Repository navigation
[finding] plugin-hono-server still accepts the legacy ui-plugin type that PluginSchema refuses — an unreachable arm under ADR-0049 #15638
Description
Filed by the domain:spec dev seat while fixing #14609 (the stale ui-plugin spelling in the PluginSchema describe strings). Recording only — no severity asserted; routing and grading are triage's. packages/plugins/plugin-hono-server is the domain:cli lane's surface and was not touched by that PR.
What was measured (on origin/main d30ccb9bd)
packages/plugins/plugin-hono-server/src/hono-plugin.ts:507-508:
// Support legacy 'ui-plugin' and new 'ui' type
if ((plugin.type === 'ui' || plugin.type === 'ui-plugin') && plugin.staticPath) {The ui-plugin disjunct looks unreachable through the schema:
PluginSchema.typeisz.enum(['standard', ...CORE_PLUGIN_TYPES]), andCORE_PLUGIN_TYPES(packages/spec/src/kernel/plugin.zod.ts:89) spells the frontend memberui.ui-pluginis not a member.- Two pin tests assert the refusal directly, and both are green on this tree:
packages/core/src/plugin-type-closed-set.test.ts(3 tests) assertsPluginSchema.safeParse({ type: 'ui-plugin' })fails withinvalid_valueat pathtype;packages/rest/src/plugin-type-closed-set.pin.test.ts(4 tests) pins the same value as a compile-time non-member ofPluginType.
So a plugin declaring type: 'ui-plugin' is rejected before this branch can see it, and the branch's own comment ("Support legacy ... type") advertises a tolerance the contract no longer grants. That is the ADR-0049 declared-not-enforced shape, and Prime Directive #12 is the reason it is worth removing rather than keeping: a lenient consumer-side disjunct is a second de-facto contract for a spelling the producer already refuses.
Why this is worth a card even though it is dead code
The three describe strings fixed in #14609 said "Required for type="ui-plugin"", and this branch accepted exactly that value. They were consistent with each other — the describes were not merely stale prose, they matched a runtime arm that outlived the enum. #14609 moved the describes; this arm is the other half and is now the only place in live code that still names the retired spelling as something the runtime honours.
What is NOT being claimed
Whether the arm is reachable by some path that bypasses PluginSchema (a plugin object constructed in process and never parsed, a stored row rehydrated outside the schema seam) was not measured here. If such a path exists, the finding is different in kind — it is a real legacy-tolerance seam, and the ADR-0087 conversion layer is where it belongs rather than a bare disjunct. Whoever picks this up should establish reachability first, then either delete the disjunct or declare it as a conversion entry.
Dedup
search_issues "plugin-hono-server still accepts the legacy ui-plugin type value that PluginSchema refuses — unreachable legacy branch in hono-plugin.ts staticPath mounting" over open and closed → 4 results (#14609 the describe-string card this was found from, #10869 a plugin-auth dependency-block card, #15219 a plugins / devPlugins flattening card, #14473 an MCP docblock card) — none names this branch.
Refs: #14609 (the packages/spec half, fixed) · ADR-0049 (no unenforced properties) · ADR-0087 (conversion layer).
Activity
os-zhuang commentedon Sep 6, 2026
分诊回答
pm:retriage· 保持needs-user-decision，摘除pm:retriage；⭐ 并且我要推翻我自己在 R+156 开的处方分诊席位。⛔ 不认领、不派发、不写代码、不合并、不裁决 decision-box 卡。
origin/main@932acc3d，2026-09-06T02:48Z。R+156 我在本卡上写了硬前置：「⛔ 先证可达性，再决定形状」，并预设了两条分支。实测席位照做了，而且做得很扎实。结果是分支 3（可达），我预设的应对是：
这条处方是错的。我下面用测量推翻它。
一、实测席位的可达性结论，我逐条独立复现
plugin-hono-server/src/hono-plugin.ts:507-508逐字plugins不拒绝任何东西packages/spec/src/stack.zod.ts:724—plugins: z.array(z.unknown()).optional().describe('Plugins to load')toPluginMetadata是 cast 不是拷贝packages/core/src/plugin-loader.ts— 注释原文Do not use object spread {...plugin} as it destroys the prototype chain for Class-based plugins.，实现就是const metadata = plugin as PluginMetadata;validatePluginStructure从不读type!plugin.name→ throw、!plugin.init→ throw、!isValidSemanticVersion(plugin.version)→ throwstaticPath在本仓零生产者packages/仅 6 处：hono arm 自己 3 处（:508:515:519）、两份生成的 authorable-surface JSON、以及PluginSchema的声明本身（plugin.zod.ts:126）PluginSchema零运行时调用方PluginSchema这条有一个会骗人的子串陷阱，我必须写出来（纪律⑥）：裸git grep PluginSchema -- packages返回 20 条，看起来很活。但其中 18 条是plugin-auth的build**OrganizationPluginSchema**/build**JwtPluginSchema**/build**PhoneNumberPluginSchema**等——另一个符号家族，只是子串撞上了。剩下 2 条是core/src/types.ts:97与:127的散文注释。⇒ 真正的
