@@ -0,0 +1,41 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): the `/packages` list-door tombstone enumerates all three filters that door reads (#19407)
+
+`limit` and `cursor` on `ListInstalledPackagesRequestSchema` both raise
+`PACKAGES_LIST_PAGINATION_REMOVED`, and that prescription enumerated the serving
+door's filters as `status` / `type`. The door reads a **third**, `enabled`
+(`readEnabledFilter`, `packages/runtime/src/domains/packages.ts`), so the
+prescription named two of three and pointed an upgrader at a narrower answer
+than the route actually offers.
+
+**Incomplete, not wrong — and only the enumeration moves.** The sentence's
+load-bearing claim, *no page was ever withheld and no continuation token was
+ever minted*, is untouched and stays true: `enabled` filters rows, it does not
+paginate. The removability argument, the `.default(50)` passage and the
+`hasMore` passage are byte-identical. Nor did the sentence ever assert that
+`enabled` was unavailable — it enumerated, it did not exclude — so nothing here
+reverses a claim.
+
+```
+FROM  … the serving door filters on `status` / `type` and then returns every
+      remaining row …
+      … Filter with `status` and `type` instead of asking for a window.
+
+TO    … the serving door filters on `status` / `type` / `enabled` and then
+      returns every remaining row …
+      … Filter with `status`, `type` and `enabled` instead of asking for a window.
+```
+
+The same repair lands on every carrier of the sentence inside the spec: the
+tombstone string, and the ADR-0087 D3 semantic entry
+`packages-list-pagination-retired` in both its `replacement` (what to use
+instead) and its `reason` (what the door reads). The generated migration
+registry and the generated reference page follow from the repo's own
+generators.
+
+No accept set moves, no key is added or removed, and no type changes: `limit`
+and `cursor` stay `retiredKey()` tombstones typed `never`, and `enabled` was
+already declared and already published as a filter on this request.
@@ -402,8 +402,8 @@ List installed packages request
 | **status** | `Enum<'installed' \| 'disabled' \| 'installing' \| 'upgrading' \| 'uninstalling' \| 'error'>` | optional | Filter by package status |
 | **enabled** | `boolean` | optional | Filter by enabled state |
 | **type** | `string` | optional | Filter by the installed manifest's `type` — exact match, unmatched values select nothing |
-| **limit** | `never` | optional | [REMOVED] `limit` / `cursor` were removed from GET /api/v1/packages in @objectstack/spec 17.5.0 (ADR-0049 enforce-or-remove) — both were declared here and read by nothing: the serving door filters on `status` / `type` and then returns every remaining row, so no page was ever withheld and no continuation token was ever minted. `limit` also declared `.default(50)`, so a reader of the published schema was entitled to believe an unparameterised list is capped at 50 rows; it has never been capped at all, and nothing parses a query string through this schema, so that default has never been stamped onto anything. Delete the key. This route is NOT paginated — it answers the whole installed set, which is a bounded table of tens of rows, and `hasMore` on the response is a constant `false` that is now true by construction. Filter with `status` and `type` instead of asking for a window. A first-class package cursor, if one is ever designed, will be a response-minted opaque token, not this key. |
-| **cursor** | `never` | optional | [REMOVED] `limit` / `cursor` were removed from GET /api/v1/packages in @objectstack/spec 17.5.0 (ADR-0049 enforce-or-remove) — both were declared here and read by nothing: the serving door filters on `status` / `type` and then returns every remaining row, so no page was ever withheld and no continuation token was ever minted. `limit` also declared `.default(50)`, so a reader of the published schema was entitled to believe an unparameterised list is capped at 50 rows; it has never been capped at all, and nothing parses a query string through this schema, so that default has never been stamped onto anything. Delete the key. This route is NOT paginated — it answers the whole installed set, which is a bounded table of tens of rows, and `hasMore` on the response is a constant `false` that is now true by construction. Filter with `status` and `type` instead of asking for a window. A first-class package cursor, if one is ever designed, will be a response-minted opaque token, not this key. |
+| **limit** | `never` | optional | [REMOVED] `limit` / `cursor` were removed from GET /api/v1/packages in @objectstack/spec 17.5.0 (ADR-0049 enforce-or-remove) — both were declared here and read by nothing: the serving door filters on `status` / `type` / `enabled` and then returns every remaining row, so no page was ever withheld and no continuation token was ever minted. `limit` also declared `.default(50)`, so a reader of the published schema was entitled to believe an unparameterised list is capped at 50 rows; it has never been capped at all, and nothing parses a query string through this schema, so that default has never been stamped onto anything. Delete the key. This route is NOT paginated — it answers the whole installed set, which is a bounded table of tens of rows, and `hasMore` on the response is a constant `false` that is now true by construction. Filter with `status`, `type` and `enabled` instead of asking for a window. A first-class package cursor, if one is ever designed, will be a response-minted opaque token, not this key. |
+| **cursor** | `never` | optional | [REMOVED] `limit` / `cursor` were removed from GET /api/v1/packages in @objectstack/spec 17.5.0 (ADR-0049 enforce-or-remove) — both were declared here and read by nothing: the serving door filters on `status` / `type` / `enabled` and then returns every remaining row, so no page was ever withheld and no continuation token was ever minted. `limit` also declared `.default(50)`, so a reader of the published schema was entitled to believe an unparameterised list is capped at 50 rows; it has never been capped at all, and nothing parses a query string through this schema, so that default has never been stamped onto anything. Delete the key. This route is NOT paginated — it answers the whole installed set, which is a bounded table of tens of rows, and `hasMore` on the response is a constant `false` that is now true by construction. Filter with `status`, `type` and `enabled` instead of asking for a window. A first-class package cursor, if one is ever designed, will be a response-minted opaque token, not this key. |
 
