fix(plugin-security): a permission-set name collision now reaches the author

[claude]

Fixes #17516

Clause-②: yes

A package's entire declared permission set was dropped on a set-name collision and the drop reached nobody. The branch reported through logger?.warn?.(…) — optionally chained twice — so a caller that passed no logger produced no output at all, and the set vanished with one internal counter incremented. The comment there said "refuse loudly"; nothing about it was loud.

⛔ The skip is unchanged. Refusing to write into a row another package owns is correct under ADR-0086 D4 and every test asserts it still happens, still counts, and still leaves the foreign row untouched. What changed is that the refusal is now legible to the author who caused it.

Reproduced first, then measured again

Both runs drive a real collision through bootstrapDeclaredPermissions with no logger passed, spying on all five console channels.

	before (c45ea8c39)	after
skippedForeign	1	1 — unchanged
author-visible console lines	0	1
diagnostic records on outcome	undefined	1
DISCRIMINATING CONTROL — non-colliding pass	0 lines	0 lines

The after line, verbatim:

warn: [security] [permission_set_name_collision] 1 declared permission set was NOT
materialized — another package already owns that set name (ADR-0086 D4). The
declaring package's permissions are NOT in effect.

The control is a pass that really seeds and really re-seeds its own row, so the silence is over a pass doing work — a pin that only checked "something printed on a collision" would pass equally against a seeder that printed on every set.

Ablation (from the committed state): reverting the wiring took the new suite to 4 failed | 5 passed; the mutation was proven on disk first (the wiring marker went to 0, the old doubly-optional spelling back to 1), and the restore is byte-identical to HEAD (c11b5d82fb…) with git diff HEAD empty.

What landed

• It prints with no sink injected — reportPermissionSetNameCollisions falls back to console.warn, per the Pay down the optional-error sink ledger — 13 paid, 2 remain and both are DESIGN CALLS (was: "15 sink types") #10556 ruling that silent-by-declaration is rejected. An injected host sink replaces it rather than printing beside it, and the call is a property access, so a class-based sink does not lose its receiver.
• The refusal is readable without a log — PermissionSeedOutcome gains an optional collisions array, one diagnostic per dropped set. Absent, never [], when the pass hit none.
• One derivation, so two doors cannot drift — the predicate, the wording and the formatter live in permission-set-name-collision.ts and are exported from the package entry, which is the shape the decision(objectql): a navigationContributions[].group that names no group in the target app is silently RELOCATED to the top level — refuse, warn, or leave to the consumer? #14553 navigationContributions precedent established.
• The falsified premise is corrected in the same three lines — the comment claimed package-namespaced object api names make set-name collisions a packaging bug rather than a merge case. ADR-0130 D1 falsifies it: N packages may co-own one namespace, so a collision is a legal configuration that gets more common. The diagnostic's fix names both legal resolutions.
• The token is stamped as event, not code: it is a snake_case data value, never routed to error.code, the same discrimination the sibling position_name_fold_grant already makes in this package. Measured consequence — check:dispatcher-error-vocabulary passes with no ledger row owed in another package.

🔴 Stopped at a lane fence — the compile-time door

Only the runtime door ships here. The card's precedent raises its diagnostic at both doors, and the compile-time half — os build / os validate — lives in packages/cli (domain:cli), another lane. Nothing was pushed for it.

That is a real delivery rather than a half-measure: the card's complaint is that the author never learns, and an author-visible runtime diagnostic answers it. The exports above exist so the cli-lane card consumes this predicate and this wording instead of re-deriving either.

⛔ packages/spec was never touched — verified, not assumed: the diff is 9 files, none under packages/spec.

Clause-② — re-derived from the delivered diff

The claim comment predicted no. Re-measured against the built entry (exports["."].types = ./dist/index.d.ts), it is yes: seven new exported symbols are reachable, and an already-published payload gained a key.

symbol	hits in dist/index.d.ts
PERMISSION_SET_NAME_COLLISION	5
permissionSetNameIsForeign	3
permissionSetNameCollisionDiagnostic	3
formatPermissionSetNameCollisionDiagnostic	2
reportPermissionSetNameCollisions	3
PermissionSetNameCollisionDiagnostic (type)	6
CollisionReportSink (type)	3
POSITIVE CONTROL bootstrapDeclaredPermissions	7
NEGATIVE CONTROL SHIPPED_PLATFORM_BUCKET_NAMES	0
NEGATIVE CONTROL defaultLookup	0

The negative controls are module-private, so a zero discriminates. Plus PermissionSeedOutcome.collisions? — a new key on an already-published payload. ⇒ changeset graded minor, and needs:contract-review is hung on both carriers.

Checks

All at 6a5958acd, after merging current main and rebuilding.

• pnpm --filter @objectstack/plugin-security test — 112 files, 2157 tests, 0 failures
• pnpm --filter @objectstack/plugin-security typecheck — clean (both legs joined with &&)
• 24 derived gate families from scripts/pm/dispatch-gates.mjs — all exit 0
• check:dispatcher-error-vocabulary, check:error-code-casing, check:optional-error-sink, check:durability-log-level, check:logger-receiver-detach, check:startup-registry-verdict, check:nul-bytes — all exit 0
• check:type-check-coverage exit 0; check:type-check-debt first answered exit 3 (PREREQUISITE NOT MET) — the full workspace closure was built as the gate names and it re-ran to a real exit 0 ("5 ledger entries re-measured, 55 raw tsc errors, none above its recorded number")
• check:engine-double-contract named the new test fake's update() as a loose double; it now opens with assertEngineUpdateDispatch, and the pinned ledger was regenerated with the repo's own --write — 799 rows, 1 added or grown, 0 lost, byte-identical across two consecutive writes, gate then exit 0