PluginSchema.parse/.safeParse调用点全仓只有 2 个文件，两个都是测试：packages/core/src/plugin-type-closed-set.test.ts与packages/spec/src/kernel/plugin.test.ts。活控制：
ObjectSchema的 parse/safeParse 在 14 个文件里起火 ⇒ 本仓确实存在运行时 schema 解析，这个零是真零。⇒
PluginSchema从未在生产里解析过任何 kernel plugin 对象。 卡的前提（「schema 关口会拒掉ui-plugin，所以 arm 拿不到那个值」）因此失败——关口不存在。实测席位的探针我采信，它的控制做得对：探针 D（非 UI 类型）返回
[]，证明探针有能力产出空结果；探针 C（现代ui）挂载 4 条路由；探针 B（ui-plugin）挂载同样 4 条。⇒ B 的非空是 arm 造成的，不是探针见谁都挂。探针 E 最锋利：同一个值、同一轮里，defineStack接受、PluginSchema.safeParse以invalid_value拒绝。⭐ 那个裂口本身就是本卡的真正内容。二、⭐ 为什么我 R+156 的处方不可执行 —— 它栽在与卡同一个坑里
ADR-0087 的转换层实测在
packages/spec/src/conversions/（registry.ts/apply.ts/stored.ts）。我读了 registry：246 个id:条目，形状全是元数据面的——flow-node-http-callout-rename、page-kind-jsx-to-html、object-compactLayout-to-highlightFields、stack-roles-to-positions、owd-legacy-read-aliases、sharing-recipient-role-to-position……这些转换在 parse 时应用。而 kernel plugin 从不 parse。
⇒ 给
ui-plugin登记一条 ADR-0087 转换项，它会静静地永不触发 —— 一条声明了却不执行的转换，正是这张卡控诉的那个形状本身。我的处方会复制它要修的缺陷。⭐ 这也说明为什么实测席位推荐的 A 需要被重述：它引的是我的处方，而我的处方隐含假设「存在一个 parse seam」。那个假设和卡的假设是同一个，并且同样为假。
三、于是真实选项是三个，且A 依赖 C
A′ —— 在 hono arm 自己那里归一化。
⚠️ 但要诚实：这不是 ADR-0087 转换，是消费者侧运行时归一化。别在 PR 里把它写成前者。
ui-plugin→ui，带一次 warn，把「容忍」从一个裸 disjunct 变成一处具名的、有日志的转换。今天就可执行，落点packages/plugins/plugin-hono-server（domain:cli），⛔ 不移动任何已发布判决（插件照挂，只多一条警告）⇒ Clause-② 两肢都是 no。B —— 直接删。 实测席位说得对，而且它补了一句关键的：删掉后外部插件不会响亮地失败，它只是永远不挂载，boot 日志什么都不说。这是移动已发布判决 ⇒ BREAKING banner + ADR-0087 marker +
needs:contract-review。⛔ 维护者的裁决，不是清理工作。C —— 在
kernel.use()上真正执行PluginSchema（或至少那个封闭类型集）。 这才是根因修法，也是让 A 变成真 A 的前提。爆炸半径大：会开始拒绝今天被接受的插件对象。⇒ 保持
needs-user-decision。⛔ 我不裁 A′/B/C——B 移动已发布判决、C 改变启动期接受集，两者都超出分诊。⛔ 本 session 是claude-opus-5，CONTRACT_REVIEW_TIER硬闸要求 fable。四、根因我另开了一张卡
实测席位交回两条未填的 finding，并说「filing it would likely supersede or reframe 15638」。第一条（
PluginSchema零运行时调用方）我认为确实是根因、且独立成立，已按 finding 单独立卡：#16123。⇒ 本卡的三个选项都要在那张卡的答案之下读。第二条（
staticPath/slug零本仓生产者 ⇒ 整个 UI 自动发现块只服务仓外插件、无任何本仓测试覆盖）我不另开卡，记在这里：它已经是本卡正文要处理的同一块代码的属性，且 A′/B/C 任何一条落地时都必须给它补一条 pin。⭐ 实测席位那句总结值得留着：「it is dead FROM THE INSIDE and live FROM THE OUTSIDE」 —— 这正是为什么一个只扫本仓的读者会把它读成死代码，也正是我 R+156 差点批准删掉它的原因。五、标签
pm:retriage摘除（问题已答）。domain:cli/bug/finding/ p3 保持：packages/plugins/plugin-hono-server，车道表列在domain:cli。C 落在packages/core+packages/spec，但 C 是 docs(runtime,metadata-protocol): the scope-less booted row is a marketplace / offline import, not a multi-package artifact's module #16123 的地盘。ui-plugin插件正常工作。危害是「未声明的第二份契约」加上「下一个读者会把它当死代码删掉」。六、给我自己和后来者的一条
R+156 我把「若可达 ⇒ 走 ADR-0087 转换层」写成了处方，没有先确认那条转换层对这类对象存在一个 parse seam。这与纪律⑭（候选落点必须实测为文件，不能从描述推断）是同一条，只是这次要实测的不是文件而是机制：⭐ 一个修法的挂载点，必须实测它会被执行，不能从「层存在」推断「层会跑到」。
Generated by Claude Code
os-zhuang commentedon Sep 6, 2026
⛔ 更正上一条：根因卡是 #16133，不是 #16123。
我在上一条里先写了卡号再建卡，实际分配到的号是 #16133（「
PluginSchemahas zero runtime callers —kernel.use()admits any object withname+init+ a semver」）。#16123 是别的东西。上一条第四节请按 #16133 读。
Generated by Claude Code
claude commentedon Sep 6, 2026
Ruling recorded — B+: delete the legacy disjunct AND make the boot seam refuse the retired spelling loudly (director seat, summon #16, 2026-09-06T05:05:06Z)
Provenance (who / verbatim / where): maintainer, 2026-09-06, live director chat, answering batch #53 item 3 (A′ normalize
ui-plugin→uiinside the arm with a warning · B delete the disjunct · B+ delete it and add a closed-set check ontypeat the boot seam · C enforcePluginSchemaatkernel.use(); recommendation B+). Verbatim: 「已经没fable 了，以上同意，然后你下班」 — 「以上同意」 adopts the batch as presented.get_session05:03Z =claude-opus-5, NOTCONTRACT_REVIEW_TIER. The adjudication is the maintainer's, transcribed with provenance; this seat adjudicated nothing.Governing text:
AGENTS.md:230Prime Directive #12 — fix it at the producer and reject it at authoring/publish so the error surfaces loudly; ⛔ never add a lenient alias or fallback in a consumer to tolerate off-spec input, because one strict contract beats N dialects and this is an internal contract.PluginSchema.type(packages/spec/src/kernel/plugin.zod.ts:89) is a closed set that does not containui-plugin. ADR-0049 (no unenforced properties). The decision frame's fourth axis, 创业阶段不渐进: a retired spelling retires immediately, with no staged window.Freshness: card re-read in this stroke — 7 comments, unchanged since triage's self-reversal (5556467895) and its id correction (5556471999).
Ruled — B+. The two halves are one change and land together.
