[objectstack-fleet]

Requested by Steve · project thread
Fixes #26410

Clause-②: no
Metadata-protocol: none
Ruling-ref: 6433001130

维护者速读

• 改了什么：删掉 dogfood 里 1,691 行手写的权限普查表 authz-probe-blind-spot.census.ts，authz-probe-blind-spot.test.ts 改成直接从两张路由账本推导：只有账本里出现一行 discover() 读不到的路由才红，不再钉任何条数。matrix 注释里两本账的「N rows」也去掉，只留 families / domains 数，[finding] authz-conformance.matrix.ts:27 states the route ledger holds "94 rows / 19 families" in the present tense — measured 91 today, and the cause is #14503, not the gate move it sits next to #17111 的钉相应只钉组数。
• 为什么改：10 天里 3 次 PR 绿着合进去、main 才红，全是「加了一条路由、条数没同步」。按裁决 C：普查从账本派生，纯数字变动不再红；discover() 的 UNCLASSIFIED / STALE 棘轮不动，也不加任何 CI 车道。
• 风险与回滚：只动测试文件和三处注释，不动任何路由代码和发布内容；回滚即 revert。代价是不再记录 rest-server.ts 注册点的盲点读数(那份记录留在 commit 6746140 的历史里)。
• 先看：packages/qa/dogfood/test/authz-probe-blind-spot.test.ts(新的推导检查)，其次 authz-conformance.test.ts 的 [finding] authz-conformance.matrix.ts:27 states the route ledger holds "94 rows / 19 families" in the present tense — measured 91 today, and the cause is #14503, not the gate move it sits next to #17111 段，再看 authz-conformance.matrix.ts 第 27 行一带。
• 两分钟验证：pnpm --filter @objectstack/dogfood exec vitest run test/authz-probe-blind-spot.test.ts test/authz-conformance.test.ts，预期 2 个文件、70 个测试全绿。
• 需要你做的：无，席位落地。

What changes

C, as ruled. The hand-written census packages/qa/dogfood/test/authz-probe-blind-spot.census.ts (1,691 lines) is deleted. It pinned per-file registration-site counts, exact positive-control counts, the probe-table shape (25 / 20 / 33) and two blind-spot totals (65 / 70), so every route added anywhere in @objectstack/rest had to be re-measured by hand. If it was not, main went red after a green merge.

authz-probe-blind-spot.test.ts is rewritten to derive everything and pin no count:

• Population and reach come from the ledgers. For REST_ROUTE_LEDGER (family) and ROUTE_LEDGER (domain), the imported table is the population. The ledger probe's own scoped text read (the same export const NAME … closing-bracket scope discover() uses) is the reach. The test asserts the two line up row by row. It goes red only on a ledger row whose grouping value the probe cannot read. Such a row is a route discover() can never name. A row with a literal family or domain moves nothing.
• Kept, derived on both sides: the matrix header's "discover(): N probes over M named source files" must equal the PROBES table it describes. Every PROBES entry must declare its kind before its file. All three kinds must still be in use.
• Kept, presence only: each file a TRIPWIRE probe reads keeps one in-file positive control, so a tripwire's zero still reads the file. Each module on the RestServer registrar list must still register routes, since the two rest-server.ts tripwires read them all. No exact counts.

The #17111 docblock pin, in place (same defect class). The claim's premise was "the three reds were all the blind-spot pin". That is only partly true. #26406's before-run shows authz-conformance.test.ts's #17111 pin also red on #26361 (docblock says 80 rows, the table holds 81), so deleting the census alone would leave a route-only PR still editing authz-conformance.matrix.ts.

The matrix docblock now states only (18 families) / (23 domains). The pin parses that shape, and the "stale ROW count" doctoring case is gone. The group, deletion, second-copy and anchor cases stay. A new family or domain still moves the figure, alongside the discover() classification it needs anyway. The seat amended the claim's file surface for this.

Untouched: discover() and its UNCLASSIFIED / STALE verdicts, the baseline, the matrix rows, every CI workflow. No census step was added to PRs or the merge queue.

