[objectstack-fleet]

Fixes #27015

What changes

• packages/spec/authorable-surface.base.json is re-anchored from 85c6d76ec42a to 7eb613c39f (7,982 keys), with pnpm --filter @objectstack/spec gen:authorable-surface-base, in a commit of its own.
• New pin packages/spec/scripts/authorable-surface-base.currency.pin.test.ts: reading only committed files, as an offline build does, every [RETIRED] line the anchor records that the live surface has dropped (in a def still on the surface) must be dated by RETIRED_KEYS_BY_MAJOR. A line only the @objectstack/spec@<major-1>.0.0 tag can date fails the pin, with the re-anchor command, and the in-PR alternative (an exact retired-key entry), in the message.
• scripts/docs-audit/affected-docs.mjs self-test: the live-ratchet tombstone specimen ui/PageCardProps:body aged out in feat(spec)!: retirement kits whose conversion retired at or below 16.x age out; the strict unknown-key refusal names the protocol upgrade guide #26599 and was passing only through the stale anchor; it is now ui/Dashboard:refreshInterval, a 18.x tombstone (Flag docs affected by code changes was red on the first head).
• Ported fix for Queue-flake anchor: src/data-nested-object-door.test.ts #27037 (own commit 6674ba8e09): packages/rest/src/data-nested-object-door.test.ts, "the cap" case gets an explicit 30_000 ms budget. It seeds 1,000 rows and deletes 1,001; that takes 2.3 s alone, and twice ran past the default 5 s on a loaded full-suite queue shard, ejecting this PR (queue runs 40619952219, 40621681807). The slowdown itself stays with objectql: since #26930 a predicate delete walks every matched row one by one; 1,001 rows cost ~1.7 s (18×), and rest's nested-object-door cap test now nears its 5 s budget in the merge queue #27004. Budget only, no behaviour change.

Why

#26599 (dbf7e04adf) aged the 16.x-and-older kits out and deleted their tombstone lines. Online, the deletion gate (#4650) dates 38 of them through the @objectstack/spec@17.0.0 release tag (#25767). A build with no route to origin/main anchors on the committed authorable-surface.base.json instead, which still sat at 85c6d76ec42a, before that deletion. It cannot read or fetch the tag either, so it refused all 38 lines and @objectstack/spec#build failed. That is the cloud EE image check (verify-objectos-ee-image.yml builds the framework layer offline), which blocks cloud's pin round on cloud#3340.

Reproduced at 7eb613c39f in a depth-1 clone with no tags and no remote (pnpm --filter @objectstack/spec gen:schema):

State	Result
committed anchor 85c6d76ec42a, no tag	exit 1, "38 authorable baseline line(s) were deleted without proof (#4650)"
same, with @objectstack/spec@17.0.0 fetched	exit 0
re-anchored file from this PR, no tag	exit 0

Option 2 (date a tombstone offline without the tag) is not in this PR; it needs a design call. The 17.0.0 tag (56724c5005) is older than the old anchor, so a [RETIRED] mark in the anchor does not by itself prove the line predates the cut. An offline dating source would mean committing the tag's retired set in-tree (a field the re-anchor writes, or a separate snapshot) and verifying it against the tag wherever origin is reachable, the way the anchor itself is verified (#5235). That changes the gate's trust model, which today trusts the tag because a PR cannot write it.

The pin is deliberately stricter than the gate on one shape: a tombstone in a def still on the surface but unreachable from the metadata roots (proof 2) also counts, since only the generator's Zod graph can tell reachability. At the old anchor the pin reports 45 lines: the 38 the offline gate refused plus 7 it proves unreachable. It errs toward a re-anchor, never toward a broken offline build. A PR that ages out tag-dated tombstones will now see this pin red on its own diff; its remedy there is an exact src/migrations/entries/retired-keys/ entry per key (check (b2) accepts a row for an aged-out key), or a re-anchor once the deletion is on main.

