[objectstack-fleet]

Requested by Sales · project thread

Part of #25467
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6270097840

Cut 6 of the protocol.ts split (#24586 ruling A, recorded in 6270097840). Cuts 1–5 landed as #25494, #25518, #25538, #25589 and #25601. The claim is 6383176261; the seat agreed the scope before it, including the two narrowings below, and asked for the anchor-entry check and the re-measure on merged main, both answered in the claim and below.

Nine PRIVATE ObjectStackProtocolImplementation methods, the save door's refusals, move unedited into a new module, packages/metadata-protocol/src/protocol-save-door-refusals.ts, with the five lock-family declarations only they read. They are one contiguous run of the class, less three members that stay.

It is move-only, and the card stays open for the later cuts. Branch: claude/project-thread-uasfag, the harness-pinned branch for this session, restarted from origin/main at 60d8fd2ea6 after cut 5 merged. The branch names no issue, so the claim comment is the identity record.

Serial with the file's in-flight PRs. Measured just before this PR was opened, on main 7265b33e77. None of the 11 open PRs touches protocol.ts, protocol-save-door-refusals.ts or the bracketed-refusal pin (each PR's diff read against its merge base), and git merge-tree of this head with each of them, and with main, is clean. Since 60d8fd2ea6, main has touched only build-probes.ts and its test in this package.

What moves

Method	Base line	Tokens
refuseUngrammaticalMetaItemName	:19858	83
defaultRecordPageSaveRefusal	:20040	626
externalBindingSaveRefusal	:20155	347
externalBindingDatasourceDefinition	:20197	61
objectsBoundExternallyTo	:20213	296
anonymousElevatedFlowRefusal	:20286	333
authoredLockFamily	:20603	439
saveWriteBinding	:20666	204
objectNamespacePrefixViolation	:20710	54

All nine are private, so none is on the series' skip list of public members with inferred return types.

Stay in the class, inside the run, narrowed out during the trial before the claim:

• refuseUnmintableMetaType and metaTypeNamespaceExists. scripts/check-durability-degradation-log-level.mjs follows the chain saveMetaItem -> refuseUnmintableMetaType -> metaTypeNamespaceExists -> engine.findOne (its own table, rows 3 and 5), and its --list carries a metaTypeNamespaceExists read seam. This is the rule that kept packagelessAddress in cut 5.
• viewContainerNameCollisionRefusal, with its one helper overlaidShippedContainerViewNames. protocol.lookup-artifact-item-call-sites.test.ts reads protocol.ts and records this member's lookupArtifactItem( site.

The shape (#23050 shape B, as cuts 1–5 apply it)

• The class keeps every method with its name, docblock, signature and position, less async. Each body is now one host literal plus fn.call(host, …), marked [#25467 cut 6].
• Typing. SaveDoorRefusalHost types every member as the class member itself (ObjectStackProtocolImplementation['m']). Each moved function types its this as the Pick of the host over exactly the members its body reads, measured by AST. Each stub annotates its literal as ThisParameterType<typeof fn>. There is no cast, and no member becomes public or protected.
• Members read, measured by AST:
  • The fields engine and getServicesRegistry (the constructor-supplied function field, passed as cut 4 passed it), as getters, so each read happens when the body makes it.
  • These methods, as late-bound closures ((...a) => this.m(...a)): artifactLockLayerAt, externalBindingDatasourceDefinition, getOverlayRepo, objectsBoundExternallyTo, overlayLockLayerAt, readActiveOverlayRows, readMetaItem, rethrowUnlessMetadataStoreUnprovisioned and storedOverlayEntries. A spy or double set on the instance is still the one the body reaches.
  • No field is assigned, no moved body names isSystem, and the host carries no elevation member.

Module-level declarations, by reader

Each declaration the moved bodies read was checked by an AST walk over the whole of base protocol.ts. The walk finds every identifier reference outside the declaration itself and takes the transitive closure over the moved set.

Move with the bodies, byte-identical and unexported. Each has 0 readers outside the moved code and carries exactly its own docblock. None is a class or a type: LOCK_FAMILY_KEYS, lockFamilyOf, sameLockFamily, withLockFamily, authoredLockFamilyRefusal. item-lock.ts declares its own, separate LOCK_FAMILY_KEYS, untouched.

