[objectstack-fleet]

Requested by Yibo Wang · project thread
Fixes #26400

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：只改 dogfood 的两个 authz 普查测试文件里的计数与说明文字，记下 feat(plugin-approvals,rest,client): a record-anchored approval lock read, { locked } for every caller who can read the record #26361 新增的审批记录锁读取路由（81 行台账、rest-server 行 70 / 19 / 51、总盲点 65 / 70）。
• 为什么改：feat(plugin-approvals,rest,client): a record-anchored approval lock read, { locked } for every caller who can read the record #26361 加了一条路由但没同步普查，main 的 Dogfood Regression Gate (1/3) 和 (3/3) 从那以后一直红，发版闸门读的正是这两条。
• 风险与回滚：只动测试文件，不动任何发布包和路由代码；回滚即 revert 本 PR，main 会回到红。
• 先看：packages/qa/dogfood/test/authz-probe-blind-spot.census.ts 的 rest-server.ts 行（新盲点 50 → 51 的判定），其次台账行，再看 authz-conformance.matrix.ts 第 27 行。
• 两分钟验证：pnpm --filter @objectstack/dogfood exec vitest run test/authz-probe-blind-spot.test.ts test/authz-conformance.test.ts，预期 2 个文件、108 个测试全绿（main 上是 10 个红）。
• 需要你做的：无，席位落地。

What changes

Census bookkeeping for the route #26361 added, GET {basePath}/approvals/records/:object/:recordId/lock in packages/rest/src/approvals-routes.ts. Each figure below was measured with deriveProbeFileCensus() on this tree, not copied from the card or from the server seat's reading (6431978738). The reading agreed with the server seat on every figure it gave.

Row / figure	Before	After	Why
rest-route-ledger.ts population / reachable / blindSpot	80 / 80 / 0	81 / 81 / 0	one new ledger row carrying family: 'approvals', a family the other approval rows already carry
rest-route-ledger.ts keys	18	18	no new family, so no new key
rest-route-ledger.ts controls route: ' / family: '	80 / 80	81 / 81	the same row
rest-server.ts population / reachable / blindSpot	69 / 19 / 50	70 / 19 / 51	a new blind spot: one direct this.routeManager.register( site in registerApprovalsEndpoints, outside registerMetadataEndpoints and the /meta subset, the same as its seven siblings
rest-server.ts controls this.routeManager.register( / approvals-routes.ts: … / enforceAuth	62 / 7 / 115	63 / 8 / 116	the new site, and its handler opens with this.enforceAuth(…) (the only enforceAuth line #26361 added)
BLIND_SPOT_TOTAL_STATIC / _RUNTIME	64 / 69	65 / 70	one call site and one runtime mount; it is a direct registration, not a route factory, so the 5-mount static/runtime delta holds
authz-conformance.matrix.ts docblock (the figure #17111 parses)	80 rows / 18 families	81 rows / 18 families	plus a line in the dated drift note

Every edited figure has a provenance comment in the row, in the shape the earlier re-measurements use.

Why

Dogfood Regression Gate (1/3) and (3/3) have been red on every main push run that runs them since #26361 (6a2866af). This is the main-red stop-bleed under convention ①. It moves the census forward and does not revert #26361.

Tests

Both files, under the verify lock, on 1cc4fa20:

before (origin/main b33dd25): 2 files failed, 10 tests failed, 98 passed

Test Files  2 failed (2)
     Tests  10 failed | 98 passed (108)
os-verify-lock: VERDICT command-exit 1
AssertionError: expected 81 to be 80        (rest-route-ledger.ts population)
AssertionError: expected 70 to be 69        (rest-server.ts population)
control "route: '" moved in packages/rest/src/rest-route-ledger.ts: expected 81 to be 80
control "this.routeManager.register(" moved in packages/rest/src/rest-server.ts: expected 63 to be 62
"packages/rest/src/rest-route-ledger.ts: docblock says 80 rows, the table holds 81"   (#17111 pin and its 5 doctoring cases)

after (1cc4fa2): 2 files passed, 108 tests passed

Test Files  2 passed (2)
     Tests  108 passed (108)
os-verify-lock: VERDICT command-exit 0 · held the lock 21s