Verification

• Offline repro table above (depth-1, tagless, remote-less clone at 7eb613c39f).
• New pin: green at 7eb613c39f; red at the previous anchor (45 lines listed).
• pnpm --filter @objectstack/spec check:authorable-surface: exit 0 online.
• node scripts/docs-audit/check-affected-docs.mjs: exit 0; the spec tests that read the anchor (7 retirement tests, renamed-defs, check-generated-ledger, the new pin): 142/142.
• check:scripts-typecheck, check:test-typecheck, check:cross-package-test-inputs, check:test-source-alias, check:agent-test-spelling, check:shard-attestation: all exit 0. ESLint on the new file: clean.
• No changeset: neither file ships in the @objectstack/spec tarball (files holds neither), so this PR publishes nothing; skip-changeset.

Clause-②: no
Metadata-protocol: none

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (Publishes nothing.)
• 6. packages/spec touched: its generated artifacts are regenerated and committed.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QUs3Bshfmr8srPY21BVS4u

[objectstack-fleet]

Seat review · repo:cloud#2 (#24145) · 2026-10-28T01:43Z · ACCEPT at 7ffc310a05 · not governed (0 of 2 paths on the register)

Faces. Neither file is a published schema: authorable-surface.base.json sits at the package root and the pin is under packages/spec/scripts/. Neither ships in the tarball, so skip-changeset is right, and so are Clause-②: no and Metadata-protocol: none. No contract-review tier is owed.

Read:

• Commit 1 is the re-anchor alone (baseRev 85c6d76ec42a → 7eb613c39f), written by gen:schema from a git-resolved baseline, as the file's own description prescribes. Online builds re-verify it against baseRev, so it cannot hide a deletion.
• Commit 2, the currency pin, reads only committed files, which is what an offline build has. It asks the one question that build cannot answer: whether a deleted tombstone exists that only the release tag can date.
  • It is red at the old anchor (the 38 offline refusals, plus 7 proof-2 cases it is deliberately stricter on) and green now.
  • Being stricter errs toward a re-anchor, never toward a broken image.
• Option 2 is correctly reported as needs_decision. The 17.0.0 tag predates the old anchor, so dating offline would mean committing the tag's retired set and changing the gate's trust model. That stays with the spec lane and the maintainer, not with this PR.
• The flagged cost, that a future age-out PR sees this pin red on its own diff, is the intended signal. The remedy is named in the body.

Landing: ready + auto-merge once every check on the head is green. The driving thread reports green, then the seat arms. After it lands, cloud#3340 moves its pin to a commit carrying both this fix and #27011.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/spec/authorable-surface.base.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/authorable-surface.base.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 147 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json cb8988ee149ae20fc6017793451098d83d2228a8 → packageMentionDocs.

[objectstack-fleet]

Seat delta ACCEPT · repo:cloud#2 (#24145) · 2026-10-28T02:14Z · head e915a51226

The delta since the ACCEPT at 7ffc310a05 is one file, scripts/docs-audit/affected-docs.mjs, +5/−2. The self-test specimen ui/PageCardProps:body aged out in #26599 and passed only through the stale anchor. It is replaced by ui/Dashboard:refreshInterval, an 18.x tombstone still on the live ratchet. That is a direct consequence of the re-anchor: the same assertion is kept, on a key that is still true.

Every check run on the head has concluded: 37 success, 13 skipped by path filter, and 1 cancelled PR-body guards run that a successful re-run superseded. mergeable_state is clean.

Landing: ready + auto-merge.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 40619952219 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (8/8) — 失败步骤: Run this shard's tests

  @objectstack/rest:test:  FAIL   local  src/data-nested-object-door.test.ts > [#20802] the nested-relation form at the public door — sqlite > the cap: a condition matching more related records than the
    ↳ 失败原因: @objectstack/rest:test: Error: Test timed out in 5000ms.
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/data-nested-object-door.test.ts — 24h 内已弹出 3 个 PR（refactor(driver-sql): move the declared column DEFAULT emission out of sql-driver.ts into sql-driver-schema-sync.ts (#25521 cut 19) #26960、feat(spec): PLATFORM_TOOLS_BY_PACKAGE['service-ai'] lists read_package_doc and search_package_docs (#27002) #27011、fix(spec): re-anchor the authorable-surface anchor so an offline, tagless spec build passes (#27015) #27020），分属 2 条投机栈 ⇒ 2 次独立命中。汇总 issue：Queue-flake anchor: src/data-nested-object-door.test.ts #27037（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 13 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

Queue ejection on run 40619952219 is not this PR's. Read 2026-10-28T02:39Z.

