[objectstack-fleet]

Requested by Steve · project thread
Fixes #26524

Part of #26431

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：packages/qa/dogfood/test/authz-conformance.test.ts 删掉「注册器文件清单长度 = 18」这条手抄断言，同一个 case 的其它断言全部保留；packages/rest/src/rest-server-registrar-files.ts 头注里「每个读者都钉清单长度」这句话改成实情。只改测试和一段注释，不发布任何东西。
• 为什么改：清单本身就是权威，这个数字每拆一个路由模块出 rest-server.ts 就要改一次，而 PR CI 不跑 dogfood，所以拆分 PR 自己看不到，合入后 main 才变红。test(rest): drop the registrar-file list's length pins from six rest tests #26518 已经删了 packages/rest 里的六处，这是第七处（维护者在退役检查清扫里「同意」）。
• 风险与回滚：只删一条断言。实测空清单、探针漏读一个文件、探针少读一个文件这三种情况，这个 case 都照样变红；回滚就是 revert 这一个 commit。
• 先看：authz-conformance.test.ts 第 1624–1659 行（这个 case），然后是 rest-server-registrar-files.ts 第 23–26 行。
• 两分钟验证：pnpm --filter @objectstack/dogfood exec vitest run test/authz-conformance.test.ts（要先建好 dogfood 的依赖闭包），预期 60/60 全绿。
• 需要你做的：无，席位落地。

What changes

• authz-conformance.test.ts, case "reads ZERO on the real rest-server.ts today (the pre-wiring baseline)": expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(18) is deleted. Everything else the case asserts stays: REST_SERVER_REGISTRAR_PATHS[0] is rest-server.ts; both probes' alsoReads equal the list minus its head, and probeSource equals the listed files joined in order; zero hits over the list; no realtime:rest-server.ts: tripwire key is minted.
• The case's comment said the list's "length is pinned so a module added to it makes this re-read". That clause is now false, so it is cut. The fifteen Length N → M history lines stay, and one closing [#26524] line follows them.
• No toBeGreaterThan(0) guard is added. On an empty list the case already reds at REST_SERVER_REGISTRAR_PATHS[0] (measured below).
• rest-server-registrar-files.ts header, lines 23–26: "Each reader keeps its own sum over the list and pins the list's length" was true of seven readers before test(rest): drop the registrar-file list's length pins from six rest tests #26518 and test(rest): execctx-consumer-census derives its structural reading from the tree instead of hand counts #26520. After this PR, none pins it. The sentence now says that each reader keeps its own sum, that none pins the length, and that a module added to the list widens every reader with no edit to any of them. test(rest): execctx-consumer-census.test.ts hand-counts 62 sites / 145 mentions / 16-46-12 catch shapes and is re-typed on every split slice — derive the census or retire the measurement file #26436 landed (PR test(rest): execctx-consumer-census derives its structural reading from the tree instead of hand counts #26520) before this PR opened, so the reword rides here as the card ordered.

Why

The list file's own header says it is ⛔ not a gate and that each reader stays the authority on what it counts. The length pin made the dogfood suite red on every registrar move, for a number nothing is derived from. Dogfood is skipped on PR CI, so the split PR never saw the red; main's push battery did, after the merge. This follows #26431's rule as applied to the six packages/rest copies in #26518.

Verification

All runs are on head 55b1b414 (base f486e9c1), after the dogfood dependency closure was built: pnpm --workspace-concurrency=2 --filter '@objectstack/dogfood^...' build, lock VERDICT command-exit 0.

• pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/authz-conformance.test.ts test/authz-probe-blind-spot.test.ts: Test Files 2 passed (2), Tests 70 passed (70), VERDICT exit 0. authz-conformance.test.ts alone: 60/60.
• pnpm --filter @objectstack/dogfood --filter @objectstack/rest run typecheck: VERDICT exit 0. Both tsc programs list the changed file (--listFilesOnly: 1 hit each).
• Acceptance grep: git grep -n "REGISTRAR_FILES).toHaveLength" -- packages/qa gives no hit (exit 1).
• Dogfood is skipped on PR CI (it runs only on main push and schedule runs), so the local run above is the evidence for this suite.

Empty list: the case still reds, so no anti-vacuity guard is added

REST_SERVER_REGISTRAR_FILES was replaced with an empty array in rest-server-registrar-files.ts, using scripts/ablation-replace.mjs. The output was ok mutation landed: anchor 1 -> 0, then ok restored: blob == HEAD (020a438009c3) and git diff HEAD is empty. The dogfood test imports the list from src/ by relative path, so no dist/ sits on the path and no rebuild is needed per leg.

Result: Tests 1 failed | 59 passed (60). The red is this case at authz-conformance.test.ts:1647: expected undefined to be 'packages/rest/src/rest-server.ts'.

