@@ -0,0 +1,46 @@
+---
+'@objectstack/runtime': minor
+---
+
+fix(runtime): `POST /api/v1/packages` parses the manifest's `version` leg instead of installing anything it is handed (#19120)
+
+Clause-②: no (narrowing)
+
+**BREAKING for callers of the install door** — a manifest with no `version`, or
+one whose `version` does not match the declared semantic grammar, is now refused
+`400` / `VALIDATION_ERROR`. It used to install and answer `201`.
+
+The accept set only shrinks back to what the published declaration has always
+said. `PackageInstallRequestSchema` binds `manifest: ManifestSchema`, and
+`ManifestSchema` declares `version` required with a semantic grammar. The door
+parsed nothing at all: `const manifest = body.manifest || body` went straight to
+`installPackage`, with an id check as the only gate on the way. That is
+«declared ≠ enforced» on a published API contract — and because the install
+landed silently, an author could install metadata the platform's own CLI build
+step (`os plugin build`) would have refused outright.
+
+The gate asks the declaration **by reference** — `ManifestSchema.shape.version`
+— rather than keeping a copy of the grammar. The version-grammar canon is an
+open question on its own card; whichever way it is settled, this door follows it
+with no further edit.
+
+**What is not affected.** Boot-time and in-process installs reach
+`SchemaRegistry.installPackage` / `ObjectQL.registerApp` directly and never pass
+through this branch, so nothing about how a package is loaded from disk or
+registered by a plugin changes. A well-formed manifest installs exactly as
+before, on both body forms (wrapped and bare) and on both install limbs (the
+protocol primitive and the bare-registry fallback).
+
+**Scope — the `version` leg alone.** The declaration's own docblock records five
+classes this door answers `201` to while the schema refuses them. This change
+closes one: `version`. A missing `type`, unknown keys on either body form, a
+string-typed `enableOnInstall` / `overwrite`, and install options spelled on the
+bare form are each left exactly as they were — measured after the change, all
+four still answer `201`. Each is its own reading and its own card.
+
+**If you are refused.** Give the manifest the `version` the schema has always
+required — `version: "1.0.0"`, three dot-separated numbers. The refusal names
+the key and shows the shape, so the prescription arrives with the `400` rather
+than in a changelog.
+
+<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or reshaped: no spec key, no export, no stored row. `objectstack migrate meta` has nothing to reach, because there is no old spelling that maps to a new one — a caller supplies a key the declaration already required. The refusal itself carries the remedy. -->
@@ -579,9 +579,19 @@ describe('HttpDispatcher extracted domains (PR-5: packages)', () => {
     it('POST /packages rejects a duplicate id with 409 unless ?overwrite=true (data-loss footgun guard)', async () => {
         const objectql = qlWithRegistry({ getPackage: vi.fn().mockReturnValue({ id: 'pkg-a' }) });
         const dispatcher = withPkgCaller(makeDispatcher({ objectql }));
-        const dup = await dispatcher.dispatch('POST', '/packages', { id: 'pkg-a', name: 'A' }, {}, {} as any);
+        // [#19120] `version` added to a fixture that never carried one. The
+        // subject here is the duplicate-id guard and its `?overwrite=true`
+        // bypass, ⛔ not manifest completeness — but `ManifestSchema` has always
+        // declared `version` required, so this body was never a legal input to
+        // the door it drives. Since the install door started parsing that leg,
+        // the fixture's own defect is what the case would report.
+        // ⚠️ The repair is owed whatever order the new gate sits in: the
+        // `forced` limb asserts `201`, which an under-specified manifest must
+        // never reach — so no placement of that gate leaves this fixture valid.
+        const manifest = { id: 'pkg-a', name: 'A', version: '1.0.0' };
+        const dup = await dispatcher.dispatch('POST', '/packages', manifest, {}, {} as any);
         expect(dup.response?.status).toBe(409);
-        const forced = await dispatcher.dispatch('POST', '/packages', { id: 'pkg-a', name: 'A' }, { overwrite: 'true' }, {} as any);
+        const forced = await dispatcher.dispatch('POST', '/packages', manifest, { overwrite: 'true' }, {} as any);
         expect(forced.response?.status).toBe(201);
     });