[objectstack-fleet]

Requested by Sales · project thread

Part of #25467
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6270097840

Cut 5 of the protocol.ts split (#24586 ruling A, recorded in 6270097840). Cuts 1–4 landed as #25494, #25518, #25538 and #25589. The claim is 6379699184; the seat agreed the scope before it, and its two pre-claim conditions (the .d.ts on the trial build, the governed-surface predicate) are answered in the claim and below.

Sixteen PRIVATE ObjectStackProtocolImplementation methods, the lock gate and the optimistic-concurrency write addresses, move unedited into a new module, packages/metadata-protocol/src/protocol-lock-version-gates.ts, with the two declarations only they read. On base ba6912c1ad that is 278 body lines, 122 of them from the last 30 days.

It is move-only, and the card stays open for the later cuts. Branch: claude/project-thread-uasfag, the harness-pinned branch for this session, restarted from origin/main at ba6912c1ad after cut 4 merged. The branch names no issue, so the claim comment is the identity record.

Release freeze. Sales paused merges at 03:57Z for a release. This PR is opened as a draft and is not readied, armed or queued until the coordinator says merges resume.

Serial with the file's in-flight PRs. Measured just before this PR was opened, on main a57643d3de. None of the 11 open PRs touches protocol.ts, protocol-lock-version-gates.ts or the bracketed-refusal pin (each PR's diff read against its merge base), and git merge-tree of this head with each of them, and with main, is clean. origin/main has not touched packages/metadata-protocol since this branch's base ba6912c1ad.

What moves

Method	Base line	Tokens
getEffectiveLock	:17113	115
readLockGateOverlayLayer	:17150	66
recordMetadataAudit	:17259	230
lockWriteRefusal	:17338	263
assertLockAllowsWrite	:17396	84
assertLockAllowsDelete	:17416	242
storedHashDigest	:17520	42
receiptVersion	:17532	21
storedHeadAt	:17559	68
readVersionToken	:17598	175
packagelessReadAddress	:17635	46
strictDraftReadAddress	:17661	82
packagelessDraftAddress	:17798	256
storedParentForToken	:17839	86
metadataConflictRefusal	:17879	209
recordPendingDenialAudit	:17966	73

All sixteen are private, so none is on the series' skip list of public members with inferred return types.

Stay in the class, beside the moved methods:

• recordOptimisticConflictAudit and the static optimisticConflictAuditEntry. The first reads a private static, which a module function cannot reach (TS2341; ruling 6364006498 precedent).
• packagelessAddress, narrowed out during the trial, before the claim.
  • scripts/check-durability-degradation-log-level.mjs's read-seam rule follows its findEnvironmentRows read. It also follows the four callers that guard it inside protocol.ts: applyObjectRegistryMutation, deleteMetaItem, deletePackage and loadMetaFromDb.
  • Moved, the rule's census dropped from 83 read seams to 79. Kept, the seam list is identical at both ends. The moved bodies call it through the protocol, as a host closure.

The shape (#23050 shape B, as cuts 1–4 apply it)

• The class keeps every method with its name, docblock, signature and position, less async. Each body is now one host literal plus fn.call(host, …), marked [#25467 cut 5].
• Typing. LockVersionGateHost types every member as the class member itself (ObjectStackProtocolImplementation['m']). Each moved function types its this as the Pick of the host over exactly the members its body reads, measured by AST. Each stub annotates its literal as ThisParameterType<typeof fn>. There is no cast, and no member becomes public or protected.
• Members read, measured by AST:
  • The field engine, as a getter, so each read happens when the body makes it.
  • These methods, as late-bound closures ((...a) => this.m(...a)): artifactLockLayerAt, getEffectiveLock, getOverlayRepo, lockWriteRefusal, overlayLockLayerAt, packagelessAddress, packagelessDraftAddress, readLockGateOverlayLayer, receiptVersion, recordMetadataAudit, rethrowUnlessMetadataStoreUnprovisioned, storedHashDigest and storedHeadAt. A spy or double set on the instance (for example protocol.delete-rewrap-envelope.test.ts's wrapper around assertLockAllowsDelete) is still the one the body reaches.
  • No field is assigned, and the host carries no elevation member. The bodies that read as the system build their own { isSystem: true } context, exactly as before.

Module-level declarations, by reader

Each declaration the moved bodies read was checked by an AST walk over the whole of base protocol.ts. The walk finds every identifier reference outside the declaration itself and takes the transitive closure over the moved set.