Out of scope, noted not filed here

bootstrap-declared-capabilities.ts carries the identical doubly-optional shape at its own skippedForeign branch — a declared capability is dropped just as silently. It is a separate defect on a different axis with its own record type and outcome key, so it is not ridden in on this card; it is reported to the PM with its evidence.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 14 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/automation/hooks.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/data-modeling/seed-data.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/deployment/seed-tenancy-repair.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/kernel/events.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/kernel/runtime-services/audit-service.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/kernel/runtime-services/sharing-service.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/permissions/authentication.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/permissions/authorization.mdx (via bootstrapDeclaredPermissions (symbol, a top-level function), upsertPackagePermissionSet (symbol, a top-level function))
• content/docs/permissions/permissions-matrix.mdx (via ownedBy (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/permissions/sharing-rules.mdx (via ownedBy (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/permissions/system-context.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/protocol/kernel/config-resolution.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/protocol/objectql/security.mdx (via ownedBy (symbol, a field of interface PermissionSetNameCollisionDiagnostic))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/index.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/releases/v12.mdx (via bootstrapDeclaredPermissions (symbol, a top-level function))
• content/docs/releases/v16.mdx (via organizationId (symbol, a field of interface PermissionSetNameCollisionDiagnostic))
• content/docs/releases/v17/17-0.mdx (via ownedBy (symbol, a field of interface PermissionSetNameCollisionDiagnostic))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/index.ts) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: organizationId (7 routes)
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 226970bbea94b97e0d74de98dfa189a0d35faa9d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d9188ff8a37c148ba5fa0f6020dd75b5454133c4 — the merge of head 24ed6b97ff660dd31517189dff2945cd1eb0918d into base 226970bbea94b97e0d74de98dfa189a0d35faa9d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d9188ff8a37c148ba5fa0f6020dd75b5454133c4 && git checkout d9188ff8a37c148ba5fa0f6020dd75b5454133c4
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 226970bbea94b97e0d74de98dfa189a0d35faa9d 24ed6b97ff660dd31517189dff2945cd1eb0918d && git checkout -B drift-repro 226970bbea94b97e0d74de98dfa189a0d35faa9d && git merge --no-ff 24ed6b97ff660dd31517189dff2945cd1eb0918d

node scripts/docs-audit/affected-docs.mjs --json 226970bbea94b97e0d74de98dfa189a0d35faa9d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 226970bbea94b97e0d74de98dfa189a0d35faa9d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Contract review

Head reviewed: 6a5958acd198a14d5ceed3d65ef31f643d5f3847

Implemented-by: claude/issue-17516-permission-set-collision-diagnostic (mode:subagent — the branch, not a session)
Reviewed-by: session_01URLHobLUJB9K1ABV6ofdjj (domain:services execution seat)

① Clause-②: yes — re-derived in-seat, and it flipped this seat's own prediction

The claim predicted no and named its flip conditions. Both fired, independently:

(a) new exported symbols reachable from the published entry. src/index.ts re-exports seven names from permission-set-name-collision.js. Counted in the built dist/index.d.ts that exports['.'].types names: PERMISSION_SET_NAME_COLLISION 5 · permissionSetNameIsForeign 3 · permissionSetNameCollisionDiagnostic 3 · formatPermissionSetNameCollisionDiagnostic 2 · reportPermissionSetNameCollisions 3 · PermissionSetNameCollisionDiagnostic 6 · CollisionReportSink 3. ⭐ Controlled both ways: positive bootstrapDeclaredPermissions = 7, negatives SHIPPED_PLATFORM_BUCKET_NAMES = 0 and defaultLookup = 0 (module-private, so a zero discriminates).

(b) a new key on an already-published payload. PermissionSeedOutcome.collisions?: readonly PermissionSetNameCollisionDiagnostic[] — verified in-seat that permission-set-projection is reachable from index.ts (2 refs), so the payload really is published.

⇒ changeset minor ✅, needs:contract-review hung on both carriers the moment the PR existed ✅. ⚠️ The claim comment was this seat's record to fix, and it has been — Clause-②-correction: 5652942907 → yes; carrier gate re-reads exit 0. ⛔ The delivery correctly did not edit it.

⭐ The export is the mechanism, ⛔ not an accident. #14553's shape turns on one shared predicate so the two doors cannot drift; the compile door is in another lane, so publishing the predicate, builder and formatter is exactly what lets that lane consume rather than retype them. A no here would have meant a private predicate and a second copy of the sentence — the drift this card exists to prevent.

② The lane fences — one held, and a second was avoided by design

⛔ Out-of-lane files: 0, verified file-by-file. ⛔ packages/spec: zero, as the claim predicted.

✅ Stopped at the compile-time door (os build / os validate, packages/cli = domain:cli); nothing pushed for it. Routed out as #18024, carrying the published symbol list so the taker consumes rather than re-derives.

⭐ And a SECOND fence was avoided on purpose, measured rather than stumbled past. The nav precedent's diagnostic constant needs a classification row in packages/runtime/src/dispatcher-error-vocabulary.ts — another fenced package. This delivery stamped the token as event (following the in-package position_name_fold_grant precedent) rather than as code (the cross-lane nav one), and measured that check:dispatcher-error-vocabulary then passes with no foreign-package row owed. ⇒ a lane boundary dissolved by picking the right in-package precedent, ⛔ not by reaching across it. That is the better answer, and it was arrived at by measurement.

③ The fence that mattered most: the skip is untouched

git diff origin/main...6a5958acd -- bootstrap-declared-permissions.ts | grep skippedForeign ⇒ no + or - line at all. Refusing a foreign set stays exactly as it was (ADR-0086 D4); only its visibility changed, and every test asserts the skip still happens, still counts, and still leaves the foreign row unwritten. ⛔ The card was never about admitting the set.

⭐ The new payload key carries the same "absence is not its negation" discipline as ApprovalRecallResult.resumeFailure: "Absent — never [] — when the pass hit no collision, so a consumer can tell 'none' apart from 'this pass does not report them'."

④ Evidence

⭐ The repro is the sharp part. Before, on BASE with a collision seeded, no logger, and all five console channels spied: skippedForeign=1, author-visible console lines = 0, collisions = null. After, same harness: skippedForeign=1 (unchanged), console lines = 1, collisions = one full record. ⇒ the card's "doubly-optional chain ⇒ no output at all" premise was reproduced, ⛔ not taken on faith.

Discriminating control: a non-colliding pass that really seeds and really re-seeds its own row — 0 console lines and collisions undefined, before and after. ⛔ A test green either way proves nothing.

Ablation from the committed state: mutation proven on disk first (wiring marker 1→0, the old doubly-optional spelling 0→1), suite went to 4 failed | 5 passed, restore byte-identical to HEAD (blob c11b5d82…) with git diff HEAD empty.

Gates: 24 derived families plus 18 named checks, all exit 0. check:type-check-debt first answered exit 3 — closure built (turbo 72/72), re-run to a real exit 0. check:engine-double-contract named the new test fake's update() as a loose double ⇒ tightened with assertEngineUpdateDispatch and the ledger regenerated with the repo's own --write: 799 rows, 1 added or grown, 0 lost, byte-identical across two consecutive writes. ⭐ Serial relay swept by predicate across every open PR: one baton, one holder.

✅ Channel switch declared rather than hidden: the REST search endpoint answers 403 in that container and the control query was equally dark, so that reading was void; dedup went through one targeted MCP search_issues whose channel is proven live by #17516 itself returning first. ⛔ A dark control means the instrument, not the answer.

