check:durability-log-level cannot represent a seam that propagates a durability failure by RETURNING an outcome object — its propagation lists are keyed on callee names

[claude]

The gap

scripts/check-durability-degradation-log-level.mjs cannot represent a durability seam whose catch propagates by returning an outcome object, and this is a limitation of the instrument's shape rather than a missing entry in its lists.

The seam that exposed it: recordNotificationEventReceipt in
packages/metadata/src/migrations/migrate-sys-notification-to-event.ts (added by PR #16230).
It is a durability seam of exactly the persistSeedTenancyReceiptRow class — the data really was
rewritten, every other reading is clean, and the only durable record of it can be absent.

Why the gate cannot hold it:

• DURABILITY_CRITICAL_CALLEES does not name it — that part is merely an entry.
• ⛔ But it cannot be added without a second change: this catch propagates by RETURNING an
  outcome object, while both FAILURE_PROPAGATION_CALLEES and FAILURE_PROPAGATION_SITES are
  keyed on callee NAMES. A returned object literal has none.

⇒ Any seam in this repo that reports a durability failure to its caller through a return value,
rather than by calling a named reporter, is invisible to this gate by construction.

What was measured, and what was not

• Measured (by the metadata: the adr-0030-notification-event migration writes its sys_migration receipt row per the ruled ledger-claim matrix — last_run_at on every completed run, applied_at on migrated only, never verified_at (#15710 follow-on) #16100 round, on its own diff): the gate's write-side limb reports 29
  seams both with and without the new file — i.e. adding a real return-propagating durability
  seam moves that population by zero.
• Measured, and it is the control that makes the zero above a reading: the gate's read-side
  limb moves 68 → 67 when the same file is swapped back to origin/main. ⇒ the file is in the
  swept population; the write-side silence is the instrument's blindness, not the file's absence.
• ⚠️ NOT a live defect. The seam is pinned per-file by that round's own failed receipt
  case, so this is an instrument-expressiveness gap, ⛔ not an unprotected degradation. Hence
  finding, not bug.
• ⚠️ NOT measured: how many other seams in the tree propagate this way. That census is the first
  thing a round on this card should buy, because it decides whether the fix is worth its cost — a
  gap with one member is a note, a gap with thirty is a hole.

Why the shape of the fix is not obvious

A name-keyed list cannot key on "returns an object with a failure-shaped field". The candidate
directions each cost something and none is free:

• Key on the enclosing function's name instead of the callee's, for a declared set of seams —
  cheap, but it moves the gate from "what does this call do" to "who is asking", which is a
  different question and may weaken the existing 29.
• Recognise a declared return shape (an outcome type carrying a failure member) — precise, but
  it needs the gate to read types, which it currently does not.
• Leave it name-keyed and accept the class as out of scope, recorded — honest, and it makes this
  card's answer a documented boundary rather than a hole.

⛔ This card proposes none of them. It records the gap, its measurement, and its control.

⚠️ Context a maintainer may want more than this row

This is now the third open finding against this one script, alongside a decision and a blocked
triage card:

#	state	what it is about
#8897	pm:on-hold	collectLoggedLevels only records part of what it should
#12576	pm:on-hold	readInventionKey falls back where it should not
this card	new	return-propagating seams are unrepresentable
#9882	pm:on-hold	decide the shrink-only delta-ratchet for the same gate
#12753	pm:blocked	triage the parameterless-catch read seams, then decide the 2a criterion

⇒ Five open items on one instrument. Whether that is five small repairs or one rewrite is a
question this card does not answer and probably should not be decided one row at a time.

Provenance and dedup

Found by the #16100 execution round, which could not file it itself and said so rather than
guessing: filing without a duplicate check is a forbidden shape, and its dedup channel was gone in
both directions — REST /search/issues is not served on that channel (a same-session control query
that must have hit #16100 came back empty, so its zero was a channel artefact, not a reading),
and both search_issues MCP calls were refused by the user-level rate limit. It handed the row to
the PM seat instead. Its full reasoning:
#16100 (comment)

Dedup performed by this seat, over a complete enumeration rather than a search: all 652 open
issues fetched with bodies (651 of 652 carry one) and grepped locally.
FAILURE_PROPAGATION_CALLEES, FAILURE_PROPAGATION_SITES, persistSeedTenancyReceiptRow and
recordNotificationEventReceipt return 0 hits each; DURABILITY_CRITICAL_CALLEES returns 2
(#15166, #8897) and check-durability-degradation-log-level returns 7 — all read, none covering
this shape. Firing controls on the same command and scope: sys_migration → 4 (#16194, #16185,
#16100, #15207), NOTIFICATION_EVENT_MIGRATION_ID → 2, durability → 12. ⇒ the zeros are readings.

Filed unassigned and ungraded — domain:* and priority are triage's.

---

os-decision-facets

决策箱 —— 普查买回来了,数是 12,⇒ 路线选择越过了本卡口径,交维护者

domain:devx 执行席(座位贴 #6023,session session_017ef78bLdybu3AffehKkhfk,round 12)。⛔ 本席不代裁。普查与边界记录已随 PR #18523 落地(Part of,⛔ 不关本卡)。

先把「为什么现在必须有人裁」说清:⭐ 不是仪器缺一条腿,是治理文件自己写出了一条死路

AGENTS.md:938-943 同时规定三件事(本席在 origin/main 上逐字读的,⛔ 不是转述报告):

1. 「a failure handed to the CALLER is not a degradation at all —— 第三个合法答案」,并明文把「a batch whose contract IS a per-item outcome report」算进去;
2. 「Do not bolt a logger.error onto such a site」;
3. 「declare how it delivers instead —— FAILURE_PROPAGATION_CALLEES 或 function-scoped 的 FAILURE_PROPAGATION_SITES」。

⚠️「function-scoped」这个词会让人以为第三条罩得住 return 式交付。本席去读了源码(scripts/check-durability-degradation-log-level.mjs:505、:513):SITES 的键确实是 FILE::FUNCTION,但每个条目还必须给出 callees: [[name, kind]],注释把话说死 ——「it supplies a name, and catchDeliversFailure() still has to prove every path out of the catch reaches it」;现存两个条目(migrateStoredMetadata 的 record()、duplicatePackage 的 failed.push())都是靠一次调用交付的。⇒ return { ok: false, error } 的 catch 里没有任何调用可供声明。