Move with the bodies, byte-identical and unexported. Each has 0 readers outside the moved code and carries exactly its own docblock:

Declaration	Base line	Readers
InboundVersionConflictError (class)	:3679	storedParentForToken (throws it), metadataConflictRefusal (instanceof). One stub docblock that stays names it in {@link} prose.
ErrorWithPendingAudit (type)	:6192	moved bodies only

There is still exactly one class, so the instanceof check meets the same constructor the throw uses.

Stay in protocol.ts and gain export in place, the only edit to each:

Declaration	Read by code that stays
canonicalMetaType (:417)	canonicalizeMetaRequestType, governServedItem, stripServedSystemColumns, bundleMemberOf
MetadataAuditEntry (:6164)	withPendingAudit, optimisticConflictAuditEntry

src/index.ts exports from ./protocol.js by name, so neither is published (measured below). No import of protocol.ts loses its last reader. protocol.ts gains one statement, the import of the new module.

The published .d.ts

Under the series bar (ruling 6348891160), measured last, on the final layout, at base ba6912c1ad and at head. This is the first cut that moves a class and a type, and the seat asked for this reading before the claim. Both ends were built with pnpm --filter @objectstack/metadata-protocol build against the same dependency tree (turbo run build --filter='@objectstack/metadata-protocol^...' at base first).

• Raw sha256 of dist/index.d.ts and dist/index.d.cts: 25da084d43455d125bfd41b85b1e70477ef7caf77f2cb7da23143b325e51a14e at base and at head, both files, 770,690 bytes each. That is raw identity:
  • neither moved declaration prints anywhere new;
  • canonicalMetaType's docblock does not splice onto a neighbour once it gains export;
  • the one stub docblock that names InboundVersionConflictError in {@link} prose prints byte-identical.
• Normalised sha256, base and head: ff7d6892b9f1161da356208d51301816c48dc021051544b9c28a3aa14329d57e. The normaliser, run from packages/metadata-protocol:

node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]*"(?:\s*\|\s*"[^"\n]*")+/g,r=>r.split(/\s*\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum

• Positive control on a copy of the head dist/index.d.ts: making line 1361, private engine;, public (engine;) gives raw 4bea7ae0… and normalised be016197…. Both differ from the real hashes.
• Export tables. The ESM and CJS bundles each export the same 78 names at base and head, loaded at runtime (import() and require of the built bundles). The sorted list hashes e47ac7c753bcb8bee1e79c1a5f79f7394cf030bd526de81ea8bcbfcb71fa024a on all four, as at cuts 1–4. None of canonicalMetaType, MetadataAuditEntry or InboundVersionConflictError appears.

No changeset: skip-changeset, per ruling 6348891160.

Proof of move-only

• Bodies and declarations, by AST token (recursive getChildren leaves). For each moved function, the parameters (less the added this), return type and body have the same token sequence as the base method. Each moved declaration has the same tokens, and its own docblock is byte-identical. 2,139 tokens compared, 0 differ. Negative control: one changed token makes the check report a difference.
• Class side. The class has 299 members at base and at head. The 283 that did not move are byte-identical to base, and each of the 16 stubs keeps its docblock and signature byte-identical, less async.
• Top level of protocol.ts. 240 of the 244 base statements other than the class are byte-identical with their leading comments. The other 4 are the 2 moved declarations and the 2 that gain export. The one new statement is the import of the new module.
• Size. +674 / −294 over 3 files, 968 changed lines. protocol.ts goes from 30,718 to 30,548 lines, and protocol-lock-version-gates.ts has 547.