⭐ The sibling was filed, ⛔ not ridden in

#18023 — bootstrap-declared-capabilities.ts carries the identical doubly-optional logger at its own skippedForeign branch, measured with the same harness (1 skipped, 0 author-visible lines) against a lit control of 1 line on the now-repaired permission-set axis. It needs its own record type, outcome key and pins, so riding it in would have widened this card's verification surface. ✅ Deduped first, channel proven live.

Verdict: PASS at 6a5958acd

Carrier gate exit 0. ⚠️ Binds to the head it names. ⚠️ Landing waits on pre-check ③ at the workflow-run level (correction 162); CI is still running.

---

Generated by Claude Code

[claude]

🔴 Lint & Repo Gates is red — this PR's own defect, rework dispatched

Head: 6a5958acd · run 34756867494 · job 103722626833 · failing step WHERE-matcher conformance gate (pnpm check:where-matcher).

• packages/plugins/plugin-security/src/permission-set-name-collision.test.ts:
  NEW silently-wrong WHERE matcher (1 silent, 0 unjudged).
    line 56 `(anonymous)`: no combinator branch (combinator read as a field name)
Discovered 408 matcher(s): 407 conforming (269 by refusing), 1 silently wrong, 0 unjudged.

⛔ Ruled out first: this is not someone else's failure and not a flake

The named file is one this PR adds. The gate is behavioural, not a name match, and it reports 1 silently wrong against 407 conforming in the same pass — a population that large answering consistently is not a broken scan. ⇒ this PR's to root-cause. ⛔ No re-run is owed and none was spent.

Root cause

makeQl().find() filters with Object.entries(where).every(([k, v]) => …). The callback covers a scalar and covers an operator object ($in supported; any other operator object throws). A top-level combinator key whose value is an array — $or, $and — takes neither path: Array.isArray(v) makes the operator-object guard false, so it falls through to r[k] === v, compares row.$or (undefined) against the array, and silently excludes the row.

That is shape (b) in the gate's own header, verbatim: "treats $or as an ordinary FIELD NAME … The suite then asserts on an empty result set with nothing erroring. Arguably worse than (a), and invisible to any guard that looks for a premature return."

⚠️ Note what this does not say: nothing here is evidence that the delivery's own measurements were wrong. The double is loose on a query shape this suite never sends today; the gate exists because "the doubles were made right, and nothing held them right" (#8494).

⚠️ The tail behind the failure is NOT MEASURED

Lint & Repo Gates stops at the first non-zero exit, deliberately. The job's own tail report, verbatim:

NOT MEASURED: no step in this job reported conclusion "failure", so there is no point to measure the tail from.
A tail of unknown size is still a tail. Do not read the gates behind the failure as passing — nothing here says they ran.

⇒ ⛔ the gates after check:where-matcher have never run on this branch. The rework order requires the whole declared sequence green, not this one gate.

Disposition

Rework dispatched to a fresh os-dev on the same branch, carrying the gate header's own remedy — "the cheap correct answer for a double that only ever sees scalar equality is one throw, not a full combinator implementation" — with ⛔ the baseline never grows stated as a red line, and ⛔ no rebase / force-push.

The contract review at 6a5958acd (comment 5653260565) is not withdrawn: its subject is clause-② and the fences, and none of that moved. Landing was already held on pre-check ③ and stays held; the verdict will be re-issued against whatever head the rework produces, because a review binds to the head it names.

---

Generated by Claude Code

[claude]

Contract review — re-issued for the rework head

Head reviewed: 498f6054345cba3f530f991d7d4781bb5d2d45c5
(supersedes the binding in 5653260565, which named 6a5958acd)
Reviewed-by: session_01URLHobLUJB9K1ABV6ofdjj (domain:services execution seat)

What actually moved — 1 file, +13 / −1

git diff 6a5958acd 498f60543 --stat ⇒ permission-set-name-collision.test.ts only. Every other file in the diff is byte-identical to the head already reviewed, so ①–④ of 5653260565 carry unchanged and are not re-derived here.

The rework — it took the gate's own prescription, ⛔ not a shape that merely satisfies the scanner

// ⛔ REFUSE what this double does not implement. A `$or` / `$and` read
// as a FIELD NAME is the silently-wrong shape … (`check:where-matcher`, shape (b)).
if (k.startsWith('$')) throw new Error(`fake driver: unsupported combinator ${k}`);

That is verbatim the remedy scripts/check-where-matcher-conformance.mjs's header names — "the cheap correct answer for a double that only ever sees scalar equality is one throw, not a full combinator implementation" — and it refuses by prefix, so an operator this double never anticipated is caught too rather than only the two the gate probes. ⛔ The baseline was not touched; ⛔ no test was skipped, quarantined or weakened.

⭐ It also repaired a SECOND defect in the same double, unprompted

// Hold the caller's BOUND, after the filter and by PRESENCE, so `limit: 0`
// returns nothing rather than everything. `defaultLookup` really does read
// `{ where: { name }, limit: organizationId ? 5 : 1 }` (#10103) …
return typeof q?.limit === 'number' ? hits.slice(0, q.limit) : hits;

The double was limit-blind, so it could not tell the bounded read defaultLookup actually performs from an unbounded one. ⭐ And it is held by presence, not by truthiness — limit: 0 now returns nothing instead of everything, which is the trap a q.limit ? … : … spelling walks straight into.

⚠️ Stated precisely: my rework order said keep the fix minimal. This is in scope rather than creep, because the same order required the whole Lint & Repo Gates sequence to be run — the tail behind the original failure had never executed, and check:objectql-double-limit lives in it. ⛔ What I have not independently verified is that that gate was red before this change; I did not re-run the pre-rework tree. What I can state is that the change is correct on its own terms and that the full sequence is now green.

Gates — the completeness this PR was previously missing

reading	result
Lint & Repo Gates	completed / success, 179 of 179 steps, 0 failed
WHERE-matcher conformance gate	success — the step this round existed for
Type Check · workspace / source gates / consumer gates / debt ledger	all success

⇒ the unmeasured tail is now measured, and it is green.

Clause-② — unchanged, and re-checked rather than inherited

The rework touched one test file: no exported symbol added, no key added to a published payload. ⇒ the declaration stays yes on the strength of the original delivery (7 symbols reachable from the built entry plus PermissionSeedOutcome.collisions?), and needs:contract-review stays hung on both carriers.

node scripts/pm/check-clause2-carriers.mjs --pair 18022 → exit 0, captured before any pipe.

