Repository navigation
test(runtime): route-ledger.conformance has no per-route reverse check, so 26 deleted ledger rows stay green; the decision it defers to (#17041) does not resolve #26513
Description
Filing gate ①: a test gap with a named location, measured. Found by the #26441 card thread (devx seat 2, PR #26511, report 6435002819) while deciding whether check-route-ledger-census could retire. Filed by domain:devx seat 2 (#20163, session session_01Q4MDXRbEJCNdPAP4SiXwp9). ⛔ Not a claim. Dedupe: the 300 newest open and closed issues grepped for route-ledger.conformance|reverse check|17041 returned no other card.
Measured (the #26441 thread, on main after c91544a4)
- Delete 3 mid-ledger rows from
packages/runtime/src/route-ledger.tsROUTE_LEDGER(GET /meta/types,POST /actions/global/:action,POST /actions/_activation/:object/:action).route-ledger.conformance.test.tsstays 6/6 green,client-url-conformance3/3, dogfood live-mount parity 8/8. Onlycheck-route-ledger-census(the hand-kept "N rows" count) reds. - Delete 26 non-final rows: the runtime conformance is still green; only the client conformance reds. Delete 28 non-sdk rows: only dogfood reds. Delete a whole section: the runtime conformance reds.
So the runtime ledger's only per-row deletion guard is a typed row count. That is the transcription-pin shape #26431 retires, and it is kept by #26511 for this reason alone.
Why it is this way
route-ledger.ts (header above ROUTE_LEDGER) and scripts/check-route-ledger-census.mjs (§ "Why a census and NOT a comparison against registered routes") both say that a per-route check against the dispatcher is "an open maintainer decision in #17041", because DomainHandlerRegistry.list() exposes domains, not routes. #17041 returns 404 on this repository, so that pointer no longer resolves.
Wanted
Either of these. The second is a decision for the owning lane or the maintainer.
- (a) A reverse check: the runtime conformance test asserts that every route the dispatcher mounts (enumerated at route granularity, e.g. by a registry listing or a probe of the running server, as the REST ledger's conformance already does) has a ledger row. The census count can then retire (ci(gates): retire the transcription pins — tests and gates that hold a hand-typed count or table equal to the tree and red on every unrelated move (parent of eight) #26431).
- (b) A recorded ruling that the count stays the guard. Re-point the two
#17041references to wherever that decision now lives.
Size: S–M. Clause-②: no. Metadata-protocol: none.
Related
#26441 / PR #26511 (keeps the census on this measurement); #26431 (retire transcription pins); #16758 (the census's origin); #26410 / PR #26491 (the same class, retired for the authz census).
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 27, 2026
Triage: first grade —
tests·priority:p3·domain:server·area:devpath·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-27T06:54Z⛔ Not a claim, ⛔ not a dispatch.
route-ledger.conformancehas no per-route reverse check, so deleting ledger rows stays green (26 measured). Add the reverse arm, where every mounted route has its row, derived from the mount and not from a typed count (the ci(gates): retire the transcription pins — tests and gates that hold a hand-typed count or table equal to the tree and red on every unrelated move (parent of eight) #26431 rule). Lane:packages/runtimeisdomain:server. It leaves [finding] The route-ledger conformance suite asserts only at DOMAIN granularity, so ANY single route row can vanish from ANY of the 11 ledgers with nothing red — measured by deleting one #17041's open question as it is, and says so in the PR.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 9 · card thread · the route-ledger reverse check
Session:
session_01R1q2xdtYgU6FKrZ7LgjPCC(the seat); the card thread issession_01FEkQ5oFmiRCo3V9eo4wD3yAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-gvuvy7(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#1Ruling-ref: triage
6435737291, card option (a):route-ledger.conformancegains a reverse arm, so every mounted route has a ledger row, derived from the mount and never from a typed count (#26431); #17041 stays open and its dead references are re-pointed. Intake split withdomain:server#2for the 18.2.0 wave-2 cards (#25807).File surface:
packages/runtime/src/route-ledger.conformance.test.ts, theroute-ledger.tsheader,scripts/check-route-ledger-census.mjs(comment re-point only), a read-only runtime route listing only if no complete enumeration exists, and itspatchchangeset. ⛔ Nopackages/spec/**(lane red line).Container & model:
S,mode:thread, default model and effort (set at thread open)Clause-②: no — a test arm plus, at most, a read-only listing; the dev measures it on the diff
Metadata-protocol: none
Responsibility: 26 ledger rows can be deleted with the runtime conformance still green, so a mounted route can lose its row unnoticed
Thread-read: 6435737291
Premise: holds (read 2026-10-27T07:41Z at
origin/main16ca320c92: card open,pm:queue, no live claim)Serial constraints cleared: none known on these paths; the dev re-measures open PRs on the files it touches before
pr_create.objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 26513,
"status": "done",
"branch": "claude/project-thread-gvuvy7",
"pr": "#26565",
"session": "session_01FEkQ5oFmiRCo3V9eo4wD3y (the card thread; seat session_01R1q2xdtYgU6FKrZ7LgjPCC holds the claim 6436437376)",
"premise_still_valid": true,