Readers of the moved lines

• Bracketed-refusal pin (protocol.bracketed-refusal-opener-absence.test.ts, PRODUCERS). 4 new Error( sites move, so protocol.ts goes 87 → 83 against its floor of 5. The new module is listed with its measured count as its floor, 'protocol-lock-version-gates.ts': 4, as cut 3 listed its module. That is the only edit outside the move. No moved site opens with a bracketed tag.
• Durability checker (check-durability-degradation-log-level). It gives identical output at both ends, with packagelessAddress kept (above).
• ADR anchors and decision letters. check:adr-anchors: 84 → 84 anchored files. Decision-letter citations on the anchored surface go 1,883 → 1,882, measured exactly at both ends.
  • The one that leaves is an ADR-0110 D3 comment citation in readLockGateOverlayLayer's body.
  • protocol.ts's anchor entry governs ADR-0005/0029/0087/0119/0126. None of its paragraphs describes these bodies, so the new module gets no entry.
• Identical output at both ends: check-adr-symbol-anchors, check-platform-checklist (protocol.ts# anchors on the moved methods resolve on the shells, which stay; not edited), check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet (no counted site moves; no file key added), and spec check-liveness.
• Engine-double contract. check-engine-double-contract differs only in the line numbers of the updateData/deleteData seams in protocol.ts, plus productionFiles +1 (the new file).
• Governed surface. check-governed-merges --branch on the final 3-path list: NOT governed. 968 changed lines, under the 3,000-line human-merge bar.
• Path readers. Files that name protocol.ts next to a moved method name (protocol.delete-rewrap-envelope.test.ts, protocol.lifecycle-audit-rows.test.ts, sys-metadata-repository.package-writability.test.ts, objectql protocol-publish-canonical-fold.test.ts, the durability checker's comment table) name it in prose or spy on the instance. None reads the moved lines by path, and all pass.

Verification

• tsc --noEmit (package) exit 0. eslint on protocol.ts and protocol-lock-version-gates.ts exit 0.
• packages/metadata-protocol suite, base and head, compared per test name and status. Base ba6912c1ad: 21,489 tests (21,470 passed, 0 failed, 19 skipped), 266 files. Head: 21,490 (21,471 passed, 0 failed, 19 skipped), 266 files. None lost, none changed status, one added: the new PRODUCERS row, protocol-lock-version-gates.ts raises no message opening with a bracketed lowercase tag (passed).
• Tests outside the package that read protocol.ts by path or name these methods, run at head, all pass:
  • core row-serving-door-exposure.pin and second-object-read-exposure.pin (7, at both ends);
  • objectql core-boundary.ratchet and protocol-publish-canonical-fold (12);
  • spec metadata-type-registry-allow-org-override-absence and scripts/liveness/evidence (44);
  • client and rest discovery-double-retired-key (3 + 2).
• Hand gates at base and head, all exit 0, identical output except the letter count above: check-adr-anchors, check-adr-symbol-anchors, check-platform-checklist, check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet, check-durability-degradation-log-level, and spec check-liveness.
• Derived gates. dispatch-gates --commands --changed derives 59 gates on the final tree (3 changed paths). All 59 exit 0 at head, and --ran reconciles 59 of 59 with 0 NOT-MEASURED. check-adr-symbol-anchors, check-liveness and the durability checker's full run are not derived and were run by hand (above). The full list and the --ran reconcile are in the report on this PR.

Carry-forward

These stay in protocol.ts in this series:

• Public members whose return type is inferred. Annotating the type would be a signature edit and needs a ruling. Later cuts skip getDiscovery, getMetaTypes, getMetaItems, getMetaItemsForExecution, getMetaItem, getMetaItemForExecution, getUiView, findData, getData, validateData, createData, cloneData, updateData, deleteData and saveMetaItem.
• Bodies kept by a reader:
  • probeRecord (per-file erasure-baseline site);
  • getMetaItemCached (the Three read-side /meta verbs (history, audit, references) never reach canonicalizeMetaRequestType — they still derive their key from the MANIFEST map #9157 pin reads its body by path);
  • packagelessAddress (the durability read-seam census, this cut).
• Private-static readers.

The inferred-return .d.ts still depends on protocol.ts byte offsets (cut 3's series note), so each cut measures it last.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J8pUyVs5eas1AjMdReJM7C

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 48 documentable anchor(s).

18 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 9f390945ebbf34696f71806d0247df47cfeaef1c.