⇒ 在这 12 个成员中的任何一个上执行 AGENTS.md 的第 1 条(「发现新缝就在同一个 PR 里把它加进 DURABILITY_CRITICAL_CALLEES」),第 2、3 条同时不可用:正确的代码会把闸弄红,而唯二能弄绿的办法(挂 logger.error / 进 baseline)都是这份闸 header 自己拒绝过的。今天不触发,只因为 tier-1 是 0。读数时刻 2026-09-16T21:18Z。

选项 × 真实代价

选项	做什么	客户/开发者可感知的后果	实测
A 改键到外层函数名	把授权粒度从「这次调用干了什么」挪成「谁在问」	一个函数级许可会连同该函数里未来新增的吞掉写失败的 catch 一起放行	⚠️ 实测有风险:现存 4 条靠 FAILURE_PROPAGATION_CALLEES 表达的缝会被函数级许可覆盖,今天的绿会变松
B 认声明的返回类型	闸读返回类型,把「交付」判成一个结构而不是一个名字	新出现的同形缝自动可见,⛔ 不必有人记得去加一行	信号确实存在:12 个成员里 8 个返回具名 interface/type;代价是给一个刻意无类型的闸引入 program 级类型解析
C 记为范围外	把 PR #18523 落下的那段边界注记改写成「这类缝不归本闸管」	8 个 tier-3 成员成为永久盲区(补偿事务 unwind、CREATE INDEX 探测、claimSuspension 消费)	⛔ 且它与上面那条死路直接冲突 —— 要么同时改 AGENTS.md(治理面,维护者独有),要么留一条写在书上却做不到的规则
D 先买一次设计,把「交付渠道」这条轴与 #8897 合并	不动判据,先把「闸的词汇表是名字,而现实里的交付不总是名字」这条轴一次想清	短期什么都不变;⚠️ 第五个条目继续开着	本卡 12 个成员与 #8897 的 port.warn 接收者是同一条轴的两半

业务含义直译

• A = 「谁签的字我就信谁,不看他签了什么」—— 像把审批权按部门授予而不是按事项授予。
• B = 「把交付写进类型,机器自己认」—— 像把发票格式标准化,而不是维护一张「这些人开的票有效」的名单。
• C = 「这类账我们不查了,写进制度」—— 诚实,但制度里另一条写着这类账必须查。
• D = 「先开一次会把口径定下来,再改流程」。

四棱

• ① 项目长远合理性:B 缩小特例与契约增生 —— 名字词汇表是「每条缝一行、永久维护」的增生机制(今天 21+33+2+2 个名字),而返回形状是一条结构判据,新缝自动进。A 扩大(每个函数级许可都是一条永久特例,且它能覆盖未来新写的 catch)。C 把增生冻结成盲区,并留下一条书面上做不到的规则。
• ② 实际业务拉动:今天没有人撞上 —— tier-1 是 0,闸当前看见的 36 条缝全部靠日志或已声明的被调者作答。⇒ 按「零拉动默认 defer」,这件事不急;⛔ 但它不改字母,只改时序。
• ③ 防 AI 犯错:出错时谁看到什么?B 是响亮拒绝(闭合的结构判据:交付得到证明,或者闸红)。A 是静默泄露(函数级许可罩住它不该罩的 catch,没有人会看到)。C 是静默泄露的制度化(那 8 条缝以后连问都不会被问)。
• ④ 创业阶段不扩散:「每个已声明的键都是永久义务」—— A 增加永久义务(多一张按函数的表)。B 减少(判据一次写成,⛔ 不必逐条声明)。C 不增不减,但把义务转成了盲区。

Prior rulings read: failure_propagation_callees,failure_propagation_sites,return-propagating,outcome object,enclosing function name,durability → 0 hits; none

⚠️ 上行按 check-prior-rulings.mjs 的口径写:docs/adr 0/463,⇒ 无 ADR 裁定。⛔ 但 AGENTS.md 有 10 处命中,其中 :938-943 就是上面那条死路的出处 —— 它不是 ADR 裁定,是规则正文本身,本席按「不是裁定所以不写进 hits」的字面口径记 0,同时把它整段抄在上面,⛔ 不让它被这个 0 藏掉。

推荐:B(读声明的返回类型),时序按 D 走(与 #8897 合并成一次设计再动手),回退项 C。
自检行:「只看①选 B;②③④ 是否翻转:否 —— ② 零拉动只把它推后(合并进 D 那次设计),③④ 都指向同一个字母。」
置信缺口:⛔ 本席没有量 B 的实现成本(给这个闸引入 program 级类型解析要多久、会不会拖慢 CI),也没有读 #12576 —— 它可能在同一条轴上,若是,D 的设计面还要再大一圈。⚠️ 另:dev 席的建议是「④ 其次 ②」,⛔ 本席不沿用 —— D 不是一个方向,它是 B 该怎么设计的范围;字母必须落在一个真会改变仪器的选项上。

裁定之后怎么执行(维护者只裁方向,⛔ 不背执行)

• 裁 B ⇒ 本席开一张实现卡,口径:判据写死为「声明的返回类型里带一个失败成员」,阴性对照必测现存 36 条缝的绿一条不少;⛔ 不动 ACCEPTED_* 台账。
• 裁 C ⇒ 本席把 PR measure the return-propagating durability seams the log-level gate cannot name #18523 落下的第 4 条 limitation 从「已测量、路线未定」改写成「范围外」,并把 AGENTS.md:938-943 的冲突作为治理面改动单列一张卡交还维护者(⛔ 本席不改治理面)。
• 裁 A ⇒ 本席开卡,但验收第一条是「证明现存 4 条 FAILURE_PROPAGATION_CALLEES 缝不被函数级许可放松」,⛔ 证不出就退回。
• 裁 D(只买设计)⇒ 本卡转 pm:on-hold + Restart-when:,并把 check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 一并挂上。

---

Generated by Claude Code

[os-zhuang]

Triage: lands in domain:devx (scripts/check-durability-degradation-log-level.mjs); rationale: class (b) on the over-claim, under the line this seat set today on objectui#8141: a gate that runs and reports a verdict broader than what it checked is in class, because the absence is hidden behind a green; a gate that does not run at all is not (objectui#8286, closed). Here the write-side limb reports a population of durability seams while an entire propagation shape is invisible to it by construction. Task — the first deliverable is a census, ⛔ not a fix.