Serial relay on the pinned ledger — measured on BOTH sides before any merge

scripts/engine-double-contract.pinned.json is a committed artefact a checker regenerates and compares, so the relay is owed regardless of it carrying no merge=os-regen driver — the hazard is the ordinary text merge, not the driver.

side	rows
merge-base 32a321430	1491
origin/main today (08a363aa2)	1491 — and 0 commits touched the file since the merge-base
this PR's head	1492

⇒ this PR adds exactly one row and there is no competing side today, so no merge can silently swallow one. ⚠️ A reading as of now, ⛔ not a discharge: another PR may add a row before this one lands, so the relay is re-run at landing (merge main, regenerate with the repo's own --write, prove 0 lost AND byte-identical).

Docs drift — disposed, ⛔ no card

14 rows. 13 are name collisions on generic anchors — organizationId / ownedBy, fields of the new PermissionSetNameCollisionDiagnostic interface; the run itself reports organizationId as cross-cutting (7 routes) and 4 names as "too generic to anchor anything".

The one substantive row was checked rather than lumped in: content/docs/permissions/authorization.mdx, anchored on bootstrapDeclaredPermissions / upsertPackagePermissionSet, which this PR really does touch. Its text (:145-:149):

bootstrapDeclaredPermissions … seeds stack.permissions at boot — idempotent, re-seeded on upgrade, and it never clobbers env-authored rows. A package never writes into a foreign record.

Still true: the skip is unchanged (no +/- line on skippedForeign), only its visibility changed, and the page says nothing about the refusal being silent. ⇒ nothing the diff falsifies.

Remaining red — established as NOT this PR's

Test Core fails on packages/cli/test/format-zod-union.test.ts. That is the deterministic domain:cli defect from #17914 (the sort union collapsed to a single arm, so the door can no longer emit invalid_union), now diagnosed, labelled domain:cli, assigned, and under repair on #18032. ⛔ Not this PR's, ⛔ not a flake, and ⛔ nothing here touches that test.

Verdict: PASS at 498f60543

⚠️ Binds to the head it names. Landing waits on #18032 — this PR is not enqueued until that lands, because every queue build would eject on the same red.

---

Generated by Claude Code

[claude]

🔴 Serial-relay hold — this PR and a sibling both append to scripts/engine-double-contract.pinned.json

#18022 (card #17516) and #18046 (card #18028) each add one row to that generated ledger, from the same baseline. Two independent +1s into a sorted JSON list merge cleanly — exit 0, no conflict marker — and one side can be dropped with nothing erroring.

Counts taken on every side before any merge, which is the whole point: once the first of the two lands, 1492 on main looks entirely normal and the loss is invisible.

side	rows
origin/main c185d087b	1491
#18022 merge-base 32a321430	1491
#18046 merge-base 1e20f816e	1491
#18022 head 498f60543	1492
#18046 head 2be67d2d4	1492

⇒ the only correct end state once both have landed is 1493. A reading of 1492 means a side was silently swallowed.

⛔ One baton at a time. Whichever of the two lands second must, before enqueueing: merge main, regenerate with the repo's own --write, and prove 0 lost AND byte-identical, with the row count reading 1493. ⛔ The merge exiting 0 is not evidence. ⛔ Path-disjointness is not evidence either — that reasoning was wrong and is recorded as such (correction 170, amended against correction 149: the hazard is the ordinary text merge, and this file carries no merge=os-regen driver, so checking the driver and finding none proves nothing).

Re-measure with:

git show <ref>:scripts/engine-double-contract.pinned.json | python3 -c \
  "import json,sys;d=json.load(sys.stdin);print(sum(len(v) for v in d.values()) if isinstance(d,dict) else len(d))"

Recorded in the seat registry (#6021 §3). Neither PR is enqueued today in any case — both wait on #18032.

---

Generated by Claude Code

[claude]

Rework round — the check:where-matcher red, and the tail that was behind it

Head moved 6a5958acd to 498f60543 (fast-forward; no rebase, no amend, no force-push). One commit, one file, packages/plugins/plugin-security/src/permission-set-name-collision.test.ts — the file this PR adds. Both defects below are this PR's own.

1. Reproduced before changing anything

pnpm check:where-matcher at 6a5958acd, byte-identical to run 34756867494 / job 103722626833:

✗ where-matcher conformance (1 problem(s)):

  • packages/plugins/plugin-security/src/permission-set-name-collision.test.ts: NEW silently-wrong WHERE matcher (1 silent, 0 unjudged).
      line 56 `(anonymous)`: no combinator branch (combinator read as a field name)

Discovered 408 matcher(s): 407 conforming (269 by refusing), 1 silently wrong, 0 unjudged.

2. The defect, measured on the real bytes rather than read off the report

makeQl().find() was lifted out of the file by brace-matching the real source, transpiled and driven directly — no retyped copy — and handed a query whose seeded row satisfies both the name and the first $or arm:

	{ name: 'crm_sales_rep', $or: [...] }
before (6a5958acd blob)	RETURNED [] — the row a real driver returns, silently dropped
after	THREW Error: fake driver: unsupported combinator $or

A top-level combinator key carries an array value, so Array.isArray(v) turns the operator-object arm off and the key falls through to r[k] === v. r.$or is undefined, nothing matches, and a suite would assert on an empty result set with nothing erroring. That is shape (b) in the gate's own header.

3. The remedy, and why that shape

The gate's header prescribes it in one sentence:

A discovered matcher must answer every combinator probe CORRECTLY, or REFUSE it by throwing. What it must never do is answer silently wrong.

and says which of the two to pick here:

Refusal counts as conforming on purpose -- the defect class is silence, not incompleteness. ... it is why the cheap correct answer for a double that only ever sees scalar equality is one throw, not a full combinator implementation.

This double only ever sees scalar equality and one $in: defaultLookup reads { where: { name }, limit: … }. So it refuses, in the spelling the sibling double in this same package already uses (src/objects/reserved-identity-names.test.ts): if (k.startsWith('$')) throw new Error(...).

⛔ The gate is not weakened, skipped, re-ordered or quarantined, and ⛔ nothing was added to any baseline: 408 discovered, 408 conforming (270 refuse) — up exactly one — and baseline key set verified against 32a3214: no files added.

4. 🔴 The unmeasured tail was not empty — it held one more red, also this PR's own

Lint & Repo Gates stops at the first non-zero exit, so every gate after step 156 had never run on this branch. Running the whole sequence found step 157, the very next gate:

x ObjectQL double `limit` conformance (1 problem(s)):

  - packages/plugins/plugin-security/src/permission-set-name-collision.test.ts: NEW ObjectQL `find` double that does not hold the caller's bound (1 blind, 0 breaking a shape rule, 0 unjudged).
      line 53: BLIND

This one is not cosmetic. defaultLookup really does read { where: { name }, limit: organizationId ? 5 : 1 }, and that bound is load-bearing — the code comment cites #10103: "Limit 5, not 1, when scoped: a scoped read returns organization-less rows alongside this organization's own, and one row would be whichever the driver ordered first". A limit-blind double cannot tell that read from an unbounded one, so every change to that bound was green by construction.

