[objectstack-fleet]

Requested by Leehom · project thread

Part of #25467
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6270097840

Cut 8 of the protocol.ts split (#24586 ruling A, recorded in 6270097840). Cuts 1–7 landed as #25494, #25518, #25538, #25589, #25601, #25623 and #25642. The claim is 6390712113; it resumes the work handed over in Release 6385903828 (claude/project-thread-uasfag@65b6d71d38), whose scope the server seat approved.

Five ObjectStackProtocolImplementation members, the runtime authoring gate and the restored-body doors, move unedited into a new module, packages/metadata-protocol/src/protocol-authoring-gate.ts (#23050 shape B; getters engine, authoringChannel, authoringGates). protocol.ts loses 189 net lines (30,010 to 29,821). The cut is move-only, and the card stays open for later cuts.

Branch claude/project-thread-dxdvqf is the harness-pinned branch for this thread. It names no issue, so the claim comment is the identity record. It holds two commits on main 47af3dde4: the picked-up commit 65b6d71d38 (cherry-picked unchanged), and one that writes the new module's header, which the picked-up commit had left as a placeholder line.

Serial with the file's in-flight PRs. Measured just before this PR was opened: none of the 18 open PRs touches protocol.ts, protocol-authoring-gate.ts or the [#8862] pin (each PR's file list read in full; #25718's 9,205-file list was checked by git diff --name-only against its merge base, since the files API caps at 3,000). git log 47af3dde4..origin/main -- packages/metadata-protocol/ is empty at f6ba1343ba.

What moves

Member	Base line	Visibility	Tokens (params + return + body)
restoredBodyDerivation	:6876	private	42
restoredBodyWriter	:6913	private	118
refuseRestoredBodyTheSaveDoorRefuses	:6983	private	209
runAuthoringGate	:7022	private	203
assertRuntimeAuthoringRules	:7085	private	540

The shape (#23050 shape B, as cuts 1–7 apply it)

• The class keeps every member with its name, docblock, signature and position, less async. Each body is now one host literal plus fn.call(host, …), marked [#25467 cut 8].
• Typing. AuthoringGateHost types every member as the class member itself (ObjectStackProtocolImplementation['m']). Each moved function types its this as the Pick of the host over exactly the members its body reads. Each stub annotates its literal as ThisParameterType<typeof fn>. No cast, and no member changes visibility.
• Members read: the fields engine, authoringChannel and authoringGates, as getters; the methods anonymousElevatedFlowRefusal, assertRuntimeAuthoringRules, credentialChannelFor, defaultRecordPageSaveRefusal, externalBindingSaveRefusal, foldStoredCollection, isArtifactBacked, orgWallEnforced, refuseRestoredBodyTheSaveDoorRefuses, resolveSduiManifest, resolveWritePackageScope, restoredBodyDerivation, rlsMembershipResolverKeys, runAuthoringGate and tenancyPostureInForce, as late-bound closures. No field is assigned.

Module-level declarations, by reader

• None moves. No module-level declaration is read by the moved bodies alone.
• Stay in protocol.ts and gain export in place (the only edit to each): permissionSetOwnerBindingRefusal and runtimeHookWithoutBodyRefusal, both read by code that stays (the save door). src/index.ts exports from ./protocol.js by name, so neither is published (measured below).
• Imports. In protocol.ts, evaluateRuntimeAuthoringGate and the type IObjectQLEngine lose their last reader and are dropped from their import lists. The one new statement is the import of the new module.

The published .d.ts

The series bar is ruling 6348891160, sorted-union identity, measured first on merged main as the seat asked. Base 47af3dde4 and head 6cbd26bd7d were built with pnpm --filter @objectstack/metadata-protocol build against the same dependency tree (turbo run build --filter='@objectstack/metadata-protocol^...' once, then the package's src/ swapped tree-only between the two builds and restored from HEAD, git diff HEAD empty after).

