fix(verify, plugin-dev, plugin-hono-server): the verify --rls report, tenancy refusals and no-API warning state each decision in words instead of a tracker number (stage 4)

[objectstack-fleet]

Part of #20752
Clause-②: no

Stage 4 of 5 of the domain:cli lane under the maintainer's A / A ruling (5902360492): the packages/verify, plugin-dev and plugin-hono-server strings. The card stays open for stage 5 (qa), so this PR carries no closing keyword. Text only: no status, error code, exit code, route, field, export, control flow, or verify verdict or count moves.

What this does

The objectstack verify --rls report, its persona-provisioning refusals and the records its probe writes, the verify harness's organizations remedy, the dev plugin's tenancy refusals and no-auth warning, and the Hono server's no-API warning sent the reader to a tracker number for the reason behind them. In form D, as stages 1 to 3 applied it (PR #21172, PR #21188, PR #21219), the number goes. Where the sentence already said what was decided, only the citation goes. Where it leaned on the number, it now says the decision in words.

All 14 ledgered occurrences in the claim's four files (claim 5938321786), at 13 string sites: rls.ts 9 (1994 x3, 7685 x3, 7978 x3), dev-plugin.ts 3 (4818 x2, 3963 x1), harness.ts 1 (4719), hono-plugin.ts 1 (4073). Every cited card was read first; all seven answer, and each decision was cross-read against its landing commit.

Rewritten in words

Where (head line)	Cited	The text now says	Decision read from
rls.ts:908 report header	1994	=== objectstack verify (RLS / cross-owner by-id-write invariant) — APP ===	card 1994 (a by-id update or delete must pass the row-level write filter: a member can no longer change a record it cannot see), and this module's header, which names that invariant
rls.ts:768 rls-hole detail	1994	"...by-id write bypassed RLS, and a caller that cannot read a record must not be able to write it"	card 1994; the module header's "A user who CANNOT READ a record must not be able to WRITE it"
rls.ts:431 probe-persona refusal	1994	"...masked by the object gate and a by-id write that bypasses RLS is unreachable."	card 1994 for the class; the 7685 half is citation-only (below)
rls.ts:943 position-persona report line	7978	── position personas (each holds one declared position and nothing else) — N of M declared position(s) probed	card 7978 and landing commit f5434b0ea4 (one persona per declared position, each holding that position and nothing else)
dev-plugin.ts:934-935 no-auth warning	3963	"...anonymous access to object data is always denied, with no setting that turns that off."	card 3963 decision A1 and landing commit 3c628ce647 (the api.requireAuth opt-out is retired; anonymous data access is denied unconditionally); stage 1's twin wording in os serve

Citation only (the sentence already stated the decision)

• rls.ts:357 probe RLS policy description and rls.ts:464 probe sys_permission_set description (7685): each already says the probe holds object read+edit plus an owner-scoped narrowing so a refusal is the record gate's. Read from card 7685 item (i) and landing commit be37f859bc. The 7685 citation at rls.ts:431 goes the same way.
• rls.ts:553 position-persona refusal and rls.ts:575 sys_user_position reason (7978): each already says position-gated policies only apply to a persona holding the position.
• dev-plugin.ts:874 construct-stage refusal and dev-plugin.ts:1000 init-stage refusal (4818): each already says OS_ALLOW_DEGRADED_TENANCY covers an absent multi-org runtime, not a present one that declined. Read from card 4818 and landing commit 29326f8eea; stage 1 dropped the twin citation in os serve the same way.
• harness.ts:626 bootStack remedy (4719): it already says the app's declaration is what is checked and that a package reachable only through NODE_PATH or a hoisted store is not accepted. Read from card 4719 and landing commit 02dc076927.
• hono-plugin.ts:683 no-API boot warning (4073): it already says the plugin is a transport adapter that serves neither API. Read from card 4073 and landing commit e5a4d26901.

The rls.ts report header was on the ledger, so it is rewritten to name the invariant it proves rather than losing its anchor.

Text only, proven on the AST

A scratch script (not committed) parses each changed TypeScript file at BASE 7c5a311a58 and at head 36281b515a, folds every + chain made only of string literals into one value, blanks every string value and template span, and compares the remaining node sequence (kinds, identifiers, numerals). Result: identical skeleton in all six files, string-value counts equal (dev-plugin 220, hono-plugin 126, harness 117, rls 212, the two tests 105 and 24), and 15 changed values, each of them prose: 2 description: values, 1 reason:, 1 detail:, 2 report lines, 4 new Error messages, 2 logger warn messages, 1 remedy string, and the 2 test assertions. The later merge of origin/main touches none of these files.

The dev plugin's no-auth warning first gained a fifth literal; commit 03a490204b re-wrapped the sentence across the original four so the skeleton stays equal.