 
 ---
 
@@ -199,15 +199,15 @@ export type InstalledPackageAtEitherStageParsed = z.infer<typeof InstalledPackag
 const PACKAGES_LIST_PAGINATION_REMOVED =
   '`limit` / `cursor` were removed from GET /api/v1/packages in @objectstack/spec 17.5.0 '
   + '(ADR-0049 enforce-or-remove) — both were declared here and read by nothing: the '
-  + 'serving door filters on `status` / `type` and then returns every remaining row, so '
+  + 'serving door filters on `status` / `type` / `enabled` and then returns every remaining row, so '
   + 'no page was ever withheld and no continuation token was ever minted. `limit` also '
   + 'declared `.default(50)`, so a reader of the published schema was entitled to believe '
   + 'an unparameterised list is capped at 50 rows; it has never been capped at all, and '
   + 'nothing parses a query string through this schema, so that default has never been '
   + 'stamped onto anything. Delete the key. This route is NOT paginated — it answers the '
   + 'whole installed set, which is a bounded table of tens of rows, and `hasMore` on the '
   + 'response is a constant `false` that is now true by construction. Filter with '
-  + '`status` and `type` instead of asking for a window. A first-class package cursor, if '
+  + '`status`, `type` and `enabled` instead of asking for a window. A first-class package cursor, if '
   + 'one is ever designed, will be a response-minted opaque token, not this key.';
 
 /**
@@ -221,14 +221,11 @@ const PACKAGES_LIST_PAGINATION_REMOVED =
  * was executed and undeclared, `limit` / `cursor` were declared and never
  * executed.
  *
- * ⚠️ ONE key is not there yet, and it is recorded rather than glossed:
- * **`enabled` is still declared here and still unread by that door.** The same
- * ruling closes it (item 2 — one filter line, the shape `status` already has)
- * in the runtime, which is a different file and a different PR, so the
- * symmetry above is TRUE of `status` / `type` / `limit` / `cursor` and PENDING
- * for `enabled`. ⛔ Do not read this docblock as saying the divergence is
- * fully closed, and ⛔ do not close it by deleting `enabled` — the ruling
- * chose to implement that one, not to retire it.
+ * ⭐ The `enabled` leg is closed too, so the symmetry above holds for every
+ * key without exception: item 2 of the same ruling made that door read
+ * `enabled` (`readEnabledFilter`, the filter line beside the `status` one).
+ * ⛔ Do not "close" it the other way by deleting `enabled` — the ruling
+ * chose to implement that key, not to retire it, and the door reads it.
  *
  * ⛔ Never add a key here that the door does not read. A declared-and-ignored
  * query parameter fails undetectably: the caller is answered `200` with the
 