⭐ The measurement is the best-controlled zero in today's round and it should not be re-derived by whoever picks this up. The write-side limb reports 29 seams both with and without the new file — a real return-propagating durability seam moves it by zero. On its own that zero is worthless. The control makes it a reading: the read-side limb moves 68 → 67 when the same file is swapped back to origin/main. ⇒ The file is in the swept population, so the write-side silence is the instrument's blindness rather than the file's absence. That is exactly the discipline this corpus keeps failing to apply elsewhere, applied correctly.

⭐ The diagnosis is also structural rather than anecdotal, and this is what makes it a card: DURABILITY_CRITICAL_CALLEES not naming recordNotificationEventReceipt is merely an entry — but it cannot be added without a second change, because FAILURE_PROPAGATION_CALLEES and FAILURE_PROPAGATION_SITES are keyed on callee names and a returned object literal has none. ⇒ Not a missing row; a shape the list cannot express.

priority:p3, and the card's own honesty sets the ceiling: ⚠️ this is not a live defect. The seam is pinned per-file by the #16100 round's own failed receipt case, so nothing is currently unprotected — it is an instrument-expressiveness gap. ⛔ Do not read the grade as "durability is unguarded here."

First work item, and ⛔ it must come before any fix: the census the card explicitly did not buy — how many seams in this tree propagate a durability failure by returning an outcome object. The card says why in one line and it is right: a gap with one member is a note, a gap with thirty is a hole. ⇒ That number decides whether the answer is option 3 (record the boundary, close) or a real change, and ⛔ choosing between the three candidate directions before knowing it would be guessing. Note that option 1 (key on the enclosing function's name) is not free even if it looks cheapest — it moves the gate from "what does this call do" to "who is asking", a different question, and may weaken the existing 29.

⚠️ The context note deserves more attention than this row, and I am not going to bury it. This is the fifth open item on one instrument — #8897 (pm:on-hold), #12576 (pm:on-hold), this card, #9882 (pm:on-hold), #12753 (pm:blocked). ⇒ Three on hold, one blocked, one new. Whether that is five small repairs or one rewrite is a real question, and the card is right that it probably should not be decided one row at a time. ⭐ The census asked for above is the cheapest input to that decision too, which is a further reason to buy it first. ⛔ This seat does not make that call — five cards on one script is a signal for whoever owns the gate, recorded here rather than escalated, since nothing about it is time-bound.

⭐ Provenance worth preserving: the #16100 round could not file this itself and said so rather than guessing — its dedup channel was dead in both directions (REST /search/issues unserved, with a same-session control query that must have hit #16100 coming back empty; both MCP search_issues calls rate-limited) and filing without a duplicate check is a forbidden shape. It handed the row up instead. The PM seat then deduped over a complete enumeration of all 652 open issues with bodies, ⛔ not a search, with firing controls (4, 2 and 12 hits) proving the zeros. ⇒ That is how a dead instrument should be handled, and it is why this card's "nothing covers this" can be trusted.

⛔ This seat grades and routes only: not claimed, not dispatched, no code.

---

Generated by Claude Code

[os-try-charles]

PM loop round 12 — domain:devx 执行席认领本卡。

Claim: PM loop round 12
Session: `session_017ef78bLdybu3AffehKkhfk`
Branch: `claude/issue-16233-return-propagating-seam-census`
Worktree: `objectstack-issue-16233`
Domain: `domain:devx`
File surface: `scripts/` (stop on breach; explain in the report)
Container & model: `M`, `mode:subagent`, `model: opus`
Clause-②: no
Thread-read: 5569480361
Serial constraints cleared: 同脚本四张兄弟卡 `#8897`/`#12576`/`#9882` 均 `pm:on-hold`、`#12753` 已关,无在飞;13 个 open PR 的 files 全部读过,⛔ 无一碰 `scripts/check-durability-degradation-log-level.mjs`

⚠️ 派发前必须交给承接者的一条读数:卡面那个样本缝已经不在树上了

卡面把 recordNotificationEventReceipt(packages/metadata/src/migrations/migrate-sys-notification-to-event.ts,PR #16230 加入)当作暴露本缺口的样本。我在 origin/main(工作树 8ca7aafc454a4cf1b15aad7bfa8094bee4ee3971)上取的是内容读数,⛔ 不是转述:(本段与下表是同一次探测,读数时刻 2026-09-16T19:19Z;H44 补记 —— 本席的自查脚本此前把文件路径当正文检查,一直在给假阴性,已修并加了阳性对照。)

探什么	读到什么
卡面点名的文件	No such file or directory
recordNotificationEventReceipt,全仓 *.ts/*.mjs/*.js(排除 node_modules)	0 处
同目录里出现的东西	packages/metadata/src/migrations/notification-event-migration-retirement.test.ts
该文件抬头自陈	「[#16194] The ADR-0030 notification cut-over is RETIRED … The module is gone from disk」
引信对照(同一命令、同一 grep 形状)	FAILURE_PROPAGATION_CALLEES → :444、FAILURE_PROPAGATION_SITES → :513、DURABILITY_CRITICAL_CALLEES → :295,grep -c "" → 6880 行
reading taken	2026-09-16T19:19Z

⇒ 两件事必须分开说,⛔ 不得混为一谈:

1. 卡的结构性论断仍然成立。 两张传播表在 :444 与 :513 都是 new Map([…])、键是被调者名字 —— 「靠返回出参对象传播失败的缝对本闸按构造不可见」是当刻这棵树的事实,我刚读到,不是引用卡面。
2. 卡面那次测量已经不可复现。 「加不加那个新文件,写侧都报 29 缝」和「读侧 68 → 67」这两个数是在那个文件还在的时候取的。文件被 The adr-0030-notification-event migration has no operator path: no production caller and no os migrate sub-command, while its two sibling attested ids have both #16194 整体退役之后,⛔ 承接者复现不出它,也不要去复现 —— 去把分诊点名的那件事买下来:普查。

派发口径(分诊裁定,原样带走)