⛔ 9 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 7 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9f390945ebbf34696f71806d0247df47cfeaef1c → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 40da60d9e314ba5bcf1cc856ad584ce828e6ccba — the merge of head 11a1c9186be16f3c881d7221f7d3efeda7b20fbd into base 9f390945ebbf34696f71806d0247df47cfeaef1c, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 40da60d9e314ba5bcf1cc856ad584ce828e6ccba && git checkout 40da60d9e314ba5bcf1cc856ad584ce828e6ccba
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9f390945ebbf34696f71806d0247df47cfeaef1c 11a1c9186be16f3c881d7221f7d3efeda7b20fbd && git checkout -B drift-repro 9f390945ebbf34696f71806d0247df47cfeaef1c && git merge --no-ff 11a1c9186be16f3c881d7221f7d3efeda7b20fbd

node scripts/docs-audit/affected-docs.mjs --json 9f390945ebbf34696f71806d0247df47cfeaef1c

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 9f390945ebbf34696f71806d0247df47cfeaef1c → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-uasfag",
"pr": "#25601",
"session": "session_01J8pUyVs5eas1AjMdReJM7C — this run's harness-stamped id, on the Claude-Session: trailer of the commit on the branch",
"premise_still_valid": true,
"summary": "Cut 5 of the protocol.ts split (#24586 ruling A, 6270097840; d.ts bar 6348891160). Claim 6379699184, scope agreed with the seat before it, and its two pre-claim conditions (the d.ts on the trial build, because this cut moves a class and a type; check-governed-merges on the file list) were measured and put in the claim. Sixteen PRIVATE methods (getEffectiveLock, readLockGateOverlayLayer, recordMetadataAudit, lockWriteRefusal, assertLockAllowsWrite, assertLockAllowsDelete, storedHashDigest, receiptVersion, storedHeadAt, readVersionToken, packagelessReadAddress, strictDraftReadAddress, packagelessDraftAddress, storedParentForToken, metadataConflictRefusal, recordPendingDenialAudit) moved unedited to packages/metadata-protocol/src/protocol-lock-version-gates.ts (host LockVersionGateHost: engine as a getter, 13 methods as late-bound closures, nothing assigned, no elevation member). ErrorWithPendingAudit (type) and InboundVersionConflictError (class; one throw and one instanceof, both moved) moved byte-identical with 0 outside readers; canonicalMetaType and MetadataAuditEntry gained export in place (index.ts names its exports, neither published). Stay: recordOptimisticConflictAudit (private-static reader) and the static optimisticConflictAuditEntry; packagelessAddress, narrowed out in the trial before the claim, because check-durability-degradation-log-level's read-seam rule follows its findEnvironmentRows read and 4 in-file callers (83 seams moved vs 79; kept, the seam list is identical). PRODUCERS row 'protocol-lock-version-gates.ts': 4 (protocol.ts 87 to 83). Serial rule: no open PR touched these files at claim or at pr_create; merge-tree clean with all 11 and with main a57643d. Release freeze (Sales 03:57Z): opened as a draft, not readied, armed or queued. No open question.",
"tests": "pnpm --filter @objectstack/metadata-protocol vitest run (JSON reporter) under os-verify-lock. Base ba6912c: 21,489 tests (21,470 passed, 0 failed, 19 skipped), 266 files. Head 11a1c91: 21,490 (21,471 passed, 0 failed, 19 skipped), 266 files. Compared per test name and status: 0 lost, 0 changed, 1 added (the new PRODUCERS row, protocol-lock-version-gates.ts raises no message opening with a bracketed lowercase tag, passed). Move-only, so no ablation. Package tsc --noEmit exit 0; eslint on protocol.ts and protocol-lock-version-gates.ts exit 0. Out-of-package tests that read protocol.ts by path or name these methods, at head, all pass: core row-serving-door-exposure.pin and second-object-read-exposure.pin (7, at base and head), objectql core-boundary.ratchet and protocol-publish-canonical-fold (12), spec metadata-type-registry-allow-org-override-absence and scripts/liveness/evidence (44), client and rest discovery-double-retired-key (3 + 2). Move proof against base ba6912c: each moved function's parameters (less the added this), return type and body have the same AST leaf-token sequence as the base method; each moved declaration has the same tokens and its own docblock byte-identical (one leading-trivia block each); 2,139 tokens compared, 0 differ. Negative control: one changed token fails the check. Class: 299 members both ends, 283 byte-identical, 16 stubs keep docblock and signature byte-identical less async. Top level: 240 of 244 base statements byte-identical with leading comments; the other 4 are 2 moved and 2 export added; one new statement (the module import). +674 / -294 over 3 files (968 changed lines); protocol.ts 30,718 to 30,548 lines, the module 547.",
"dts_block": {
"files": "packages/metadata-protocol dist/index.d.ts and dist/index.d.cts; base ba6912c built with turbo run build --filter='@objectstack/metadata-protocol^...' then pnpm --filter @objectstack/metadata-protocol build; head 11a1c91 (tree identical to the measured trial commit 127d460817) built with the same command against the same dependency tree",
"raw_sha256": "base index.d.ts and index.d.cts 25da084d43455d125bfd41b85b1e70477ef7caf77f2cb7da23143b325e51a14e · head index.d.ts and index.d.cts 25da084d43455d125bfd41b85b1e70477ef7caf77f2cb7da23143b325e51a14e",
