os-hourly-full-run-ci — machine-findable marker for this generated card. ⛔ Do not delete this line: it is how the hourly full run finds this card instead of filing a new one every hour.

hourly full run: red on main (CI)

Swept 2026-10-23T17:30:46.152Z · run log · commit 4c8f40a1961f75b84d5f2222554c471e035a3744 · conclusion failure.
CI runs the FULL battery on main every hour (#16467). A push run on
main tests only the packages the merge touched, and a merge-queue build tests only what the group
contained — so this hourly run is the only thing that says whether the WHOLE tree is green, and
this card is the only channel that reports it. Nothing is blocked by it.
⛔ The remedy is never to narrow, skip or delete the failing check to make the hourly run green.
Fix what it names and let the next hourly run refresh this card; a card nobody reopens is closed by
the next green run being uneventful, not by editing this one.

What landed since the last green hourly run

Range: f0fdd45bbc (run 39950233212, the last green CI schedule run) .. 4c8f40a196 — compare

• 925fd0772c feat(spec,lint): a bulk action's confirmText is a template slot over count and its params, judged at validate, compile and the publish gate (feat(spec,lint): a bulk action's confirmText is a template slot over count and its params, judged at validate, compile and the publish gate #24947)
• 25f88e899a refactor(plugin-security): move the permission-set resolution and addressed-write readers out of security-plugin.ts ([maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223 cut 8) (refactor(plugin-security): move the permission-set resolution and addressed-write readers out of security-plugin.ts (#25223 cut 8) #25406)
• b62ca7812f docs(pm-dispatch): fold the engine, services and cli lanes into domain:server (docs(pm-dispatch): fold the engine, services and cli lanes into domain:server #25247)
• 4e606ce039 docs(pm-dispatch): a project-coordinator reference — the cross-lane scheduling rules a Claude Code project runs by, so its instructions name only its lanes (docs(pm-dispatch): a project-coordinator reference — the cross-lane scheduling rules a Claude Code project runs by, so its instructions name only its lanes #25255)
• 24bbd0bd6a chore(examples): declare @objectstack/organizations in the showcase so a walled os serve boots without a temporary edit (chore(examples): declare @objectstack/organizations in the showcase so a walled os serve boots without a temporary edit #25418)
• 77392e901c docs(os-dev): name the harness attribution-line exemption in 〈干净收尾〉; Check Changeset reads the PR body (docs(os-dev): name the harness attribution-line exemption in 〈干净收尾〉; Check Changeset reads the PR body #25393)
• d0a1361bda fix(plugin-approvals): a new delegation starts with the Delegator set to you, and its help says why (fix(plugin-approvals): a new delegation starts with the Delegator set to you, and its help says why #25420)
• 4374f3c760 fix(cli,mcp): name the MCP server objectstack in os dev's banner, from the constant the served SKILL.md reads (fix(cli,mcp): name the MCP server objectstack in os dev's banner, from the constant the served SKILL.md reads #25425)
• 141056b417 test(runtime): judge each share-link password pair once in the messages-audience file (test(runtime): judge each share-link password pair once in the messages-audience file #25426)
• 70ff9983c9 refactor(plugin-auth): move AuthManager's audience gate and membership admission into auth-manager-membership-admission.ts ([maintainer] refactor(plugin-auth): split src/auth-manager.ts (10,338 lines, +1,867 in 30 days) along its AuthManager seams, one move-only slice per PR #25224 cut 8) (refactor(plugin-auth): move AuthManager's audience gate and membership admission into auth-manager-membership-admission.ts (#25224 cut 8) #25423)
• 2b7c331537 fix(service-sms, runtime): the Send test SMS refusals and the flow clone notice name admin controls, not REST recipes (fix(service-sms, runtime): the Send test SMS refusals and the flow clone notice name admin controls, not REST recipes #25421)
• b9c7a8f541 fix(service-datasource)!: the datasource admin API refuses to make a datasource managed while objects bind it with external (fix(service-datasource)!: the datasource admin API refuses to make a datasource managed while objects bind it with external #25431)
• b3f3298d97 fix(plugin-auth): degraded rate-limit warning names the cache registration that boots (fix(plugin-auth): degraded rate-limit warning names the cache registration that boots #25434)
• 8d9e8b954f fix(cloud-connection)!: refuse a cloud-fetched marketplace install whose catalog name an environment-authored item holds (fix(cloud-connection)!: refuse a cloud-fetched marketplace install whose catalog name an environment-authored item holds #25435)
• 2581efbcbd fix(service-automation): get_record form descriptor's limit declares minimum 1 (fix(service-automation): get_record form descriptor's limit declares minimum 1 #25441)
• 1000cc78e7 fix(spec): a dataset dimension's nullLabel is live; move the objectui pin past its reader (fix(spec): a dataset dimension's nullLabel is live; move the objectui pin past its reader #25437)
• 97be89bb3b chore(ci): refresh the Test Core shard-timings dataset (chore(ci): refresh the Test Core shard-timings dataset #25409)
• 01fd98089b chore(ci): empty spec-shape-retirements.json — all five entries name closed objectui cards (spec-shape-gate: all five entries in spec-shape-retirements.json name closed objectui cards and match nothing on main, so the registry's own rule says delete them #25108) (chore(ci): empty spec-shape-retirements.json — all five entries name closed objectui cards (#25108) #25394)
• 6c2699b3f4 docs(pm-dispatch): a project-run seat form beside the Routine form — the seat post as a stub, the dispatch order in the card thread, event wake plus one patrol per project, 项目总监 → 总监席 (docs(pm-dispatch): a project-run seat form beside the Routine form — the seat post as a stub, the dispatch order in the card thread, event wake plus one patrol per project, 项目总监 → 总监席 #25385)