"summary": "route-ledger.conformance.test.ts gains a per-route reverse arm: every route dispatcher-plugin.ts mounts on its host IHttpServer, recorded by running the plugin start() against a recording server in its widest composition (no REST plugin, a serveable analytics service, environment scoping on under projectResolution auto: 124 mounts), must have a ROUTE_LEDGER row (exact VERB /api/v1/pattern, a * /prefix/** family row, scoped twins answering to their unscoped row). No production listing method was added, no count is typed, no server is booted. The three dead #17041 references (route-ledger.ts census header, the suite header, check-route-ledger-census.mjs) now point to #26513, the #17041 question is left open, and the census stays for #26431 to rule on. MEASURED LIMIT, against the order: per-row ablation over the recorded table shows 71 of 105 rows now red this suite when deleted. The other 34 have no mount of their own spelling, and that includes all three rows the card named. GET /meta/types is served by REST on objectstack serve and by dispatch() inline if-chains behind the hono catch-all, and the two /actions rows are servedBy specializations registered nowhere. So the order line saying the card three must turn the arm red cannot be met by any mount-derived arm; see open_questions.",
"tests": "Red first, scripts/ablation-replace.mjs deleting the mid-ledger row GET /automation/actions (anchor 1 to 0, restored to the HEAD blob, git diff HEAD empty, not committed): on main 16ca320 route-ledger.conformance.test.ts 6/6 passed exit 0; on head 1 failed 7 passed exit 1, message: Dispatcher mounts with no route-ledger row: GET /api/v1/automation/actions, GET /api/v1/environments/:environmentId/automation/actions. On head, GET /meta/types deleted: 8/8 passed exit 0 (no mount to derive from, as measured). Unmutated head: 8/8 passed. pnpm --filter @objectstack/runtime test under os-verify-lock: Test Files 457 passed (457), Tests 7424 passed | 19 skipped, exit 0. pnpm --filter @objectstack/runtime typecheck: exit 0 (check:test-typecheck OK). Test budget: suite wall 15.45 s on main vs 16.72 s on head (shared box, import phase 15.28 vs 16.54 s), test time 12 vs 16 ms. No dist ablation needed: the suite imports runtime src relatively.",
"gates": "Local, on head 2eae6bd: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 70 commands; each run with its exit code captured before any pipe. 68 exit 0, including pnpm check:route-ledger-census (its --self-test, then reads 105, array holds 105), which is also the edited script own suite. 2 exit 3, NOT MEASURED, each gate refusing its own prerequisite: node scripts/check-plugin-teardown-shape.mjs --self-test (positive control pinned to a commit this shallow clone cannot reach) and pnpm check:dual-build-cjs-loads (needs a full pnpm build). --ran: 70 derived famil(ies) accounted for, 68 run, 2 NOT-MEASURED. eslint --no-inline-config on the three touched files: exit 0. CI check-runs on PR #26565: in_progress at report time (not waited on, per os-dev).",
"dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
"mcp_calls": "9, all reads: issue_read x2 (26513 get, get_comments), search_pull_requests x1, pull_request_read get_files x3 (26551, 26337 pages 1-2: 26337 edits one route-ledger.ts row note, no overlap with these hunks), issue_read get_labels x1 (errored, PR not an issue there), pull_request_read get x1 (PR read-back), issue_read get_comments x1 (report read-back). No MCP write tool.",
"api_writes": "3 strokes: git push of claude/project-thread-gvuvy7; relay pr_create (fleet-write run 40474786883, POST pulls + issues/26565/assignees + issues/26565/labels skip-changeset; read-back: body 9201 bytes identical, assignee os-project-manager, label skip-changeset); this os-dev-report comment through post-stamped.mjs.",
"open_questions": [
{
"status": "needs_decision",
"question": "The order rules that deleting any of the card three rows (GET /meta/types, POST /actions/global/:action, POST /actions/_activation/:object/:action) must red the arm. Measured: no mount-derived arm can, and 34 of 105 rows share that state (dispatch()-only routes behind a catch-all host, raw-app doors, servedBy rows, family rows). What guards those 34 per row?",
"options": [
"A: Land the arm as is (71 of 105 rows guarded per row, derived from the mount). The 34 stay guarded per row by check-route-ledger-census alone, and #26431 rules on the census with this measurement in hand. Cost: none now.",
"B: Make dispatch() enumerable at route granularity: lift each domain inline parts[N] if-chain into a route table that dispatch() itself routes by, then derive the arm from that table. Complete, but a multi-domain refactor of the routing core (meta.ts 2353 lines, automation.ts 3927, packages.ts 2908), far beyond this S-M card.",
"C: Add a read-only runtime listing of the dispatch()-only routes. Rejected: dispatch() does not read it, so it is a hand-written second ledger, the transcription shape #26431 retires."
],
"recommendation": "A. Business need (measured): the incident class (#16758, a mass deletion) is caught by the census, and union gates (live-mount parity, client-url-conformance) already catch most of the 34 when deleted; no consumer was found harmed by a single missing dispatch-only row. Long-term: B is the north-star shape (ADR-0076 D11 table routing) but it is its own architecture card, while C is a workaround that adds a list nothing routes by. AI-error axis: A keeps one loud generated guard; C gives an AI two lists to keep in step, which is the error surface. Startup-scope axis: A adds no gate and no surface; B widens the card well beyond its size; new gates default to no. If the maintainer wants B, it should be filed as its own card, not grown here."
}
],
"out_of_scope_findings": []
}
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Landed
PR #26565 merged at 2026-10-27T09:12Z by the merge queue as
8e9abd9e37onmain(Fixes #26513; ACCEPT6437715561).git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-26565-*'origin/mainby contentgit cat-file -e origin/main:packages/runtime/src/route-ledger.conformance.test.tsgit merge-base --is-ancestor 8e9abd9e37 origin/mainState: this card closed by
Fixes(completed);pm:dispatchedremoved. The 34 dispatch-only rows stay withcheck-route-ledger-census; #26431 rules on the census with this measurement in hand.Generated by Claude Code