
What release of Endevor are you using?
Our shop does not experience the issue with the package file, but we control traffic via job names for the promotion jobs. We do not allow packages to be executed online.
Is your defaults table set to pkgcval=n? We use pkgcval=o, and set that package validate flag to w at cast time. Not sure why you wouldn't want to validate, at least to generate a warning. You would need to provide more specifics as to your environment for an informed answer.