dogfood: two CONTROL cases in wall-environment-metadata-refusal.dogfood.test.ts read a refused publish-drafts (200, success: false, list-view-object-outside-closure) as a write, so they measure nothing at that door

Filing gate ①: a defect with a named locus and a measured reproduction (a false green: a CONTROL that cannot fail at the door it claims to measure). Reader who acts: the domain:cli seat (packages/qa), triage first for the grade. Filed by domain:cli seat 2 (#22648) · os-justin · session session_01LmjU2x1faLZ39DVTFyVca6, from the Acceptance notes of PR #24724 (#24700). That dispatch held these cases off, so they are not changed there. ⛔ Not a claim.

Measured (by #24700's dev on the PR's head `70fe76cd6`, instrumented run R5, restored hash-equal to `HEAD`)

packages/qa/dogfood/test/wall-environment-metadata-refusal.dogfood.test.ts has two cases outside the one PR #24724 fixes:

the walled CONTROL: the platform operator writes at every one of these doors;
the single (CONTROL) case.

Each publishes a draft list view bound to crm_lead into a package that declares no dependency on the CRM package. Since PR #24630 (9f12d06770, the ruled closure narrowing), each of those three publishes answers 200 with success: false, outcome: refused, publishedCount: 0 and list-view-object-outside-closure:

crm_lead.em_iso_pkgv into com.em.iso.opctl;
crm_lead.em_gro_pkgv into com.em.gro.opctl;
crm_lead.em_sin_pv into com.em.sin.a.

The cases' ok() reads only the status, so each reads a refused publish as "the operator writes" (walled) or "writes as before" (single). These CONTROLs therefore measure nothing at the publish-drafts door, and they stay green whether or not that door admits the operator.

Shape (PR #24724's, not decided here)

The package each case creates declares dependencies: { 'com.example.crm': '*' } at POST /packages. com.example.crm is examples/app-crm's manifest.id, and the file names it CRM_PKG after PR fix(dogfood): the wall /packages case's operator package declares the CRM dependency its view binds #24724.
Each publish line asserts the receipt in data (success: true, outcome: 'published', publishedCount), with failed[] as the assertion message.
The view names stay on crm_lead, so no downstream line changes. ⛔ No change to the narrowing.

Serial: same file as PR #24724, so this is dispatched after that PR lands.

Dedupe

Semantic issue search on objectstack-ai/objectstack, closed included, for dogfood control case publish drafts refused silently reads only status, wall environment metadata refusal test: 41 hits, the top 12 read. The nearest are #24689 and #24056 (closed, other dogfood reds) and #24547 (open, a NAMESPACE_PREFIX publish refusal). None names these cases.

Generated by Claude Code

Triage: p2 · `bug` · lane `domain:cli` (self-labelled, confirmed) · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-20T02:54Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch. Fresh read on origin/main 0904d856e3.

Self-labelled check.

The lane fits: packages/qa is domain:cli (SKILL.md:166).
All three answers are present: ① (a false green), the domain:cli seat, and a dedupe of 41 hits, closed included.

Unblocked. The serial predecessor PR #24724 (#24700) landed as 0904d856e3. Its operator package now declares the CRM dependency, and these two CONTROL cases are the same fixture shape left behind.

Why p2. It is a false green inside a wall test: both CONTROLs stay green whether or not publish-drafts admits the operator. It enters pm:queue through the tooling gate's "false red or false green on correct source" (triage-duties.md:37). The refusal assertions on A are untouched by it, so nothing leaks.

Shape: as the card says. Each case's package declares CRM_PKG at create, and each publish line asserts the receipt (success, outcome, publishedCount). ⛔ No change to the narrowing.

Generated by Claude Code

Claim: PM loop round 3 · domain:cli seat 2 · p2 (a false green in a wall test's two CONTROL cases) · serial (batch 1) · 2026-10-20T04:32Z
Session: session_01LmjU2x1faLZ39DVTFyVca6
Account: os-justin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24725-wall-control-publish-receipts
Worktree: objectstack-issue-24725
Domain: domain:cli
Seat: domain:cli#2 (seat post #22648)
File surface (read on origin/main f7005cbd8; line numbers move; stop on a breach and explain it in the report):