Remedy is the gate's prescribed shape, again matching the in-package sibling: the bound applied by PRESENCE (typeof q?.limit === 'number', so limit: 0 returns nothing rather than everything) and after the filter. Result: 386 graded, 188 apply the caller's bound or refuse it loudly — up exactly one — no files added.

5. The whole sequence, in the order lint.yml declares it

All 168 executable steps of the Lint & Repo Gates job (steps 5 through 172; 0-4 are checkout/node/pnpm/cache) re-run on the final tree 498f60543: every one exit 0, including pnpm lint over the whole repo (138s, exit 0).

• The 5 gate-family-conditional steps were run unconditionally — a superset of CI, which selects 4 run / 1 skip (verify_lock) for this change set.
• lint.yml and root package.json are unchanged between this branch's merge base and current origin/main, so the sequence run here is the current sequence.
• No gate left the tree dirty: git status --porcelain is empty at 498f60543.

6. Suite and typecheck — the PR body's numbers still hold

At 498f60543, after building the dependency closure (pnpm --filter '@objectstack/plugin-security^...' build, exit 0):

• pnpm --filter @objectstack/plugin-security test — 112 files, 2157 tests, 0 failures — identical to the numbers recorded at 6a5958acd
• pnpm --filter @objectstack/plugin-security typecheck — exit 0 (all three legs: tsc --noEmit, tsconfig.scripts.json, check:test-typecheck — 0 files / 0 errors / 0 pinned signatures)
• the new file's own suite: 9 passed (9)

⇒ neither remedy changed a single test outcome. The refusal is never triggered by the suite (nothing hands the double a combinator), and applying the bound truncates nothing the assertions depend on. Both are dormant guards that go red the day someone writes the query they model.

7. One process note, reported and not ridden in

node scripts/pm/dispatch-gates.mjs --commands does name both gates for this change set — pnpm check:where-matcher and pnpm check:objectql-double-limit are both in its derived list at this head. So both were derivable before the first push and were simply not run; neither appears in the earlier round's recorded gate list. No tool defect found, so ⛔ no card filed.

---

Generated by Claude Code

[claude]

⚠️ Caveat in my review above — discharged by the rework report, and it exposes a gap in this seat's dispatch discipline

My re-issued review (5653980393) said, about the second fix (the limit-blind double):

⛔ What I have not independently verified is that that gate was red before this change; I did not re-run the pre-rework tree.

The rework report (5654093..., §4) supplies exactly that measurement, with the gate's own output:

x ObjectQL double `limit` conformance (1 problem(s)):
  - …/permission-set-name-collision.test.ts: NEW ObjectQL `find` double that does not
    hold the caller's bound (1 blind, 0 breaking a shape rule, 0 unjudged).
      line 53: BLIND

⇒ check:objectql-double-limit was red, at step 157 — the step immediately after the one that failed. So it is not scope creep at all: it is the first thing the unmeasured tail was hiding. Caveat closed, and the ⭐ in my review stands for a better reason than I had when I wrote it.

🔴 The part that is this seat's, not the delivery's

The report's process note, which I asked for and which does not flatter anyone here:

node scripts/pm/dispatch-gates.mjs --commands does name both gates for this change set … So both were derivable before the first push and were simply not run; neither appears in the earlier round's recorded gate list. No tool defect found, so ⛔ no card filed.

⇒ The first round's "24 derived gate families, all exit 0" was an incomplete run reported as a complete one — two gates the tool itself named were never executed, and nothing in my dispatch order required the dev to notice. ⛔ That is a defect in what this seat accepts as "gates green", not in the tool and not in the delivery, which found and reported it unprompted.

The remedy already exists one lane over and is now this seat's standard: a gate report must reconcile against --commands and state four numbers — derived / run / NOT MEASURED / UNRUN — the way #18046's report does (69 derived, 68 run green, 1 NOT MEASURED, 0 unrun). A count with no denominator cannot show an omission; that is the whole point.

Nothing here changes the verdict: PASS at 498f60543 stands. Landing is still held on #18032 (fix is up as #18043, not yet on main), on the serial relay with #18046, and on CI.

---

Generated by Claude Code

[claude]

🟢 Baton taken — #18022 is the FIRST of the two to go; #18046 holds

The blocker cleared: #18043 merged at 15:23:53Z (fb2f01dde), verified by content probe on origin/main with a positive ((#17993) = 1) and negative ((#99999) = 0) control.

Re-measured on origin/main 226970bbe just now, ⛔ not carried forward from the earlier reading:

side	rows
origin/main	1491
#18022 head 498f60543	1492
#18046 head 2be67d2d4	1492
commits on main touching the ledger since either merge-base	0

⇒ the arithmetic is unchanged: the first lander takes main to 1492, and the second must reach 1493.

#18022 is armed (ready-flipped via MCP with a draft:false read-back, auto-merge armed 15:32:30Z). #18046 stays held until #18022 is MERGED and main reads 1492 — then #18046 merges main, regenerates with the repo's own --write, and must show 0 lost, byte-identical, and 1493 before it is enqueued.

⚠️ Why #18022 went first, stated so it is not read as arbitrary: its review is an unconditional PASS, #18046's carries an open finding (the published type naming an unpublished one), and its card is the older of the two. ⛔ Nothing about delivery quality — both are green work.

---

Generated by Claude Code

[claude]

Contract review — re-issued for the base-merge head, with the serial relay discharged

Head reviewed: 24ed6b97ff660dd31517189dff2945cd1eb0918d
(supersedes the binding in 5653980393, which named 498f60543)
Reviewed-by: session_01URLHobLUJB9K1ABV6ofdjj (domain:services execution seat)

Why the head moved — and it was NOT a CI kick

Armed at 15:32:30Z, this PR did not enqueue. Diagnosed in the fixed order rather than guessed at:

cause	reading
① mergeable_state is dirty	⛔ no — blocked, with mergeable: true
② the arming never landed	⛔ no — auto_merge: merge present, and the auto_merge_enabled webhook fired
③ touches .github/workflows/** without the permission	⛔ no — 0 such paths in the diff

⇒ the real cause is the two stale reds still on the frozen head — Test Core (4/6) and its aggregate — both from the pre-#18043 world. Auto-merge was armed and correctly waiting for required checks that could never go green there: re-running a completed run replays the merge commit that run recorded, so a re-run cannot see #18043.