• Raw sha256: 325970c1661efaa6a3762ce7de9e6bb205ea16099784f2b6c5950d62d175b331 at base and at head, on both dist/index.d.ts and dist/index.d.cts, 772,838 bytes each. diff exits 0. Raw identity holds, so sorted-union identity holds too.
• Normalised sha256 (cut 7's normaliser, unchanged): aa05995b9d9a32f69b3416eac92ef86b46d79593001a37bf1bb529ed7a9f8952 at both ends, both files.
• The two builds differ where they should: index.js hashes 8ef7591738381e3e… at base and 12c3ff329045d303… at head, and restoredBodyDerivation.call occurs 0 times in the base bundle and once in the head bundle.
• Positive control on a copy of the head index.d.ts, the first private engine; changed to engine;: raw 3c2a24456c659dbf…, normalised 86fb565ea19f9768…. Both move.
• Export tables. The ESM and CJS bundles, loaded at runtime, each export the same 78 names at base and head; the sorted list hashes to e47ac7c753bcb8be… on all four (the same hash cut 7 reported). Neither permissionSetOwnerBindingRefusal, runtimeHookWithoutBodyRefusal nor any moved function appears.

No changeset: skip-changeset, per ruling 6348891160.

Proof of move-only

• Bodies, by AST token. For each moved function, the parameters (less the added this), the return type and the body have the same token sequence as the base method: 1,112 tokens compared, 0 differ. The body and parameter text, comments included, is also equal with whitespace collapsed, for all five. Negative control: one changed token in assertRuntimeAuthoringRules's body makes the check report differ=1.
• Class side. 299 members at base and at head. The 294 that did not move are byte-identical to base. Each of the 5 stubs sits at its base position and keeps its docblock and signature byte-identical, less async.
• Top level of protocol.ts. 231 of the 235 base statements other than the class are byte-identical, leading comments included. The other 4 are the two import statements that lose a name and the two declarations that gain export. Head adds one statement, the new module's import.
• Size. +468 / −250 over 3 files, 718 changed lines. protocol-authoring-gate.ts has 404 lines.

Readers of the moved lines

• The [#8862] pin (protocol.object-registry-write-through-spelling.test.ts). assertRuntimeAuthoringRules holds the collection pair it counts, so the scan now reads protocol.ts and protocol-authoring-gate.ts as one text and keeps the exact "one executable 'objects' literal" assertion. That is the only edit outside the move. The diff:

-    const code = executableTextOf(readFileSync(
-        fileURLToPath(new URL('./protocol.ts', import.meta.url)),
+    // [#25467 cut 8] `assertRuntimeAuthoringRules`, which holds the collection
+    // pair, moved whole into `protocol-authoring-gate.ts`; the scan reads both
+    // files as one, so the population it counts is the one it always counted.
+    const code = executableTextOf(['./protocol.ts', './protocol-authoring-gate.ts'].map((path) => readFileSync(
+        fileURLToPath(new URL(path, import.meta.url)),
         'utf8',
-    ));
+    )).join('\n'));

Both controls, re-run on this head through scripts/ablation-replace.mjs (mutation proven on disk, restored to the HEAD blob 7d8b3ff36eba, git diff HEAD empty after each):

• blanked module (the whole file deleted): AssertionError: expected [] to have a length of 1 but got +0 (the file's 12 tests: 7 fail, because the other suites import the blanked module too);
• an added 'objects' literal (listCollection('permission', 'permissions') spelled with 'objects'): expected [ '\'objects\'', '\'objects\'' ] to have a length of 1 but got 2, 1 failed, 11 passed.
• Unmutated: 12 of 12 pass. this.applyRegistryWriteThrough( sites in protocol.ts stay at 7.
• Bracketed-refusal pin (PRODUCERS): the new module has no new Error( (0), so it gets no row.
• ADR anchors and decision letters. check:adr-anchors: 85 → 85 anchored files. Decision-letter citations on the anchored surface go 1,847 → 1,846: the one that leaves is ADR-0090 D11 in assertRuntimeAuthoringRules's [#7674] comment. ADR-0090 is not among protocol.ts's anchored ADRs, and no paragraph of that anchor entry describes the authoring gate, so the new module gets no entry (disclosure only, as cut 7 did).
• Durability checker (check-durability-degradation-log-level --list): identical at both ends once [@:][0-9]+ is stripped (159 lines). None of the five members holds a seam. The gate itself exits 0 at both ends with identical output.
• Engine-double contract (check-engine-double-contract): exits 0 at both ends. The updateData/deleteData seams keep their entries at new line numbers (14254 → 14065, 14279 → 14090). productionFiles is 3,682 at base and 3,684 at head: +1 is the new file, +1 is the gitignored packages/spec/src/migrations/registry.ts, which the spec build writes and the base tree had not built.
• Identical output at both ends: check-adr-symbol-anchors, check-platform-checklist, check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet, check-filter-alias-parity. check-nul-bytes differs only in the scanned file count, +1.
• Governed surface. check-governed-merges --branch claude/project-thread-dxdvqf: 0 of 3 paths hit the register, NOT governed; 718 changed lines, under the 3,000-line human-merge bar.

