[objectstack-fleet]

Requested by Sales · project thread

Part of #25222
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6348891160

This is slice 5 of the engine.ts split. The claim is comment 6376387561, and the seat agreed the slice on the remaining-bodies table (comment 6376268510). The bodies of nine AutomationEngine methods move, unedited, into a new module, packages/services/service-automation/src/run-history.ts:

• listRuns, listRunsPage, runRecordToLogEntry, suspendedRunToLogEntry, getRun, listSuspendedRuns and readSuspendedRuns, which read runs and suspended runs back;
• recordLog and finishRefusedRun, which record a run's log entry and finish a refused run.

The change is move-only, and the card stays open for the later slices. The branch is claude/project-thread-nirtwt, which the harness pins for this session. It was restarted from main at 673ebfd4 after slice 4 (#25542) merged. The branch name has no issue number, so the claim comment is the identity record.

Scope

• The 33-site question. The ruling on the 33 this.FIELD.delete/insert/update( sites in 21 methods is still pending with Sales. This slice moves 0 of those sites, because none of the nine bodies holds one. check-tenant-audit-census and check-system-context-census give byte-identical output at base and head (see Readers).
• Return types. Each of the nine methods declares its return type, so no public body with an inferred return type moves.
• None of the bodies that must stay moves. Those are the ones the remaining-bodies table marks as stays:
  • for liveness, retryExecution and getConnectorDescriptors;
  • for private statics, resolveCanonicalDescriptor, resolveResumeAuthority and resolveEffectiveSuspension;
  • for the startup-registry gate, knownNodeTypes, getUnknownNodeTypeAudit, sealNodeTypeVocabulary and warnUnknownNodeTypes.
• Left in place. listSuspendedRunsDurable, getSuspendedScreen and compactStepsForHistory are one line each, so a stub would be no shorter than the body, and they stay in the class.
• Size. 1,522 changed lines, under the 3,000-line bar: engine.ts +80 / -659, the new module +781, and the test 1 / 1.

What stays in engine.ts

• Every moved method keeps its name, docblock, signature and position in the class, because tsup emits each member, private ones included, into the published .d.ts.
• The line comments between recordLog's docblock and its signature ([#10101], [#13909]) stay above the signature too.

The shape (slices 1 to 4)

• The host interface. RunHistoryHost holds the 14 members these bodies read, each typed as the class member itself (AutomationEngine['m']), so a renamed member is a compile error. There is no cast, and no member becomes public or protected.
  • Each moved function types this as the Pick of RunHistoryHost over exactly the members its own body reads, read off each body's AST in first-read order.
  • runRecordToLogEntry and suspendedRunToLogEntry read no member, so they are called directly, without a host.
• Methods are passed as late-bound closures, (...a) => this.m(...a), so a spy or test double set on the instance is still the one called. There are six: listRunsPage, suspendedRunToLogEntry, runRecordToLogEntry, evictConsumedSuspension, compactStepsForHistory and recordLog.
• store goes through a getter. This is the first time the series uses one, and it follows the seat's shape call.
  • setSuspendedRunStore reassigns store, so passing it by value could hand a body a store the engine has since replaced.
  • The stub builds const readStore = () => this.store; and the host member get store() { return readStore(); }, the form [maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223 cut 1 (PR refactor(plugin-security): move SecurityPlugin's leaf readers into security-plugin-object-inputs.ts (#25223 cut 1) #25290) uses for non-readonly fields. Each read of this.store in the body reads the engine's current store, as it did inside the class.
  • No moved body writes store, or any other field: the generator refuses a this.X =, op=, ++ or -- in a moved body, and found none. So no get/set pair (refactor(plugin-auth): move AuthManager's request routing into auth-manager-request-routing.ts (#25224 cut 10) #25508) is needed.
• Seven fields go by value: executionLogs, logger, suspendedRuns, cacheOnlySuspensions, maxLogSize, runSummaryLog and consumedSuspensions. The seat asked for proof that none is reassigned after construction:
  • The declarations (engine.ts at this head):
    • private executionLogs: ExecutionLogEntry[] = [];
    • private readonly maxLogSize: number;
    • private readonly runSummaryLog: RunSummaryLogLevel;
    • private logger: Logger;
    • private suspendedRuns = new Map…
    • private cacheOnlySuspensions = new Set…
    • private consumedSuspensions = new Map…
  • git grep -nE "this\.(executionLogs|logger|suspendedRuns|cacheOnlySuspensions|maxLogSize|runSummaryLog|consumedSuspensions)\s*=[^=]" -- packages/services/service-automation/src finds 3 lines, all in the constructor: this.logger = logger;, this.maxLogSize = … and this.runSummaryLog = ….
  • Across the repo, git grep -nE "\.(executionLogs|suspendedRuns|cacheOnlySuspensions|maxLogSize|runSummaryLog|consumedSuspensions)\s*(=[^=>]|\?\?=)" finds those 2 constructor lines and one test, src/run-summary.test.ts:295, which overwrites runSummaryLog with 'off' before the run starts.
    • The host is built afresh on each call, and recordLog, the one body that reads runSummaryLog, is synchronous, so the body reads the value the test set. That test passes at head.
  • The one body that changes a field's contents is recordLog. It changes them in place, with this.executionLogs.push(…) and .splice(…) on the engine's own array, and never rebinds the field.
• Async. The stubs of the four async methods (listRuns, listRunsPage, getRun and readSuspendedRuns) drop async and return the moved function's promise, as in slices 3 and 4.
  • The caller gets the very promise the body makes.
  • Dropping async is the only edit to those signature lines, and the .d.ts does not print async.
• The moved bodies keep saying this., so the moved lines are unedited.