• b2c0752900 fix(release): re-date a pre-written current-series field on its GA's own version run (fix(release): re-date a pre-written current-series field on its GA's own version run #25407)
• 8878c36a58 fix(service-messaging): Notification Preferences says which topics and channels can be entered (fix(service-messaging): Notification Preferences says which topics and channels can be entered #25449)
• 17ef0327b2 feat(pm): fleet-roster.mjs — regenerate the pinned fleet roster issue from seat posts, labels and pulls (scripts/pm: fleet roster generator — regenerate the pinned 「车队总表」 issue from seat posts, labels, assignees and PR queries (maintainer's word 2026-10-23) #25416) (feat(pm): fleet-roster.mjs — regenerate the pinned fleet roster issue from seat posts, labels and pulls (#25416) #25440)
• b3fddd196e fix(plugin-approvals): an out-of-office delegation applies only in its own organization (fix(plugin-approvals): an out-of-office delegation applies only in its own organization #25439)
• ab510f42e7 feat(settings,plugin-email): state the live mail transport on Setup → Email (feat(settings,plugin-email): state the live mail transport on Setup → Email #25448)
• 0b8dbea00d fix(plugin-email): the Send test email refusals name what the admin does on the page, not a request body (fix(plugin-email): the Send test email refusals name what the admin does on the page, not a request body #25453)
• ecb4e69951 feat(lint)!: refuse a bulk action's confirmText hole over an unbound root, a single-brace token, a hole holding logic and a blank sentence at validate, compile and the publish gate (feat(lint)!: refuse a bulk action's confirmText hole over an unbound root, a single-brace token, a hole holding logic and a blank sentence at validate, compile and the publish gate #25451)
• 2a80904e07 feat(pm): pm:mailbox label and the mailbox-open.mjs opener/closer (scripts/pm: pm:mailbox label in ensure-pm-labels.sh; every landing-ledger query (head:claude/, digest, roster) excludes pm:mailbox PRs; one-shot mailbox-open.mjs opens the empty-commit draft PR on mailbox/<login> (maintainer's word 2026-10-23) #25417) (feat(pm): pm:mailbox label and the mailbox-open.mjs opener/closer (#25417) #25433)
• f7d6f5bd60 docs(releases): the 18.1.0 notes, and the 18.x level rule on every page that still promised strict SemVer after GA (docs(releases): the 18.1.0 notes, and the 18.x level rule on every page that still promised strict SemVer after GA #25460)
• ea33919f56 docs(pm-dispatch): the project layer — one project form, 「pm-dispatch <席位…>」 as the summon, seats read from the seat posts' 🟢 line, takeover that never waits for a walled account, mailbox PRs, a generated roster board (docs(pm-dispatch): the project layer — one project form, 「pm-dispatch <席位…>」 as the summon, seats read from the seat posts' 🟢 line, takeover that never waits for a walled account, mailbox PRs, a generated roster board #25427)
• dd124e9466 refactor(plugin-security): move the read filters, field readers and object admissions out of security-plugin.ts ([maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223 cut 9) (refactor(plugin-security): move the read filters, field readers and object admissions out of security-plugin.ts (#25223 cut 9) #25456)
• 05cc3ee953 refactor(plugin-auth): move AuthManager's MCP access-token verifier into auth-manager-mcp-access-token.ts ([maintainer] refactor(plugin-auth): split src/auth-manager.ts (10,338 lines, +1,867 in 30 days) along its AuthManager seams, one move-only slice per PR #25224 cut 9) (refactor(plugin-auth): move AuthManager's MCP access-token verifier into auth-manager-mcp-access-token.ts (#25224 cut 9) #25461)
• 832a84ebdf fix(service-settings,platform-objects): Branding's name is the product name with no unserved default, and both timezone fields say which one is in effect (fix(service-settings,platform-objects): Branding's name is the product name with no unserved default, and both timezone fields say which one is in effect #25464)
• 6308143731 fix(release): leave a current-series field written ahead of its GA cut for that GA's own version run (fix(release): leave a current-series field written ahead of its GA cut for that GA's own version run #25488)
• d44c8936b1 chore(console): move the objectui pin 1d178e06ac5e → 6fb31dcc9954, past objectui#13370, so the console builds against the spec again (chore(console): move the objectui pin 1d178e06ac5e → 6fb31dcc9954, past objectui#13370, so the console builds against the spec again #25455)
• c5cbf7f3b0 test: scope the tree-wide pin scans to the extensions they judge, one shared scan per file (test: scope the tree-wide pin scans to the extensions they judge, one shared scan per file #25410)
• 5497d4ad43 docs(pm-dispatch): Tier S landed from a project needs a review of record by another account; the 分诊席 shrinks to bare cards; decision cards stay in their repo and the 总监席 scans every repo (docs(pm-dispatch): Tier S landed from a project needs a review of record by another account; the 分诊席 shrinks to bare cards; decision cards stay in their repo and the 总监席 scans every repo #25422)
• ce009085ab test(cli): move the audit-mail-bodies archive test budget onto the 10 s grid (test(cli): move the audit-mail-bodies archive test budget onto the 10 s grid #25492)
• 4c8f40a196 refactor(service-automation): move the registration-time checks into flow-registration-checks.ts ([maintainer] refactor(service-automation): split src/engine.ts (13,735 lines, +2,199 in 30 days) along its AutomationEngine seams, one move-only slice per PR #25222 slice 1) (refactor(service-automation): move the registration-time checks into flow-registration-checks.ts (#25222 slice 1) #25270)
  Filed by .github/workflows/scheduled-full-run-card.yml. Generated by Claude Code