Verification

• pnpm --filter @objectstack/metadata-protocol typecheck exits 0. eslint --no-inline-config packages/metadata-protocol exits 0.
• packages/metadata-protocol suite, base and head, compared per test name and status:
  • Base 47af3dde4: 21,504 tests (21,485 passed, 0 failed, 19 skipped), 266 files.
  • Head 6cbd26bd7d: 21,504 tests (21,485 passed, 0 failed, 19 skipped), 266 files.
  • None lost, none added, none changed status. The suite includes protocol.runtime-authoring-gate.test.ts, which main changed after the picked-up commit was cut.
• Derived gates. dispatch-gates --commands --repo objectstack-ai/objectstack derives 59 gates on the final tree (3 changed paths). 58 exit 0 at head. check-plugin-teardown-shape --self-test and check:lean-entry-closure first answered PREREQUISITE NOT MET (a pinned fixture commit outside the shallow clone; an unbuilt objectql/dist) and exit 0 once those were fetched and built. check:dual-build-cjs-loads is NOT MEASURED locally: it needs every package's dist/ (72 absent here) and is left to CI; the CJS bundle of this package was loaded directly above. --ran reconciles 59 of 59: 58 run, 1 NOT-MEASURED, 0 UNRUN.

Acceptance notes

• packages/metadata-protocol/src/protocol-package-install.ts (cut 7, on main) still carries its placeholder header line ([#25467 cut 7] HEADER PLACEHOLDER), while its host interface's docblock says "See the module header for which members are getters". This PR writes the cut 8 module's header and does not touch cut 7's file, which is outside this claim's file surface. Carrier: [maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467.

Carry-forward

Unchanged from cut 7: public members whose return type is inferred, the bodies kept by a reader (probeRecord, getMetaItemCached, findReferencesToMeta, packagelessAddress, refuseUnmintableMetaType, metaTypeNamespaceExists, viewContainerNameCollisionRefusal with overlaidShippedContainerViewNames, reportPageRequiresAbsentAtLoad, the 7 applyRegistryWriteThrough callers), and the private-static readers stay in protocol.ts.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 40 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/wire-format.mdx (via /api/v1/meta/* (route, a path literal in a comment in assertRuntimeAuthoringRules))
• content/docs/deployment/validating-metadata.mdx (via /api/v1/meta/* (route, a path literal in a comment in assertRuntimeAuthoringRules))
• content/docs/kernel/cluster.mdx (via /api/v1/meta/* (route, a path literal in a comment in assertRuntimeAuthoringRules))
• content/docs/protocol/kernel/plugin-spec.mdx (via resolveWritePackageScope (symbol, a field of interface AuthoringGateHost), resolveWritePackageScope (literal, a string literal in assertRuntimeAuthoringRules; a string literal in resolveWritePackageScope))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via /api/v1/meta/* (route, a path literal in a comment in assertRuntimeAuthoringRules))
• content/docs/releases/v17/17-5.mdx (via judgeFilter (literal, a string literal in assertRuntimeAuthoringRules))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f6ba1343ba41cb173baadfc36e6069123d3f2cfd → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d2b967d4ffe38c6d053b306401b0f5acea6437e1 — the merge of head 6cbd26bd7d18e6288c8e13e8694adb6833f76956 into base f6ba1343ba41cb173baadfc36e6069123d3f2cfd, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d2b967d4ffe38c6d053b306401b0f5acea6437e1 && git checkout d2b967d4ffe38c6d053b306401b0f5acea6437e1
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f6ba1343ba41cb173baadfc36e6069123d3f2cfd 6cbd26bd7d18e6288c8e13e8694adb6833f76956 && git checkout -B drift-repro f6ba1343ba41cb173baadfc36e6069123d3f2cfd && git merge --no-ff 6cbd26bd7d18e6288c8e13e8694adb6833f76956

node scripts/docs-audit/affected-docs.mjs --json f6ba1343ba41cb173baadfc36e6069123d3f2cfd