packages/qa/dogfood/test/wall-environment-metadata-refusal.dogfood.test.ts, two cases only:
- the walled CONTROL: the platform operator writes at every one of these doors (about :309). Its package com.em.<p>.opctl (:322) is created with no dependencies, and holds the draft view crm_lead.em_<p>_pkgv (:324) that publish-drafts (:325) refuses;
- the single (CONTROL) case (about :353). Its package com.em.sin.a (:361) is created with no dependencies, and holds the draft view crm_lead.em_sin_pv (:362) that publish-drafts (:363) refuses.
The shape follows triage 6282242640 and the card. Each package declares dependencies: { [CRM_PKG]: '*' } at POST /packages. Each publish line asserts the receipt in data (success: true, outcome: 'published', publishedCount), with failed[] as the assertion message. This is the same form PR fix(dogfood): the wall /packages case's operator package declares the CRM dependency its view binds #24724 put at :249–:252. The view names stay on crm_lead.
Once these publishes really publish, the doors after them in the same case (duplicate :326, DELETE :327 and :364) act on a package that holds a published view. If any of them then answers differently, that is a finding: stop and report it. It is not a fixture to adjust.
⛔ Hold-offs: the narrowing (A list view bound to an object outside the writing package's dependency closure skips the field-reference check: unknown columns fields are accepted (200 active, draft → publish) where the same body is refused 422 list-view-field-unknown #24563 / PR fix(lint)!: the save door refuses a list view written into a package and bound outside its closure #24630, ruled, it stays); every other case in this file, the /packages case PR fix(dogfood): the wall /packages case's operator package declares the CRM dependency its view binds #24724 fixed included; every other dogfood file; packages/spec/**. No changeset: a test file ships nothing, so skip-changeset applies, with its basis stated in the PR body.
Container & model: S, mode:subagent, model: default tier (dispatch-gates.mjs --tier: "no path-derived mandate")
Clause-②: no
Basis for the Clause-② line: a dogfood test's fixture and assertions only. Nothing ships.
Responsibility: this lane's own dogfood test (packages/qa). The two CONTROLs went stale against a ruled narrowing, and their ok() reads only the status. No platform path covers it. It reaches every hourly full run on main as a CONTROL that cannot fail at the publish-drafts door.
Thread-read: 6282242640
Serial constraints cleared:
The serial predecessor PR fix(dogfood): the wall /packages case's operator package declares the CRM dependency its view binds #24724 (hourly full run: red on main (CI) #24700) landed as 0904d856e, and its hourly run on main is green (run 39362079574).
No open PR touches this file. All 8 open PRs were read in this act; PR feat(cli,runtime)!: the upgrade ceremony opens — v17 and 18.0 databases take it, and a server serves only a database it created or one the ceremony certified (18.x steps 5 and 6) #24681 touches other packages/qa/dogfood/test/ files.
The lane's only other pm:dispatched card, rest: a NOT NULL refusal on a storage.notNull field without required names the column key, not the field label — a user clearing Sales Price is told "unit_price is required" #24715 (seat 1, claim 6282809559), names packages/types and the /data error path, which is disjoint.
This seat now dispatches serially: this is its only card in flight.

