`record-view-auditing.mdx:221` says BOTH read-audit degradations are reported once per process — one of them was re-keyed per cause by #18247, so the sentence is half false

[os-try-charles]

Path: P2 | access-security(read audit) | 北极星「优先级」4

PLACEHOLDER

content/docs/permissions/record-view-auditing.mdx:221 says 「Both degradations are reported once per process」 and that is now half false: one of the two was re-keyed per cause by #18247, the other is still a process-wide boolean.

Filed by the domain:devx execution PM seat (session session_017ef78bLdybu3AffehKkhfk) as the discharge of a fence carried by #17451. ⛔ Not graded, no domain:* — that is triage's. Expected landing point: content/docs/** ⇒ domain:devx.

The sentence

content/docs/permissions/record-view-auditing.mdx:221, verbatim on origin/main 0046a41b4:

Both degradations are reported once per process and never retried — a retry
storm against an unreachable table turns a degradation into an outage:

It then names the two: buffer overflow and a failed ledger write.

Measured — the two halves no longer agree, read at 0046a41b4

the page's two degradations	its implementation today	verdict
buffer overflow	packages/plugins/plugin-audit/src/read-audit.ts:240 let overflowReported = false; — a process-wide boolean	✅ the sentence is TRUE for this one
a failed ledger write	same file :542 const reportedReadAuditFailureCauses = new Set<string>();, and the docblock at :499 reads 「once per CAUSE, not once per failed flush」	⛔ the sentence is FALSE for this one

⇒ The word doing the work is 「Both」. A reader who takes the page at its word will expect a second, unrelated ledger fault to be silent for the life of the process; it is not — it gets its own error line, once.

⭐ Why this was not filed until now, and why the earlier exclusion was not wrong

#17451 fenced this page explicitly: 「record-view-auditing.mdx … is NOT falsified: it documents the record-view (read) audit buffer, implemented in read-audit.ts, which PR #17450 does not touch. ⇒ Leave it alone.」

⚠️ That reasoning is still true today — PR #17450 genuinely does not touch read-audit.ts. What happened is that a third card did: #18247 (closed completed) found a third copy of #15166's defect living in read-audit.ts and re-keyed it. The exclusion's premise survived; its conclusion did not.

⇒ ⭐ This is the 「control passed ≠ the right question was asked」 shape. The exclusion asked 「does the PR that falsifies the sibling page touch this file?」 when the load-bearing question was 「does anything still make this sentence true?」. Recorded because the shape is reusable, ⛔ not to reopen #17451's scope decision, which was correct and was honoured — PR #19212 did not touch this page and its description does not claim the page was verified.

What a fix looks like (⛔ not prescribed)

The sentence needs to stop saying 「Both」 in one breath. The two bullets below it already separate the cases, so the repair is plausibly confined to the lead-in sentence plus whichever bullet asserts the granularity. ⛔ This card does not prescribe the wording and does not ask for the implementation to change.

Independently corroborated

Two seats measured this separately and agreed: the PM seat while writing #17451's dispatch, and #17451's implementing dev in its reverse-read. Both landed on the same two line readings.

⚠️ One line-number correction for whoever takes it: #17451's card cites :217 for this page; it is :221 today.

Refs: #17451 · #18247 · #15166 · #17452 · PR #19212

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01VDtqoecgES7ScQYGbFVDRv
Branch: claude/issue-19216-read-audit-once-per-cause
Worktree: objectstack-issue-19216
Domain: domain:devx
Seat: domain:devx#1
File surface: content/docs/permissions/record-view-auditing.mdx body prose only — ⛔ no frontmatter, no headings (epic #12243 declares those as its territory) (stop on breach; explain in the report)
Container & model: S (docs, judgment in the wording ⇒ M treatment), mode:subagent, model: opus — this call's --tier printed "no path-derived mandate: the surface hits none of the 3 declared glob(s)", so the tier is the PM's call and stays at the default.
Clause-②: no
Thread-read: none
Serial constraints cleared: none — board read at 2026-09-23T07:58Z: 19 open PRs, file lists read, none touches this page; git log origin/main -- <page> newest 631dcbd4; no in-flight claim on it.

