[os-project-manager]

Closes #6579

变更内容

#5712 同一洞的第四例:company.country 的 description 一直承诺 ISO 3166-1,而 pattern: '^[A-Za-z]{2}$' 只约束形状——ZZ(未分配)与 UK(CLDR 别名,非 ISO 3166-1 码)均能通过写入门。#6581 合入后 iso_3166_alpha2 的执行(显式 249 码表,两扇门共判)已在库,本 PR 即该单裁定的「一行 + 测试」:

1. company.manifest.ts:country specifier 增加 valueDomain: 'iso_3166_alpha2'。pattern 保留——形状裁决仍先说话(ZZZ → invalid_format),形状与域各自独立收窄。
2. 测试(沿用 fix(service-settings): localization 的标准域是执行边界 —— valueDomain 两扇门落地 (#5712) #6581 建立的写法,localization 的 manifest + service 测试为模板):
   • manifest 测试:声明存在、round-trip 过 spec parse、其余键刻意不声明域;
   • 写入门:CH 收;ZZ/UK 拒(invalid_value + constraint: { valueDomain: 'iso_3166_alpha2' });ZZZ 仍以 invalid_format 先拒;
   • 收紧钉死:小写 us 从「pattern 收」变「域拒」——域成员按标准大写精确匹配,与 localization 的 timezone / currency 用「策展式 options 表」当穷尽执行边界:合法的 IANA 时区与 ISO 4217 币种被拒 #5712 对 localization.default_country 的处理一致;库内无 company.country 运行时读者,风险同级;
   • env 门:OS_COMPANY_COUNTRY 同样按域裁决(ZZ 大声忽略、CH 生效)。仅域——env 门不执行 pattern 是 settings env 门不执行 pattern:写入门拒的形状非法值,OS_* 覆盖照收——#5204 不对称的最后一族 #6580 的独立卡,本 PR 刻意不触碰。

反向验证(先定方向再跑)

预测:删掉 valueDomain 一行后,声明测试、写入门 ZZ/UK、小写收紧钉、env 门测试变红;ZZZ 形状测试保持绿(pattern 仍在)。实测完全一致:4 红 1 绿,复原后 16 文件 / 323 测试全绿。

验证

• pnpm --filter @objectstack/service-settings test:16 文件 / 323 测试全过(本 PR 新增 5 条);
• 触碰文件 eslint 干净(exit 0);
• 包内 tsc --noEmit 错误数 13,与 DEBT 账本持平(未新增);
• node scripts/check-nul-bytes.mjs OK;
• changeset:@objectstack/service-settings patch(用户可见的校验收紧)。

🤖 Generated with Claude Code

https://claude.ai/code/session_01USNUyHEr7uaU6MoEWXitei

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 8, 2026 6:17am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-settings.

7 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/kernel/runtime-services/audit-service.mdx (via packages/services/service-settings)
• content/docs/kernel/runtime-services/index.mdx (via packages/services/service-settings)
• content/docs/kernel/runtime-services/settings-service.mdx (via packages/services/service-settings)
• content/docs/plugins/packages.mdx (via @objectstack/service-settings)
• content/docs/protocol/kernel/config-resolution.mdx (via @objectstack/service-settings)
• content/docs/releases/implementation-status.mdx (via @objectstack/service-settings)
• content/docs/releases/v9.mdx (via @objectstack/service-settings)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.