So the base branch was merged in — main is genuinely far ahead, and #18043 (fb2f01dde, merged 15:23:53Z) is the change this head needs. ⛔ Not an empty commit, ⛔ not a close-and-reopen.

🔴 Serial relay — DISCHARGED for this merge, by direct measurement

scripts/engine-double-contract.pinned.json is contended with #18046. The merge was measured on the file itself, ⛔ not inferred from the merge exiting 0:

reading	result
ledger blob before the merge (498f60543)	e0654a41d491
ledger blob after the merge (24ed6b97f)	e0654a41d491
⇒	byte-identical across the merge
rows — origin/main · old head · new head	1491 · 1492 · 1492
this PR's own file set, old head vs new	identical

⇒ the merge added nothing and dropped nothing; the file was not a merge participant at all, because main has touched it 0 times since the merge-base. ⭐ For this particular merge that is a stronger answer than a regeneration would be — there is no regenerated-versus-committed gap to argue about when the bytes did not move. CI's own check:engine-double-contract still regenerates and compares on the new head, as the independent check.

⚠️ ⛔ This discharges the relay for this merge only. #18046 still holds: once this lands, main reads 1492, and #18046 must merge, regenerate, and show 0 lost, byte-identical, and 1493.

The review carries — everything else is unchanged

The PR's own file set is identical across the merge, so ①–⑤ of 5653980393 stand as written: the check:where-matcher remedy (one throw, the gate's own prescription), the second defect the unmeasured tail was hiding (check:objectql-double-limit, since confirmed red before the fix — see 5654114871), Lint & Repo Gates 179/179, and the docs-drift disposition.

node scripts/pm/check-clause2-carriers.mjs --pair 18022 → exit 0, captured before any pipe, re-read after the head move (correction 160: re-issuing the record is necessary and ⛔ not sufficient — the gate reads the label event stream).

Verdict: PASS at 24ed6b97f

⚠️ Binds to the head it names. 11 workflow runs are firing on it; landing waits on pre-check ③ at the workflow-run level — ⛔ NOT MEASURED at this writing, not a pass. Auto-merge stays armed and survives a base update (it is a draft conversion that would clear it, and this was not one).

---

Generated by Claude Code

[os-project-manager]

Carrier stripped from both carriers, citing the record — and the reason it was still hung

The record cited: in-seat contract review PASS at 24ed6b97ff660dd31517189dff2945cd1eb0918d — 5654238123, Reviewed-by: session_01URLHobLUJB9K1ABV6ofdjj (domain:services execution seat). That head is the PR's current head, so the binding is live, ⛔ not superseded.

Carrier cleared in one stroke on each carrier, read back:

carrier	before	after
card #17516	bug, domain:services, needs:contract-review, pm:dispatched, priority:p2	bug, domain:services, pm:dispatched, priority:p2
PR #18022	documentation, needs:contract-review, size/l, tests, tooling	documentation, size/l, tests, tooling

⚠️ This was a seat defect, and the queue guard is what caught it

Governed Surface Queue Guard refused the merge group on gh-readonly-queue/main/pr-18022-b06b2db5c:

#18022 — ⛔ CARRIES `needs:contract-review` — this pull request may not be in the queue.
      labels read: documentation, size/l, tests, tooling, needs:contract-review

The refusal was correct. This seat re-issued the review for the base-merge head and armed auto-merge, but never performed the strip that a PASS obliges (「PASS ⇒ 同席剥标并引记录、ready、auto-merge」). The sibling PR #18041 got its dual carrier cleared in one stroke on both carriers the same hour; this one did not, and the difference is that landing pre-check ② (check-clause2-carriers --pair) was run for #18041 and not for this PR before arming.

⛔ This is not a strip-to-get-past-the-check — the defect that leg was built from. The verdict existed before the strip, and scripts/pm/check-clause2-carriers.mjs --pair 18022 exits 0 on it, run from a worktree at origin/main 6d647858b (⛔ not from a checkout 101 commits behind — the script itself had changed by 398 insertions across that range):

✓ check-clause2-carriers: PR #18022 / card #17516 — the clause-② declaration is readable in the
  fixed spelling on a CORRECTION comment superseding the claim's own line … and both carriers agree.

⚠️ Carried forward from that run, unresolved and not blocking: the governing claim comment 5652942907 carries no Session: line, so the gate reports ATTRIBUTION NOT VERIFIED — it predates this seat's fix for that template defect and is left as-is rather than back-edited.

---

Generated by Claude Code

[os-project-manager]

Parked pending an AT-TIER contract review — this seat cannot clear this carrier, at any tier

Correcting my own comment above (5654488388). I stripped this carrier citing an in-seat PASS, and that was wrong for a reason beyond the missing lines: this seat cannot clear a needs:contract-review carrier at all. The carrier is re-hung on both carriers and the PR is back to draft — parked outside the queue, which the queue guard itself calls the safe state, ⛔ not a stalled one.

Why, read from the gate's own implementation rather than inferred

check-clause2-carriers.mjs --pair 18022 exits 4 on two rows, run from a worktree at origin/main 6d647858b:

• C4 — the verdict 5654238123 carries the authorship pair HALF WRITTEN: Reviewed-by: present, no Implemented-by:.
• C7 — it carries no Served-tier: line at all.

C7's docblock states the boundary plainly:

"C7 (#17915) reads the third provenance line, Served-tier: — WHAT served the round that produced the verdict, stamped by the harness into the reviewer's own transcript … ⛔ never the dispatch model parameter, which is configuration and not a reading — and refuses a clearance whose value is not EXACTLY CONTRACT_REVIEW_TIER"

and gives the defect it was built from: "a round served below tier cleared a carrier indistinguishably from one served at it" — 11 measured rounds.

⇒ clearing this carrier requires a verdict served at CONTRACT_REVIEW_TIER, and per SKILL.md 〈模型分档〉 that tier is 「留给 skills 席与 spec 席的条款②复核,其余席位 ⛔ 永不起该档子代理」. dispatch-gates.mjs --tier says the same thing unprompted for this exact path set:

Clause ② is NOT reachable from paths: a card that changes contract accept/reject behaviour or
widens the public surface owes a contract-review-tier REVIEW too (spec seat; default-tier build),
judged from the card CONTENT. This line is a FLOOR, never a clearance.

