[objectstack-fleet]

Requested by Leehom · project thread
Fixes #26433

Part of #26431

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：packages/rest 里六个测试文件删掉了「注册器文件清单长度 = 18」这条手抄断言（meta-draft-read-door-census.test.ts 顺带删掉 SITES = 8），只改测试，不发布任何东西。
• 为什么改：清单本身就是权威；这条数字每次把一个路由模块拆出 rest-server.ts 都会让六个文件同时变红，钉的是树的转录，不是不变量（维护者在退役检查清扫里「同意」）。
• 风险与回滚：只删断言，每个文件原本要抓的缺陷都做了一次消融，仍然变红；回滚就是 revert 这一个 commit。
• 先看：meta-draft-read-door-census.test.ts（唯一加了防空守卫的文件）、rest-server-docblock-position.test.ts（还留着一个手算的楼层和 70，见 Acceptance notes）、rest-server-canonical-query-ast.test.ts。
• 两分钟验证：pnpm --filter @objectstack/rest exec vitest run src/meta-draft-read-door-census.test.ts src/rest-server-docblock-position.test.ts，预期 2 个文件全绿。
• 需要你做的：无，席位落地。

What changes

• Six readers of REST_SERVER_REGISTRAR_FILES lose expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(18): ui-view-route-identity.measurement.test.ts, ui-view-route-tenancy.measurement.test.ts, rest-server-canonical-query-ast.test.ts, rest-server-query-number-census.test.ts, meta-draft-read-door-census.test.ts, rest-server-docblock-position.test.ts. Each keeps iterating the list it imports.
• meta-draft-read-door-census.test.ts also loses expect(SITES).toHaveLength(8): its first case ("the sites found are exactly the ledgered ones") already holds the sum as an exact set equality against the ledger. The case that held both pins is left with only a list-mirroring assertion, which passes on an empty list, so it gains the ruled anti-vacuity guard expect(REST_SERVER_REGISTRAR_FILES.length).toBeGreaterThan(0). No other file goes vacuous on an empty list (measured below), so no other guard is added.
• Prose the deletion made false is corrected in place, nothing more: the four case titles that said "its length and … are pinned" now name only what is still pinned, the header sentences that said a case "pins the list's length" drop that clause, and each slice-history comment log gets one closing [#26433] line. The length N → M history entries stay as history.

Why

The list file's own header says it is ⛔ not a gate and that each reader stays the authority on what it counts. The length pin made every reader red on every registrar move, for a number nobody derives anything from (#26431's rule: a pin on something that already has an authority is retired, not loosened).

Tests

All runs on head 83cff86f77 (base 45de8c6cba), rest's dependency closure built first (pnpm --filter '@objectstack/rest^...' build, lock VERDICT exit 0).

• The six files: Test Files 6 passed (6), Tests 223 passed | 18 skipped.
• pnpm --filter @objectstack/rest test (project local): Test Files 324 passed (324), Tests 6483 passed | 326 skipped, VERDICT exit 0.
• pnpm --filter @objectstack/rest test:repo (project repo, which holds rest-server-canonical-query-ast.test.ts): Test Files 5 passed (5), Tests 280 passed | 18 skipped, VERDICT exit 0.
• pnpm --filter @objectstack/rest typecheck (tsc plus check:test-typecheck over tsconfig.test.json, which includes *.test.ts): VERDICT exit 0.
• Acceptance grep: git grep -n "REGISTRAR_FILES).toHaveLength" -- packages/rest → no hit, exit 1.

Each file still reds on the defect it was written for (one ablation per file, via scripts/ablation-replace.mjs; every mutation landed and was restored to the HEAD blob)

The six tests read route sources as text from src/ or mount RestServer from src/ by relative import, so no dist/ sits on the path and no rebuild is owed per leg. Each ablation mutates a moved route module (not rest-server.ts), so it also proves the reader still reaches files off the list.