Module-level declarations and imports

• Nothing is newly exported. Every top-level name the bodies read is already exported from engine.ts: buildRunTrigger, isTerminalRunStatus, ExecutionLogEntry, RunRecord, StepLogEntry and SuspendedRun.
  • The module imports buildRunTrigger and isTerminalRunStatus by value, and the rest, AutomationEngine included, as types.
  • Both values are read only inside function bodies, at call time, and a comment above the import says so, as in slice 3.
• The module's other imports use the same specifiers as engine.ts's own imports:
  • the types ExecutionStatus, FlowParsed, AutomationContext, AutomationResult and RunListResult;
  • the values summarizeRun, formatRunSummaryLine and describeThrownForLog.
• One engine.ts import line changes. formatRunSummaryLine was read only by recordLog, so import { summarizeRun, formatRunSummaryLine } from './run-summary.js'; keeps summarizeRun alone. That is a moved line: the module carries it verbatim.
  • Every other name is still read in engine.ts too.
  • engine.ts gains the ./run-history.js import, after the ./dag-traversal.js one, with a 3-line comment naming its bodies.
• Authored text. The module docblock and the host interface's docblock are new. The host docblock says why store is a getter.

Proof of move-only

• Moved block. This is git diff --color-moved=plain --color-moved-ws=allow-indentation-change 673ebfd4 HEAD over engine.ts and run-history.ts. It detects 655 of the 659 deleted lines and 684 of the 861 added lines as moved.
  • Deleted, not moved (4): the signature heads of listRuns, listRunsPage, getRun and readSuspendedRuns, each of which drops async.
  • Added, not moved (177):
    • the module's docblock, imports and host interface;
    • the nine pointer docblocks and rewritten function heads;
    • the ./run-history.js import and its comment;
    • the four heads without async;
    • the nine stub bodies;
    • lines git does not pair with a moved block.
• An independent check. A script compared base and head engine.ts against the new module.
  • Module lines. 698 of the module's 782 lines are in 9 verbatim runs of base engine.ts: the nine method texts, de-indented one level. The script names each of the other 84:
    • 62 head lines: the copyright line, the docblock, the imports and their comment, the host docblock and the 14-member host interface;
    • the 9 pointer docblocks;
    • 13 signature lines: nine export function heads, and four this parameter lines, each a Pick of the host.
  • Deleted lines. Every line deleted from engine.ts (659 in all, 6 of them blank) is among the module's lines, apart from the 4 async heads above.
  • Added lines. Of the 80 lines added to engine.ts, 66 are found nowhere in base: the narrowed ./run-summary.js import, the ./run-history.js import with its comment, the four heads without async, and the stub lines. The other 14, such as logger: this.logger, and };, are lines base already contains elsewhere.
  • Literals. No string or template literal in the nine method bodies spans a line, checked on the TypeScript AST of base engine.ts. So de-indenting changed no string value.
• .d.ts: see the next section.
• Bundles. The ESM and CJS export lists are identical: 39 names each at base and at head, and ESM equals CJS on each side. The bundle JS bytes differ only because code moved within the bundle.
• Tests. @objectstack/service-automation's suite passes the same at base and head, 199 of 199 files and 2628 of 2628 tests.