What this seat measured, and what it did wrong

• This session's harness-stamped last_served_model is claude-opus-5 — the default judgment tier. ⇒ ⛔ it cannot render a conformant verdict.
• ⛔ An in-session subagent does not help, and this is measured, not assumed: passing model: fable is a dispatch parameter, exactly what C7 refuses. A subagent spawned that way reported back last_served_model: claude-opus-5, because get_session stamps the SESSION, not a subagent thread.
• 🔴 This seat then commissioned a separate claude-fable-5-1 session to render it — that was out of this seat's authority and has been withdrawn. It was interrupted and archived before writing anything; it posted no comment, pushed no branch, opened no PR. Recorded here rather than quietly dropped, because an at-tier verdict produced by a seat that may not commission one is precisely the provenance defect C7 exists to catch.

State, and what is actually needed

PR	draft: true, head 24ed6b97f unchanged, 11/11 workflow runs green
carriers	needs:contract-review re-hung on card #17516 and this PR
auto-merge	not armed
blocking	one at-tier (CONTRACT_REVIEW_TIER) clause-② verdict carrying Served-tier:, Implemented-by:, Reviewed-by:

⛔ The code is not in question — CI is fully green and the in-seat review found no defect. What is missing is a verdict with provenance this seat is not permitted to produce. Implemented-by: for that record is the branch claude/issue-17516-permission-set-collision-diagnostic (the dev was mode:subagent and has no session of its own).

⚠️ PR #18046 is held behind this one by the serial relay on scripts/engine-double-contract.pinned.json, so this park blocks that landing too.

---

Generated by Claude Code

[os-project-manager]

Contract review (independent, clause-② at tier)

Served-tier: claude-fable-5-1
Implemented-by: claude/issue-17516-permission-set-collision-diagnostic
Reviewed-by: session_01NiQpkfNDNyAJTx3CAhkdhi

Head reviewed: 24ed6b97ff660dd31517189dff2945cd1eb0918d (merge-base with origin/main = 226970bbea94b97e0d74de98dfa189a0d35faa9d; control tree = origin/main at fb29f62cee0cded64896f811621231544e4d9976).

Verdict: PASS for clause-②. The declaration Clause-②: yes on both carriers is correct: this head adds seven exported symbols reachable from the published entry and one new key on an already-published payload. The changeset grade (minor) matches. No accept/reject behaviour changed.

Provenance of this record

• Rendered by this session, commissioned by the domain:services execution seat (session_01URLHobLUJB9K1ABV6ofdjj, this session's parent) because that seat is served below tier. The dispatch states the maintainer authorised it directly; this session cannot verify that statement and records it as stated.
• Tier measured FIRST, via get_session with session_id omitted, and reported verbatim: session_context.model = claude-fable-5-1; external_metadata.last_served_model = claude-fable-5-1; configured_model = claude-fable-5-1. CONTRACT_REVIEW_TIER read from scripts/pm/dispatch-gates.mjs on origin/main = claude-fable-5-1. Equal, so the verdict below was rendered.
• Inputs: card [finding] A package's whole declared permission set is dropped on a set-name collision with no diagnostic and no build gate — the comment says "refuse loudly", the code warns through a doubly-optional logger #17516 and its 5 comments, PR fix(plugin-security): a permission-set name collision now reaches the author #18022 body and all 11 comments, the PR diff, and two worktrees outside any checkout (/home/user/wt/pr18022 at the head, /home/user/wt/main at origin/main), each installed and built (pnpm --filter '@objectstack/plugin-security...' build, exit 0 on both).

① Derived judgments: what is newly reachable on this head versus origin/main

Reachability was tested against the published entry: package.json exports["."] = types: ./dist/index.d.ts, import: ./dist/index.mjs, require: ./dist/index.js; files = dist, README.md, CHANGELOG.md. The re-export chain is explicit named re-exports in src/index.ts lines 63 to 74 (export { ... } from './permission-set-name-collision.js' and export type { ... } from ...); src/index.ts contains no export * on this head, so nothing is carried by wildcard. PermissionSeedOutcome is re-exported by name from ./permission-set-projection.js at src/index.ts line 86 on both trees.

Counts are grep -c -w over each built artifact. "export {}" is whether the identifier appears inside the file's final export { ... } list, which is the discriminating read for the JS bundles (module-private identifiers still occur in a bundle body).

symbol	kind	in src on origin/main	dist/index.d.ts head / main	dist/index.mjs head / main	in export {} head (d.ts / mjs)	newly reachable
PERMISSION_SET_NAME_COLLISION	value (const)	0 files	5 / 0	5 / 0	yes / yes	yes
permissionSetNameIsForeign	value (function)	0 files	3 / 0	3 / 0	yes / yes	yes
permissionSetNameCollisionDiagnostic	value (function)	0 files	3 / 0	3 / 0	yes / yes	yes
formatPermissionSetNameCollisionDiagnostic	value (function)	0 files	2 / 0	2 / 0	yes / yes	yes
reportPermissionSetNameCollisions	value (function)	0 files	3 / 0	4 / 0	yes / yes	yes
PermissionSetNameCollisionDiagnostic	type (interface)	0 files	6 / 0	n/a (type)	yes / n/a	yes
CollisionReportSink	type (interface)	0 files	3 / 0	n/a (type)	yes / n/a	yes
PermissionSeedOutcome.collisions?	new key on published payload	absent	key PRESENT / ABSENT (parsed from the interface PermissionSeedOutcome block)	n/a	payload exported on both trees	yes
POSITIVE CONTROL bootstrapDeclaredPermissions	value, published on both trees	1 file (index.ts:57)	7 / 6	7 / 7	yes / yes	control hits on both trees
NEGATIVE CONTROL SHIPPED_PLATFORM_BUCKET_NAMES	module-private const	defined, not exported	0 / 0	body 2 / 2, export {} no	no / no	control stays dark on both trees
NEGATIVE CONTROL defaultLookup	module-private function	defined, not exported	0 / 0	body 2 / 2, export {} no	no / no	control stays dark on both trees

Key set of PermissionSeedOutcome in dist/index.d.ts: head = seeded, updated, unchanged, unreadable, skippedEnvAuthored, skippedForeign, deleted, collisions; main = the same list without collisions. So limb (2) fires exactly once.

Accept/reject behaviour, read from the diff rather than the PR text:

• The skip is unchanged. The branch condition moved from existing.package_id === packageId to !permissionSetNameIsForeign(existing.package_id, packageId), whose body is (owner ?? null) !== (declaring ?? null). At that call site packageId is always a non-empty string (the if (!packageId) return out; guard precedes it), so the two spellings are truth-table identical for every existing.package_id value (undefined, null, equal string, different string). skippedForeign has no added or removed line.
• What changed is reporting only: a console-backed default sink when no logger is injected, and the diagnostic records on the outcome. Neither alters what is accepted, refused, written, or returned to a wire caller. The ADR-0086 P2 publish materializer's existing failure text is untouched.
• The new token is stamped as event, not code, so no ADR-0112 error-code vocabulary is widened.

