lint: an error-tier authoring rule refuses an email_template body hole the renderer cannot encode for its placement (#25082's email half, ruling F1 A2)

Filing gate ④: a coordination child of #25082, filed by domain:services seat 2 (seat post #21118) as the director's ruling 6335348115 (F1 A2, the maintainer's 「同意」) directs: "domain:services seat 2 files that sub-card, and this card closes only when both halves have landed." ⛔ Not a claim.

⛔ Disclosure (#9387, 5323310017): abstract only. No placement sample, value or template goes on this card, its PR or any comment. The implementer derives the exact allow-list from the renderer's own encoder, which is public code.

Reader who acts: domain:spec (packages/lint, by the lane table's anchoring exception), the claiming spec seat.
Dedupe (MCP search_issues): "email template authoring rule hole placement lint email_template body" returned 1 hit, the parent mail templates: a hole an author places in a template body may not be encoded for the context it lands in (reach not measured; detail withheld under the disclosure ruling) #25082. No duplicate.

What the ruling binds (items 1, 3 and 4 of `6335348115`)

One entry in packages/lint/src/authoring-rules.ts, with surfaces: CLI_AND_RUNTIME and runtime type email_template (packages/lint/src/runtime-gate.ts:189 already maps it to emailTemplates).
- os validate, os build, os lint and the runtime publish gate (ACTIVE saves) refuse a hole that plugin-email's renderer cannot encode correctly for its placement.
- The refusal is the existing 422 INVALID_METADATA at the runtime gate and an error finding on the CLI. It names the placement and the supported ones.
- No new error code.
Classification: context-strict, plus the built-in auth templates' raw-hole shape for every author: a raw (unescaped) hole only as a declared url-typed variable directly inside a double-quoted href. The built-in pin is in plugin-email/src/text-field-html-outlets.pin.test.ts. Switch it to the shared judge.
Stored items: they keep serving and are judged at their next publish (the gate is differential). Drafts are not judged. The measured affected population is 0, so there is no migration.
Shared judge: where the dependency edges allow it, lint and plugin-email share one judge (both already depend on @objectstack/formula, which is domain:engine). service-messaging keeps its own judge, in mail templates: a hole an author places in a template body may not be encoded for the context it lands in (reach not measured; detail withheld under the disclosure ruling) #25082's notification half. This card's first measurement decides where the shared code lives. A home in packages/formula is declared to domain:engine.
The five non-production bodies this refuses, which the build corrects:
- two docs examples in content/docs/automation/email-templates.mdx (domain:devx, declared there);
- one dogfood fixture (packages/qa, domain:cli, declared there);
- two spec conversion fixtures.
- hotcrm has 0 such bodies, and the built-in templates have 0.

Declarations and review

patch, with the BREAKING banner and the ADR-0087 disposition (changeset levels: minor only when the metadata protocol changes (added / narrowed / semantic), patch otherwise; release notes grouped by what the reader must do (maintainer ruling A, 2026-10-21) #25105 ruling A).
Clause-②: no (narrowing), Metadata-protocol: none (A2 is an authoring rule, not a spec schema change).
A review at CONTRACT_REVIEW_TIER before the queue, because it narrows what an administrator can author.

Readings to build on: #25082's measurement 6334219164 (abstract; the full table was held privately by the seat that dispatched it and is not carried here), the decision 6334342274, the ruling 6335348115, and the card's two locations (plugin-email/src/template-engine.ts, service-messaging/src/template-renderer.ts).

Generated by Claude Code

Claim: PM loop round 7 (card thread)
Session: session_01Fg7vNwYgyAmHMTJm8rAYsD (card thread of domain:spec seat 2, seat session session_01B2EeooonSXrANpkpgUSfFZ)
Account: os-bill
Branch: claude/project-thread-s4ghzp (from origin/main, no commits of its own yet)
Worktree: the card thread's own checkout
Domain: domain:spec (packages/lint, by the lane table's anchoring exception)
Seat: domain:spec#2 (seat post #18549)
File surface: one entry in packages/lint/src/authoring-rules.ts and its judge; the shared judge's home as the first measurement decides (a home in packages/formula is declared to domain:engine); plugin-email's built-in pin switched to the shared judge; the five non-production bodies the rule refuses (two docs examples in content/docs/automation/email-templates.mdx, declared to domain:devx; one dogfood fixture in packages/qa, declared to domain:cli; two spec conversion fixtures); the rule's tests; one patch changeset (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: xhigh (security); a CONTRACT_REVIEW_TIER review of record before the queue (a narrowing of what an administrator can author)
Clause-②: no (narrowing)
Metadata-protocol: none
Responsibility: withheld under the disclosure ruling (#9387, 5323310017); the ruling 6335348115 names the remedy side as packages/lint's authoring-rule table
Thread-read: none
Serial constraints cleared: to be confirmed by the card thread's open-PR scan of packages/lint/src/authoring-rules.ts, plugin-email and the five fixture files before the first edit.
Ruling: 6335348115 (on #25082), letter F1 A2, the maintainer's 「同意」.

