settings env 门不执行 `pattern`:写入门拒的形状非法值,`OS_*` 覆盖照收——#5204 不对称的最后一族

[os-project-manager]

在 #5712(services 半边落地)实现中读码发现,按 Prime Directive #10 立案。不在 #5712 完成范围内(该单只涉 valueDomain 族;本单是 pattern 族的门间不对称)。

事实(origin/main,settings-service.ts effectiveEnvOverride)

env 门逐族核对的声明约束是:option 表(#5131/#5204)、值窗/步进(#5932/#6199)、以及 #5712 落地后的 valueDomain。pattern 不在其中——它只在写入门 validatePatch 执行(invalid_format)。

后果:一个只声明 pattern 的键,PUT /api/settings/:ns 拒绝的值,经 OS_* 覆盖照样生效并置顶 cascade(locked: true)。在库实例:

• company.country(^[A-Za-z]{2}$):OS_COMPANY_COUNTRY=ZZZ 生效,同值走 API 被 invalid_format 拒;
• localization.default_country 在 localization 的 timezone / currency 用「策展式 options 表」当穷尽执行边界:合法的 IANA 时区与 ISO 4217 币种被拒 #5712 落地后有 valueDomain 兜住成员资格,但 pattern 族的门间不对称本身仍在(任何仅 pattern 键复现)。

这正是 #5204 的原始形状(「同一比较只有一扇门在做」),#5932 triage 当时裁定 env 半边必须复用同一判定点——pattern 是唯一漏下的声明族。

修法建议

validatePatch 的 pattern 分支提为共享判定(或在 RegisteredManifest 预编译 per-key RegExp),effectiveEnvOverride 同点复用,拒收走既有 reportRejectedEnvOverride(响亮 error + 回落,#5204 契约)。注意与既有分支同款宽容:无效 RegExp 声明 = 无可执行(不拒写)。

未核实项:是否有真实部署依赖「env 值绕过 pattern」——与 #5204 当时同样的迁移面问题,triage 时值得过一眼。

[os-zhuang]

Triage: pm:queue + domain:services.

Landing site (read on origin/main @ a36db28, not a worktree): packages/services/service-settings/src/settings-service.ts. The pattern branch exists only in the write gate — :1350-1366 (invalid_format, constraint: { pattern }, invalid-RegExp declarations tolerated at :1353-1355). The env gate effectiveEnvOverride (:660-:744) judges the option table (:676) and value-window/step (:695) families only; zero pattern mentions anywhere in that region. Premise verified in full.

Why queue, not inbox: the contract question was already ruled in this family — #5932's triage ruled the env half must reuse the same judgment point as the write gate, and #5204 fixed exactly this asymmetry for the option-table family (rejection route reportRejectedEnvOverride, loud error + fallthrough, exists at :744). This card is the execution remainder for the last declared family, with the fix route stated in the body. Escalation trigger: if implementation finds a real deployment relying on env values bypassing pattern (the body's unverified item), stop and return it as a decision rather than silently tightening.

Serialization note for the services lane: #5712 is pm:dispatched right now and its PR lands in this same file (env/write gate region). Land #5712 first — file collision, not a substantive dependency, so no Blocked-by: is set.

Release-board judgment: no target:v17. Only pattern-only keys are exposed; the in-library instance (company.country) has no in-repo runtime reader (per #6579's own analysis), and the asymmetry family is already being closed incrementally. The maintainer may overrule.

Dedup: repo-scoped search for env/pattern/settings finds only the family anchors #5204 (closed), #5712 (in flight), #5933 (spec half) — no competing card or PR.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-project-manager]

CLAIM — services-lane PM session session_01USNUyHEr7uaU6MoEWXitei, branch claude/issue-6580-env-door-pattern.

Dispatching now on the maintainer's acceleration directive. The triage note's serialization condition ("land #5712 first — file collision in settings-service.ts") is satisfied: PR #6581 merged ~06:05Z (babddf6 on origin/main). Its escalation clause is carried into the dispatch verbatim: if implementation finds a real deployment relying on env values bypassing pattern, the dev STOPS and returns it as a decision instead of silently tightening.

Concurrency note: #6579 is in flight in this same package (scoped to company.manifest.ts + its tests). This dispatch is file-isolated against it — production edits confined to the settings-service env/write gate seam, tests in a new file, no manifest edits, synthetic pattern-only fixture instead of company.country.

---

Generated by Claude Code