Acceptance notes

• The order named a docblock figure in packages/rest/src/rest-route-ledger.ts. The figure the [finding] authz-conformance.matrix.ts:27 states the route ledger holds "94 rows / 19 families" in the present tense — measured 91 today, and the cause is #14503, not the gate move it sits next to #17111 pin reads is in authz-conformance.matrix.ts line 27, so that is the one that moved. No packages/rest/** file changes, as the claim requires.
• Shards 1/3 and 3/3 were not run whole locally: the title carries no ! and no (narrowing) arm, so the full battery is not owed. The two files above hold all 10 failures. The card's acceptance (the first main push run and the next scheduled run green) can only be read after landing.
• The census pins still sit outside PR and merge-queue CI, which is how feat(plugin-approvals,rest,client): a record-anchored approval lock read, { locked } for every caller who can read the record #26361 merged green. Seat 1 answered that question on the card (6432031749). It is not in this PR.

Verification

Local derived gate set (dispatch-gates.mjs on 1cc4fa20, 50 families): 48 exit 0, 2 NOT MEASURED, 0 red.

NOT MEASURED (exit 3, prerequisite not met in this container)

• node scripts/check-plugin-teardown-shape.mjs --self-test: its positive control is pinned to a commit that this shallow clone cannot reach.
• pnpm check:dual-build-cjs-loads: it reads built output, and seven packages outside this diff have no dist/.

Both run in CI's Lint & Repo Gates. --ran reconciliation: 50 derived famil(ies) accounted for — 48 run, 2 NOT-MEASURED.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind. (no names added)
• 3. No formatter ran; pnpm lint passes. (CI-owned)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset. (@objectstack/dogfood is private, test files only: skip-changeset)
• 6. packages/spec touched: n/a.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English, except the 维护者速读 block.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 48a9d9db9bedba7c47abbff22574fa4e82bb6bc9 → packageMentionDocs.

[objectstack-fleet]

席位核对 · ACCEPT · domain:spec seat 1 (#6017) · session session_01WGufzfhobWEgUUrjz4rrbh · 2026-10-27T02:32Z

Head 1cc4fa2059269ec9804c072a6370f878003dc6ee. Card #26400 (main-red anchor, p0), claim 6432019740, dev report 6432279665.

• Shape: draft, base main, Fixes #26400. Two files, packages/qa/dogfood/test/authz-conformance.matrix.ts and packages/qa/dogfood/test/authz-probe-blind-spot.census.ts, both inside the claim's file surface. No packages/rest/**. skip-changeset (the dogfood package is private). check-governed-merges --pr 26406: NOT governed, 51 changed lines.
• Contract faces: none. These are test-only measurement pins: no published surface, no governed path, Clause-②: no. CI plus this seat's read are enough.
• Diff read against the cause (feat(plugin-approvals,rest,client): a record-anchored approval lock read, { locked } for every caller who can read the record #26361):
  • The ledger row goes 80/80/0 → 81/81/0, with route: ' and family: ' at 81 and keys 18. The new row carries family: 'approvals', which its siblings already carry.
  • The rest-server.ts row goes 69/19/50 → 70/19/51. this.routeManager.register( goes 62 → 63, approvals-routes.ts 7 → 8, and enforceAuth 115 → 116.
  • Totals go 64/69 → 65/70, and the matrix docblock now reads 81 rows / 18 families with a dated history line.
  • Every figure has a [#26400] note naming its cause. That is the re-read the census header asks for, not a bare bump.
  • The new site sits in registerApprovalsEndpoints, not registerMetadataEndpoints, so recording it as one more blind spot matches its seven sibling approval routes.
  • Server seat 2's reading 6431978738 agreed on the ledger row and left reachable to measurement. The dev measured it with deriveProbeFileCensus().
• Gates:
  • Both files are green under the verify lock on the head, 108/108 (before: 10 failed).
  • Derived local gates: 48 exit 0. Two are NOT MEASURED (plugin-teardown self-test on a shallow clone, dual-build-cjs-loads with no dist), and CI's lint lanes cover both.
  • Check-runs at arming: the fast set is green (Governed Surface Queue Guard, Check Changeset, branch-claim, single-writer, liveness, dispatch-gates lint). Build, Test Core and the lint/type lanes are in progress. Auto-merge waits on the required set.
• Accepted deviations: shards 1/3 and 3/3 were not run whole, which is accepted for a pin-only diff. The two failing files are the whole red. Acceptance on the card is the first main push run that runs the dogfood legs after landing, plus the next scheduled run, and the seat reports both.
• Landing: main-red stop-bleed, Tier S, not governed. pr_ready + automerge_enable in this act.