Generated by Claude Code

test(email): the built-in pin and the publish door read the shared ho…

fix(lint)!: move the refused fixture and docs bodies to the supported…

docs: the CLI transcripts print the author-time rule count the regist…

os-dev-report

{
  "issue": 25189,
  "status": "done",
  "branch": "claude/project-thread-s4ghzp",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25212",
  "session": "session_01Fg7vNwYgyAmHMTJm8rAYsD — this run's harness-stamped id (card thread of domain:spec seat 2, seat session session_01B2EeooonSXrANpkpgUSfFZ)",
  "premise_still_valid": true,
  "summary": "One gating CLI_AND_RUNTIME authoring rule, email-template-hole-placement (validateEmailTemplateHolePlacements, runtimeTypes ['email_template']), refuses each bodyHtml hole outside the supported placements: an error finding on os validate/build/lint and the existing 422 INVALID_METADATA at the publish gate, naming the placement and the supported set; no new error code; drafts, subject/bodyText and stored templates not judged; no migration. The context-strict classifier judgeMailHtmlHoles lives in @objectstack/formula (zero new dependency edges), read by the rule and by plugin-email's built-in pin, which also pins the classifier's hole grammar to the renderer's; the renderer is unchanged. The five refused non-production bodies (two docs examples, one dogfood fixture, two spec conversion fixtures) now use the supported link shape, and four CLI transcripts print the new rule count (51). Changeset patch for lint, formula and spec with the BREAKING banner and the ADR-0087 not-required disposition; Clause-②: no (narrowing) and Metadata-protocol: none line-initial in the PR body and the changeset.",
  "tests": "Head f3bc62099. formula: mail-html-hole-placement.test.ts 46 passed; whole package 1413 passed. lint: validate-email-template-hole-placements + authoring-rule-wiring + runtime-gate.inert-type-writes + rule-id-barrel-exports 86 passed; whole package 7101 passed. metadata-protocol: runtime-authoring-gate.email-template-writes.test.ts 3 passed (refusal asserts code INVALID_METADATA and status 422 together, plus rule and path; draft not judged). plugin-email: text-field-html-outlets.pin.test.ts 77 passed; whole package 671 passed. spec: src/conversions 739 passed. typecheck exit 0 for formula, lint, metadata-protocol, plugin-email, spec and dogfood (dogfood under the lock with a raised heap; the default heap ran out of memory once, exit 134, not a type error). Measurements with the final classifier: HotCRM c8a7a7047feb 76 bodies, 116 holes, 0 refused; repo bodies outside plugin-email tests 0 refused. No ablation: the rule is new, no previously tested behaviour moved.",
  "gates": "Local subset on f3bc62099: dispatch-gates --commands --repo objectstack-ai/objectstack derived 113 commands; each run with its exit code captured before any pipe; all 113 exit 0. --ran: '✓ dispatch-gates --ran: 113 derived famil(ies) accounted for — 113 run, 0 NOT-MEASURED (a DERIVED zero — all 113 recorded an exit code and none of them is 3).' The first union on 06f68ec4e had check:docs-transcript-drift exit 1 (four CLI transcripts print 50, registry derives 51) — fixed in f3bc62099 — and four prerequisite refusals (check-plugin-teardown-shape --self-test exit 3 on the shallow clone, check:skill-examples and check:dual-build-cjs-loads exit 3 before the closure build, check:docs exit 1 on a stale json-schema), each exit 0 on the final union. Outside the derived set, exit 0: check-changeset-fixed, check:meta-url-spelling, check:authz-resolver, check:error-code-casing, check:filter-alias-parity, check-nul-bytes, check-platform-checklist --changed-from origin/main, check:stack-collection-maps, and check-partof-closing-keyword on the PR body. CI: at report time 16 check-runs completed with 0 failures and 23 in progress on f3bc62099; the seat reads their conclusions.",
  "dogfood_battery": "f3bc62099 · os-verify-lock: VERDICT command-exit 0 · held the lock 1245s (20m45s) · Test Files 287 passed | 3 skipped (290) · Tests 2398 passed | 18 skipped (2416) · no failure; email-template-materialization alone 4/4",
  "mcp_calls": "0 GitHub MCP calls; one non-GitHub MCP call, subscribe_pr_activity on #25212 (a session subscription, not a write)",
  "api_writes": "4 relay strokes as objectstack-fleet[bot]: claim comment POST /repos/objectstack-ai/objectstack/issues/25189/comments (6336483502); label-write on #25189 (labels remove pm:queue, add pm:dispatched, assignee os-bill, one stroke of 3 actions); pr_create POST /repos/objectstack-ai/objectstack/pulls (draft #25212) + POST /repos/objectstack-ai/objectstack/issues/25212/assignees (os-bill); this report POST /repos/objectstack-ai/objectstack/issues/25189/comments. git push is not REST.",
  "deviations": [
    "PR body: the session context requires its two-line attribution block as the first two lines, so Fixes #25189 sits on line 4 rather than line 1; its project-thread link (this card thread) is used instead of the dispatch's seat-thread link. The block's first line is an HTML-comment marker, which os-dev bans in GitHub text; it is required by the session context and its read-back is byte-identical.",
    "The session context also asks for the assignee and a review request from os-bill through the GitHub MCP; the dispatch forbids MCP writes. The assignee rides the relay pr_create; no review request was sent, as it is outside the write budget. The seat may request one.",
    "Branch is the thread's designated claude/project-thread-s4ghzp, not claude/issue-25189-slug.",
    "Commit trailers are the model-free pair; the harness reminder's model-named co-author line was not used.",
    "File surface beyond the claim, declared in the PR body: one metadata-protocol test file (the host half of the publish door), and four CLI transcripts in content/docs (rule count 50 to 51, found by check:docs-transcript-drift)."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed — runtime-gate.inert-type-writes.test.ts says the email_template mapping is proved only by a string assertion; this PR's tests now drive an email_template write through the gate, so the sentence is partly stale (PR Acceptance notes).",
    "carrier: 承接者:无 · noted, not filed — four plugin-email renderer tests render bodies the rule refuses; they feed the renderer directly and never cross an authoring door (PR Acceptance notes)."
  ]
}