.d.ts reading (ruling 6348891160, item 2)

The merge base is 673ebfd4, the head of main, so the merge-base reading and the base reading are one reading.

• Base is dist/, built at 673ebfd4 in this container, in a worktree of that commit.
• Head is dist/, built at this PR's commit. The package's dependencies were built by turbo run build --filter=@objectstack/service-automation (31 of 31 tasks), and both sides resolve the same built dependencies.

The readings:

• Raw sha256, index.d.ts and index.d.cts, which are identical to each other on both sides: base 1a5162a4dd929399460a3936e22747a74cf0a8db24d398ffbab5d7ead7bf212e, head 1a5162a4dd929399460a3936e22747a74cf0a8db24d398ffbab5d7ead7bf212e.
• Normalised sha256, all four files: base 0df32585069f743135440763aabff8c23473231181297c8d164f5f7ee4f10232, head 0df32585069f743135440763aabff8c23473231181297c8d164f5f7ee4f10232.
• Raw diff, index.d.ts base vs head: 0 lines, with 19,626 lines on each side. This slice reorders no union, so the normalised diff is empty too.
• The normaliser, the ruling's one-liner, verbatim:
  node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]*"(?:\s*\|\s*"[^"\n]*")+/g,r=>r.split(/\s*\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum
• Positive controls, on line 4276 of the head index.d.ts, a private member whose body moved. Each control changes that one line, then runs the same normaliser:
  • private recordLog; made public (recordLog;) gives 0ec48a1a498558b9a4c85d40790ef91f63014441ec38485bc40b564ad81f8c3b.
  • The same member renamed (private recordLogRenamed;) gives ad22516615ca006846b45d71c4647406ba6465f5fd420778a8d709e5517473ca.
  • Both differ from 0df32585…, so the normaliser hides neither kind of change.
• Item 1 holds:
  • (a) the declaration set and visibility are the same;
  • (b) the files are byte-identical, before and after the normalisation;
  • (c) the ESM and CJS export lists are identical;
  • (d) there is no raw-diff line.

Readers

One reader re-pointed. src/flow-activation-ledger.test.ts's ENGINE_SOURCES holds the #10243 grep pins, which are absence checks. It gains ./run-history.ts, so a moved body is not a place the retired mechanism could come back unseen. That 1-line edit is the PR's third file.

Readers examined. The base for each is 673ebfd4, in a worktree of that commit.

• check-tenant-audit-census (derived): output byte-identical to base.
  • It certifies 238 write call sites (162 decidable; 2 provably without tenant context, 29 more unreadable).
  • It holds 23 prose figures and matches every UNTYPED_RECEIVERS row.
  • Its --self-test output is identical too.
• check-system-context-census (derived): output byte-identical. It finds 149 elevation read sites in 22 packages across 77 files, in 129 symbols.
• check:liveness (spec lane, not derived; run by hand as packages/spec's tsx scripts/liveness/check-liveness.mts): output identical at base and head.
  • 753 (entry, cited file) pairs: 752 anchored, 1 exempt.
  • 982 of 982 symbol anchors resolve.
  • No packages/spec/liveness row cites any of the nine methods.
• check:platform-checklist (not derived; run by hand): output identical at base and head. 987 of 997 symbol anchors resolve; the other 10 are the same ones, the named [finding] the platform-checklist corpus resolves symbol anchors with its OWN rule, not the shared resolver — a permissive token match where the ruling says there is to be exactly one implementation #16898 residual.
• check-adr-symbol-anchors (not derived; run by hand): output identical at base and head. 2384 anchors across 142 records resolve.
• check:adr-anchors (decision letters; run by hand at the merge base and the head): output byte-identical. It reads 84 anchored files, 52279 citations across 6684 files, and 1956 decision-letter citations. Neither engine.ts nor run-history.ts is on the anchored surface.
• check:startup-registry-verdict (not derived; run by hand at both ends, and on the hand-gate list from this slice on, as the seat asked): 46 seams, 40 of them read-only, none recording a verdict, at base and at head.
  • Its --list is the same at both ends apart from line numbers.
  • None of its four engine bodies moves: knownNodeTypes, getUnknownNodeTypeAudit, sealNodeTypeVocabulary and warnUnknownNodeTypes.
  • The scanned file count is 3454 at base and 3455 at head; the extra file is run-history.ts.
• path:line citations. The only one into this package's engine.ts is service-automation/src/engine.ts:44, in packages/spec/scripts/liveness/evidence.test.ts. It is a realm-attribution fixture that scanEvidence parses without reading the file.
  • Lines of engine.ts after base :129 move down by 14 until the first moved body.
  • Lines after the last moved body move up by 579, since the file goes from 11,686 to 11,107 lines.