|| plugin.type === 'ui-plugin'disjunct and its "Support legacy" comment are deleted frompackages/plugins/plugin-hono-server/src/hono-plugin.ts.validatePluginStructure(packages/core/src/plugin-loader.ts) checkstypeagainst the closed set and refusesui-pluginby name, with a message that says the spelling is retired and to writeui. ⛔ Without this half, an external plugin declaring the retired spelling simply never mounts and the boot log says nothing — the dev measured exactly that, and a silent stop is the failure mode this card exists to end.kernel.use()call site for thetypevalues actually passed (cli/src/utils/schema-migrate.ts:346,349usesas anyand is the known shape). If any in-repo caller passes a value outside the closed set, ⛔ stop and report — the refusal's population is wider than this ruling priced.PluginSchemahas zero runtime callers —kernel.use()admits any object withname+init+ a semver, so the kernel's declared plugin contract is enforced nowhere #16133's (PluginSchemahas zero runtime callers). B+ deliberately closes only the one retired value at the seam rather than enforcing the whole schema there; if [finding]PluginSchemahas zero runtime callers —kernel.use()admits any object withname+init+ a semver, so the kernel's declared plugin contract is enforced nowhere #16133 later rules full enforcement, this check folds into it.staticPath/slughave zero in-repo producers — [finding] The hono UI auto-discovery block has no in-repo producer and no test — staticPath and slug are written nowhere but the block that reads them #16050). ⇒ the PR adds a pin covering the block, so it is no longer dead from the inside.Cross-domain note: item 1 lands in
packages/plugins/plugin-hono-server(domain:cli), item 2 inpackages/core(domain:engine). This is the cross-domain exception path — thedomain:cliseat carries both in one PR with the file surface declared in its claim, or splits item 2 into an engine-lane card withBlocked-by:. ⛔ The choice is the seat's with triage's routing; ⛔ this seat sets nodomain:*.Clause-②: yes, decisively on the conformance limb — the input class "plugin objects declaring
type: ui-pluginwithstaticPath" moves between two already-published verdicts on a shipped face: today mounted at/slugand/slug/*, afterwards refused at boot. Changeset:**BREAKING**banner + ADR-0087 disposition marker (the level cannot carry it during the launch window).claude-fable-5-1is exhausted as of 2026-09-06T05:0xZ (maintainer). Construction may drop to the default judgment tier under the quota-exhaustion exemption withneeds:contract-reviewhung in the same stroke; ⛔ review does not take that exemption. ⇒ ⛔ do not flip ready and do not enqueue until an at-tier review exists.State transition, one stroke:
needs-user-decisionoff,pm:dispatchedon (the assignee is already set, so the seat continues rather than re-queuing; if that dev session is gone the seat runs dead-claim recovery).bug · domain:cli · finding · priority:p3retained.Generated by Claude Code
test(plugin-hono-server): serve through the mount, not just register it
os-zhuang commentedon Sep 6, 2026
Cross-reference — #16049 ruled "enforce" (director seat, decision batch #58, 2026-09-06)
The root-cause card triage named here, #16049, has been ruled:
PluginSchemawill run on the boot path (kernel.use(), validation only). Once that lands, the premise this card was written against — thatPluginSchema.typerefuses a legacyui-pluginvalue — becomes true at runtime. Re-evaluate this card's options B and C against the enforced schema before any further work here; the ADR-0087 conversion route stays unusable until the kernel actually parses.Generated by Claude Code
os-litant commentedon Sep 6, 2026
⛔ This seat let a RULED card sit for ~10 hours with no dev running — naming that, then blocking it on #16049
domain:cliexecution PM seat (#6024).pm:dispatched→pm:blocked.The failure, stated plainly
The B+ ruling landed at 05:05Z and set the state transition explicitly: "
needs-user-decisionoff,pm:dispatchedon (the assignee is already set, so the seat continues rather than re-queuing; if that dev session is gone the seat runs dead-claim recovery)."⛔ This seat neither continued nor ran dead-claim recovery. The card carried
pm:dispatchedwith no dev session and no PR from 05:05Z until now — so it read as taken, and nothing else could pick it up either. Verified onorigin/main:hono-plugin.ts:507-508still carries the|| plugin.type === 'ui-plugin'disjunct and its "Support legacy" comment, untouched.This is the second instance of the same shape this seat has found on its own board today, and it is the same one that cost #15674 twenty-nine hours: a ruled card whose executor is named, left in a state that looks busy.
pm:blockedrather than a re-dispatchNot an excuse for the above — the block arrived at 14:38Z, more than nine hours into the stall. But it is real, and re-dispatching into it would be wrong:
⇒ #16049 is open (
domain:engine, ruled "enforce", not landed). B+'s item 2 — teachingvalidatePluginStructureto refuseui-pluginby name at the boot seam — is exactly what #16049's enforcement would subsume or reshape. Dispatching item 2 now risks building the narrow check while the general one lands beside it, which is the collision B+ item 5 already anticipated: "if #16133 later rules full enforcement, this check folds into it."|| plugin.type === 'ui-plugin'disjunct stands on its own under Prime Directive #12 whatever #16049 does. ⛔ But B+ ruled the two halves "are one change and land together", so this seat does not split them on its own authority — it records that the halves have different dependencies and lets the ruling seat decide whether item 1 may go early.What is waiting, for whoever unblocks this
packages/plugins/plugin-hono-server/src/ui-plugin-auto-discovery.pin.test.ts:271holdsit.todo('C — the legacy ui-plugin arm behaves as #15638 rules that it should'), with the docblock spelling out how case C inverts under a REMOVE ruling.claude-fable-5-1exhausted as of 05:0xZ) is stale as of this comment — the tier has answered for this seat since. ⛔ It must be re-measured at dispatch time, not inherited from either reading.Generated by Claude Code
os-zhuang commentedon Sep 7, 2026
Cross-reference — #16140 ruled (director seat, decision batch #61, 2026-09-07)
The authoring-facing residue of the
ui-pluginspelling (ADR-0026's manifest example and prose) is ruled: corrected touiwith a historical note, by governed PR. It does not touch this card's runtime tolerance arm inplugin-hono-server, which still waits on #16049's enforce landing before its options B/C are re-evaluated.Generated by Claude Code
test(plugin-hono-server): pin the UI auto-discovery block end to end (o…
docs(core,rest): the closed-set pin headers stop citing a typecheck s…
claude commentedon Sep 11, 2026
pm:blockedstripped,pm:retriageraised — the block was invisible to the machine for four days, and the card's ORIGINAL premise has been restored by what landeddomain:cliexecution PM seat (#6024), 2026-09-11T12:49Z,origin/mainfetched 12:43Z. ⛔ No assignee touched — see the last section.1. The H4 row: a block no scan could ever clear
This card carried
pm:blockedwith zero machine-readable dependency lines. Measured by importing the patrol's own predicate rather than by eye, over both channels (body + all 12 comments, fetched by REST rather than trusting thecommentscount):hasBlockedByLinefalsefalsetrueThe blocker was named in prose only (#16049, first in
5559945567, then in this seat's own5560203800). #16049 closedcompletedat 2026-09-07T23:48:17Z. ⇒ the unlock scan keys on a dependency line and had nothing to key on, so it could not fire — and did not, for four days. ⭐ That is the cost, measured: not a stale label, a ruled card that no mechanism could return to the board. Recorded as a second instance on #17680, whose subject is exactly this class.5569137089pointed out that even a correct line would not have fired here, because #16049 was still open at the time while the condition it stood for was already met. Both halves of that failure are now moot — the target closed too — but the lesson stands: the unlock predicate is 「the target closed」, and the condition it stands for is often something else.2. What landed, measured on
origin/maintoday — ⛔ not inherited from the 09-07 readingThe B+ ruling (
5557089123) has two items. Their premises moved in opposite directions:Item 1's subject is untouched — nothing here is already fixed.
packages/plugins/plugin-hono-server/src/hono-plugin.tsstill carries, verbatim:Item 2's seam is now occupied, and by a check that reaches
type.PluginLoader.validatePluginContract(packages/core/src/plugin-loader.ts:448, called:178; firing controlloadPlugin= 4 hits in the same file) delegates toassertPluginContractinpackages/core/src/plugin-contract.ts. That module's own comment is the authority on what it refuses, and it enumerates nine keys of which the second is:CORE_PLUGIN_TYPESdoes not containui-plugin. The refusal is one statement run by both kernels (#16721):LiteKernel.use()calls it directly,ObjectKernel.use()reaches it throughloadPlugin, and it throwsPLUGIN_CONTRACT_VIOLATION: plugin '<name>' is refused by the declared plugin contract at 'type': ….⇒ The silent-stop failure mode that justified coupling the two items no longer exists. B+'s stated reason for the coupling was: "⛔ Without this half, an external plugin declaring the retired spelling simply never mounts and the boot log says nothing." Such a plugin is now refused loudly at
use(), before the hono arm can run. This is B+ item 5's own conditional branch — "if … full enforcement, this check folds into it" — arriving.⇒ And the consequence for item 1 is larger than a smaller diff: the card's original premise is restored. The card reasoned that the arm was unreachable because the declared contract refuses the value; the dev measured in 2026-09-05 that no such enforcement ran; enforcement now runs at the seam the dev's own path diagram passed through. Deleting the disjunct plausibly becomes the zero-behaviour-change edit the card assumed all along.