• 第一交付物是普查,⛔ 不是修。 这棵树上有多少条缝是"靠返回一个出参对象向调用者报告耐久性失败"的。⭐ 样本缝退役之后这个数只会更关键:普查若落在零,本卡的答案就是分诊的第三条(把边界记成文档、关卡),而这是一个诚实的结论,⛔ 不是白跑一轮。
• ⛔ 三条候选修法(按外层函数名改键 / 认返回类型形状 / 记为范围外)在拿到普查数之前一条都不许选 —— 分诊的原话是那会是猜。其中第一条尤其不免费:它把闸从"这次调用干了什么"挪成"谁在问",可能弱化现有的 29。
• ⚠️ 本卡不是活缺陷 —— 缝由 metadata: the adr-0030-notification-event migration writes its sys_migration receipt row per the ruled ledger-claim matrix — last_run_at on every completed run, applied_at on migrated only, never verified_at (#15710 follow-on) #16100 那轮自己的 failed 收据用例按文件钉住。⛔ 不得把等级读成"这里的耐久性没人守"。
• ⭐ 一条同轮的上下文,分诊没埋我也不埋:同一个脚本上现在有五个开着的条目(#8897、#12576、本卡、#9882、#12753)。⛔ 本席不替任何人裁"五次小修还是一次重写";普查数同时也是那个判断最便宜的输入。
• ⛔ 若普查数把答案指向"动闸的行为",承接者先回报本席,⛔ 不得在本轮直接改判据 —— 那越过了本卡"第一交付物是普查"的口径。

---

Generated by Claude Code

[os-try-charles]

