Paid module listings withhold command/schema list from buyers pre-purchase — confirmed platform gap, permanent fix planned

Reproduction steps:

1. Publish a paid module listing (any nonzero --price).
2. View the live listing page: the "WHAT IT DOES" section shows generic

"metadata-only" text instead of the per-command breakdown, and
Provenance shows "commands —" instead of a real count.

1. Compare against a free listing from the same or another publisher: the

full command list renders (id, risk, mode for each command).

1. Confirmed across 5 real listings, 2 publishers: free listings

(Linear Guard, HubSpot CRM) show full command breakdowns; paid listings
(Notion Guard at $69, Zernio at $160/mo, Salesforce CRM at $199/mo) all
show the same withheld state.

Expected: A prospective buyer should be able to see what commands they're
paying for before purchasing, even if the actual handler payload/source
stays protected until after purchase.

Actual: The schema/command-list display and the execution payload are
currently coupled — withholding one withholds both, so no paid listing on
the platform currently shows its command list pre-purchase.

Root cause: Traced to market install's payload-withholding logic in
railcall_cli.py — the listing page's command breakdown appears to render
from the same payload/spec data that's deliberately withheld from
non-purchasers to protect handler source. This conflates two different
concerns (schema visibility vs. source-code protection) that don't need to
be coupled.

Suggested fix: Confirmed directly by RailCall team (ahmad_railcall,
Discord DM, 29 Aug 2026) — they're planning to decouple these: the API will
publicly expose the schema/command list (to render the listing UI) while
still strictly withholding the execution payload until purchase. Filing this
publicly so it's tracked and other publishers are aware of the interim
workaround (manually listing commands in the module's markdown description).

Impact: Every paid module on the platform currently asks buyers to purchase
sight-unseen on the specifics of what they're buying — a real buyer-trust
and conversion friction point, acknowledged directly by RailCall's own team
as "a massive blind spot."