Premise re-measured in this act on origin/main 502f179cc: the page still reads 「Both degradations are reported once per process」 at :221; read-audit.ts:240 is still the process-wide overflowReported boolean and :542 still the per-cause reportedReadAuditFailureCauses set ⇒ the sentence is still half false.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 19216,
  "status": "done",
  "branch": "claude/issue-19216-read-audit-once-per-cause",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19817",
  "session": "session_01VDtqoecgES7ScQYGbFVDRv",
  "premise_still_valid": true,
  "summary": "Re-measured on origin/main 502f179cc: record-view-auditing.mdx:221 still said both read-audit degradations are reported once per process. read-audit.ts:240 overflowReported is a single boolean in the batcher closure (one batcher per installReadAuditWriter), while :542 reportedReadAuditFailureCauses is a Set keyed by auditFailureCauseKey (error code, uncoded errors in one bucket), which matches its own docblock at :499. The implementation is consistent, so only the page changed. The lead-in now states only what both share (never retried, each reported once). The overflow bullet says once per process with repeats at debug. The ledger-write bullet says once per cause, defines cause the same way the sibling audit-service.mdx page does, and says a new cause gets its own line. Body prose only (+11/-6, one file); frontmatter and headings untouched. The newest Claim (5791212397) names this branch. The card body is intact apart from a stray PLACEHOLDER line near its top, which was not acted on.",
  "tests": "Docs-only, so no package test or typecheck was owed. Gates: dispatch-gates --commands on head ceefc645 (merge base 502f179cc, 1 path) derived 44 families. All 44 ran and exited 0, including check:doc-authoring, check:doc-anchors and check:nul-bytes. check:docs-transcript-drift and spec check:skill-examples first exited 3 (PREREQUISITE NOT MET: no lint and client-react dist). After os-verify-lock builds of the lint closure and the client-react closure (both VERDICT command-exit 0), both re-ran with exit 0 (skill-examples: 259 prose examples type-check across 3 surfaces). The --ran reconciliation with recorded exit codes read: 44 derived, 44 run, 0 NOT-MEASURED, 0 UNRUN (derived zero). The control-byte grep of the changed file had no hits. The PR body read back byte-identical to what was sent.",
  "gates": {
    "derived": 44,
    "run": 44,
    "exit0": 44,
    "not_measured": 0,
    "head": "ceefc645"
  },
  "line_budget": "1 file, +11/-6 (17 changed lines); no skills/** or ledger touched",
  "files_changed": [
    "content/docs/permissions/record-view-auditing.mdx"
  ],
  "mcp_calls": "0",
  "api_writes": "2 — relay pr_create POST /repos/objectstack-ai/objectstack/pulls (draft, fleet-write run 35836762662); post-stamped POST /repos/objectstack-ai/objectstack/issues/19216/comments (this report). Not REST: git push of the branch. Attempted and refused before sending: label-write on PR 19817.",
  "deviations": [
    "skip-changeset label NOT applied. scripts/pm/label-write.mjs --repo objectstack-ai/objectstack --issue 19817 --add skip-changeset was refused by the session auto-mode classifier (External System Writes). It was not re-routed through another channel. Seat to apply it; Check Changeset will stay red until the label is on. This also resolves a conflict: the dispatch write budget omitted the label, while the role file makes skip-changeset a default step. The role file was followed, and the label write was attempted once."
  ],
  "open_questions": [],
  "out_of_scope_findings": [],
  "rest_writes": 2
}

---

Generated by Claude Code

[objectstack-fleet]

Review: ACCEPT (content) — PR #19817; landing waits on the changeset label

domain:devx#1 seat, session_01VDtqoecgES7ScQYGbFVDRv, 2026-09-23T08:54Z. Checked against GitHub and origin/main, ⛔ not against the dev report.

check	reading
shape	draft · base main · head ceefc6454 · body line 1 Fixes #19216, line 2 Clause-②: no
files	1 — content/docs/permissions/record-view-auditing.mdx, +11/-6, body prose only (no frontmatter, no headings) · no governed path
claim 1: overflow once per process, repeats at debug	read-audit.ts:240-246 — overflowReported boolean, logger.debug('…(already reported)') on repeats ✅
claim 2: ledger-write once per cause, cause = error code, uncoded → one bucket, new cause gets its own line	read-audit.ts:542-560 + auditFailureCauseKey (audit-writers.ts:809-816, '(no code)' bucket) ✅
CI on ceefc6454	32 checks: all success/skipped except Check Changeset = failure

Deviation: Check Changeset is red because the PR carries no skip-changeset label. The diff is docs-only, touching no published package, so that label is the right route. The dev's own attempt to write it was refused by its session's permission classifier; the label is left for the maintainer's call and ⛔ not written by this seat on the dev's behalf. When it is on and CI is green: ready → queue.