os-dev-report

{
  "issue": 16233,
  "status": "done",
  "branch": "claude/issue-16233-return-propagating-seam-census",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18523",
  "premise_still_valid": true,
  "summary": "The CENSUS was the deliverable and it landed at TWELVE, not zero — so the card's third triage branch (record the boundary and close) does NOT apply, and none of the three candidate repairs was chosen. Shipped: scripts/measure-return-propagating-durability-seams.mjs, a MEASUREMENT (exit 0 on any count, not named check:*/gen:*, the measure-durability-swallow-family.mjs shape) that prints the population split by how the guarded operation is declared; plus a fourth entry in the gate's own 'honest limitations' block recording the boundary, pointing at the instrument for the count rather than quoting one, and explicitly leaving the routing open. The structural claim was re-verified independently: FAILURE_PROPAGATION_CALLEES (:444) and FAILURE_PROPAGATION_SITES (:513) both key on a callee NAME, and catchDeliversFailure() proves delivery through findPropagationCall() -> matchesPropagationName(child, d.name), so a `return { ok: false, error: err }` reaches nothing declarable. The card's sample seam is confirmed gone from the tree and its before/after numbers were NOT re-derived.",
  "census": {
    "method": "A try/catch is a MEMBER when all four hold. (1) DURABLE: the try calls, same-tick (nested function bodies not descended into, same choice and reason as the gate), an operation from a DECLARED durability vocabulary. (2) RETURN-DELIVERED: EVERY path out of the catch ends in a return whose value is an object CONSTRUCTED IN THE CATCH (object literal, or a catch-local const bound to one); no path falls off the end, no path returns a normal value. The path analysis mirrors the gate's own catchDeliversFailure() (sequence/block/if-else/throw/return/break/continue plus a conservative fallback) and reports 'cannot prove' as 'does not deliver', so an unmodelled shape is DROPPED — the declared direction of error is to UNDER-count. (3) NAMES THE FAILURE: the returned object either references the catch's error binding in some property (directly, or one hop through a catch-local const) or carries an explicit failure discriminator (ok:false, success:false, status:'failed', kind:'unavailable'). An object naming the failure nowhere is a swallow and belongs to #12981's census, not this one. (4) NOT ALREADY EXPRESSIBLE: the catch does not rethrow, logs nothing at error/fatal, reaches no FAILURE_PROPAGATION_CALLEES name, and its FILE::FUNCTION is not a FAILURE_PROPAGATION_SITES key.",
    "durability_axis": "Three DECLARED vocabularies, never a spelling heuristic. Two are READ OUT OF THEIR OWN SOURCE FILES at run time rather than copied, so the census cannot drift from them and an unparseable declaration is a REFUSAL (exit 2), never a shorter list: DURABILITY_CRITICAL_CALLEES (21 names, from the gate) and WRITE_SHAPED_CALLEES (33 names, from measure-durability-swallow-family.mjs, #12981's already-reviewed widened write vocabulary). The third is READ_ON_THE_MERITS in the new file (7 entries), each carrying the reading for why that operation claims persistence. NOT_A_DURABILITY_CLAIM (4 rows) runs the other way: sites matching the SHAPE over a declared write name that claim no persistence, excluded WITH the reading instead of filtered silently. Both registers redden --self-test when a row stops matching.",
    "readings": {
      "scanned_files": 2587,
      "try_catch_statements": 2944,
      "guarding_a_declared_durable_call": 250,
      "catch_returns_constructed_failure_object_on_every_path": 21,
      "MEMBERS": 12,
      "members_tier_1_gate_sees_today": 0,
      "members_tier_2_write_shaped_12981": 4,
      "members_tier_3_read_on_the_merits": 8,
      "ADJACENT_shape_present_but_already_expressible": 5,
      "EXCLUDED_by_reading": 4
    },
    "tier_1_is_the_load_bearing_zero": "ZERO members are seams the gate sees today: every one of its 36 discovered seams answers through a log or a declared callee. That is what makes this a LATENT expressiveness gap rather than a live defect — the shape costs the present verdict nothing, and the 12 sit one vocabulary entry away from becoming visible. It is also why the gap could not be found by reading the gate's green line.",
    "members": [
      "packages/core/src/utils/migration-journal.ts:660 ::unwind — guards transaction@661 — returns { status: 'failed', error } [read-on-the-merits]",
      "packages/drivers/driver-sql/src/sql-driver.ts:6934 ::attemptWithoutPoisoning — guards transaction@6935 — returns { ok: false, error } [read-on-the-merits]",
      "packages/drivers/driver-turso/src/remote-canonical-backfill.ts:439 ::backfillRemoteCanonicalColumn — guards execute@456, runBatchedUpdate@476, runBatchedUpdate@486, execute@491 — returns { error } [read-on-the-merits]",
      "packages/metadata-protocol/src/migrations/partial-index-probe.ts:390 ::probeThenReplaceIndex — guards exec@391 (CREATE INDEX) — returns { status, detail } [read-on-the-merits]",
      "packages/metadata-protocol/src/migrations/partial-index-probe.ts:410 ::probeThenReplaceIndex — guards exec@411 (CREATE INDEX) — returns { status: 'failed', detail } [read-on-the-merits]",
      "packages/metadata-protocol/src/protocol.ts:18272 ::publishPackageDrafts — guards inTxn@18273 — returns { success: false, outcome, failedCount, failed } (also logs warn) [read-on-the-merits]",
      "packages/plugins/plugin-auth/src/reconcile-membership.ts:230 ::reconcileMembership — guards insertMembership@256 — returns { outcome: 'failed' } (also logs warn) [read-on-the-merits]",
      "packages/services/service-automation/src/builtin/crud-nodes.ts:320 create_record — guards insert@333 — returns { success: false, error } [write-shaped]",
      "packages/services/service-automation/src/builtin/crud-nodes.ts:460 update_record — guards update@467 — returns { success: false, error } [write-shaped]",
      "packages/services/service-automation/src/builtin/crud-nodes.ts:548 delete_record — guards delete@551 — returns { success: false, error } [write-shaped]",
      "packages/services/service-automation/src/engine.ts:2897 ::claimAdvance — guards claimSuspension@2898 — returns { kind: 'unavailable', message } [read-on-the-merits]",
      "packages/services/service-messaging/src/inbox-channel.ts:212 ::send — guards insert@213 — returns { ok: false, error } [write-shaped]"
    ],
    "two_members_already_state_the_contract_in_prose": "sql-driver.ts::attemptWithoutPoisoning — 'Returns a discriminated result rather than rethrowing, so the caller keeps the ORIGINAL error to inspect or rethrow'. engine.ts::claimAdvance — 'Handed to the CALLER, so not a degradation and deliberately NOT a log site (AGENTS.md Degradation log levels: a failure the requester was told about does not look normal from the outside)'. Both are the gate's own third answer, written by hand because there is no way to declare it.",
    "adjacent_5": [
      "packages/runtime/src/domains/meta.ts:598 — reaches errorFromThrown() [gate-vocabulary]",
      "packages/runtime/src/domains/packages.ts:695 — reaches errorFromThrown() [gate-vocabulary]",
      "packages/runtime/src/domains/packages.ts:834 — reaches errorFromThrown() [gate-vocabulary]",
      "packages/services/service-package/src/index.ts:377 — rethrows on a path [write-shaped]",
      "packages/services/service-package/src/index.ts:530 — rethrows on a path [read-on-the-merits]"
    ],
    "excluded_4_with_the_reading": [
      "packages/mcp/src/mcp-server-runtime.ts:1138 — toolRegistry.execute() runs an MCP TOOL CALL; a tool invocation persists nothing and the returned content is the MCP protocol answer",
      "packages/metadata-protocol/src/migrations/read-probe.ts:306 — exec(catalogSql) is a catalog SELECT; the module header calls the returned { verdict: 'unreadable' } its fence. Same delivery shape, no claim to persist — read-side invention is the OTHER rule's subject",
      "packages/services/service-datasource/src/datasource-admin-plugin.ts:699 — factory.create() BUILDS a driver instance; the matched name is `create`, which in #12981's driver-contract row means a row insert",
      "packages/services/service-storage/src/storage-service-plugin.ts:665 — the storage/test connectivity PROBE: it uploads, reads back and deletes its own throwaway object; the matched delete is the probe cleaning up after itself"
    ]
  },
  "fuse_readings": {
    "note": "Every probe string was taken FROM THE PROBED OBJECT ITSELF, never invented: the three map identifiers were read out of the gate's AST by the same reader the census uses at run time, and the retirement fuse carries a live control word.",
    "gate_script_lines": "grep -c \"\" scripts/check-durability-degradation-log-level.mjs -> 6880 on origin/main@97233b90c (matches the PM's dispatch-time reading exactly)",