Stay in protocol.ts and gain export in place, the only edit to each:

Declaration	Read by code that stays
MetadataIssueEntry	permissionSetOwnerBindingRefusal, protectionBlockRefusal, publishBackfillRefusal, readPublishBackfillRequest
MetadataWriteFace	specValidationFindings, destructiveChangeRemedy, flowSaveReplaysRetired, saveMetaItem
specValidationFindings	saveMetaItem

overlaySchemaDeclaredKey, also read by the moved code, is already exported. src/index.ts exports from ./protocol.js by name, so none is published (measured below).

Imports narrowed in protocol.ts, each having lost its last reader: METADATA_ITEM_NAME_PATTERN, defaultRecordPageObject, MetadataProtectionFields, validateObjectNamespacePrefix, and the whole @objectstack/spec/api value import. That import's 3-line [ADR-0138 D2b] comment moves with it onto the new module's import of the same names. protocol.ts gains one statement, the import of the new module.

The published .d.ts

Under the series bar (ruling 6348891160), measured first on merged main as the seat asked, on the final layout, at base 60d8fd2ea6 and at head. Both ends were built with pnpm --filter @objectstack/metadata-protocol build against the same dependency tree (turbo run build --filter='@objectstack/metadata-protocol^...' at base first).

• Raw sha256 of dist/index.d.ts and dist/index.d.cts: 25da084d43455d125bfd41b85b1e70477ef7caf77f2cb7da23143b325e51a14e at base and at head, both files. That is raw identity: no moved declaration prints anywhere new, and no docblock splices onto a neighbour where a declaration gains export.
• Export tables. The ESM and CJS bundles each export the same 78 names at base and head, loaded at runtime (import() and require of the built bundles). The sorted list hashes e47ac7c753bcb8bee1e79c1a5f79f7394cf030bd526de81ea8bcbfcb71fa024a on all four, as at cuts 1–5. None of MetadataIssueEntry, MetadataWriteFace, specValidationFindings or the moved declarations appears.

No changeset: skip-changeset, per ruling 6348891160.

Proof of move-only

• Bodies and declarations, by AST token (recursive getChildren leaves). For each moved function, the parameters (less the added this), return type and body have the same token sequence as the base method. Each moved declaration has the same tokens, and its own docblock is byte-identical. 2,966 tokens compared, 0 differ. Negative control: one changed token makes the check report a difference.
• Class side. The class has 299 members at base and at head. The 290 that did not move are byte-identical to base, and each of the 9 stubs keeps its docblock and signature byte-identical, less async.
• Top level of protocol.ts. 230 of the 243 base statements other than the class are byte-identical with their leading comments. The other 13 are the 5 moved declarations, the 3 that gain export, and the 5 import statements narrowed or removed. The one new statement is the import of the new module.
• Size. +551 / −321 over 3 files, 872 changed lines. protocol.ts goes from 30,548 to 30,312 lines, and protocol-save-door-refusals.ts has 464.

Readers of the moved lines

• Bracketed-refusal pin (protocol.bracketed-refusal-opener-absence.test.ts, PRODUCERS). 5 new Error( sites move. The new module is listed with its measured count as its floor, 'protocol-save-door-refusals.ts': 5, as cuts 3 and 5 listed theirs. That is the only edit outside the move. No moved site opens with a bracketed tag.
• Durability checker (check-durability-degradation-log-level --list): identical at both ends apart from line numbers (159 lines), with the two members above kept.
• ADR anchors and decision letters. check:adr-anchors: 85 → 85 anchored files. Decision-letter citations on the anchored surface go 1,871 → 1,868, measured exactly at both ends. The three that leave: ADR-0138 D2b in the moved import comment, ADR-0138 D2b in anonymousElevatedFlowRefusal's body, and ADR-0131 D6 in a moved body.
• Anchor entry. scripts/adr-anchors/packages__metadata-protocol__src__protocol.ts.json governs ADR-0005/0029/0087/0119/0126 and names applyObjectRegistryMutation, loadMetaFromDb, removeObjectOverlay, the OBJECT_OVERLAY_PACKAGE_MISMATCH producer, batchData/transaction(, saveMetaItem/projectStorableViewBody/VIEW_CONSOLE_ROUND_TRIP_KEYS, hydrateOverlayIntoRegistry, readFlattenedMetaItems and isShippedFlowName/isStoredFlowEntryOfShippedName. None appears in the new module (0 hits), and both OBJECT_OVERLAY_PACKAGE_MISMATCH producers stay in protocol.ts. The new module gets no entry.
• Identical output at both ends: check-adr-symbol-anchors, check-platform-checklist (protocol.ts#objectNamespacePrefixViolation resolves on the shell, which stays; not edited), check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet (no counted site moves; no file key added), and spec check-liveness.
• Engine-double contract. check-engine-double-contract differs only in productionFiles +1 (the new file).
• Governed surface. check-governed-merges --branch on the final 3-path list: NOT governed. 872 changed lines, under the 3,000-line human-merge bar.
• Path readers. Files that name a moved method (protocol.restore-doors-save-refusal-family.test.ts, protocol.item-name-every-door.test.ts, protocol.item-name-grammar.test.ts, objectql default-record-page-save-door.test.ts, service-datasource's datasource-admin-service.ts docblock, the platform checklist) name it in prose or exercise it through the instance. None reads the moved lines by path, and all pass.