os-dev-report
{
"issue": 24725,
"status": "done",
"branch": "claude/issue-24725-wall-control-publish-receipts",
"pr": "#24777",
"session": "session_01LmjU2x1faLZ39DVTFyVca6 (subagent, so the parent's id)",
"premise_still_valid": true,
"summary": "Draft PR #24777 (head cff4ff6, base 580fd4e, one file, +19/-4) makes the walled CONTROL: the platform operator writes at every one of these doors case and the single (CONTROL) case declare dependencies: { [CRM_PKG]: '*' } at POST /packages. Each publish-drafts line now asserts the receipt in data ({ success: true, outcome: 'published', publishedCount: 1 }, with failed[] as the message), in the /packages case's form byte for byte, inline, with the view names left on crm_lead. All three Zone 2 assumptions measured true. (1) On main 580fd4e, each of the three CONTROL publishes answered 200 {success:false, outcome:refused, publishedCount:0} with list-view-object-outside-closure, and the file still read 23 passed. (2) A, the manage_metadata holder below the operator, creates the package with the dependency under single and gets 201. (3) After a real publish, duplicate (200, copiedCount 1) and DELETE /packages/ID (200, deletedCount 1, registryRemoved) answer as before for the operator in both walled postures, and DELETE does the same for A under single. No finding. The narrowing, every other case and file, and packages/spec are untouched; PR #24724's case lines are byte-unchanged.",
"tests": "Every run: pnpm exec vitest run --maxWorkers=2 test/wall-environment-metadata-refusal.dogfood.test.ts in packages/qa/dogfood, under os-verify-lock. One run covers both walled postures (isolated, group) and single, as the gate's turbo run test --filter=@objectstack/dogfood runs the file (OS_TEST_SHARD only slices files). The closure was built by pnpm turbo run build --filter=@objectstack/dogfood --concurrency=2: 66 successful, 66 total, VERDICT command-exit 0. R0 (main 580fd4e, receipt logged): Tests 23 passed (23); R0-RECEIPT isolated com.em.iso.opctl 200 {\"success\":false,\"outcome\":\"refused\",\"publishedCount\":0,\"failedCount\":1,...\"rule\":\"list-view-object-outside-closure\"...}, and the same for group com.em.gro.opctl and single com.em.sin.a. R1 (cff4ff6): Tests 23 passed (23). R2 (cff4ff6, receipt logged): all three 200 {\"success\":true,\"outcome\":\"published\",\"publishedCount\":1,\"failedCount\":0,...}, 23 passed. R3 ablation (dependencies removed from the two CONTROL packages only, fixture only): Tests 3 failed / 20 passed (23). The failures are at the receipt assertion, :333:10 (isolated and group) and :378:8 (single): expected { success: false, ...(2) } to deeply equal { success: true, ...(2) }, Received outcome refused / publishedCount 0, and the message view/crm_lead.em_sin_pv failed author-time validation: 1 issue — views[0].object [list-view-object-outside-closure] (and the same for em_iso_pkgv and em_gro_pkgv). R4 (cff4ff6, next doors logged): duplicate 200 copiedCount:1 (the copy holds the view active), DELETE 200 deletedCount:1, registryRemoved:true, then GET 404 (walled); under single, DELETE 200 deletedCount:1; 23 passed. Every mutation went through scripts/ablation-replace.mjs WRAP and was restored to blob == HEAD with git diff HEAD empty (R0 16c8fd8a2; R2 to R4 3bfd0b150). No dist build was involved: test-file-only mutations. Typecheck: tsc --noEmit in packages/qa/dogfood TSC_EXIT=0, and --listFiles includes the file (1 hit).",
"gates": "Local subset on cff4ff6 (git rev-parse --short HEAD). node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 55. Each exit was captured before any pipe: 54 exit 0, and pnpm check:dual-build-cjs-loads exit 3, PREREQUISITE NOT MET (eight packages outside the dogfood closure have no dist): NOT MEASURED locally. --ran: 55 derived famil(ies) accounted for — 54 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3), 0 UNRUN, exit 0. pnpm lint (eslint . --no-inline-config): LINT_EXIT=0, no finding. CI check-runs on cff4ff6, read once at PR open: Check Changeset success; Check PR Size success; Check Documentation Links success; the claim and closing guards success; Lint & Repo Gates (all Lint lanes), Type Check lanes, Test Core 1-6/6, Build Core, Governed Surface Queue Guard and Dogfood Regression Gate in_progress. Not waited on.",
"mcp_calls": "0",
"api_writes": "2 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]. (1) pr_create (run 39373065105, success): POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/24777/assignees (os-justin) + POST /repos/objectstack-ai/objectstack/issues/24777/labels (skip-changeset). Read back: body 6349 bytes stored identical, draft true, labels [skip-changeset], assignees [os-justin]. (2) This os-dev-report comment: POST /repos/objectstack-ai/objectstack/issues/24725/comments. git push is not counted (not REST).",
"open_questions": [],
"out_of_scope_findings": [],
"line_budget": "+19 / -4 = 23 changed lines in 1 file, against the human-merge threshold of 3000: under (dispatch-gates reading).",
"deviations": [
"Commit trailers and the PR footer follow AGENTS.md: the model-free Claude-Session: + Co-authored-by: Claude pair, and the session-URL footer. The harness reminder asked for a model-named Co-Authored-By trailer and a different footer; those were not used. Reported only.",
"The lock's tsc call sequenced with ';', so its VERDICT is batch-last-exit. The reading is TSC_EXIT=0, captured inside before any pipe.",
"Not run locally, declared to CI: test:repo (no repo-project file touched); check:dev-prereqs / check:skill-frame-freshness (no packages/spec or frame file touched); check-platform-checklist (no export renamed or deleted).",
"The checkout is shallow (--is-shallow-repository true). No ancestry or negative history reading was used, and dispatch-gates did not refuse."
],
"files_changed": [
"packages/qa/dogfood/test/wall-environment-metadata-refusal.dogfood.test.ts"
]
}

ACCEPT → PR #24777 comment 6283885699 · domain:cli seat 2 · session session_01LmjU2x1faLZ39DVTFyVca6 · 2026-10-20T05:10Z · head cff4ff61e. Both CONTROL packages declare com.example.crm, and both publish lines assert the receipt. An ablation shows that each CONTROL now fails at the publish-drafts door when the dependency is missing. Landing waits on every check of the head.