File	Ablation (route module)	Result
ui-view-route-identity.measurement.test.ts	delete if (this.enforceAuth(req, res, context)) return; in ui-routes.ts	1 file failed: "the handler now calls enforceAuth — read off the mounted registrar…"
ui-view-route-tenancy.measurement.test.ts	delete the enforceEnvironmentOwnership(...) line in ui-routes.ts	1 file failed, 11 cases, including "⭐ the registrar body itself carries the three steps" and "⭐ THE PIN"
rest-server-canonical-query-ast.test.ts	where: { id: jobId } → filter: { id: jobId } in data-action-routes.ts	1 file failed: "no server-built query literal spells a wire alias"
rest-server-query-number-census.test.ts	add a bare Number(req.query.zzAbl) in search-routes.ts	1 file failed: "no coercion is unclassified…" and the sum case (sites 8 → 9)
meta-draft-read-door-census.test.ts	add req.query?.state === 'draft' in search-routes.ts	1 file failed: "the sites found are exactly the ledgered ones" (so dropping SITES 8 loses nothing)
rest-server-docblock-position.test.ts	stack a TSDoc block above another in email-routes.ts	1 file failed: "binds every TSDoc block to a declaration — none is stacked above another"

Every leg: ablation-replace: ok mutation landed: anchor 1 -> 0, then ok restored: blob == HEAD … and git diff HEAD is empty. (In a first pass the tool refused five of the six legs before any test ran, because each anchor was a substring of its own replacement or was not deleted; the canonical leg ran in that pass and red as it does in the table. All six were rerun with non-overlapping anchors or --delete, and the table is that rerun.)

Dry move: a new registrar module appended to the list (the point of the change)

Probe: a new zz-dry-move-routes.ts (module header and export {};, no route body) appended to REST_SERVER_REGISTRAR_FILES, list length 19. All legs restored; final git diff HEAD empty, git status clean.

Leg	Result
base test files (pins in)	Test Files 6 failed (6): each of the six reds on its toHaveLength(18) line
this head	Test Files 2 failed / 4 passed: identity, tenancy, query-number and meta-draft stay green. rest-server-canonical-query-ast and rest-server-docblock-position red because their per-file floor tables (REGISTRAR_QUERY_SLOT_FLOORS, MOVED_FILE_FLOORS) have no row for the new module
this head plus the two floor rows the module would owe (0 and 1)	Test Files 1 failed / 5 passed: only rest-server-docblock-position's expect(…minBlocks sum).toBe(70) reds

So on this head a new module costs the list file plus its own floor row in two tables, plus the docblock file's 70. The floor rows are per-file measurements the two censuses ask for by design ("a file the split adds to the list needs a floor here before this census reads it"), not length transcriptions, and the ruling keeps them. The 70 is a hand sum of the table beside it: see Acceptance notes.

Empty list: no reader goes vacuous

REST_SERVER_REGISTRAR_FILES emptied in place (].filter(() => false);), restored after: Test Files 6 failed (6), 11 cases. Each file reds on an assertion it already had (identity and tenancy on the over-40 call counts, canonical on the floors' keys and the slot sum, query-number on its sum and positive control, docblock on the floors' keys), and meta-draft's list case reds on the new guard (meta-draft-read-door-census.test.ts:291).

Verification

Local gate subset: 49 derived, 48 run exit 0, 1 NOT MEASURED

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on this diff named 49 commands; each was run with its exit code captured before any pipe, then reconciled with --ran: ✓ dispatch-gates --ran: 49 derived famil(ies) accounted for — 48 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3).

• NOT MEASURED: pnpm check:dual-build-cjs-loads, exit 3 PREREQUISITE NOT MET (needs every package's dist/; only rest's closure is built here). CI runs it.
• Lint scoped to the touched package: eslint packages/rest --no-inline-config exit 0.
• Not run locally, CI's: the repo-wide pnpm lint, Test Core shards, the type-check lanes, dogfood (no ! in the title, no (narrowing) arm).

skip-changeset: tests only. Nothing under packages/rest that ships in files[] changes.