Gates

• Derived. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on this commit derives 59 families from the 3 changed paths: 1,522 changed lines, under the 3,000-line human-merge threshold.
  • All of them ran in this container on this commit, with each exit code captured before any pipe, and all 59 exit 0.
  • dispatch-gates.mjs --ran reconciles: 59 derived, 59 run, 0 NOT-MEASURED, 0 UNRUN.
• By hand, at base and head, not derived: check:liveness, check:platform-checklist, check-adr-symbol-anchors, check:adr-anchors and check:startup-registry-verdict, with the readings in the Readers section above.
• Package checks. @objectstack/service-automation's vitest run gives 199 of 199 files and 2628 of 2628 tests, the same at base and head. tsc --noEmit, and ESLint on the three files, pass.
• Open PRs, re-listed before this PR was opened: 11, and none of them touches service-automation/src, the readers above or their ledgers. refactor(plugin-auth): move the better-auth global before-hook into auth-manager-before-hook.ts (#25224 cut 13) #25548 and refactor(plugin-security): move the authorization middleware out of security-plugin.ts (#25223 cut 12) #25545 edit scripts/check-dispatcher-error-vocabulary.mjs and scripts/check-system-context-census.mjs, but only rows for plugin-auth and plugin-security. The Version Packages PR chore: version packages #24876 touches only the package's CHANGELOG.md and package.json. main has moved to ab596f82 (test(cli): the shared-name install-local jobs test lets each install run to the setup deadline, not a fixed 120 s #25547, a cli test), which touches none of these files.

node scripts/check-ci-filter-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-adoption.mjs :: exit 0
node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-dts-emitted.mjs --self-test :: exit 0
node scripts/check-issue-citations.mjs :: exit 0
node scripts/check-keyed-text-bounds.mjs :: exit 0
node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0
node scripts/check-platform-object-tenancy-census.mjs :: exit 0
node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0
node scripts/check-plugin-teardown-shape.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0
node scripts/check-position-name-fold-loaders.mjs :: exit 0
node scripts/check-position-name-fold-loaders.mjs --self-test :: exit 0
node scripts/check-registry-log-declared.mjs :: exit 0
node scripts/check-registry-log-declared.mjs --self-test :: exit 0
node scripts/check-rest-log-spy-declared.mjs :: exit 0
node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0
node scripts/check-system-context-census.mjs :: exit 0
node scripts/check-system-context-census.mjs --self-test :: exit 0
node scripts/check-tenant-audit-census.mjs :: exit 0
node scripts/check-tenant-audit-census.mjs --self-test :: exit 0
node scripts/check-undeclared-dep-imports.mjs :: exit 0
node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0
node scripts/ci/assert-turbo-remote-cache.mjs --self-test :: exit 0
node scripts/docs-audit/check-affected-docs.mjs :: exit 0
node scripts/docs-audit/check-drift-comment.mjs :: exit 0
pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:dispatcher-error-vocabulary :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:dts-closure :: exit 0
pnpm check:dual-build-cjs-loads :: exit 0
pnpm check:durability-log-level :: exit 0
pnpm check:engine-double-contract :: exit 0
pnpm check:error-status-conformance :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:issue-citations :: exit 0
pnpm check:lean-entry-closure :: exit 0
pnpm check:logger-receiver-detach :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:objectql-double-limit :: exit 0
pnpm check:org-identifier :: exit 0
pnpm check:page-declaration-shape :: exit 0
pnpm check:published-files :: exit 0
pnpm check:query-options-erasure :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:slot-lookup :: exit 0
pnpm check:sourcemap-no-sources-content :: exit 0
pnpm check:test-source-alias :: exit 0
pnpm check:tier-file-adoption :: exit 0
pnpm check:type-check-coverage :: exit 0
pnpm check:type-check-debt :: exit 0
pnpm check:watch-hint-literal :: exit 0
pnpm check:where-matcher :: exit 0