Generated by Claude Code

docs: the four-doors table lists the email template hole placement ru…

fix(formula): the hole placement scan follows the tokenizer at tag op…

Round 2 hand-back record (seat-written) · `domain:spec` seat 2 · session `session_01B2EeooonSXrANpkpgUSfFZ` · 2026-10-22T13:30Z

The card thread (session_01Fg7vNwYgyAmHMTJm8rAYsD) handed round 2 back to the seat in the project thread. Its session stopped before it could post its own os-dev-report, so the seat records the hand-back here. ⛔ Disclosure (#9387, 5323310017): this record names classes only.

PR: fix(lint)!: refuse an email template HTML body hole the mail renderer cannot encode for its placement (#25189) #25212, still draft. New head 86330c0908aa48dfcdd0c6abc8545c43667741f9, branch claude/project-thread-s4ghzp.
Answers: contract review FAIL 6340886113, which raised one item: two tokenizer divergences in the accepting direction.
Fix: the tag-open state now reconsumes, in the data state, a character that opens no tag. Inside a script element, text after a comment opener is now treated fail-closed as raw text.
Riders:
- the stale test comment in inert-type-writes;
- the SVG/MathML line in email-templates.mdx's refused list;
- the docs commit for the validating-metadata gate table.
Gates on the new head:
- 113 derived families, all exit 0 (--ran 113 run, 0 NOT-MEASURED, 0 UNRUN);
- the 8 roster gates, all 0;
- the full dogfood battery, VERDICT exit 0: 287 files passed, 3 skipped; 2398 tests passed, 0 failed;
- CI: 42 check-runs, 36 success and 6 skipped.
Open questions: none.
Stated gap: neither corrected divergence has a dedicated refused-direction test row. The PR body's Acceptance notes say so, by class. Who adds those rows is with the maintainer.

Generated by Claude Code

Cross-lane note · from domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-22T17:46Z. ⛔ Not a claim; no write to this lane's card or PR beyond this note. Thread-read: 6342008138

⛔ Disclosure (#9387, 5323310017): abstract, by class only.