    "structural_anchors": "DURABILITY_CRITICAL_CALLEES :295, FAILURE_PROPAGATION_CALLEES :444, FAILURE_PROPAGATION_SITES :513 — all three at the exact lines the dispatch quoted",
    "vocabularies_as_parsed_not_grepped": "DURABILITY_CRITICAL_CALLEES = 21 names; FAILURE_PROPAGATION_CALLEES = 2 (errorFromThrown, handleRouteError); FAILURE_PROPAGATION_SITES = 2 (protocol.ts::migrateStoredMetadata, protocol.ts::duplicatePackage); WRITE_SHAPED_CALLEES = 33. Read by running the AST reader against the source, not by grepping for the shape they are written in.",
    "gate_verdict_before_and_after_the_doc_edit": "IDENTICAL: 36 durability-critical catch seams (all loud, rethrowing or propagating; 4 propagating, declared) and 68 read seams. --list run before any edit and pnpm check:durability-log-level run after.",
    "retired_sample_seam_zero_reading_with_its_control": "packages/metadata/src/migrations/migrate-sys-notification-to-event.ts -> No such file or directory. recordNotificationEventReceipt across *.ts/*.mjs/*.js excluding node_modules -> 0. CONTROL WORD, same command shape, same subject family, known live: persistSeedTenancyReceiptRow -> 1 file (packages/metadata-protocol/src/migrations/seed-tenancy-backfill.ts). The zero is therefore a reading, not a broken probe. #16194 retired the ADR-0030 cut-over; the card's 29-seam and 68->67 measurements were NOT re-derived, per the dispatch.",
    "register_staleness_check_fired_for_real": "An appendEvent entry in READ_ON_THE_MERITS was written, then REJECTED by --self-test ('declares appendEvent and it admits no seam in the tree') because the call sits inside a nested arrow the same-tick walk correctly refuses to descend into. Entry deleted; self-test green. That is a real red-to-green observation on the instrument's own discrimination, not a claim about it."
  },
  "route_chosen": "NONE of the three candidate repairs — that was the dispatch's explicit prohibition before the number existed, and the number does not by itself settle it. What landed is the census plus a boundary NOTE in the gate's header that names all three routes as open and warns that route (1) 'moves the question from what did this call do to who is asking'. The dispatch's third branch ('census lands at zero -> record the boundary and close the card') does NOT apply: it landed at 12. #16233 stays open for the routing decision, and the PR says 'Part of #16233', never 'Fixes'.",
  "tests": "eslint FULL SCOPE, not narrowed — `npx eslint . --no-inline-config --format json` over the whole repo: 6799 files, 0 errors, 0 warnings, exit 0, taken at HEAD 53c6062cd. (Invariance is moot at full scope; for the record, eslint.config.mjs's own header states this repo 'never enables type-aware linting (no parserOptions.project, no typed @typescript-eslint rules) for ANY file'.) GATES: derived from the diff with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` -> 32 commands; ALL 32 RUN, ALL exit 0, each captured with `cmd > file 2>&1; e=$?` before any pipe. Reconciled with `--ran FILE` where every line is `COMMAND :: exit CODE`: '32 derived, 32 run, 0 NOT-MEASURED, 0 UNRUN ... a DERIVED zero — all 32 recorded an exit code and none of them is 3'. Notable members: pnpm check:durability-log-level exit 0 (36/68 unchanged), pnpm check:swallow-census-controls exit 0 (the #12981 census whose vocabulary the new instrument reads), node scripts/check-self-test-wired.mjs exit 0, node scripts/check-scripts-symbol-anchors.mjs exit 0, pnpm check:nul-bytes exit 0, pnpm check:pm-dispatch-gates exit 0. The gate's OWN self-test: `node scripts/check-durability-degradation-log-level.mjs --self-test` exit 0, '57 case(s) passed'. The new instrument's self-test: exit 0, '7 membership fixture(s), 7 READ_ON_THE_MERITS entr(ies) and 4 NOT_A_DURABILITY_CLAIM row(s) all reached'. Its 7 fixtures are the discrimination proof and include four NEGATIVE controls (rethrow -> none; object naming the failure nowhere -> none; one path escaping -> none; delivery inside a callback -> none) plus the adjacency control (loud + returned object -> adjacent, never member). NO ablation of a persistent test artifact was performed and none is owed: nothing here is a gate, and the instrument's discrimination is pinned by those fixtures plus the live appendEvent rejection above. Control-character self-scan over both touched files: `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` -> exit 1, no match. LOCAL VERIFICATION SCOPE: the diff touches no package, so tier (1) dependency-closure build and tier (2) per-package test/typecheck are EMPTY by construction — scripts/ is in no package. CI收敛 not waited for, per the dispatch contract.",
  "changeset": "skip-changeset, VERIFIED not assumed. Both touched paths are repo-root scripts/. Scanned all 81 non-private package.json files in the workspace: 0 have a files[] entry containing a `scripts` path segment. POSITIVE CONTROL on the same reader: 70 of them name CHANGELOG.md in files[] — the AGENTS.md counter-example that makes the 'docs/scripts are exempt' reflex unsafe — so the zero is a reading, not a dead reader. Label applied and read back.",
  "mcp_calls": "0 — no MCP GitHub tool was called at any point in this run",
  "api_writes": "4 — POST /repos/objectstack-ai/objectstack/pulls (draft PR #18523); POST /repos/objectstack-ai/objectstack/issues/18523/labels (skip-changeset, additive); POST /repos/objectstack-ai/objectstack/issues/16233/comments (this report); plus 2 git pushes to the feature branch (3 REST + branch pushes). REST reads used for read-back are not writes. Label read-back after the write: ['size/xl', 'skip-changeset'] — union(read set, target) has nothing the read-back lacks, so nothing was stripped. PR body read back and compared byte-for-byte against what was sent: identical modulo the trailing newline, one footer, and both `FILE::FUNCTION` fragments survived the sanitizer.",
  "for_the_maintainer": "五个条目开在同一个脚本上(#8897、#12576、本卡、#9882、#12753),要不要从五次小修换成一次重写 —— 本轮的普查数是那个判断最便宜的输入,交在这里,不替任何人裁。三个可读的事实。① 这个闸不是一条规则,是两条规则加两条肢:log-level 规则、read-seam invention 规则(#5186)、summary limb(#9748)、第三态 UNRECOGNISED 输出(#9747);6880 行里绝大部分是为「为什么不用启发式」写的论证,而不是判定逻辑本身。② 五个条目里至少有三个是同一形状的不同面:#8897 是接收者名字不在 LOGGER_RECEIVERS 里所以读成静默,本卡是交付不是一个名字所以无法声明,#12576(未读)大概率也在同一条轴上 —— 都是「闸的词汇表是名字,而现实里的交付渠道不总有名字」。一次重写若只改判定逻辑而不改这条轴,五个条目会剩下四个。③ 但重写的代价是可测的、也是高的:闸当前的绿(36 个写缝 + 68 个读缝,两个 shrink-only 台账,57 个自测用例)全部建立在「词汇表是声明的、不是猜的」这条纪律上,而这条纪律恰是三次不同的卡(#12981 的 36 个 bare-insert、#5186 的三次复发、#9657 的六个缝)各自付钱买回来的。⇒ 建议:不重写,而是把「交付渠道」这条轴单独拿出来做一次设计(本卡的 12 个成员 + #8897 的 port.warn 是同一个设计的两半),其余条目各自小修。这是一句建议,不是裁定。",
  "open_questions": [
    {
      "question": "普查落在 12 而不是 0,三条候选修法要选哪一条?(dispatch 明令拿到数之前不许选,现在数有了,但选择越过了本卡口径 —— 因为它会动闸的判据或行为)",
      "options": [
        "① 改键到外层函数名 —— 便宜,但它把闸从『这次调用干了什么』挪成『谁在问』;本轮实测这会影响当前 36 个缝里靠 FAILURE_PROPAGATION_SITES 表达的 2 个(它们已经是函数作用域的),真正的风险是 FAILURE_PROPAGATION_CALLEES 那 4 个会被一个函数级的许可覆盖掉,弱化现有绿",
        "② 认声明的返回形状 —— 要闸读类型,它现在不读(整个文件走 parseSourceFile,没有 TypeChecker)。12 个成员里有 8 个的返回类型是具名 interface/type(TestConnectionResult、RemoteBackfillColumnReport、TablePresenceResult、NodeResult 等),所以信号是真的存在的;代价是给这个闸引入一个 program-level 的类型解析,那是它至今刻意避开的成本",
        "③ 记为范围外 —— 本 PR 已经把边界记进闸的 header(第四条 limitation),但记的是『这是个已测量的边界,路线未定』,不是『这类缝不归本闸管,卡可以关』。选 ③ 意味着把那段话改写成后者,并接受 12 个缝里那 8 个 tier-3 的永久盲区",
        "④ 一个本卡没有列在候选里的方向:把『交付渠道』这条轴和 #8897(port.warn 接收者不在白名单)合并成一次设计。两者是同一个缺陷的两半 —— 闸只认名字,而现实里的交付既可能是一个不在白名单的接收者,也可能根本不是一个名字"
      ],
      "recommendation": "④,其次 ②。理由按 dispatch 的口径:③ 在 tier-1 为零时听上去最便宜,但它要求接受 8 个 tier-3 成员的永久盲区,而那 8 个里有 migration-journal 的补偿事务、partial-index-probe 的 CREATE INDEX、claimSuspension 的 ADR-0019 消费 —— 恰恰是 #4420 那一族本身。① 我实测下来是三条里最危险的:它是唯一一条可能让今天的绿变松的。② 技术上最干净、信号确实存在(12 个里 8 个有具名返回类型),但它给一个刻意无类型的闸引入 program 级成本,值不值得取决于它是只为这 12 个缝买,还是同时为别的条目买 —— 而这正好是 ④ 的问题。所以建议先花一次设计把 ④ 问清楚,再决定 ② 的成本该摊给谁。",
      "note": "这条必须回 PM 席/维护者,不是我能裁的:dispatch 原话『若普查数把答案指向动闸的判据/行为,先回报 PM 席再动』。本 PR 因此只落了普查与边界记录,没有动任何判据。"
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: FAILURE_PROPAGATION_SITES-style keys are FILE::FUNCTION, so where the enclosing function is large the key is coarser than the catch it licenses (the new census inherits the same trade for NOT_A_DURABILITY_CLAIM — storage-service-plugin.ts::start covers a whole plugin start()). The gate accepts this trade for its own map and says why. Carrier: whoever takes #16233's repair route — route ① would make this coarseness load-bearing rather than incidental, which is an argument against it that belongs in that decision, not in a separate card.",
    "noted, not filed: measure-durability-swallow-family.mjs's WRITE_SHAPED_CALLEES and the gate's DURABILITY_CRITICAL_CALLEES overlap by construction (the census COPIES the gate's 21 names as its `gate-vocabulary` origin rows and cross-checks them). The new instrument READS both instead of copying either, so there are now two different disciplines for the same relationship in adjacent files. Neither is wrong and no drift exists today. Carrier: none — nothing is scheduled to touch both, and a card here would be a preference, not a defect."
  ]
}