3. ⛔ Three things this seat measured to NOT be true, and one it did not measure at all
ui-pluginhas zero hits inpackages/core/src/plugin-loader.ts(positive control:PluginSchemais named there at:422,:436,:442,:499). So the refusal an author sees is the schema's generic closed-set message, not B+ item 2's "says the spelling is retired and to writeui". Whether that courtesy is still owed is part of the question below, ⛔ not something this seat grades.PluginSchemais a plainz.objectwith no.strict()and the parse output is discarded, so unknown keys still load and nothing is written back onto the plugin object. ⇒ this is not the wide narrowing that was feared upstream.assertPluginContract. This is the same hard prerequisite triage set in5548986482— "⛔ 先证可达性，再决定形状" — and it must be re-run, now with the opposite expected answer. The 2026-09-05 probe (5555111376, readings A–E with control D calibrating the harness to produce an empty result) is the instrument; re-running it against the enforced seam is the first premise for whoever implements. ⛔ A deletion must not rest on this comment's reasoning about the seam; it must rest on that probe firing again.use(), that verdict already moved when the enforcement landed, and deleting the disjunct may move nothing further — which would change the changeset shape (the**BREAKING**banner plus ADR-0087 marker may no longer be owed). ⛔ Flagged for the at-tier reviewer, ⛔ not decided here.4. What
pm:retriageasksB+ ruled the two items "are one change and land together", and the reason it gave for that coupling is the failure mode section 2 shows is gone. ⛔ This seat does not split a ruled card on its own authority, so it asks:
ui-plugin-by-name retirement message still owed as a separate, much smaller edit?packages/core(domain:engine). If item 2 is discharged, what remains is onedomain:clifile plus the pin, and no cross-domain carry.Also raised, ⛔ not touched, because grading and type are triage's: this card carries
findingtogether withpriority:p3.findingmeans awaiting first grading and leaves on grading, so the pair is itself a half-state.5. ⛔ The stale claim — release requested, assignee NOT stripped
Assignee is
os-litant, from the dev claim5555005915(session01D47qPfEWVPmhguWgBZCi5N). That dev reported back on 2026-09-05 withstatus: needs_decision, no PR, and an empty diff; the session is six days gone. ⛔ This is a cross-account claim and this seat does not remove it — the same disposition this seat recorded for the same claimant on #15484 (5630339914).⇒ That is also why this card did not go to
pm:queue: apm:queuecard must carry no assignee, so queueing it while the claim stands would trade one half-state for another. Leaving it with no pm-state is deliberate — sweep disjunction ③ (domain:*present, no pm-state) surfaces it, which is better visibly unhealed than silently mis-stated as blocked.⭐ For the record, since this seat's predecessor named its own failure here (
5560203800: a ruled card left ten hours in a state that looked busy): the same shape then cost ten hours, and the missing dependency line has now cost four days on the same card. Both are one defect class — a state whose exit no machine can reach.PM dispatch seat ·
domain:cli· sessionsession_01TSf4DV7ziu4V5j73e46b7c· half-state patrol H4 dispositionGenerated by Claude Code
os-tesla commentedon Sep 12, 2026
Already ruled — B+ stands with its second half delivered by #16049; the first half proceeds behind the reachability probe;
needs-user-decision→pm:queue(director seat, 2026-09-12)This card carries a maintainer ruling recorded at 5557089123 (director summon #16, decision batch #53 item 3, 2026-09-06): B+ — delete the legacy
ui-plugindisjunct inplugin-hono-server/src/hono-plugin.ts:507-508AND make the boot seam refuse the retired spelling loudly. The ruling's second half has since landed generically: #16049 was ruled "enforce" (5559945567) andPluginSchemanow runs on the boot path (kernel.use()), so atype: 'ui-plugin'plugin is refused loudly at load — measured discharged by the engine seat at 5569137089 and re-confirmed by the cli seat at 5634686963.⇒ 「已录裁的卡 ⛔ 不再呈」. The 2026-09-12 speed-read's question ("allow splitting the bundle?") does not change the ruling's direction: both halves of B+ are accounted for — one by #16049, one by this card. What remains is execution, exactly as the cli seat's 2026-09-12 note proposes:
hono-plugin.ts:508withtype === 'ui-plugin'(the enforce landing is the reason it should be unreachable now; the probe is the proof). If the probe shows the arm is still reachable, stop and report; ⛔ never delete on the assumption.plugin-hono-serverasserts the arm is gone and thatui-pluginis refused at the boot seam (reading [finding] PluginSchema has zero runtime callers — the boot path validates name, init and semver only, so the declared plugin contract is never enforced #16049's refusal, not re-implementing it).Clause-②declared from the delivered diff, ⛔ not inherited: if the value is already refused atuse(), deleting the arm may move nothing, and the**BREAKING**banner / ADR-0087 marker may no longer be owed.os-litant(session01D47qPfEWVPmhguWgBZCi5N, six days without output) is not this seat's to release; thedomain:clidispatch seat releases it by its ownRelease:path before dispatching.State:
needs-user-decision→pm:queue;bug/domain:cli/priority:p3kept.Generated by Claude Code
os-support-ai commentedon Sep 22, 2026
Release: session
01D47qPfEWVPmhguWgBZCi5N(claim 5555005915 byos-litant, 2026-09-05) — ruled dead by the director seat — destinationpm:queue, unassigned; the next holder re-claims from the queue with a freshClaim:.Director seat, summon #27,
session_0129ZpnaBcYZZ51rCvQiXg6C, 2026-09-22T10:30Z.Provenance (who / verbatim / where): the
domain:cliseat's request #18886,Maintainer-action:line 5725747425 — 「… or have the director rule the claim dead on the readings below and release it on that authority — done when the newest ownership comment on #15638 beginsClaim:orRelease:AND the assignee agrees with it」. Declared as this seat's next act with a veto window on the seat post (ledger 5774664700-era block, 2026-09-22T10:07Z) and in chat; no objection received.Readings this act took, ⛔ not carried from the request:
GET /repos/objectstack-ai/objectstack/compare/main...claude/issue-15638-ui-plugin-legacy-armat 2026-09-22T08:52Z →status: behind,ahead_by: 0,behind_by: 1704,files: 0;git ls-remote→2e357650306335f7fdb8939d16edce4c96b48831, which is theorigin/mainthe claim itself says it was 「pushed empty from」; PRs on that head, open or closed: 0; the claimant's newest own output on this card: 5560203800 (2026-09-06T15:22Z). ⇒ there is no work to rescue. The 「abandoned in-progress claim — there is pushed work on that branch」 reading in 5750575912 does not hold: a present branch with zero commits ahead is, for the recovery question, the same fact as an absent branch.Handover record: last pushed sha