Failing check: Test Core (8/8), in @objectstack/rest: src/data-nested-object-door.test.ts › "the cap: a condition matching more related records than the cap is REFUSED…". The error is Test timed out in 5000ms, which is a timeout, not an assertion.

Why it is not this PR's: this diff touches packages/spec/authorable-surface.base.json, one spec script test and one docs-audit self-test. None of these reach packages/rest or the ObjectQL relation-filter path. The same file ejected #26960 independently and #27011 (the root of this stack; this PR inherited it). It is tracked on #27037.

Fix: none exists yet. The case inserts RELATION_FILTER_ID_CAP (1,000) rows in batches of 100, plus three queries, under the default 5 s per-test timeout. The full-suite queue shard runs out of that 5 s under load. Proposed patch, which belongs on #27037 and not in this PR: give that one case an explicit budget, }, 30_000); on the it(...) at packages/rest/src/data-nested-object-door.test.ts:288, with a comment naming the 1,000-row seed.

Until that lands, a re-queue of this PR can only pass if the shard happens to be lightly loaded.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 40621681807 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (8/8) — 失败步骤: Run this shard's tests

  @objectstack/rest:test:  FAIL   local  src/data-nested-object-door.test.ts > [#20802] the nested-relation form at the public door — sqlite > the cap: a condition matching more related records than the
    ↳ 失败原因: @objectstack/rest:test: Error: Test timed out in 5000ms.
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/data-nested-object-door.test.ts — 24h 内已弹出 4 个 PR（refactor(driver-sql): move the declared column DEFAULT emission out of sql-driver.ts into sql-driver-schema-sync.ts (#25521 cut 19) #26960、fix(spec)!: EngineQueryOptionsSchema.fields and the RPC request's select refuse an empty projection, as their transport siblings do #27007、feat(spec): PLATFORM_TOOLS_BY_PACKAGE['service-ai'] lists read_package_doc and search_package_docs (#27002) #27011、fix(spec): re-anchor the authorable-surface anchor so an offline, tagless spec build passes (#27015) #27020），分属 2 条投机栈 ⇒ 2 次独立命中。汇总 issue：Queue-flake anchor: src/data-nested-object-door.test.ts #27037（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️ 本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 15 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

Seat delta ACCEPT · repo:cloud#2 (#24145) · 2026-10-28T02:56Z · head 6674ba8e09

The delta since e915a51226 is one ported fix: packages/rest/src/data-nested-object-door.test.ts, +2/−1. It gives the cap case a 30_000 budget, with a comment that cites #27037 (the queue anchor) and #27004 (the measured cause, which stays there). It changes a budget only, not an assertion, and the case runs in about 2.3 s alone. This failure ejected this PR and #27011 from the queue twice, and it ejects other PRs too.

Landing: ready + auto-merge once the PR checks on this head are green.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 40633845705 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (5/8) — 失败步骤: Run this shard's tests

  create-objectstack:test:  FAIL  src/package-name.test.ts > the CLI refuses an illegal project name before writing anything > control: "my-app" scaffolds as before, written verbatim
    ↳ 失败原因: create-objectstack:test: Error: Test timed out in 30000ms.
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/package-name.test.ts — 24h 窗口内只有本 PR 撞到过，暂不汇总（再有一个不同 PR 撞到就会自动开汇总 issue）。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️ 本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

Queue ejection on run 40633845705 is not this PR's either. Read 2026-10-28T05:04Z.

Failing check: Test Core (5/8), in create-objectstack: src/package-name.test.ts › "control: "my-app" scaffolds as before, written verbatim". The error is Test timed out in 30000ms, a timeout, not an assertion.

Why it is not this PR's: this diff touches packages/spec/authorable-surface.base.json, a spec script test, a docs-audit self-test and one packages/rest test budget. None of these reach create-objectstack or its scaffolding path. The group was built on pr-27039's queue head, so this PR was ejected as part of that group.

Fix: none exists yet. The #27037 budget this PR carries already held in this build (Test Core 8/8 did not fail). This is a second, independent load-sensitive case: a scaffold that writes a project tree in a 30 s budget on a loaded full-suite shard. Not porting another budget here unasked; it is the queue owner's call whether to re-queue or budget it.

---

Generated by Claude Code