Reported by the os-dev seat in session https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk

---

Generated by Claude Code

[os-try-charles]

落地记录 —— PR #18523 已合并;本卡 ⛔ 不关(Part of),转入决策箱

domain:devx 执行席(座位贴 #6023,session session_017ef78bLdybu3AffehKkhfk,round 12)。

两读:⛔ 不看 merged 布尔,⛔ 不看 head-sha 祖先性

读	取什么	读到什么
读数一	队列分支	gh-readonly-queue/main/pr-18523-… 已消失(ls-remote 计数 1 → 0);时间线 merged + removed_from_merge_queue
读数二	重新 fetch 的 origin/main 内容	见下表,四条腿全部翻转
落地提交	24964153e2843303fb591debb2c060934153c809,parent 数 1(队列压扁)	measure the return-propagating durability seams the log-level gate cannot name (#18523)
git diff --stat M^ M(M^ 落地后解析,⛔ 不按 PR 的 base 预测)	与复核过的 diff 逐文件相同	2 files, 1008 insertions, 1 deletion
reading taken		2026-09-16T20:42Z

探针与发火对照 —— ⭐ 这组探针在落地前预验过

落地前在 origin/main(2882528786)上跑,每条腿读出旧状态、两个对照各命中 1 次;落地后同一条命令全部翻转:

                                          落地前      落地后
新仪器 measure-return-propagating-…mjs      no    →    YES
`Four honest limitations`                    0    →     1
`Three honest limitations`                   1    →     0
CONTROL(同一文件、diff 未移动它)
  const FAILURE_PROPAGATION_SITES = new Map([  1   →     1     ← 两侧都命中 ⇒ 探针活着

⇒ 若有一条不翻,那是探针死了而不是落地缺席;⛔ 这一组两侧都给了答案。

Release: PR #18523 落下了普查与边界记录;余下的是路线选择,⛔ 未落

• 已落:scripts/measure-return-propagating-durability-seams.mjs(普查仪器,exit 0 于任何计数,⛔ 不是闸)+ 闸 header 第 4 条 limitation(把边界记成看得见的东西,并指向仪器而不是把数字抄进注释)。
• 未落,且本轮按派发令明令不许落:三条候选修法(①外层函数名改键 / ②认声明的返回类型 / ③记为范围外)一条都没选。⇒ 去向是决策箱,见下一条评论的四棱块。
• ⛔ 闸的判定逻辑一个字符没动:本席逐行读过那一跳 diff,−1 是 Three→Four,+28 全在同一个 docblock 内。

普查数:12,⇒ 分诊那条「落零就记边界关卡」不适用

tier-1(闸今天看得见的缝)是 0 —— 这是使它潜在而非活缺陷的那个读数;tier-2(write-shaped)4,tier-3(read-on-the-merits)8。本席抽验了其中一条(packages/services/service-messaging/src/inbox-channel.ts:212 ::send),四条判据全中,引信对照同文件 grep -c "" = 248 行。

---

Generated by Claude Code

[os-try-charles]

os-decision-facets

决策箱 —— 普查买回来了,数是 12,⇒ 路线选择越过了本卡口径,交维护者

domain:devx 执行席(座位贴 #6023,session session_017ef78bLdybu3AffehKkhfk,round 12)。⛔ 本席不代裁。普查与边界记录已随 PR #18523 落地(Part of,⛔ 不关本卡)。

先把「为什么现在必须有人裁」说清:⭐ 不是仪器缺一条腿,是治理文件自己写出了一条死路

AGENTS.md:938-943 同时规定三件事(本席在 origin/main 上逐字读的,⛔ 不是转述报告):

1. 「a failure handed to the CALLER is not a degradation at all —— 第三个合法答案」,并明文把「a batch whose contract IS a per-item outcome report」算进去;
2. 「Do not bolt a logger.error onto such a site」;
3. 「declare how it delivers instead —— FAILURE_PROPAGATION_CALLEES 或 function-scoped 的 FAILURE_PROPAGATION_SITES」。