Other readers of the census path, re-read before deleting. None needs the table:

Reader	What it held	Action
packages/rest/src/rest-route-ledger.ts, packages/runtime/src/route-ledger.ts	a comment pointer: "the full reading lives in … census.ts"	pointer now names the census at commit 6746140 and its derived successor
packages/rest/src/rest-meta-auth.test.ts	a comment: the test "licenses the census counting those 8 as REACHABLE"	reworded to the ratchet's meta:rest-server.ts:registerMetadataEndpoints key
authz-conformance.test.ts (5 comments)	pointers to the census's prose and per-file controls	re-pointed (the controls now live in the new test)
scripts/pm/dispatch-gates.mjs:2822	a dated incident narrative naming the path	unchanged; it describes a past edit
scripts/pm/dispatch-gates.self-test.mjs:12013	the path as a change-set fixture for jobFilteredSteps	unchanged; pure path-pattern matching, no file read, and the path still lies under packages/qa/dogfood/**

No scripts/pm/** wording moved, so this PR is not Tier H.

Why

Three main reds in ten days (#24057, #25988, #26361 → #26400) came from a PR that changed a counted file and merged green. These census files run only on main's push and scheduled batteries. Every one was a count moving, never an unclassified route. The ruling (6433001130) withdrew a PR-time census step (letter A) and kept C: derive the population, so a bump-only change reds nothing, and leave discover() as the only gate.

Tests

Both files on origin/main 6746140 (before): 108 passed

 Test Files  2 passed (2)
      Tests  108 passed (108)
os-verify-lock: VERDICT command-exit 0 · held the lock 19s

Both files on bd9b1ea (after): 70 passed

 Test Files  2 passed (2)
      Tests  70 passed (70)
os-verify-lock: VERDICT command-exit 0 · held the lock 22s

The 38 fewer tests are the census's per-file parametrised rows and its table and totals pins, all deleted with it.

Controls on bd9b1ea: one row added to REST_ROUTE_LEDGER via scripts/ablation-replace.mjs, restored and hash-checked after each leg

• Positive control: a route-only change. Added GET /api/v1/approvals/zz-control-probe with family: 'approvals', an existing family. Result: Test Files 2 passed (2) · Tests 70 passed (70), nothing to edit. The same shape of change on main (feat(plugin-approvals,rest,client): a record-anchored approval lock read, { locked } for every caller who can read the record #26361) needed test(dogfood): re-measure the authz census for the approval record-lock read #26406 (+37/−14 in the census and matrix) to clear 10 reds.
• Negative control: an unclassified route. Added a row with family: 'zz-unclassified-probe'. discover() still refuses: UNCLASSIFIED surface — add a ledger row (ADR-0060): rest-family:rest-route-ledger.ts:zz-unclassified-probe, and the [finding] authz-conformance.matrix.ts:27 states the route ledger holds "94 rows / 19 families" in the present tense — measured 91 today, and the cause is #14503, not the gate move it sits next to #17111 families figure reds too. 11 failed / 59 passed.
• Negative control: a row the probe cannot read. Added a row with family: 'approv' + 'als'. authz-probe-blind-spot.test.ts reds on the probe reads EVERY row, naming the row. 12 failed / 58 passed.
• After each leg: ablation-replace: ok restored: blob == HEAD (b6dd2271294b) and git diff HEAD is empty.

Acceptance notes

• The rest-server.ts registration-site blind-spot reading (70 sites, 19 reachable, 51 not) is no longer recorded anywhere live. The route-level bound it measured is still stated in the matrix header: a route inside an existing family mints no key. The full record stays in history at 6746140.
• rest-server-registrar-files.ts's header says each reader pins the list's length. The derived check walks every module on the list instead, so no length is pinned. That header is not edited here.
• Leg 3 also shows a pre-existing probe weakness: family: 'approv' + 'als' makes the ledger probe mint a phantom key approv, because its pattern stops at the first quote. It is caught twice (UNCLASSIFIED, and the new row-by-row check), so this is noted only.
• Dogfood shards run only on main push and schedule runs (dispatch-gates lists Dogfood Regression Gate as "scheduled BY YOUR PATHS" for a route-ledger.ts change, but its if: skips pull_request and merge_group, so neither PR CI nor the derived commands run the dogfood pins (main red after #24009) #24073 stands), so the first CI reading of these two files is after merge.

Verification

All readings on head bd9b1ea5b0, clone unshallowed, every package under packages/** built (turbo run build --concurrency=2 --filter='./packages/**', 75 tasks, under the verify lock).

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 56 derived commands, every exit captured before any pipe, 56 exit 0. The first pass had 2 exit-3 prerequisite refusals (check-plugin-teardown-shape --self-test on the shallow clone, check:dual-build-cjs-loads without dist/). Both exit 0 after unshallowing and building.
• --ran: 56 derived famil(ies) accounted for — 56 run, 0 NOT-MEASURED (a DERIVED zero).
• The three artifact-roster families whose roster sits under packages/ were run too: check:authz-resolver, check:error-code-casing and check:filter-alias-parity, all exit 0.
• pnpm --filter @objectstack/dogfood typecheck: exit 0, 0 errors.
• Not run locally: @objectstack/rest and @objectstack/runtime tests and typecheck. Their diff is comment-only (three comment blocks). Test Core runs them on this PR.
• Dogfood shards: not run whole. The title has no ! and no (narrowing) arm. The two affected files are the ones run above.