@@ -7,7 +7,7 @@
 // `api/package-api.zod.ts`.
 //
 // `GET /api/v1/packages` declared a window it has never applied. The serving
-// door filters on `status` / `type` and returns every remaining row, so a
+// door filters on `status` / `type` / `enabled` and returns every remaining row, so a
 // caller asking for one row was handed the whole table together with a
 // `hasMore: false` that agreed with it — the silent-widening half of the
 // ingress rule that names this exact parameter as the one whose drop is worst.
 
@@ -11,7 +11,7 @@ export const entry: SemanticMigration = {
     + 'GET /api/v1/packages declared by ListInstalledPackagesRequestSchema. The same entry '
     + 'covers the limit default: the request schema no longer declares default(50)',
   replacement:
-    'the `status` and `type` filters — this route answers the whole installed set and has '
+    'the `status`, `type` and `enabled` filters — this route answers the whole installed set and has '
     + 'no page 2. There is no replacement for `cursor`, deliberately: nothing ever minted '
     + 'one, so no caller holds a value to carry over, and the response `nextCursor` it '
     + 'would have paired with was never emitted. Callers that looped on it were re-reading '
@@ -25,7 +25,7 @@ export const entry: SemanticMigration = {
     + 'item 1, maintainer 「同意」 2026-09-13, route 2 of three; routes 1 — build paging — '
     + 'and 3 — refuse unknown names — were considered and refused). `limit` and `cursor` '
     + 'were declared on the request and honoured on neither: the serving door filters on '
-    + '`status` and `type` and then returns every remaining row, and no emit site has ever '
+    + '`status`, `type` and `enabled` and then returns every remaining row, and no emit site has ever '
     + 'written the response half `nextCursor`. `limit` is the sharper of the two because '
     + "the repo's own ingress rule names it as the parameter whose silent drop is worst, "
     + 'and it is the silent-WIDENING half that was live: a caller asking for one row was '
 
@@ -10180,7 +10180,7 @@ const step18: MigrationStep = {
         + 'GET /api/v1/packages declared by ListInstalledPackagesRequestSchema. The same entry '
         + 'covers the limit default: the request schema no longer declares default(50)',
       replacement:
-        'the `status` and `type` filters — this route answers the whole installed set and has '
+        'the `status`, `type` and `enabled` filters — this route answers the whole installed set and has '
         + 'no page 2. There is no replacement for `cursor`, deliberately: nothing ever minted '
         + 'one, so no caller holds a value to carry over, and the response `nextCursor` it '
         + 'would have paired with was never emitted. Callers that looped on it were re-reading '
@@ -10194,7 +10194,7 @@ const step18: MigrationStep = {
         + 'item 1, maintainer 「同意」 2026-09-13, route 2 of three; routes 1 — build paging — '
         + 'and 3 — refuse unknown names — were considered and refused). `limit` and `cursor` '
         + 'were declared on the request and honoured on neither: the serving door filters on '
-        + '`status` and `type` and then returns every remaining row, and no emit site has ever '
+        + '`status`, `type` and `enabled` and then returns every remaining row, and no emit site has ever '
         + 'written the response half `nextCursor`. `limit` is the sharper of the two because '
         + "the repo's own ingress rule names it as the parameter whose silent drop is worst, "
         + 'and it is the silent-WIDENING half that was live: a caller asking for one row was '
@@ -13363,7 +13363,7 @@ export const RETIRED_KEYS_BY_MAJOR: Readonly<Record<number, readonly string[]>>
     // `api/package-api.zod.ts`.
     //
     // `GET /api/v1/packages` declared a window it has never applied. The serving
-    // door filters on `status` / `type` and returns every remaining row, so a
+    // door filters on `status` / `type` / `enabled` and returns every remaining row, so a
     // caller asking for one row was handed the whole table together with a
     // `hasMore: false` that agreed with it — the silent-widening half of the
     // ingress rule that names this exact parameter as the one whose drop is worst.