Acceptance notes

• The slice is the seat's agreed list, with no judgement call outside it.
• This is the first host getter in the series: store, in the [maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223 cut 1 form. No get/set pair is needed.
• After this slice, the remaining-bodies table leaves about 1,420 movable lines in bodies over 3 lines. Those are slices 6 and 7, and they need no ruling. The 21 site-bearing bodies, and the five startup-registry bodies tied to registerFlow, wait on the 33-site ruling.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Mnj4nkWuhJ18xEdZvb2cjE

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 39 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ai/actions-as-tools.mdx (via /api/v1/automation/:name/runs (route, bridged from symbol getRun — its route source's handler names it), /automation/:name/runs (route, the route ledger binds it to client method automation.listRuns), /automation/:name/runs/:runId (route, the route ledger binds it to client method automation.getRun))
• content/docs/automation/approvals.mdx (via /api/v1/automation/:name/runs (route, bridged from symbol getRun — its route source's handler names it), /automation/:name/runs (route, the route ledger binds it to client method automation.listRuns), /automation/:name/runs/:runId (route, the route ledger binds it to client method automation.getRun))
• content/docs/automation/flows.mdx (via getRun (symbol, a method of class AutomationEngine; a top-level function), listRuns (symbol, a method of class AutomationEngine; a top-level function), listRunsPage (symbol, a field of interface RunHistoryHost; a method of class AutomationEngine; a top-level function), runSummaryLog (symbol, a field of interface RunHistoryHost), listRunsPage (literal, a string literal in listRuns; a string literal in listRunsPage), runSummaryLog (literal, a string literal in recordLog; a string literal in runSummaryLog), /api/v1/automation/:name/runs (route, bridged from symbol getRun — its route source's handler names it), /automation/:name/runs (route, the route ledger binds it to client method automation.listRuns), /automation/:name/runs/:runId (route, the route ledger binds it to client method automation.getRun))
• content/docs/concepts/metadata-lifecycle.mdx (via /api/v1/automation/:name/toggle (route, bridged from symbol listRuns — its route source's handler names it))

⛔ 6 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via AutomationEngine (symbol, a top-level type))
• content/docs/releases/v17/17-0.mdx (via AutomationEngine (symbol, a top-level type), getRun (symbol, a method of class AutomationEngine; a top-level function), listRuns (symbol, a method of class AutomationEngine; a top-level function))
• content/docs/releases/v17/17-1.mdx (via /api/v1/automation/:name/runs (route, bridged from symbol getRun — its route source's handler names it), /automation/:name/runs (route, the route ledger binds it to client method automation.listRuns), /automation/:name/runs/:runId (route, the route ledger binds it to client method automation.getRun))
• content/docs/releases/v17/17-3.mdx (via /api/v1/automation/:name/toggle (route, bridged from symbol listRuns — its route source's handler names it))
• content/docs/releases/v17/17-6.mdx (via AutomationEngine (symbol, a top-level type), /api/v1/automation/:name/runs (route, bridged from symbol getRun — its route source's handler names it), /api/v1/automation/:name/toggle (route, bridged from symbol listRuns — its route source's handler names it), /automation/:name/runs (route, the route ledger binds it to client method automation.listRuns), /automation/:name/runs/:runId (route, the route ledger binds it to client method automation.getRun))
• content/docs/releases/v17/17-7.mdx (via /api/v1/automation/:name/runs (route, bridged from symbol getRun — its route source's handler names it), /automation/:name/runs (route, the route ledger binds it to client method automation.listRuns), /automation/:name/runs/:runId (route, the route ledger binds it to client method automation.getRun))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ab596f82c961f9975e40012fcdbca0d291c69326 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from dc30c59f11d1facde5a9b156885ada0b346398c6 — the merge of head 9047bcb70475ef42a87dc04015a1cdccf0ee7326 into base ab596f82c961f9975e40012fcdbca0d291c69326, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin dc30c59f11d1facde5a9b156885ada0b346398c6 && git checkout dc30c59f11d1facde5a9b156885ada0b346398c6
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ab596f82c961f9975e40012fcdbca0d291c69326 9047bcb70475ef42a87dc04015a1cdccf0ee7326 && git checkout -B drift-repro ab596f82c961f9975e40012fcdbca0d291c69326 && git merge --no-ff 9047bcb70475ef42a87dc04015a1cdccf0ee7326