Changeset: skip-changeset. @objectstack/dogfood is private, and the two src/ edits in @objectstack/rest / @objectstack/runtime are comments only.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (CI-owned)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset. (nothing publishes: skip-changeset)
• 6. packages/spec touched: n/a.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English, except the 维护者速读 block.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ADHkmPfdxeQ7cdMHou5dY1

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 2 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 37 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d0a7e748a933a7fb549c38c3105c1c49f5935dec → packageMentionDocs.

Which tree this was computed on

This run read content/docs from feee8b0d4f9c1bf10c7b202fda7807fd6cd29f48 — the merge of head bd9b1ea5b0264123eba1612a63e00e791787a838 into base d0a7e748a933a7fb549c38c3105c1c49f5935dec, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin feee8b0d4f9c1bf10c7b202fda7807fd6cd29f48 && git checkout feee8b0d4f9c1bf10c7b202fda7807fd6cd29f48
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d0a7e748a933a7fb549c38c3105c1c49f5935dec bd9b1ea5b0264123eba1612a63e00e791787a838 && git checkout -B drift-repro d0a7e748a933a7fb549c38c3105c1c49f5935dec && git merge --no-ff bd9b1ea5b0264123eba1612a63e00e791787a838

node scripts/docs-audit/affected-docs.mjs --json d0a7e748a933a7fb549c38c3105c1c49f5935dec

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

席位核对 · ACCEPT · devx seat 2 · 2026-10-27T05:06Z

Seat domain:devx#2 (#20163) · session_01Q4MDXRbEJCNdPAP4SiXwp9 · reviewed head bd9b1ea5 · card #26410 (claim 6433691397, branch claude/project-thread-4g1xrr), wave 10 delta N, ruling C only (Ruling-ref: 6433001130). Not governed (check-governed-merges: tier null); +227/−1870, below the 3000-line threshold.

• C, as ruled: the 1,691-line authz-probe-blind-spot.census.ts is deleted. The test now imports REST_ROUTE_LEDGER / ROUTE_LEDGER as the population and re-reads each ledger's scoped text, the way the discover() ledger probes do, as the reach. It asserts the two match row by row, in order, so only a row the probe cannot read (grouping value missing or non-literal) reds, and the failure names the route. No count is pinned. The non-vacuity controls are > 0, not a number. The tripwire controls check presence, not counts, and the registrar-list check needs each listed module to still register a route.
• The surface amendment (seat-approved on the thread's measurement): feat(plugin-approvals,rest,client): a record-anchored approval lock read, { locked } for every caller who can read the record #26361's red was also the [finding] authz-conformance.matrix.ts:27 states the route ledger holds "94 rows / 19 families" in the present tense — measured 91 today, and the cause is #14503, not the gate move it sits next to #17111 docblock pin ("80 rows, the table holds 81"). The authz-conformance.matrix.ts sentence now states family/domain counts only, and [finding] authz-conformance.matrix.ts:27 states the route ledger holds "94 rows / 19 families" in the present tense — measured 91 today, and the cause is #14503, not the gate move it sits next to #17111 pins those. A route inside an existing family or domain moves nothing. A new family or domain still reds, which is the same event discover() reports as UNCLASSIFIED.
• Untouched, as ruled: discover()'s UNCLASSIFIED/STALE ratchet, the baseline, every workflow, scripts/pm/** (dispatch-gates.mjs names the census path only as history and fixtures). No CI lane is added. The comment pointers in rest-route-ledger.ts, route-ledger.ts and rest-meta-auth.test.ts now name the census at 67461403. They are comment-only edits in published packages, so skip-changeset is correct.
• Measured by the thread (report 6434223105): both files 108/108 before (67461403) → 70/70 after. Positive control: a route added in an existing family passes with no other edit. Negative control: a new family is reported UNCLASSIFIED by discover(). A non-literal family is named by the new test. 56 derived gates exit 0, 0 NOT-MEASURED. The relative ../../../<pkg>/src/ imports follow the existing dogfood pattern (authz-conformance.test.ts:43 already does the same).

Landing: ready + auto-merge once CI on this head is green. The card closes on Fixes.