Verification

• tsc --noEmit (package) exit 0. eslint on protocol.ts and protocol-save-door-refusals.ts exit 0.
• packages/metadata-protocol suite, base and head, compared per test name and status. Base 60d8fd2ea6: 21,490 tests (21,471 passed, 0 failed, 19 skipped), 266 files. Head: 21,491 (21,472 passed, 0 failed, 19 skipped), 266 files. None lost, none changed status, one added: the new PRODUCERS row, protocol-save-door-refusals.ts raises no message opening with a bracketed lowercase tag (passed).
• Tests outside the package that read protocol.ts by path or name these methods, run at head, all pass:
  • core row-serving-door-exposure.pin and second-object-read-exposure.pin (7, at both ends);
  • objectql core-boundary.ratchet, protocol-publish-canonical-fold and default-record-page-save-door (46);
  • spec metadata-type-registry-allow-org-override-absence and scripts/liveness/evidence (44);
  • client and rest discovery-double-retired-key (3 + 2).
• Hand gates at base and head, all exit 0, identical output except the letter count above: check-adr-anchors, check-adr-symbol-anchors, check-platform-checklist, check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet, check-durability-degradation-log-level --list, and spec check-liveness.
• Derived gates. dispatch-gates --commands --changed derives 59 gates on the final tree (3 changed paths). All 59 exit 0 at head, and --ran reconciles 59 of 59 with 0 NOT-MEASURED. The full list and the --ran reconcile are in the report on this PR.

Carry-forward

These stay in protocol.ts in this series:

• Public members whose return type is inferred. Annotating the type would be a signature edit and needs a ruling. Later cuts skip getDiscovery, getMetaTypes, getMetaItems, getMetaItemsForExecution, getMetaItem, getMetaItemForExecution, getUiView, findData, getData, validateData, createData, cloneData, updateData, deleteData and saveMetaItem.
• Bodies kept by a reader:
  • probeRecord (per-file erasure-baseline site);
  • getMetaItemCached (the Three read-side /meta verbs (history, audit, references) never reach canonicalizeMetaRequestType — they still derive their key from the MANIFEST map #9157 pin reads its body by path);
  • packagelessAddress, refuseUnmintableMetaType, metaTypeNamespaceExists (the durability read-seam census);
  • viewContainerNameCollisionRefusal and overlaidShippedContainerViewNames (the lookupArtifactItem( call-site pin).
• Private-static readers.

The inferred-return .d.ts still depends on protocol.ts byte offsets (cut 3's series note), so each cut measures it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J8pUyVs5eas1AjMdReJM7C

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 45 documentable anchor(s).

44 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json f7b02989688255549339747d03a42d65940b2c19.

⛔ 15 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f7b02989688255549339747d03a42d65940b2c19 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 38f02eca6add46f37b68fb967d613be481670544 — the merge of head 04c063af57c5da225a4828bcd97f52cd057a1716 into base f7b02989688255549339747d03a42d65940b2c19, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 38f02eca6add46f37b68fb967d613be481670544 && git checkout 38f02eca6add46f37b68fb967d613be481670544
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f7b02989688255549339747d03a42d65940b2c19 04c063af57c5da225a4828bcd97f52cd057a1716 && git checkout -B drift-repro f7b02989688255549339747d03a42d65940b2c19 && git merge --no-ff 04c063af57c5da225a4828bcd97f52cd057a1716

node scripts/docs-audit/affected-docs.mjs --json f7b02989688255549339747d03a42d65940b2c19