"normalised_sha256": "base ff7d6892b9f1161da356208d51301816c48dc021051544b9c28a3aa14329d57e · head ff7d6892b9f1161da356208d51301816c48dc021051544b9c28a3aa14329d57e (both files, both sides)",
"normaliser": "node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]"(?:\s\|\s*"[^"\n]")+/g,r=>r.split(/\s\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum",
"raw_diff_lines": 0,
"raw_diff": "none: raw identity, 770,690 bytes both sides. The moved class and type print nowhere new; canonicalMetaType's docblock does not splice once it gains export; the stub docblock naming InboundVersionConflictError in {@link} prose prints byte-identical.",
"positive_control": "head index.d.ts line 1361, private engine; made public (engine;): raw 4bea7ae08e75e20ca2c256fb3a3110a9dda7285cbd72bb0b12650c1395c73c2c, normalised be0161971853121da3a941ad8936c6de5bdea6ad91bf0cc6072ded0c27054a58, both different from the real hashes.",
"exports": "ESM and CJS bundles loaded at runtime: 78 names each at base and head; sorted-list sha256 e47ac7c753bcb8bee1e79c1a5f79f7394cf030bd526de81ea8bcbfcb71fa024a on all four, as at cuts 1-4; none of canonicalMetaType, MetadataAuditEntry, InboundVersionConflictError appears.",
"note": "No changeset (skip-changeset), per 6348891160."
},
"adr_anchor_block": {
"gate": "node scripts/check-adr-symbol-anchors.mjs at base ba6912c and head, exit 0 at both with identical output.",
"adr_anchors": "pnpm check:adr-anchors exit 0 at base and head; anchored files 84 to 84; decision-letter citations on the anchored surface 1,883 to 1,882, measured at both ends. The one that leaves is an ADR-0110 D3 comment citation inside readLockGateOverlayLayer's moved body. No entry added: protocol.ts's anchor entry governs ADR-0005/0029/0087/0119/0126 and none of its paragraphs describes these bodies."
},
"gates": "Local on the final head 11a1c91: dispatch-gates --commands --changed derives 59 commands (3 changed paths), each run with its exit captured; all 59 exit 0. --ran: 59 derived, 59 run, 0 NOT-MEASURED (a derived zero). Run by hand, not derived, at base ba6912c and head, all exit 0 with identical output except the letter count above: check-adr-symbol-anchors, check:adr-anchors, check-platform-checklist (protocol.ts# anchors on the moved methods resolve on the shells; not edited), check-tenant-audit-census, check-system-context-census, check-query-options-erasure-ratchet (no counted site moves, no file key added), spec check-liveness, check-durability-degradation-log-level (read-seam list identical with packagelessAddress kept). check-engine-double-contract exit 0 at both; it differs only in the updateData/deleteData seam line numbers and productionFiles +1. check-governed-merges --branch on the final 3-path list: NOT governed, 968 lines. Bracketed-refusal PRODUCERS: new Error( in protocol.ts 87 to 83 (floor 5), new module row 4 = its measured count. CI on head 11a1c91: 46 check runs, 34 success, 12 skipped by their own filters, 0 failed or pending; mergeable_state clean. Success: Auto Label, Build Core, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Regression Gate, filter, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Test Core, Test Core (1/6) to (6/6), The card this PR closes must claim this branch, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check. Skipped: 18.x upgrade harness (opt-in) x2, Auto Label (second run), Build Docs, Check Changeset (second run), Check PR Size (second run), Console Pin Gate, the sharded Dogfood Regression Gate matrix, Dogfood Verify CLI, Packed-tarball smoke (opt-in) x2, Temporal Conformance (live PG + MySQL).",
"docs_drift": "Advisory. Re-derived with node scripts/docs-audit/affected-docs.mjs --json ba6912c on the head: 27 docs plus 9 release-owned from 48 anchors, reached through literals inside the moved bodies and names the move relocated: sys_metadata (26), ITEM_LOCKED (3), ObjectStackProtocolImplementation (3), METADATA_CONFLICT (2), sys_metadata_audit (2), getOverlayRepo (host member, 2), and fewer. Every method keeps its name, signature, docblock and behaviour and every literal moved unedited, so no page goes stale. No page reads the moved lines by path. Bot comment 6379902161.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "No MCP write tool. GitHub reads through gh api GET (open PRs, PR state, check runs, comments). Also claude-code-remote subscribe_pr_activity on #25601 (a session subscription, not a GitHub write).",
"api_writes": "5 strokes, all through the scripts/pm relay or git: (1) post-stamped claim comment 6379699184 on #25467 (relay run 40061346453); (2) git push of claude/project-thread-uasfag at 11a1c91 (new branch on ba6912c; the merged cut 4 branch had been deleted by the queue); (3) fleet-write pr_create, PR #25601 draft with assignee os-sales and label skip-changeset (relay run 40062707593; body read back identical, 14,074 bytes); (4) fleet-write pr_request_reviewers os-sales (relay run 40062762768); (5) this report, via post-stamped.",
"open_questions": [],
"out_of_scope_findings": [
"check-durability-degradation-log-level's read-seam rule only follows read wrappers it can see as in-file this.method bodies; a shape-B stub (fn.call(host, ...)) hides the wrapped read from it. That is why packagelessAddress stays. Any later cut must diff the rule's --list output at both ends, and a body the rule follows stays unless the rule is taught shape B in its own PR (a gate change, not a move)."
]
}