Ablation: a probe that skips a listed file reds the case

Leg	Mutation (ablation-replace, anchor 1 → 0, restored to the HEAD blob)	Result
B1, alsoReads skips ui-routes.ts	REST_SERVER_REGISTRAR_ALSO_READS filter gains && !file.endsWith('/ui-routes.ts')	Tests 1 failed / 59 passed: this case, at line 1650 (expected [ …(16) ] to deeply equal [ …(17) ])
B2, probeSource reads one file fewer	probe.alsoReads is read with .slice(1) before .map in probeSource	Tests 1 failed / 59 passed: this case, at line 1651 (the probe-text equality)

Dry move: a name appended to the list stays green here

Probe: a new packages/rest/src/zz-dry-move-routes.ts (licence header and export {};, no route body) is appended to REST_SERVER_REGISTRAR_FILES, making the list length 19. The append went through ablation-replace --hold (ok mutation landed: anchor 1 -> 0) under an EXIT/INT/TERM restore trap. Afterwards both files hash to their HEAD blobs, the probe module is removed, git diff HEAD is empty and git status is clean.

Leg	Result
this head	authz-conformance.test.ts 60/60 green. authz-probe-blind-spot.test.ts reds one case, "every module on the RestServer registrar list still registers routes": the probe module has no route body. That case asserts a fact about each listed module, not a count; a real registrar module satisfies it.
base test file (pin in), same list	Tests 1 failed / 59 passed: expected [ 'rest-server.ts', …(18) ] to have a length of 18 but got 19 at line 1646

The first attempt at this leg was a no-op. The anchor 'meta-object-state-routes.ts', occurs twice in the list file, and ablation-replace refused it (ANCHOR AMBIGUOUS, exit 3; on-disk count 0). The two readings taken in that pass are discarded. The table above is the rerun with a unique anchor.

Gates

Head 55b1b414. Derivation: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack gave 53 commands. Each one ran with stdin closed, and its exit code was captured before any pipe.

• 51 of 53 exited 0 on the first pass.
• node scripts/check-plugin-teardown-shape.mjs --self-test exited 3 (PREREQUISITE NOT MET: the pinned fixture commit 621a4876 was missing from the shallow clone). After git fetch --depth=1 origin of that sha it exited 0: "48 cases pass".
• pnpm check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: no dist for six packages outside the dogfood closure). After turbo run build --concurrency=2 --filter='./packages/**' (lock VERDICT exit 0) it exited 0: "112 published require entry point(s) across 69 package(s) load".
• --ran reconciliation: "53 derived, 53 run, 0 NOT-MEASURED, 0 UNRUN", a DERIVED zero.
• The families the derivation places outside its list (artifact rosters, wide populations, path-scheduled CI jobs, type-check lanes) are CI's run on this PR. The dogfood jobs among them do not run on a PR.

Acceptance notes

• authz-probe-blind-spot.test.ts:155 already carries expect(REST_SERVER_REGISTRAR_FILES.length).toBeGreaterThan(0), so dogfood keeps one anti-vacuity guard on the list either way.
• Changeset: none. The diff touches a dogfood test (private package) and a comment in a src/ file that src/index.ts never reaches (it is not in dist), so nothing published changes. skip-changeset is set at creation.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind. (no names added)
• 3. No formatter ran; pnpm lint passes. (no formatter ran; lint is CI's run)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (publishes nothing; both lines are above)
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (not touched)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English. (the 维护者速读 block is Chinese by repo convention)
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/rest/src/rest-server-registrar-files.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/rest/src/rest-server-registrar-files.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a3009cbfe275b93b480488bc9131032d2acb428b → packageMentionDocs.

[objectstack-fleet]

席位核对 · ACCEPT · devx seat 2 · 2026-10-27T08:21Z

Seat domain:devx#2 (#20163) · session_01Q4MDXRbEJCNdPAP4SiXwp9 · reviewed head 55b1b414 · card #26524 (claim 6436195492, branch claude/project-thread-7tg5gk). Not governed; 2 files, comments plus one deleted assertion. Thread-read: none.

• The pin is gone and nothing else moved: expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(18) is deleted. The case still asserts REST_SERVER_REGISTRAR_PATHS[0] is rest-server.ts, that both probes read exactly the listed files in order, and zero hits over the list. The Length N → M history stays, closed by one [#26524] line. git grep -n "REGISTRAR_FILES).toHaveLength" -- packages/qa → 0, and no exact-length pin on the registrar list is left under packages/ (only > 0 anti-vacuity floors remain, in authz-probe-blind-spot and meta-draft-read-door-census).
• No toBeGreaterThan(0), correctly: the thread measured that an empty list already reds at the PATHS[0] assertion, which is the condition the card set for leaving it out.
• Ablation and dry move are in the report (6437040976): a probe that skips one listed file reds (alsoReads at :1650, probeSource at :1651), and appending a name to the list keeps conformance 60/60 green.
• The rest-server-registrar-files.ts header is reworded because test(rest): execctx-consumer-census.test.ts hand-counts 62 sites / 145 mentions / 16-46-12 catch shapes and is re-typed on every split slice — derive the census or retire the measurement file #26436 already landed (PR test(rest): execctx-consumer-census derives its structural reading from the tree instead of hand counts #26520, 4166a929). The header now says that no reader pins the list's length, which is true on this head.
• Deviation, accepted: packages/rest's own test suite was not run locally; that file's change is comment-only. Dogfood is skipped on PR CI, so the thread's local authz run (70/70) is the dogfood reading.

Landing: ready + auto-merge once CI on 55b1b414 is green. The card closes on Fixes.