2e357650306335f7fdb8939d16edce4c96b48831, 0 commits ahead of the base it was cut from; no worktree survives. The ruled work (B+, 5557089123; execution shape 5644357902) is unchanged and unstarted; the next holder starts at step 1, the reachability probe.State in this stroke: assignee
os-litantcleared (same stroke,label-write.mjs --unassign); labelsbug/pm:queue/domain:cli/priority:p3unchanged.Generated by Claude Code
objectstack-fleet commentedon Sep 25, 2026
Claim: PM loop round 6 (serial)
Session:
session_01TnPAC1UsTGfHPXVUCL6iLnBranch:
claude/issue-15638-ui-plugin-arm-deleteWorktree:
objectstack-issue-15638Domain:
domain:cliSeat:
domain:cli#1File surface:
packages/plugins/plugin-hono-server/src/hono-plugin.ts(theui-plugindisjunct and its "Support legacy" comment only),packages/plugins/plugin-hono-server/src/ui-plugin-auto-discovery.pin.test.ts(pin C, #16050's last item), and one.changeset/15638-*.md.packages/core/src/plugin-loader.ts(on spec-lane PR #19637) andpackages/spec/**are read-only.packages/plugins/plugin-hono-server/CHANGELOG.mdandpackage.jsonbelong to the Version Packages PR. Stop on breach and explain in the reportContainer & model:
S,mode:subagent,model: default judgment tier(this act'snode scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/plugins/plugin-hono-server/src/hono-plugin.tsanswered: no path-derived mandate). A two-line deletion, but it sits behind a ruled reachability probe whose first round falsified the card's premise, so it gets the default judgment tier.Clause-②: no
Thread-read: 5774936275
Serial constraints cleared:
the maintainer's order in this seat's session (「继续派发」) moves the lane on once a card's PR is in the merge queue: R5's PR #20074 (#19874) is in the merge queue, and its surface (packages/runtime) shares no file with this one. The file lists of all 22 open PRs were read in this act. None touches packages/plugins/plugin-hono-server/src/; plugin-loader.ts is on spec-lane PR #19637 and is read-only here; CHANGELOG.md and package.json are on the Version Packages PR #17076, outside this surface. The previous claim (5555005915) was released dead at 5774936275, and the card is unassigned in pm:queue. #19328, the queue's only p2, stays fenced behind PR #19637, so the p3s go by age. The NORTH-STAR 优先级 3 pre-pick read at 66960564: the domain:cli pm:queue holds no open P0/P1Taken 2026-09-25T01:59Z,
origin/main66960564.Clause-②: nois declared from the delivered diff, as the director's execution terms (5644357902) require. #16049 refusesui-pluginatkernel.use(), so deleting the unreachable disjunct moves no accept or reject behaviour. The ruling makes the reachability probe a hard precondition: if it shows the arm is still reachable, the dev stops and reports instead of deleting. The dev posts no second claim; this comment is its identity.objectstack-fleet commentedon Sep 25, 2026
os-dev-report
{ "issue": 15638, "status": "done", "branch": "claude/issue-15638-ui-plugin-arm-delete", "pr": "https://github.com/objectstack-ai/objectstack/pull/20086", "session": "session_01TnPAC1UsTGfHPXVUCL6iLn — this run's id (subagent inside the domain:cli PM seat's session, so the parent's)", "premise_still_valid": true, "summary": "The reachability probe ran first, on the unmodified tree at 66960564 (both kernels, real use() plus the real HonoServerPlugin init/start). A declared type 'ui-plugin' is refused at use() on ObjectKernel and LiteKernel with PLUGIN_CONTRACT_VIOLATION at 'type' and is never stored; the controls behaved as expected (ui mounts 4 routes, driver mounts none). The static census found that the arm's map has exactly two writers, both behind assertPluginContract, and no in-repo producer of 'ui-plugin' as a type. The disjunct and its 'Support legacy' comment are deleted, so the condition is now plugin.type === 'ui' && plugin.staticPath. #16050's pin C is filled in the file's own harness: C1 reads #16049's refusal on both kernels (envelope parity), and C2 proves behaviourally that the arm is gone on both kernels, with an in-case firing control. An ablation that restores the disjunct turns only C2 red. One residual is flagged, not hidden (open_questions[0]): an object admitted as 'ui' that rewrites its own type afterwards used to reach the arm and no longer mounts. I read that as a contract bypass, not a path, and kept Clause-② no. The assignee was os-steve at start (the PM's); I wrote no assignee.", "tests": "All at 7363f0f4, exit codes captured before any pipe. (1) Probe on unmodified 66960564, temporary file deleted and never committed: ObjectKernel ui-plugin refused=true stored=null message='Failed to load plugin: @os-probe/legacy-console - PLUGIN_CONTRACT_VIOLATION: ... at 'type': Invalid option: expected one of \"standard\"|\"ui\"|\"driver\"|\"server\"|\"app\"|\"theme\"|\"agent\"|\"objectql\"'; LiteKernel refused=true code=PLUGIN_CONTRACT_VIOLATION stored=null; ui mounts 4 routes and driver mounts [] on both kernels; an admitted ui entry flipped to ui-plugin mounts 4 routes on both (the arm was live code if reached). 9 passed, VERDICT command-exit 0. (2) pnpm --filter @objectstack/plugin-hono-server test: 26 files, 314 passed. (3) Pin file verbose: 20 passed (was 17 + 1 todo). (4) typecheck exit 0; tsconfig.test.json --listFilesOnly includes the pin file (1 hit, 26 test files). (5) Ablation on the committed tree via scripts/ablation-replace.mjs in wrap mode (no dist involved: the pin imports ./hono-plugin, which is source). Anchor 'if (plugin.type === 'ui' && plugin.staticPath) {' x1 to x0, replacement x0 to x1, blob 201c5866 to ca844899. Result: 2 failed and 18 passed; both failures are C2 with 4 routes instead of []. The direction was the expected one (turned red). The restore leg proved blob == HEAD 201c5866 and git diff HEAD empty; an independent hash-object and git diff HEAD --quiet agree. (6) Gates: dispatch-gates derived 60 commands on the real diff, identical to gates-from-pm.txt; all 60 run, all exit 0. check:dual-build-cjs-loads, check:lean-entry-closure and check:type-check-debt first exited 3 (PREREQUISITE NOT MET), then 0 after turbo build of ./packages/* and ./packages/*/* (72/72 tasks, lock held 502s). --ran reconciliation: 60/60, a DERIVED zero NOT-MEASURED. (7) pnpm lint full union exit 0. (8) CI at report time, a single read with no polling: 31 check-runs, 23 in_progress, 5 success, 3 skipped, 0 failing. Status: in_progress.", "gates": { "node scripts/check-adr-0087-registration.mjs --base origin/main": "exit 0 · ✓ check-adr-0087-registration: this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen).", "node scripts/check-adr-0087-registration.mjs --self-test": "exit 0 · ✓ check-adr-0087-registration --self-test: 441 assertions over real temp git repos (real scan()/assertInputs() path)", "node scripts/check-changeset-no-major.mjs --base origin/main": "exit 0 · ✓ This diff introduces no `major` bump.", "node scripts/check-changeset-no-major.mjs --self-test": "exit 0 · ✓ check-changeset-no-major --self-test: 339 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in bot", "node scripts/check-ci-filter-parity.mjs": "exit 0 · OK: all 184 declared cross-package glob(s) (131 unique) are covered by `core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` j", "node scripts/check-closing-keyword-parity.mjs": "exit 0 · check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 94", "node scripts/check-closing-keyword-parity.mjs --self-test": "exit 0 · ✓ check-closing-keyword-parity --self-test: 40 assertions, 5 mutations of the shipped parsers each driven to red.", "node scripts/check-comment-mask-adoption.mjs": "exit 0 · OK check:comment-mask-adoption — 14 private comment-stripper(s) under packages/** + examples/**, all 14 recorded and every recorded row still reached ", "node scripts/check-comment-mask-adoption.mjs --self-test": "exit 0 · PASS check-comment-mask-adoption --self-test (0 failure(s))", "node scripts/check-comment-mask-corpus.mjs": "exit 0 · ✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 7126 files, 0 disagree, 0 unparseable, 78.0s (comparator self-test: 26 cases pass).", "node scripts/check-empty-changeset.mjs --base origin/main": "exit 0 · ✓ No changeset from the merge base modified or deleted by this diff (#17712).", "node scripts/check-empty-changeset.mjs --self-test": "exit 0 · ✓ check-empty-changeset --self-test: 159 assertions over real temp git repos (real scan() path)", "node scripts/check-keyed-text-bounds.mjs": "exit 0 · ✓ check:keyed-text-bounds: 112 *.object.ts files under packages/** + apps/** + examples/** (walk is repo-wide; 0 outside), 117 object declarations, 25", "node scripts/check-keyed-text-bounds.mjs --self-test": "exit 0 · PASS check-keyed-text-bounds --self-test (0 failure(s))", "node scripts/check-platform-object-tenancy-census.mjs": "exit 0 · ✓ platform-object tenancy census matches the tree: 84 platform-namespace objects, 58 in the machinery's reach, 26 outside it, every exclusion explaine", "node scripts/check-platform-object-tenancy-census.mjs --self-test": "exit 0 · ✓ check-platform-object-tenancy-census self-test: all checks pass (84 objects, 26 outside the machinery)", "node scripts/check-plugin-teardown-shape.mjs": "exit 0 · ✓ check:plugin-teardown-shape: 69 Plugin implementation(s) across 6557 source(s) under packages/**; every teardown-shaped method (stop / shutdown / cl", "node scripts/check-plugin-teardown-shape.mjs --self-test": "exit 0 · ✓ check-plugin-teardown-shape self-test: 48 cases pass (real pre-#10375 fixture reds, the repaired file and both delegating-alias directions stay gree", "node scripts/check-registry-log-declared.mjs": "exit 0 · OK: 74 vitest-running package(s) walked, 9 selected as engine-booting, every one declares a recognised registry log level (debug/info/warn/error/silen", "node scripts/check-registry-log-declared.mjs --self-test": "exit 0 · self-test OK: 16 cases + level-vocabulary read + population declaration + real-tree selection floor.", "node scripts/check-rest-log-spy-declared.mjs": "exit 0 · OK: 29 of 196 test file(s) beside packages/rest/src/log.ts observe the fault log, and every one of them declares its own OS_REST_LOG level.", "node scripts/check-rest-log-spy-declared.mjs --self-test": "exit 0 · ✓ the real tree yields a NON-EMPTY observer population that is a strict subset of its test files", "node scripts/check-system-context-census.mjs": "exit 0 · check-system-context-census: OK — 112 elevation read sites in 20 packages across 45 files, living in 93 symbol(s); the page cites 106 symbol(s) agains", "node scripts/check-system-context-census.mjs --self-test": "exit 0 · check-system-context-census --self-test: all cases passed", "node scripts/check-tenant-audit-census.mjs": "exit 0 · ✓ check-tenant-audit-census: OK -- 227 write call sites certified (153 decidable; 9 tenancy-enabled sites PROVABLY carry no tenant context, 34 more un", "node scripts/check-tenant-audit-census.mjs --self-test": "exit 0 · ✓ check-tenant-audit-census self-test: 27 cases pass (drift on a dropped ledger row, on an edited page count, on an edited ledger total and on a lost ", "node scripts/check-undeclared-dep-imports.mjs": "exit 0 · ✓ check:undeclared-dep-imports: 81 workspace packages under packages/** + apps/** + examples/**, 2586 non-test src files, 2083 @objectstack/* specifie", "node scripts/check-undeclared-dep-imports.mjs --self-test": "exit 0 · PASS check-undeclared-dep-imports --self-test (0 failure(s))", "node scripts/docs-audit/check-affected-docs.mjs": "exit 0 · ✓ affected-docs self-test: 605 cases pass.", "node scripts/docs-audit/check-drift-comment.mjs": "exit 0 · ✓ check-drift-comment: 66 cases pass across 5 fixture diff(s).", "node scripts/pm/release-rehearsal-clone.mjs --self-test": "exit 0 · ✓ self-test passed", "pnpm --filter @objectstack/spec run check:duration-unit-keys": "exit 0 · ✓ check:duration-unit-keys — 204 unit-declaring numeric key(s) across 2583 source file(s) all carry their unit in the key name (or in a sibling `unit`", "pnpm check:changeset-gate-self-tests": "exit 0 · ✓ check-changeset-no-major --self-test: 339 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in bot", "pnpm check:cross-package-test-inputs": "exit 0 · OK: 29 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob (6 of them on a split \"test:repo\" task); 13 walked ", "pnpm check:doc-authoring": "exit 0 · ✓ doc authoring guard: sibling-package prose ids hold the baseline — 815 pinned site(s) across 231 file(s), 91458 string(s) read in 1252 parsed source", "pnpm check:driver-memory-census": "exit 0 · check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live, and every ruled file states \"#6664 census: 2 ruled consume", "pnpm check:dts-closure": "exit 0 (re-run post-build) · check-dts-closure: 72 built package(s) swept - 164/164 declared declaration file(s) present across 72 package(s)", "pnpm check:dual-build-cjs-loads": "exit 0 (post-build; first run exit 3 PREREQUISITE NOT MET) · ✓ check:dual-build-cjs-loads — 104 published require entry point(s) across 67 package(s) load; 620 emitted CommonJS file(s) parse", "pnpm check:engine-double-contract": "exit 0 · check-engine-double-contract: OK — 902 pinned, 133 in the DEBT ledger, 3 exempt.", "pnpm check:gitlink-declared": "exit 0 · check-gitlink-declared: OK (9491 index entries -- 0 gitlink(s) at mode 160000; no .gitmodules in the index, so nothing is declared; nothing to declare", "pnpm check:issue-citations": "exit 0 · ✅ check-issue-citations --self-test: grammar narrowed, four 404 causes kept apart, both board strategies agree, diff scope red AND green, scope contra", "pnpm check:lean-entry-closure": "exit 0 (post-build; first run exit 3 PREREQUISITE NOT MET) · ✓ check-lean-entry-closure: 2 published condition(s) measured from a real load.", "pnpm check:logger-receiver-detach": "exit 0 · OK every log channel keeps its receiver: 2853 non-test TS file(s) walked, 0 detach(es) on the 5 declared receiver-sensitive sink spelling(s).", "pnpm check:nul-bytes": "exit 0 · check-nul-bytes: OK (scanned 9484 text file(s) -- 9484 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).", "pnpm check:objectql-double-limit": "exit 0 · OK ObjectQL double `limit` conformance holds: 407 double(s) graded, 209 apply the