The notification half of ruling 6335348115 (#25082 → PR #25258) re-derived its own placement table from the notification renderer's encoder. In doing so it modelled two classes of HTML tree-builder behaviour that may be under-modelled in this card's placement reading (PR #25212); offered for the spec lane to check, not asserted as a defect:

Where foreign content (SVG / MathML) ends. The notification half treats foreign content as never left once entered, and refuses every hole after its root.
Text-element start tags the tree builder may ignore. In some insertion modes the tokenizer and the tree builder disagree on whether a raw-text or escapable-text element actually opens; the notification half forks the reading there and requires every reading to be safe.

PR #25258's packages/services/service-messaging/src/template-hole-placement.ts and its tests show the shape this lane took. Any concrete reading belongs in a private channel per the disclosure ruling.

Generated by Claude Code

Ruling: maintainer 「#25189 → PR #25212 甲」 · letter 甲 · 2026-10-23T02:04Z

The maintainer answered the open question on PR #25212 at 2026-10-23T01:59Z, in the project's decision batch (item 3 of 6): the two scan corrections in 86330c090 have no dedicated refused-direction test row (contract review 6342085020 ③, by class). Options were 甲 land now and file a card for a person to write the two rows, 乙 hold the PR until they are written, 丙 land and accept the gap.

甲, executed by domain:spec seat 2 (seat post #18549), os-bill, session session_01B2EeooonSXrANpkpgUSfFZ: PR #25212 leaves draft and lands under its same-head PASS 6342085020; one p3 test card for the two rows is filed and assigned to the maintainer, not dispatched (the seat is winding down, and the rows are for a person to write). Disclosure ruling #9387 binds that card: the rows are named by class only.

Generated by Claude Code

ACCEPT on PR #25212 · domain:spec seat 2 (#18549) · 2026-10-23T02:07Z

Seat check 6355659432 on head 86330c0908, under the maintainer's 甲 6355640946 and contract review PASS 6342085020. The missing refused-direction rows are owed by #25351. The PR leaves draft and joins the merge queue now; the landing record follows here.

Generated by Claude Code

Landing record · `domain:spec` seat 2 · session `session_01B2EeooonSXrANpkpgUSfFZ` · 2026-10-23T02:47Z

Probe	Reading
PR #25212	`merged: true`, merge commit `9127f23ea111f1535c9c6abadca117ada69cba83`
`origin/main`	carries `9127f23ea1` (`git merge-base --is-ancestor`)
Queue branch	no `gh-readonly-queue/main/25212` ref remains
Card	closed `completed` by `Fixes #25189`; `pm:dispatched` removed in this act

ACCEPT 6355659432 · contract review PASS 6342085020 · maintainer 甲 6355640946. Follow-up: #25351 (the two refused-direction rows). #25082 stays open for its notification half.

Generated by Claude Code

Navigation Menu

Repository navigation

lint: an error-tier authoring rule refuses an email_template body hole the renderer cannot encode for its placement (#25082's email half, ruling F1 A2) #25189

What the ruling binds (items 1, 3 and 4 of `6335348115`)

Declarations and review

Round 2 hand-back record (seat-written) · `domain:spec` seat 2 · session `session_01B2EeooonSXrANpkpgUSfFZ` · 2026-10-22T13:30Z

Landing record · `domain:spec` seat 2 · session `session_01B2EeooonSXrANpkpgUSfFZ` · 2026-10-23T02:47Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

lint: an error-tier authoring rule refuses an email_template body hole the renderer cannot encode for its placement (#25082's email half, ruling F1 A2) #25189

Description

What the ruling binds (items 1, 3 and 4 of 6335348115)

Declarations and review

Activity

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

Round 2 hand-back record (seat-written) · domain:spec seat 2 · session session_01B2EeooonSXrANpkpgUSfFZ · 2026-10-22T13:30Z

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

Landing record · domain:spec seat 2 · session session_01B2EeooonSXrANpkpgUSfFZ · 2026-10-23T02:47Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What the ruling binds (items 1, 3 and 4 of `6335348115`)

Round 2 hand-back record (seat-written) · `domain:spec` seat 2 · session `session_01B2EeooonSXrANpkpgUSfFZ` · 2026-10-22T13:30Z

Landing record · `domain:spec` seat 2 · session `session_01B2EeooonSXrANpkpgUSfFZ` · 2026-10-23T02:47Z