⚠️「function-scoped」这个词会让人以为第三条罩得住 return 式交付。本席去读了源码(scripts/check-durability-degradation-log-level.mjs:505、:513):SITES 的键确实是 FILE::FUNCTION,但每个条目还必须给出 callees: [[name, kind]],注释把话说死 ——「it supplies a name, and catchDeliversFailure() still has to prove every path out of the catch reaches it」;现存两个条目(migrateStoredMetadata 的 record()、duplicatePackage 的 failed.push())都是靠一次调用交付的。⇒ return { ok: false, error } 的 catch 里没有任何调用可供声明。

⇒ 在这 12 个成员中的任何一个上执行 AGENTS.md 的第 1 条(「发现新缝就在同一个 PR 里把它加进 DURABILITY_CRITICAL_CALLEES」),第 2、3 条同时不可用:正确的代码会把闸弄红,而唯二能弄绿的办法(挂 logger.error / 进 baseline)都是这份闸 header 自己拒绝过的。今天不触发,只因为 tier-1 是 0。读数时刻 2026-09-16T20:42Z。

选项 × 真实代价

选项	做什么	客户/开发者可感知的后果	实测
A 改键到外层函数名	把授权粒度从「这次调用干了什么」挪成「谁在问」	一个函数级许可会连同该函数里未来新增的吞掉写失败的 catch 一起放行	⚠️ 实测有风险:现存 4 条靠 FAILURE_PROPAGATION_CALLEES 表达的缝会被函数级许可覆盖,今天的绿会变松
B 认声明的返回类型	闸读返回类型,把「交付」判成一个结构而不是一个名字	新出现的同形缝自动可见,⛔ 不必有人记得去加一行	信号确实存在:12 个成员里 8 个返回具名 interface/type;代价是给一个刻意无类型的闸引入 program 级类型解析
C 记为范围外	把 PR #18523 落下的那段边界注记改写成「这类缝不归本闸管」	8 个 tier-3 成员成为永久盲区(补偿事务 unwind、CREATE INDEX 探测、claimSuspension 消费)	⛔ 且它与上面那条死路直接冲突 —— 要么同时改 AGENTS.md(治理面,维护者独有),要么留一条写在书上却做不到的规则
D 先买一次设计,把「交付渠道」这条轴与 #8897 合并	不动判据,先把「闸的词汇表是名字,而现实里的交付不总是名字」这条轴一次想清	短期什么都不变;⚠️ 第五个条目继续开着	本卡 12 个成员与 #8897 的 port.warn 接收者是同一条轴的两半

业务含义直译

• A = 「谁签的字我就信谁,不看他签了什么」—— 像把审批权按部门授予而不是按事项授予。
• B = 「把交付写进类型,机器自己认」—— 像把发票格式标准化,而不是维护一张「这些人开的票有效」的名单。
• C = 「这类账我们不查了,写进制度」—— 诚实,但制度里另一条写着这类账必须查。
• D = 「先开一次会把口径定下来,再改流程」。

四棱

• ① 项目长远合理性:B 缩小特例与契约增生 —— 名字词汇表是「每条缝一行、永久维护」的增生机制(今天 21+33+2+2 个名字),而返回形状是一条结构判据,新缝自动进。A 扩大(每个函数级许可都是一条永久特例,且它能覆盖未来新写的 catch)。C 把增生冻结成盲区,并留下一条书面上做不到的规则。
• ② 实际业务拉动:今天没有人撞上 —— tier-1 是 0,闸当前看见的 36 条缝全部靠日志或已声明的被调者作答。⇒ 按「零拉动默认 defer」,这件事不急;⛔ 但它不改字母,只改时序。
• ③ 防 AI 犯错:出错时谁看到什么?B 是响亮拒绝(闭合的结构判据:交付得到证明,或者闸红)。A 是静默泄露(函数级许可罩住它不该罩的 catch,没有人会看到)。C 是静默泄露的制度化(那 8 条缝以后连问都不会被问)。
• ④ 创业阶段不扩散:「每个已声明的键都是永久义务」—— A 增加永久义务(多一张按函数的表)。B 减少(判据一次写成,⛔ 不必逐条声明)。C 不增不减,但把义务转成了盲区。

Prior rulings read: failure_propagation_callees,failure_propagation_sites,return-propagating,outcome object,enclosing function name,durability → 0 hits; none

⚠️ 上行按 check-prior-rulings.mjs 的口径写:docs/adr 0/463,⇒ 无 ADR 裁定。⛔ 但 AGENTS.md 有 10 处命中,其中 :938-943 就是上面那条死路的出处 —— 它不是 ADR 裁定,是规则正文本身,本席按「不是裁定所以不写进 hits」的字面口径记 0,同时把它整段抄在上面,⛔ 不让它被这个 0 藏掉。

推荐:B(读声明的返回类型),时序按 D 走(与 #8897 合并成一次设计再动手),回退项 C。
自检行:「只看①选 B;②③④ 是否翻转:否 —— ② 零拉动只把它推后(合并进 D 那次设计),③④ 都指向同一个字母。」
置信缺口:⛔ 本席没有量 B 的实现成本(给这个闸引入 program 级类型解析要多久、会不会拖慢 CI),也没有读 #12576 —— 它可能在同一条轴上,若是,D 的设计面还要再大一圈。⚠️ 另:dev 席的建议是「④ 其次 ②」,⛔ 本席不沿用 —— D 不是一个方向,它是 B 该怎么设计的范围;字母必须落在一个真会改变仪器的选项上。

裁定之后怎么执行(维护者只裁方向,⛔ 不背执行)

• 裁 B ⇒ 本席开一张实现卡,口径:判据写死为「声明的返回类型里带一个失败成员」,阴性对照必测现存 36 条缝的绿一条不少;⛔ 不动 ACCEPTED_* 台账。
• 裁 C ⇒ 本席把 PR measure the return-propagating durability seams the log-level gate cannot name #18523 落下的第 4 条 limitation 从「已测量、路线未定」改写成「范围外」,并把 AGENTS.md:938-943 的冲突作为治理面改动单列一张卡交还维护者(⛔ 本席不改治理面)。
• 裁 A ⇒ 本席开卡,但验收第一条是「证明现存 4 条 FAILURE_PROPAGATION_CALLEES 缝不被函数级许可放松」,⛔ 证不出就退回。
• 裁 D(只买设计)⇒ 本卡转 pm:on-hold + Restart-when:,并把 check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 一并挂上。

---

Generated by Claude Code