Acceptance notes

• Seventh copy, not in this PR: packages/qa/dogfood/test/authz-conformance.test.ts:1646 on origin/main b7f2b0c290 (expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(18); it sat at 1642 before PR test(dogfood): derive the authz probe reach from the route ledgers; retire the hand-written census #26491 landed in that file) is domain:devx's; the seat files its child card.
• Same pin under an alias: packages/rest/src/execctx-consumer-census.test.ts:848 pins expect(SITE_FILES).toHaveLength(18), where SITE_FILES = REST_SERVER_REGISTRAR_FILES (line 149). The card's acceptance grep does not see it. That file is test(rest): execctx-consumer-census.test.ts hand-counts 62 sites / 145 mentions / 16-46-12 catch shapes and is re-typed on every split slice — derive the census or retire the measurement file #26436's; it belongs on that card.
• Hand sum beside its own table: rest-server-docblock-position.test.ts:301, expect(MOVED_FILES.reduce(…)).toBe(70) is the sum of MOVED_FILE_FLOORS in the same file, and it is the one red left in the dry move once the new module has its floor row. Same family as ci(gates): retire the transcription pins — tests and gates that hold a hand-typed count or table equal to the tree and red on every unrelated move (parent of eight) #26431; left alone here because the ruling says nothing else changes.
• Header prose now partly false: rest-server-registrar-files.ts:23-26 still says each reader "pins the list's length". After this PR that is true only of the dogfood copy and the execctx alias above. The file is outside this card's file surface; whichever of those two cards removes the last pin should reword it.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b7f2b0c290ebae63240a13918fdbe67135ecfafa → packageMentionDocs.

[objectstack-fleet]

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-27T06:42Z · head 83cff86f77 · #26433

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」.

1. Shape: a draft against main, opened by the relay with assignee os-project-manager and skip-changeset (tests only). The body carries Fixes #26433, Part of #26431, Clause-②: no and Metadata-protocol: none, all line-initial. check-governed-merges --pr 26518 reads NOT governed, 42 changed lines. No contract face is touched, so no at-tier review is owed. The card's newest claim (6434734809) names this PR's branch.
2. Diff against the order: the seat read the whole diff (6 files, +22 / −20).
   • Each of the six files loses exactly one expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(18).
   • meta-draft-read-door-census.test.ts also loses expect(SITES).toHaveLength(8) and gains the ruled guard expect(REST_SERVER_REGISTRAR_FILES.length).toBeGreaterThan(0). Its first case's exact set equality against the ledger still holds the sum, and the body's ablation shows that case red.
   • The rest is prose the deletion made false: four case titles, four header sentences and one [#26433] line per slice log. No assertion is changed beyond the ruled ones.
   • The acceptance grep git grep -n "REGISTRAR_FILES).toHaveLength" -- packages/rest returns 0 on the head.
3. Not weakened: the body holds one ablation per file, each red on the defect the file was written for and restored to the HEAD blob. The dry move (a 19th module appended) shows that identity, tenancy, query-number and meta-draft stay green. Canonical-query-ast and docblock-position still ask for their per-file floor rows, which is by design and kept by the ruling. With the list emptied, every file reds, so none goes vacuous.
4. Overlap: none. No other open PR touches these six files (seat's read of every open PR's file list at this stamp). test(rest): execctx-consumer-census derives its structural reading from the tree instead of hand counts #26520 (test(rest): execctx-consumer-census.test.ts hand-counts 62 sites / 145 mentions / 16-46-12 catch shapes and is re-typed on every split slice — derive the census or retire the measurement file #26436) edits only execctx-consumer-census.test.ts.
5. Gates: at this stamp every check-run on the head reads success or skipped; none reads failed or in progress. Locally the dev reports:
   • 49 derived gates: 48 exit 0, with check:dual-build-cjs-loads not measured (prerequisite; CI's full build covers it);
   • rest 324 / 324 files, test:repo 5 / 5, typecheck and scoped lint green.
6. Out of scope, filed:
   • The seventh copy in dogfood (packages/qa/dogfood/test/authz-conformance.test.ts:1646) is test(dogfood): authz-conformance.test.ts pins the registrar-file list's length as toHaveLength(18) (the seventh copy of #26433) #26524 (domain:devx), as the triage line ordered. That card also carries the stale header sentence in rest-server-registrar-files.ts:23-26.
   • The execctx-consumer-census.test.ts:848 alias is test(rest): execctx-consumer-census.test.ts hand-counts 62 sites / 145 mentions / 16-46-12 catch shapes and is re-typed on every split slice — derive the census or retire the measurement file #26436's, and its PR test(rest): execctx-consumer-census derives its structural reading from the tree instead of hand counts #26520 removes it.
   • The hand sum toBe(70) in rest-server-docblock-position.test.ts is a hand sum of the table beside it, the same family as ci(gates): retire the transcription pins — tests and gates that hold a hand-typed count or table equal to the tree and red on every unrelated move (parent of eight) #26431. The ruling left it alone, and it stays a candidate under that parent.

---

Generated by Claude Code