The ledger

node scripts/check-doc-authoring.mjs --census-ledger, written to a scratch file first so its no-growth check reads the committed baseline, then installed:

	occurrences	(file, id) pairs	files
the four rows before	14	7	4
the four rows after	0	0	0
whole ledger before (7c5a311a58, also d6d6e872e5)	399	279	107
whole ledger after	385	272	103

15 lines deleted, 0 added; every other row is byte-identical. After merging origin/main (d6d6e872e5) the recomputed ledger is byte-identical to the committed one. pnpm check:doc-authoring: before "338 pinned site(s) across 107 file(s) ... no growth, no burn-down unrecorded", after "325 pinned site(s) across 103 file(s) ... no growth, no burn-down unrecorded".

Pins, and that they can fail

Two tests asserted an id. Each now asserts the words that carry the decision, and each was ablated through scripts/ablation-replace.mjs on the committed fix (anchor must hit once, blob must change, restore proven by blob equal to HEAD and an empty git diff HEAD). Both tests import the source by relative path, so no build sits between the mutation and the run.

Pin	Asserts now	Ablation	Result
plugin-dev/src/dev-plugin-optional-load-failure.test.ts:283	"always denied, with no setting that turns that off"	"turns that off" to "turns that on" in dev-plugin.ts	1 failed / 9 passed
plugin-hono-server/src/hono-transport-only.test.ts:92	"transport adapter and serves neither"	"serves neither" to "serves nothing" in hono-plugin.ts	1 failed / 4 passed

Restored, the two files run 10 passed and 5 passed.

No other pin asserts any of the old strings: the whole repository was searched (packages/** including qa and dogfood, examples, docs/qa/**, snapshots and JSON). The dogfood RLS suites print formatRlsReport only as an assertion message, and docs/qa/platform-checklist/RUNNER.md quotes the summary lines and N of M declared position(s) probed, which are unchanged.

What ships

Measured on the built dist/ of each package: every rewritten sentence is present (in both the ESM and CJS bundles) and no old spelling is. All three packages publish dist, so the changeset carries patch for @objectstack/verify, @objectstack/plugin-dev and @objectstack/plugin-hono-server.

Verification (head 36281b515a, after merging origin/main d6d6e872e5)

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-20752-s4); each verdict line reads VERDICT command-exit 0 unless stated.

• Build: pnpm turbo run build over the three packages and their dependency closures, 38/38 tasks.
• Tests: @objectstack/plugin-hono-server 27 files / 324 tests, @objectstack/plugin-dev 9 / 86, @objectstack/verify 16 / 120, all passed (before and after the merge). The dogfood RLS runner oracle (packages/qa/dogfood/test/rls-runner.test.ts, which drives the rls-hole path against the rebuilt @objectstack/verify dist): 17 passed.
• Typecheck: typecheck of all three packages, each tsc --noEmit plus check:test-typecheck (the test layer, the two pins included) OK.
• Gates: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 71 commands; all 71 run with exit codes recorded; --ran reconciliation: "71 derived famil(ies) accounted for — 71 run, 0 NOT-MEASURED". check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3, no dist for unrelated packages); after a full workspace build (72/72 tasks, 71 cached) it passed and that rerun is the recorded result.
• Lint, a proven narrowing: eslint's own config places 6 of the 8 changed paths in its population (isPathIgnored false and a matching config object; the changeset and the JSON ledger are outside it). --no-inline-config with the json formatter: 6 file results, 0 errors, 0 warnings. Invariance: this repo's config enables no type-aware linting (eslint.config.mjs, the note at lines 326-328) and its only disk reads are two baselines this diff does not touch, so no untouched file's verdict can move. The full pnpm lint is CI's.

Acceptance notes

• The seat's staging comment (5930275362) listed a dead tracker number in the plugin-dev test title dev-plugin-security-enforcement-warning.test.ts:121 for this stage. Claim 5938321786 names four files and not that one, and a test title is not on the ledger, so it is not touched here. Carrier: the seat, when it stages what remains.
• Code comments in the same four files still cite these cards. They are not on the ledger, and the claim keeps them out of scope.
• packages/qa/dogfood/test/enterprise-organizations.ts:184 carries the 4719 twin of the harness remedy. It sits in the qa row, which stage 5 owns.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/plugin-dev, @objectstack/plugin-hono-server, @objectstack/verify, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/services-checklist.mdx (via DevPlugin (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via bootStack (symbol, a top-level function))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 62b90d74f757dbdd413780819bae54915af5a149 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from adde1dd1cfb4d4dd06a639961047bca5c1fc1e76 — the merge of head 36281b515a9f3c2ada618809dd3578694407e15a into base 62b90d74f757dbdd413780819bae54915af5a149, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin adde1dd1cfb4d4dd06a639961047bca5c1fc1e76 && git checkout adde1dd1cfb4d4dd06a639961047bca5c1fc1e76
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 62b90d74f757dbdd413780819bae54915af5a149 36281b515a9f3c2ada618809dd3578694407e15a && git checkout -B drift-repro 62b90d74f757dbdd413780819bae54915af5a149 && git merge --no-ff 36281b515a9f3c2ada618809dd3578694407e15a

node scripts/docs-audit/affected-docs.mjs --json 62b90d74f757dbdd413780819bae54915af5a149

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 62b90d74f757dbdd413780819bae54915af5a149 → pass the list as
args.docs, on the commit named under Which tree this was computed on.