缩契约但改存储形状并丢加载时点名;C 新增可与源码矛盾的手写面。
② 拉动:手写 requires 零作者;拉动在 AI/Studio 保存时的组件校验,维护者判据不以仓内读者定去留。
③ 防错:A 保存即 422 并点名插件、卸插件时启动点名;B 卸插件后由终端用户在渲染时撞上;D 对 AI/Studio 静默。
④ 不扩散:B 最省(S–M);A 为 L;C 为 M 且永久维护手写面。
Prior rulings read: page.requires,sduimanifest,plugin presence,compiledtree,server-side at save → 1 hits; ADR-0080 §5 (Proposed, not an accepted decision); thread: none

推荐 A,子参数取「服务端宿主读取它所服务的 console 的组件清单」。这是唯一答得出「本部署提供了什么」、又不另造一份注册表的来源;另一种是 os build 把清单盖进产物,但它与实际服务的 console 会在 console 升级不重编时分叉。回退为 B。只看①选 A;②③④ 是否翻转:否。②④ 只影响分期:先接上清单,再上保存门编译,最后加加载报告。

置信缺口:云端每项目内核是否服务 console、能否拿到同一份清单,未实测;服务端运行时编译已存 html 页面的误拒率未实测,是 A 第②步上线前必须先测的;仓外(hotcrm、云端)html 页面数量未实测。

裁后执行:

• 回「A」⇒ 本席请分诊把第①步(console 导出组件清单、os serve 与独立宿主把它传进保存门、缺席时开机提示)拆成前驱卡;本卡挂 Blocked-by 等它落地,再派第②③步,账本、describe 与文档随之。
• 回「B」⇒ 本卡改派退役:按 spec-property-retirement 立墓碑、账本行转退役、删两处「validated at save and load」;保存时组件校验另立一卡,同样挂在第①步上。
• 回「C」或「D」⇒ 本席按所选形状重新派发,不再另起请示。

---

Generated by Claude Code