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-24T05:09Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25467 cut 5 (os-dev-report 6380175109) · reviewed head 11a1c9186b · merge base ba6912c1ad

• Shape: the lock gate and the OCC write addresses (16 private methods) move unedited into protocol-lock-version-gates.ts, using the cut 1 host pattern. engine is passed as a getter and the rest as closures, with nothing assigned. 3 files, +674 / −294, 968 changed lines.

• Stays (accepted at scope): the two private-static readers, and packagelessAddress, which keeps the durability read-seam list at 83.

• Seat conditions from the scope call: the d.ts reading below is clear, so the moved class and interface print nowhere new. check-governed-merges was run on the final list.

• .d.ts, ruling 6348891160 item 1, re-run by the seat in its own worktree:

  • Raw 25da084d43455d12… at base and at head, on both index.d.ts and index.d.cts. The raw diff is 0 lines.
  • Normalised ff7d6892b9f1161d… at both ends.
  • Positive control: head line 1361, private engine;, made public, moves the hashes to raw 4bea7ae08e75e20c… and normalised be0161971853121d….
  • CJS exports: 78 at both ends.

• Gates re-run by the seat, all exit 0 at base and at head:

  • check-adr-symbol-anchors: 2,384 anchors.
  • check-tenant-audit-census: 238.
  • check-system-context-census: 149.
  • check-adr-anchors, check-dispatcher-error-vocabulary and check-platform-checklist.

• Decision letters, read by the seat: 1883 at the merge base and 1882 at head. One ADR-0110 D3 citation leaves with the body.

• PRODUCERS: new Error( counts 87 in protocol.ts at base, and 83 plus 4 in the new module at head. The new row 'protocol-lock-version-gates.ts': 4 matches.

• Tests and gates (report):

  • The suite runs 21,489 tests at base and 21,490 at head; the one added test is the PRODUCERS row.
  • 59 of 59 derived gates exit 0.
  • The durability seam list is identical at both ends.

• CI: 34 success and 12 expected skips, none failed or pending (46 runs).

• Mergeable: git merge-tree onto today's main is clean. The card's serial check is clean against all 11 open PRs.

• Body: the attribution header and the os-sales reviewer are in place. The footers are present.

• Landing: HELD, on two holds:

  1. Sales paused merges for a release at 2026-10-24T03:57Z.
  2. main's full battery has been red since feat(sharing): a share or sharing rule on a public object reaches an external member of the record's organization #25591 (dogfood: main's Dogfood Regression Gate (1/3) is red since #25591 — showcase-d3-d4-capabilities still pins the pre-#25549 SHARING_NOT_ENABLED reason for a share on showcase_project #25602, this lane). Under AGENTS.md's main-red rule, no lane PR arms the queue until that fix lands.

  The PR is not governed (968 lines). The seat readies and arms it only once both holds clear, and re-checks git merge-tree first.

---

Generated by Claude Code