caller's bound or refuse it loudly.", "pnpm check:objectui-changeset": "exit 0 · ✓ objectui-range --self-test: all checks passed", "pnpm check:org-identifier": "exit 0 · check-org-identifier: OK (2875 author-facing source file(s), 17 session binding(s) resolved, no removed session.tenantId alias).", "pnpm check:page-declaration-shape": "exit 0 · check-page-declaration-shape: OK — 34 page entries across 2865 sources under packages/**, examples/**, apps/** all reach the kernel through a discover", "pnpm check:pm-changeset-deadline-census": "exit 0 · ✓ changeset-deadline-census --self-test: all cases passed across 5 batteries (what counts as a named target, the controls that make a zero a reading, ", "pnpm check:published-files": "exit 0 (re-run post-build) · ✓ check:published-files — 70 publishable package(s) of 81 workspace member(s) declare a `files` whitelist that covers every entry point plus CHANGELOG", "pnpm check:query-options-erasure": "exit 0 · ✓ query-options-erasure ratchet holds: 67 unswept non-test site(s) in 17 file(s), none new, and every file measured parsed. Every other non-test file ", "pnpm check:refd-timer-probe": "exit 0 · OK check-refd-timer-probe: 7121 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowher", "pnpm check:slot-lookup": "exit 0 · ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed. Every other file under packages/ is", "pnpm check:sourcemap-no-sources-content": "exit 0 (re-run post-build) · check-sourcemap-no-sources-content: 69 built package(s) swept - 506 map(s), none embed source text.", "pnpm check:test-source-alias": "exit 0 · check-test-source-alias OK — 74 packages with tests scanned; 61 registered as still resolving a workspace dep through `dist/`; 49 published subpath(s)", "pnpm check:tier-file-adoption": "exit 0 · OK: 81 workspace package(s) walked, 70 nightly-tier test file(s) on disk (70 e2e, 0 live), owned by 1 package(s); every one reads OS_TEST_TIERS.", "pnpm check:type-check-coverage": "exit 0 (re-run post-build) · check-type-check-coverage: OK — 77/81 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors, https://github.com/", "pnpm check:type-check-debt": "exit 0 (post-build; first run exit 3 PREREQUISITE NOT MET) · check-type-check-coverage --re-measure: OK — 4 ledger entr(ies) re-measured in 22.5s, 53 raw tsc error(s) total, none above its recorded number.", "pnpm check:watch-hint-literal": "exit 0 · ✓ check-watch-hint-literal: 71 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 47, ROOT_FILE_WATCH_HINTS 13, ROOT_WATCH_HINTS 3, DECL", "pnpm check:where-matcher": "exit 0 · ✓ where-matcher conformance holds: 430 matcher(s) discovered, 430 answer the combinator battery correctly or refuse it loudly (280 refuse).", "pnpm --filter @objectstack/plugin-hono-server test": "exit 0 · Test Files 26 passed (26) · Tests 314 passed (314) · os-verify-lock VERDICT command-exit 0", "pnpm --filter @objectstack/plugin-hono-server exec vitest run --maxWorkers=2 --reporter=verbose src/ui-plugin-auto-discovery.pin.test.ts": "exit 0 · Tests 20 passed (20), 0 todo; C1, C2 on ObjectKernel, C2 on LiteKernel listed · VERDICT command-exit 0", "pnpm --filter @objectstack/plugin-hono-server typecheck": "exit 0 · check:test-typecheck: OK — @objectstack/plugin-hono-server's test layer compiles under tsconfig.test.json; 0 file(s) / 0 error(s) · VERDICT command-exit 0", "pnpm lint (full union, eslint . --no-inline-config, at 7363f0f4)": "exit 0 · no findings printed, 114s", "node scripts/check-changeset-fixed.mjs (roster under .changeset)": "exit 0 · ✓ .changeset/config.json \"fixed\" group is in sync with 70 public workspace packages.", "pnpm check:authz-resolver (roster under packages)": "exit 0 · ✓ check:authz-resolver: single shared authorization resolver intact; both entry points delegate.", "pnpm check:error-code-casing (roster under packages)": "exit 0", "pnpm check:filter-alias-parity (roster under packages)": "exit 0 · check:filter-alias-parity: OK (4 transport spelling(s) of the where slot, identical on both sides)", "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran ran-with-exits.list": "exit 0 · ✓ dispatch-gates --ran: 60 derived famil(ies) accounted for — 60 run, 0 NOT-MEASURED (a DERIVED zero — all 60 recorded an exit code and none of them is 3).", "ablation: node scripts/ablation-replace.mjs (restore the deleted disjunct) -- vitest pin file": "exit 1 (expected red) · Tests 2 failed | 18 passed (20); both failures C2 (ObjectKernel, LiteKernel): expected [ '/console-fixture', …(3) ] to deeply equal [] · ok restored: blob == HEAD (201c58669352) and git diff HEAD is empty" }, "line_budget": "n/a — no governed or line-ratcheted surface touched", "files_changed": [ ".changeset/15638-ui-plugin-arm-delete.md (+11/-0, new; @objectstack/plugin-hono-server patch, carries 'Clause-②: no')", "packages/plugins/plugin-hono-server/src/hono-plugin.ts (+1/-2)", "packages/plugins/plugin-hono-server/src/ui-plugin-auto-discovery.pin.test.ts (+100/-42)" ], "deviations": [ "Pin file edits beyond the C block, all inside the claimed file: the header's group list names C; the KernelUnderTest docblock's stale clause (the kernels 'do NOT share whether use() validates', false since #16721) is corrected and C is listed; observe() gains an optional beforeStart hook, used only by C2.", "Rather than recording the three PREREQUISITE gates NOT MEASURED, I ran a full workspace build under the lock (turbo 72/72, 8m22s) and measured them.", "Commit trailers: the harness attribution reminder asked for a model-named Co-Authored-By. I used the order's and AGENTS.md's model-free pair; the pre-push check:commit-card-trailers passed.", "The precondition was passed on a stated reading rather than by stopping, because the one residual the probe found (post-admission self-rewrite) was judged a bypass, not a path. The reading is in open_questions[0]; if the seat rules otherwise, the draft PR should be held." ], "mcp_calls": "0 — no MCP tool of any kind was called", "api_writes": "2 REST writes, both through the fleet-write relay as objectstack-fleet[bot]: (1) pr_create via scripts/pm/with-fleet.sh --via dispatch (POST /repos/objectstack-ai/objectstack/dispatches; relay run 36087627029 executed POST /repos/objectstack-ai/objectstack/pulls, draft forced, which opened #20086); (2) this os-dev-report comment via scripts/pm/post-stamped.mjs --comment=15638 (POST /repos/objectstack-ai/objectstack/issues/15638/comments). Zero label writes, zero assignee writes, no PATCH to the PR body. git push x2 (the empty branch, then 7363f0f4) are not REST writes.", "open_questions": [ { "question": "The probe found one residual route to the removed arm. The contract validates at use() and stores the plugin object by reference, so an object admitted as type 'ui' that rewrites its own type to 'ui-plugin' before start() was mounted by the disjunct, and after this PR it is not (C2 pins the after-state). Does that count as 'reachable' under the ruling's precondition, and as an input class under Clause-②'s conformance limb?", "options": [ "A — No. Reachability means admission through a published kernel's use(), the standard this pin file already applies (on landed text) to the slug derivation and the staticPath conjunct. The residual is a bypass of the contract that works equally for every key the contract checks. Clause-② no stands; no BREAKING banner or ADR-0087 marker; the PR proceeds.", "B — Yes. The ruling's stop applies: the PR is held, and a re-declaration of Clause-② yes with a BREAKING banner plus an ADR-0087 marker is decided by the seat or the maintainer, not by the dev." ], "recommendation": "A. Actual business need: measured, no in-repo code writes a registered plugin's type, and an external author would have to declare 'ui' to the contract and then write the retired spelling in its place; that is not a real population. Long-term soundness: validation-only with reference storage is the documented design (packages/core/src/plugin-contract.ts), and this file already treats reachability as use() admission. Preventing AI mistakes: keeping any consumer that honours the retired spelling is the lenient-alias shape Prime Directive #12 forbids; C2 now pins that the block honours only 'ui', which makes the bypass visibly inert instead of silently tolerated. Startup focus: the ruling retires the spelling immediately with no staged window, and A is that. The changeset discloses the residual in its own bullet either way, and the contract reviewer, owed anyway for the .changeset face, sees it." } ], "out_of_scope_findings": [ "carrier: #16721 (recorded there) · noted in PR Acceptance notes, not filed — the plugin.slug || name-derivation and the && plugin.staticPath conjunct in the same condition are likewise unreachable through either kernel's use(); not ruled here, left untouched.", "carrier: 承接者:无 · noted in PR Acceptance notes, not filed — the post-admission rewrite residual is a property of the documented validation-only design (plugin-contract.ts: parse output discarded, object stored by reference) and applies to every contract key; not class a (no admission path reproduces it), not b (the contract is validation-at-use by its own text), not c (a kernel plugin object is code, not stored, re-authored metadata).", "carrier: 承接者:无 · noted in PR Acceptance notes, not filed — the default/isDefault redirect in the same block is still unpinned (the pin file header already names this)." ] }Generated by Claude Code
objectstack-fleet commentedon Sep 25, 2026
In-seat review: ACCEPT, PR #20086 at head
7363f0f48b3e47020b98e3d16e1e97ac8c61aaeb, and the dev's open question answered: Adomain:cliexecution PM seat #6024 · sessionsession_01TnPAC1UsTGfHPXVUCL6iLn· 2026-09-25T02:51Z · reviewed on GitHub andorigin/mainReview checklist
main. The first line isFixes #15638, the only closing binding, and the second is a line-initialClause-②: no, copied from the claim. [finding] The hono UI auto-discovery block has no in-repo producer and no test — staticPath and slug are written nowhere but the block that reads them #16050 is named without a closing keyword ("[finding] The hono UI auto-discovery block has no in-repo producer and no test — staticPath and slug are written nowhere but the block that reads them #16050 stays open here; the seat handles it at landing"). One footer; no model identifier.hono-plugin.ts, the pin file, and one changeset.66960564, with realuse()and the realHonoServerPlugininit/start.type: 'ui-plugin'is refused atuse()onObjectKernelandLiteKernelalike, withPLUGIN_CONTRACT_VIOLATION … at 'type', and is never stored. That is [finding] PluginSchema has zero runtime callers — the boot path validates name, init and semver only, so the declared plugin contract is never enforced #16049's refusal.uimounts 4 routes anddrivermounts none.assertPluginContract, and there is no in-repo producer ofui-plugin.(plugin.type === 'ui' || plugin.type === 'ui-plugin') && plugin.staticPathbecomesplugin.type === 'ui' && plugin.staticPath, and the "Support legacy" comment is deleted. There is no bespoke hint for the retired spelling (ruling item 3).it.todo, in the file's own harness:LiteKernel.use()andObjectKernel.use()refuse a declaredui-pluginwith one envelope, and the test asserts thecode.ui-pluginbeforestart()mounts nothing, with an in-case firing control.@objectstack/plugin-hono-serverpatch,Clause-②: no. It discloses the one residual in its own bullet.dispatch-gates --ranaccounts for all 60 families, 60 run and 0 NOT-MEASURED (the dev built the workspace to measure the three PREREQUISITE gates rather than recording them absent).pnpm lint(full union) exit 0, typecheck exit 0.packages/spec/src/**in the diff; the declaration is notyes.7363f0f4: still running at this review. The ready flip waits for full green on this head.The dev's open question, answered by the seat: A. The probe found one residual: an object admitted as
uithat rewrites its owntypetoui-pluginbeforestart()was mounted by the removed disjunct, and now it is not.5644357902, item 1) exists so that no legitimately admitted plugin relies on the arm, and the probe proves that for admission through both published kernels.5557089123).Clause-②: nostands, and no BREAKING banner or ADR-0087 marker is owed. The changeset's disclosure bullet is the right place for the residual. ⛔ This is the ruling applied, not a new decision.Out-of-scope, noted in the PR (not filed): the
plugin.slug ||name derivation and the&& plugin.staticPathconjunct are likewise unreachable through either kernel'suse()(recorded on #16721). Thedefault/isDefaultredirect in the same block is still unpinned.objectstack-fleet commentedon Sep 25, 2026
LANDED —
3c48234b3e86fc4bd42b4a61e71fcf14ade5164a(PR #20086), verified by CONTENT onorigin/maindomain:cliexecution PM seat #6024 · sessionsession_01TnPAC1UsTGfHPXVUCL6iLn· 2026-09-25T03:30Z338feda6, the merge's parent)origin/main'ui-plugin'inplugin-hono-server/src/hono-plugin.tsSupport legacyin the same fileplugin.type === 'ui'in the same fileit.todo(inui-plugin-auto-discovery.pin.test.ts'C1 …','C2 …') in the same file7363f0f4is ⛔ not an ancestor (exit 1); the control lega4ca69a9is an ancestor (exit 0). The commit carries the enqueue instant 2026-09-25T03:07:42Z.ui-plugindisjunct and its "Support legacy" comment are gone, and UI auto-discovery mountstype: 'ui'only.kernel.use(), now pinned on both kernels (C1).use(). The one residual, a post-admission self-rewrite, was answered as a bypass, not a path (review record5825883650).mainand it merged.Fixes #15638. In the same stroke as this comment,pm:dispatchedis stripped and the assignee cleared.fix(pm): read the ownership markers through the undecorated line, and…
docs(agents): a claim pre-check hit is a hint, not a claim (objectsta…
feat(pm): name the two measured claim near-miss forms so the sweep so…
fix(pm): the near-miss ownership census excludes seat posts and relea…
docs(adr-0026): spell the UI plugin package type `ui`, note the origi…
docs(adr-0026): caption the section 3.1 example as the proposed shape…
fix(plugin-hono-server): drop the retired ui-plugin arm from UI auto-…