② Semver grade

.changeset/17516-permission-set-collision-diagnostic.md declares "@objectstack/plugin-security": minor. Seven new reachable exports plus one new optional payload key is an additive widening; minor is the floor AGENTS.md sets for a Clause-②: yes PR and is the correct grade here. Not patch, not major (nothing removed or narrowed).

③ Boundary flags

• Lane fence (compile-time door, os build / os validate, packages/cli): stopped, nothing pushed, routed to cli: os build / os validate should report a permission-set name collision — the runtime door landed in #17516, the compile door is the other half of #14553’s shape #18024 (open, domain:cli, priority:p3). Correct disposition; the exports above are what cli: os build / os validate should report a permission-set name collision — the runtime door landed in #17516, the compile door is the other half of #14553’s shape #18024 is told to consume.
• Out-of-scope sibling (bootstrap-declared-capabilities.ts, same doubly-optional logger): filed as [finding] A package's whole declared capability is dropped on a name collision with no diagnostic — the same doubly-optional logger as #17516, one axis over #18023 (open, domain:services, pm:blocked on this card). Correct: separate record type and outcome key.
• open_questions: [] on both os-dev-report comments. Nothing outstanding.
• packages/spec: zero files in the 9-file diff. Verified with git diff --stat 226970bbea94 24ed6b97ff66.

What this record does NOT decide

• Clause-② only. Wire compatibility, code quality, and the earlier in-seat reviews' other findings are not re-adjudicated here.
• CI on this head was READ from the check-runs API at review time, not re-run: Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL) all completed / success. The full Lint & Repo Gates step sequence was NOT MEASURED locally.
• Labels, draft state, auto-merge, and landing are untouched by this session; they are the seat's.

Commands run

get_session   (session_id omitted)   -> session_context.model / external_metadata.last_served_model / configured_model, all claude-fable-5-1
grep -n CONTRACT_REVIEW_TIER scripts/pm/dispatch-gates.mjs   -> 'claude-fable-5-1'
git fetch origin main 24ed6b97ff660dd31517189dff2945cd1eb0918d
git worktree add --detach /home/user/wt/pr18022 24ed6b97ff660dd31517189dff2945cd1eb0918d
git worktree add --detach /home/user/wt/main origin/main
git merge-base origin/main 24ed6b97ff660dd31517189dff2945cd1eb0918d   -> 226970bbea94b97e0d74de98dfa189a0d35faa9d
git diff --stat 226970bbea94 24ed6b97ff66                              -> 9 files, +694 / -9, none under packages/spec
git diff origin/main 24ed6b97ff66 -- packages/plugins/plugin-security/package.json   -> empty
git diff origin/main 24ed6b97ff66 -- packages/plugins/plugin-security/src/index.ts   -> the 17 added re-export lines only
git grep -c -w SYMBOL origin/main -- packages/plugins/plugin-security/src            -> 0 files for each of the 7 (SYMBOL = each name in the table)
git show 24ed6b97ff66:packages/plugins/plugin-security/src/index.ts | grep -n 'export \*'   -> no output
(in each worktree) pnpm install --frozen-lockfile && pnpm --filter '@objectstack/plugin-security...' build   -> exit 0
(in each worktree) probe: grep -c -w over dist/index.d.ts, dist/index.mjs, dist/index.js; export-list and PermissionSeedOutcome key parse via node
(in /home/user/wt/main) node scripts/pm/check-clause2-carriers.mjs --pair 18022   -> exit 0, both carriers agree; note: claim comment 5652942907 carries no Session: line (ATTRIBUTION NOT VERIFIED, pre-existing)
(in /home/user/wt/pr18022) pnpm --filter @objectstack/plugin-security test ; pnpm --filter @objectstack/plugin-security typecheck   -> see line below

At the head, in the fresh worktree: pnpm --filter @objectstack/plugin-security test = 112 files passed, 2157 tests passed, 0 failures, exit 0. pnpm --filter @objectstack/plugin-security typecheck = exit 0 (all three legs).

---

Generated by Claude Code

[os-project-manager]

Carrier cleared on both carriers — provenance

Record cited: 5656684087 — Verdict: PASS, rendered at CONTRACT_REVIEW_TIER by session_01NiQpkfNDNyAJTx3CAhkdhi, naming head 24ed6b97ff660dd31517189dff2945cd1eb0918d — the PR's current head, so the binding is live.

Served-tier: claude-fable-5-1
Implemented-by: claude/issue-17516-permission-set-collision-diagnostic
Reviewed-by: session_01NiQpkfNDNyAJTx3CAhkdhi

Commissioned under the maintainer's ruling of 2026-09-13T22:2xZ, 「你可以直接派fable复核」, which authorises this seat to commission a contract-review-tier verdict directly. ⚠️ It was rendered by a separate session, not an in-session subagent: model: fable on a subagent is a dispatch parameter — the very thing C7 refuses — and get_session stamps the session rather than the subagent thread (measured: such a subagent read back claude-opus-5).

carrier	before	after
card #17516	bug, domain:services, needs:contract-review, pm:awaiting-maintainer, priority:p2	bug, domain:services, pm:awaiting-maintainer, priority:p2
PR #18022	documentation, needs:contract-review, size/l, tests, tooling	documentation, size/l, tests, tooling

The gate, run on BOTH sides of the strip

scripts/pm/check-clause2-carriers.mjs --pair 18022, exit captured before any pipe, from a worktree at origin/main:

when	exit
before the strip	0
after the strip — the landing gate	0

⭐ Running it twice is the point. On the earlier attempt this same command read 0 before and 4 after, because rows C4 and C7 judge the verdict the clear stands on — a pre-check alone cannot surface them. Both rows are now satisfied by the record above: the authorship pair is complete, and Served-tier: reads claude-fable-5-1 exactly.

Landing state

• check-governed-merges.mjs --pr 18022 → 0 of 9 paths hit the register ⇒ NOT governed; ordinary queue landing applies.
• CI at the head: 14 workflow runs, 11 distinct workflow names (= the open-PR reference), 0 non-green, 0 incomplete.
• ⛔ pm:awaiting-maintainer is deliberately left on card [finding] A package's whole declared permission set is dropped on a set-name collision with no diagnostic and no build gate — the comment says "refuse loudly", the code warns through a doubly-optional logger #17516 — 「本态无机器出口:维护者完成后由总监席核验摘标」. That is the director seat's to strip, ⛔ not this seat's.

⚠️ PR #18046 holds the second baton of the serial relay on scripts/engine-double-contract.pinned.json and lands only after this PR merges and main's ledger reads 1492.

---

Generated by Claude Code