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f6ba1343ba41cb173baadfc36e6069123d3f2cfd → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-dxdvqf",
"pr": "#25719",
"session": "session_014vzV3bUKh27BRiihG8aCqR — the card thread (claim 6390712113); the picked-up commit 65b6d71 carries session_01J8pUyVs5eas1AjMdReJM7C",
"premise_still_valid": true,
"summary": "Cut 8, move-only: restoredBodyDerivation, restoredBodyWriter, refuseRestoredBodyTheSaveDoorRefuses, runAuthoringGate and assertRuntimeAuthoringRules move into protocol-authoring-gate.ts (shape B; getters engine, authoringChannel, authoringGates); permissionSetOwnerBindingRefusal and runtimeHookWithoutBodyRefusal gain export in place. Resumed from claude/project-thread-uasfag@65b6d71d38, cherry-picked unchanged onto main 47af3dd (protocol.ts unmoved since dc6c7ee); every hunk read and kept. One fix on top: the picked-up module's header was a placeholder line ('[#25467 cut 8] HEADER PLACEHOLDER'), now a written header in cut 5/6's shape (commit 6cbd26b). protocol.ts 30,010 -> 29,821 lines; +468/-250 over 3 files, 718 changed lines.",
"tests": "head 6cbd26b. metadata-protocol suite (vitest --maxWorkers=2, json reporter) at base 47af3dd and head: 21,504 tests each (21,485 passed, 0 failed, 19 skipped), 266 files; per-test name+status compare: 0 lost, 0 added, 0 changed. Base leg = package src swapped tree-only from 47af3dd and restored from HEAD under a trap, git diff HEAD empty after. typecheck (tsc --noEmit) exit 0; eslint --no-inline-config packages/metadata-protocol exit 0. AST token compare (TS scanner, params less this + return type + body): 1,112 tokens, 0 differ; negative control (one body token changed) reports differ=1; body+param text incl. comments equal whitespace-collapsed for all 5. Class: 299 members both ends, 294 non-moved byte-identical, 5 stubs keep docblock+signature less async. Top level: 231/235 base statements byte-identical; the 4 others = 2 narrowed imports + 2 gained export. [#8862] pin controls via ablation-replace.mjs, each restored to HEAD blob 7d8b3ff36eba: blanked module -> 'expected [] to have a length of 1 but got +0' (7 of 12 fail); added 'objects' literal -> 'got 2' (1 of 12 fail); unmutated 12/12 pass; this.applyRegistryWriteThrough( sites in protocol.ts = 7.",
"gates": ".d.ts (ruling 6348891160), base and head built against one dependency tree: raw sha256 325970c1661efaa6a3762ce7de9e6bb205ea16099784f2b6c5950d62d175b331 both ends, both index.d.ts and index.d.cts, 772,838 bytes, diff exit 0 -> RAW IDENTITY HOLDS; normalised aa05995b9d9a32f69b3416eac92ef86b46d79593001a37bf1bb529ed7a9f8952 both ends; positive control (private engine; -> engine;) moves raw and normalised; index.js differs base/head (restoredBodyDerivation.call 0 -> 1). Export tables ESM+CJS: 78 names, sorted-list sha e47ac7c753bcb8be on all four. Letters: check:adr-anchors exit 0 both ends, 85 -> 85 anchored files, decision-letter citations 1,847 -> 1,846 (ADR-0090 D11 in assertRuntimeAuthoringRules' [#7674] comment; ADR-0090 not anchored on protocol.ts, no entry). Governed: check-governed-merges --branch claude/project-thread-dxdvqf exit 0, 0 of 3 paths, NOT governed, 718 lines. Hand gates exit 0 both ends, identical output: check-adr-symbol-anchors, check-platform-checklist, check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet, check-filter-alias-parity, check-durability-degradation-log-level; --list identical after stripping [@:][0-9]+ (159 lines); check-nul-bytes +1 file only; check-engine-double-contract exit 0, seam line numbers move (updateData 14254->14065, deleteData 14279->14090), productionFiles 3,682 -> 3,684 (+1 new file, +1 gitignored packages/spec/src/migrations/registry.ts written by the spec build in the head tree). Derived: dispatch-gates --commands --repo objectstack-ai/objectstack -> 59 gates on 3 paths; 58 exit 0 (check-plugin-teardown-shape --self-test and check:lean-entry-closure first exit 3 PREREQUISITE NOT MET, 0 after fetching fixture commit 621a487 and building objectql); check:dual-build-cjs-loads NOT MEASURED locally (72 packages without dist/, needs full pnpm build; CI Lint & Repo Gates runs it). --ran: 59 derived, 58 run, 1 NOT-MEASURED, 0 UNRUN, exit 0. CI on 6cbd26b at report time: Check Changeset success, Check PR Size success, Check Documentation Links success, both single-claim checks success; Lint, Type Check, Test Core, Build Core, Governed Surface Queue Guard in_progress or queued.",
"dogfood_battery": "n/a — no ! in the PR title and the claim's Clause-② is no with no (narrowing) arm",
"mcp_calls": "0 — no GitHub MCP calls; reads went through gh api",
"api_writes": "3 — git push of claude/project-thread-dxdvqf (not REST); relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches -> run 40145008903 executing POST /pulls, POST /issues/25719/assignees, POST /issues/25719/labels); this os-dev-report comment via post-stamped.mjs",
"line_budget": "718 changed lines (+468/-250), under the 3,000-line bar",
"files_changed": ["packages/metadata-protocol/src/protocol.ts", "packages/metadata-protocol/src/protocol-authoring-gate.ts", "packages/metadata-protocol/src/protocol.object-registry-write-through-spelling.test.ts"],
"deviations": ["Added one commit beyond the picked-up work: the new module's header, which the picked-up commit left as a placeholder line; inside the claim's file surface.", "check:dual-build-cjs-loads not run locally (declared narrowing; CI runs it). The package's own ESM and CJS bundles were loaded directly at both ends instead.", "The standing changeset line is replaced by skip-changeset, as the order says; Clause-② no and Metadata-protocol none are in the PR body, measured on the diff: no authorable key, value or published export moves, same as the claim."],
"open_questions": [],
"out_of_scope_findings": ["carrier: #25467 — packages/metadata-protocol/src/protocol-package-install.ts (cut 7, on main) still carries its placeholder header line '[#25467 cut 7] HEADER PLACEHOLDER' while its host interface docblock says 'See the module header for which members are getters'. Doc defect, not class a/b/c; outside this claim's file surface, so not touched. Noted in the PR's Acceptance notes.", "cut 9 proposal (from Release 6385903828's larger groups): the carry-forward credential group (credentialChannelFor and its readers), which cut 8's moved bodies already reach only through the host; measure its size and readers at claim and keep it under 3,000 changed lines."]
}

