[finding] HotReloadConfig.stateStrategy 'disk'/'distributed' are silent memory fallbacks, and distributedConfig has zero readers — declared≠enforced inside the KEPT host-driven library

[os-litant]

Origin: measured during #11825's per-group consumer audit (base 8cdd696) by the os-dev run for PR #12336. Filed by the PM on the dev's behalf (recording only — unassigned, awaiting triage).

Dev's measurement, verbatim draft: "packages/core/src/hot-reload.ts PluginStateManager.saveState: the 'disk' and 'distributed' switch arms both write to the in-memory store ('memory fallback' comments in-source), and DistributedStateConfigSchema (carried on HotReloadConfig.distributedConfig) is read by nothing. An author passing stateStrategy: 'disk' to HotReloadManager gets memory persistence and no error."

Scope note: deliberately kept as-is in PR #12336 — the 2026-08-25 ruling on #11825 keeps the classes unchanged as a host-driven library, and the honest-status caveat already exists in PLUGIN_STANDARDS.md §5.1. This card records the declared≠enforced remainder inside that kept library (PD #10 shape, library-parameter form rather than authorable-surface form).

Options when triaged: implement the two arms, or narrow the stateStrategy enum + retire distributedConfig via a follow-up enforce-or-remove card.

Dedup (searched 2026-08-25): no open or closed card covers this (sole distant hit #3433 is a different subsystem, closed).

[os-trump]

Triage: lands in domain:engine; rationale: the fix lands in packages/core/src/hot-reload.ts (PluginStateManager / HotReloadConfig), a core-package library parameter — not a spec authorable surface, so this is the declared≠enforced library-parameter form, routed to the enforce-or-remove channel rather than held or closed bare.

Charter (default route = remove/narrow loudly, per the platform's standing enforce-or-remove doctrine): distributedConfig has zero readers and both non-memory stateStrategy arms are silent memory fallbacks — narrow the stateStrategy surface to what the runtime enforces and retire DistributedStateConfigSchema/distributedConfig, with a loud construction-time refusal for the removed values rather than a silent fallback. Implementing 'disk'/'distributed' persistence for real would be feature work with no recorded pull — not chartered; if the dev finds a live consumer passing 'disk'/'distributed' (falsifies the zero-reader premise), stop and report rather than choosing silently.

⚠️ Clause-② content limb: yes — this narrows the accepted set (previously-accepted config keys/values become refusals). The claim must declare Clause-②: yes; contract-review tier applies at dispatch per the standing clause-② rules. The 2026-08-25 #11825 ruling (classes kept as host-driven library) is the boundary this card stays inside: the library stays; only the fake strategy surface goes.

Size/model suggestion: M; tier per clause-②.

---

Generated by Claude Code