node scripts/docs-audit/affected-docs.mjs --json ab596f82c961f9975e40012fcdbca0d291c69326

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ab596f82c961f9975e40012fcdbca0d291c69326 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-24T00:10Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25222 slice 5 (claim 6376387561; os-dev-report 6377154774) · reviewed head 9047bcb704 · merge base 673ebfd4dc

• Shape: nine run-history bodies move unedited into the new src/run-history.ts: listRuns, listRunsPage, runRecordToLogEntry, suspendedRunToLogEntry, getRun, listSuspendedRuns, readSuspendedRuns, recordLog and finishRefusedRun. That is 655 body lines. 3 files, +862 / −660, 1,522 changed lines.
• Host:
  • store is a getter in the [maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223 cut 1 / PR refactor(plugin-security): move SecurityPlugin's leaf readers into security-plugin-object-inputs.ts (#25223 cut 1) #25290 form, because setSuspendedRunStore reassigns it (engine.ts:2749). No moved body writes a field, so there is no get/set pair.
  • The seat's grep finds that the by-value fields (executionLogs, suspendedRuns, cacheOnlySuspensions, consumedSuspensions, maxLogSize, runSummaryLog, logger) are written only in the constructor (engine.ts:2724-2727), in every module of the engine source.
  • The host is built on each call.
• Path reader: the flow-activation-ledger.test.ts ENGINE_SOURCES list gains ./run-history.ts, so the grep pin still reads every module a body moved to.
• .d.ts, ruling 6348891160 item 1, re-run by the seat in its own worktree:
  • turbo run build at 673ebfd4dc and at this head.
  • Raw 1a5162a4dd929399… / normalised 0df32585069f7431… on both index.d.ts and index.d.cts at both ends. The raw diff is 0 lines.
  • The seat's positive control makes head line 1490, private flows;, public. That moves both hashes, to raw 192d82835c6dd986… and normalised 89e8a8fac9607092….
  • CJS exports: 39 at both ends.
• Gates re-run by the seat, all exit 0 at base and at head:
  • check-adr-symbol-anchors: 2,384 anchors.
  • check-tenant-audit-census: 238 sites.
  • check-system-context-census: 149 sites over 77 files.
  • check-adr-anchors
  • check-dispatcher-error-vocabulary
  • check-platform-checklist
  • spec check-liveness: byte-identical output.
  • check-startup-registry-verdict: 46 seams at both ends. The only change is the file count, 3,454 → 3,455, from the new module.
• Decision-letter count, read by the seat: 1956 at the merge base and 1956 at head.
• Tests and gates (report): 59 of 59 derived gates exit 0. 199 files / 2,628 tests at both ends.
• CI: 34 success and 12 expected skips, none failed or pending (46 runs).
• Mergeable: git merge-tree onto today's main (45f996231e) is clean. No other open PR touches the package.
• Census sites: this slice moves 0 of the 33 sites, which still wait on their ruling.
• Landing: not governed (check-governed-merges --pr 25551: 1,522 lines). The maintainer paused merging at 2026-10-24T00:00Z and lifted the pause at 2026-10-24T00:09Z. The seat re-ran merge-tree on 45f996231e after that, and it is clean. Ready + auto-merge through the relay. The card stays open and dispatched. Slice 6 is claimed afresh on the merged main.

---

Generated by Claude Code