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · domain:server seat 1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-10-25T00:05Z

Head 6cbd26bd7d, report 6391184870, claim 6390712113 (Resume-from claude/project-thread-uasfag@65b6d71d38).

item	reading
Shape	draft, base main, Part of #25467 (no closing keyword), skip-changeset label, Clause-②: no and Metadata-protocol: none line-initial.
Files (3, +468/−250)	protocol.ts, the new protocol-authoring-gate.ts, the [#8862] pin. Exactly the claim's surface. Not governed (check-governed-merges --pr 25719), 718 changed lines.
Move-only, seat's own read	every non-blank line deleted from protocol.ts (240) appears in the new module except 7, and each of the 7 is a signature or import the move rewrites: the three private async method heads (now stubs), the two function … Refusal( heads (now export function in place, as the scope ruled), one narrowed IObjectQLEngine, IPubSub import and one evaluateRuntimeAuthoringGate import specifier. The lines added to protocol.ts are the module import, the two export keywords and the five host-delegating stubs.
Pin	reads protocol.ts and the module as one text and keeps the exact one-'objects'-literal assertion; both controls reproduce on this head per the report (blanked module got +0, added literal got 2).
.d.ts	raw identity at base and head (325970c1…, .d.ts and .d.cts) with a positive control, so ruling 6348891160's sorted-union bar holds; export tables 78 names on all four.
Gates	dev union 59 derived, 58 exit 0, check:dual-build-cjs-loads NOT MEASURED (CI). CI at this act: 15 success, 12 skipped, 16 in progress, 0 failed. Lint & Repo Gates and Type Check owed success before ready.
Letters	1,847 → 1,846 (ADR-0090 D11 leaves with the body; not anchored on protocol.ts, no entry), disclosed.
Out of scope	cut 7's protocol-package-install.ts on main still carries its header placeholder line: carrier #25467, the next cut fixes it in the same file family.
Landing	ready + auto-merge through the relay once every check on this head is green or an expected skip. Cut 9 (the carry-forward credential group) is the next claim on this card, after this merges.

---

Generated by Claude Code