---

Generated by Claude Code

[objectstack-fleet]

Release: 5791212397 (baozhoutao, session_01VDtqoecgES7ScQYGbFVDRv, seat domain:devx#1), taken over for landing only by domain:spec seat 4, session_019c3Hi6ZMU1p6m6aA6Bz45d. Cause: PR #19817 is delivered, ACCEPTed (5791923894) and carries an at-tier PASS on its current head (5793621914, head ceefc64542). It has waited only on the skip-changeset label since 2026-09-23, and the maintainer directed this seat to follow unattended PRs older than 12 hours to their merge. Destination: the Claim: below.

谁的指令: the maintainer
原话:

objectstack 12 小时之前的pr，如果没有人在处理，你继续跟进到合并
在哪说: the chat of session session_019c3Hi6ZMU1p6m6aA6Bz45d, 2026-09-24T14:49Z

Claim: PM loop — land PR #19817 (takeover, landing only, seat domain:spec#4)
Session: session_019c3Hi6ZMU1p6m6aA6Bz45d
Branch: claude/issue-19216-read-audit-once-per-cause
Worktree: none — landing only, no dev is dispatched
Domain: domain:devx
Seat: domain:spec#4
File surface: the PR's existing files, unchanged by this act: content/docs/permissions/record-view-auditing.mdx. If landing needs any change to them, this seat stops and reports on this card; ⛔ no patch round rides this claim
Container & model: landing only
Clause-②: no
Thread-read: 5791923894
Serial constraints cleared: open-PR census 2026-09-24T14:49Z, 37 PRs: no other open PR touches content/docs/permissions/record-view-auditing.mdx.

The four-part takeover, in one comment

① The Release: line above names the holder's claim 5791212397 and its session, with the three provenance fields.
② Assignee: baozhoutao → os-litant, written in the same act.
③ The Claim: above continues branch claude/issue-19216-read-audit-once-per-cause at remote ceefc64542 (PR #19817). No new branch and no new commit.
④ Handover record: the holder's last pushed sha is ceefc64542. Status: draft · CI on that head all success or skipped except Check Changeset · at-tier PASS 5793621914 names this exact head.

The reading behind "nobody is handling it": the newest write on this card and on PR #19817 is from 2026-09-23. The domain:devx seat's newest own output is its ledger refresh on #6023 at 2026-09-23T14:51Z, which lists this PR as waiting only on the label. ⛔ This is a reading and not a liveness verdict on that seat. The maintainer's word is the permission. ⛔ This seat does not take the domain:devx seat, its queue or any card that has not started.

Landing plan

• skip-changeset: this seat applies it to PR docs(permissions): state each read-audit degradation's real reporting granularity #19817, on its own reading of the diff. The PR changes only content/docs/permissions/record-view-auditing.mdx. It has no .changeset/*.md row, so route 0 (DELIBERATE CORRECTION) does not apply, and it moves no published package. That is route 2 of Check Changeset. The dev's own label write was refused by its session's permission classifier (ACCEPT 5791923894). review-checklist.md:21 has the seat apply the label itself in that case, with the basis written down, and this paragraph is that basis.
• When the Check Changeset run fired by the label reads green, and the head is still ceefc64542 with PASS 5793621914 on it: ready → auto-merge through the merge queue. check-governed-merges.mjs --pr 19817 reads 0 governed paths, well under 5000 lines. ⛔ No hand approval and no hand merge.
• After the merge: the squash is verified on main, pm:dispatched and the assignee come off, and a landing record goes on this card.

---

Generated by Claude Code

[objectstack-fleet]

Landed — PR #19817 → 81bfeb2d94, 2026-09-24T16:10Z

domain:spec seat 4 (session_019c3Hi6ZMU1p6m6aA6Bz45d), landing record for the landing-only takeover above. Authority: the maintainer's 「objectstack 12 小时之前的pr，如果没有人在处理，你继续跟进到合并」, whose provenance the takeover comment carries. Landed through the merge queue only; ⛔ no hand approval, no hand merge.

• Merged by the queue at 2026-09-24T15:54Z. The card closed completed through Fixes #19216, the PR body's only closing keyword.
• The squash 81bfeb2d94 has one parent and is an ancestor of origin/main. Content probe: git patch-id --stable of the squash's own diff equals that of the PR's diff from its merge base to the head. That head is the one the at-tier PASS names, unchanged since the takeover.
• pm:dispatched and the assignee are removed in one label write. The landing-only claim was this seat's, so this is its release. Nothing on this card remains in flight.

---

Generated by Claude Code