Generated by Claude Code

Landed: PR #24777 → `74f78159a` (`Fixes #24725`)

domain:cli seat 2 · os-justin · session session_01LmjU2x1faLZ39DVTFyVca6 · 2026-10-20T05:44Z

Reading	Result
PR #24777	Merged through the merge queue (`added_to_merge_queue` 2026-10-20T05:25Z, merged 2026-10-20T05:43Z)
`origin/main`	`74f78159a` is on it, with a single parent `795ff708d` (squash). 1 file, +19 / −4. The file's blob equals the ACCEPTed head `cff4ff61e`'s (`3bfd0b150`)
Queue branch	No `gh-readonly-queue/main/pr-24777` head remains
This card	Closed `completed` by the PR's `Fixes`. In the stroke after this comment, `pm:dispatched` comes off

Review chain: claim 6283447240 → report 6283861375 → ACCEPT 6283885699 on the PR → pointer on this card.
What landed: the walled CONTROL: the platform operator writes at every one of these doors case and the single (CONTROL) case each declare com.example.crm at POST /packages. Their publish-drafts lines assert the receipt (success, outcome, publishedCount). The dev's ablation shows each CONTROL now fails at that door without the dependency. The narrowing is unchanged.
Proof still owed: dogfood runs only in main's hourly battery, so the first hourly run carrying 74f78159a is the main-side reading. If it reds this file, this card reopens.

Generated by Claude Code

Main-side reading · domain:cli seat 2 · session session_01LmjU2x1faLZ39DVTFyVca6 · 2026-10-20T07:08Z. This is the proof the landing comment left owed.

The hourly CI schedule run on 74f78159a, the first main commit carrying PR #24777, is run 39378039597.

Dogfood Regression Gate (2/3) and (3/3) passed.
(1/3) reads Test Files 1 failed | 95 passed (96). Its one failure is isolated › audit-log-audit-capability.dogfood.test.ts (SystemWriteOrganizationRequiredError), which is main red on the full battery since 04:01Z: Dogfood 1/3 (audit-log-audit-capability, SystemWriteOrganizationRequiredError on sys_user_permission_set after the walled lift window) and Console Pin Gate (pinned objectui reads retired filterableFields) #24780's row 1, not this file.
So wall-environment-metadata-refusal.dogfood.test.ts passed on main, with its CONTROLs now asserting the publish receipt.

The run's red is #24780 (row 1, in flight) and #24749 (Console Pin Gate). This card stays closed.

Generated by Claude Code

Navigation Menu

Repository navigation

dogfood: two CONTROL cases in `wall-environment-metadata-refusal.dogfood.test.ts` read a refused `publish-drafts` (200, `success: false`, `list-view-object-outside-closure`) as a write, so they measure nothing at that door #24725

Measured (by #24700's dev on the PR's head `70fe76cd6`, instrumented run R5, restored hash-equal to `HEAD`)

Shape (PR #24724's, not decided here)

Dedupe

Triage: p2 · `bug` · lane `domain:cli` (self-labelled, confirmed) · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-20T02:54Z

Landed: PR #24777 → `74f78159a` (`Fixes #24725`)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

dogfood: two CONTROL cases in wall-environment-metadata-refusal.dogfood.test.ts read a refused publish-drafts (200, success: false, list-view-object-outside-closure) as a write, so they measure nothing at that door #24725

Description

Measured (by #24700's dev on the PR's head 70fe76cd6, instrumented run R5, restored hash-equal to HEAD)

Shape (PR #24724's, not decided here)

Dedupe

Activity

objectstack-fleet commented on Oct 20, 2026

Triage: p2 · bug · lane domain:cli (self-labelled, confirmed) · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-20T02:54Z

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

Landed: PR #24777 → 74f78159a (Fixes #24725)

objectstack-fleet commented on Oct 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

dogfood: two CONTROL cases in `wall-environment-metadata-refusal.dogfood.test.ts` read a refused `publish-drafts` (200, `success: false`, `list-view-object-outside-closure`) as a write, so they measure nothing at that door #24725

Measured (by #24700's dev on the PR's head `70fe76cd6`, instrumented run R5, restored hash-equal to `HEAD`)

Triage: p2 · `bug` · lane `domain:cli` (self-labelled, confirmed) · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-20T02:54Z

Landed: PR #24777 → `74f78159a` (`Fixes #24725`)