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f7b02989688255549339747d03a42d65940b2c19 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-uasfag",
"pr": "#25623",
"session": "session_01J8pUyVs5eas1AjMdReJM7C — this run's harness-stamped id, on the Claude-Session: trailer of the commit on the branch",
"premise_still_valid": true,
"summary": "Cut 6 of the protocol.ts split (#24586 ruling A, 6270097840; d.ts bar 6348891160). Claim 6383176261; scope agreed with the seat before it (in-hand series work under Sales's 08:24Z word that this card continues to merge), with the seat's two notes answered in the claim: the anchor-entry check and the re-measure on merged main in the order d.ts, letters, governed. Nine PRIVATE methods (refuseUngrammaticalMetaItemName, defaultRecordPageSaveRefusal, externalBindingSaveRefusal, externalBindingDatasourceDefinition, objectsBoundExternallyTo, anonymousElevatedFlowRefusal, authoredLockFamily, saveWriteBinding, objectNamespacePrefixViolation) moved unedited to packages/metadata-protocol/src/protocol-save-door-refusals.ts (host SaveDoorRefusalHost: engine and getServicesRegistry as getters, 9 methods as late-bound closures, nothing assigned, no elevation member). LOCK_FAMILY_KEYS, lockFamilyOf, sameLockFamily, withLockFamily, authoredLockFamilyRefusal moved byte-identical with 0 outside readers (none a class or type); MetadataIssueEntry, MetadataWriteFace, specValidationFindings gained export in place (index.ts names its exports, none published); five imports narrowed, the @objectstack/spec/api import's [ADR-0138 D2b] comment moving with it. Stay, narrowed out in the trial before the claim: refuseUnmintableMetaType and metaTypeNamespaceExists (check-durability-degradation-log-level follows saveMetaItem -> refuseUnmintableMetaType -> metaTypeNamespaceExists -> engine.findOne; --list carries the metaTypeNamespaceExists seam), viewContainerNameCollisionRefusal with overlaidShippedContainerViewNames (protocol.lookup-artifact-item-call-sites.test.ts reads its lookupArtifactItem( site in protocol.ts). PRODUCERS row 'protocol-save-door-refusals.ts': 5. Serial rule: no open PR touched these files at claim or at pr_create; merge-tree clean with all 11 and with main 7265b33. No open question.",
"tests": "pnpm --filter @objectstack/metadata-protocol vitest run (JSON reporter). Base 60d8fd2: 21,490 tests (21,471 passed, 0 failed, 19 skipped), 266 files. Head 04c063a: 21,491 (21,472 passed, 0 failed, 19 skipped), 266 files. Compared per test name and status: 0 lost, 0 changed, 1 added (the new PRODUCERS row, protocol-save-door-refusals.ts raises no message opening with a bracketed lowercase tag, passed). Move-only, so no ablation. Package tsc --noEmit exit 0; eslint on protocol.ts and protocol-save-door-refusals.ts exit 0. Out-of-package tests that read protocol.ts by path or name these methods, at head, all pass: core row-serving-door-exposure.pin and second-object-read-exposure.pin (7, at base and head), objectql core-boundary.ratchet, protocol-publish-canonical-fold and default-record-page-save-door (46), spec metadata-type-registry-allow-org-override-absence and scripts/liveness/evidence (44), client and rest discovery-double-retired-key (3 + 2). Move proof against base 60d8fd2: each moved function's parameters (less the added this), return type and body have the same AST leaf-token sequence as the base method; each moved declaration has the same tokens and its own docblock byte-identical; 2,966 tokens compared, 0 differ. Negative control: one changed token fails the check. Class: 299 members both ends, 290 byte-identical, 9 stubs keep docblock and signature byte-identical less async. Top level: 230 of 243 base statements byte-identical with leading comments; the other 13 are 5 moved, 3 export added, 5 imports narrowed or removed; one new statement (the module import). +551 / -321 over 3 files (872 changed lines); protocol.ts 30,548 to 30,312 lines, the module 464.",
"dts_block": {
"files": "packages/metadata-protocol dist/index.d.ts and dist/index.d.cts; base 60d8fd2 built with turbo run build --filter='@objectstack/metadata-protocol^...' then pnpm --filter @objectstack/metadata-protocol build; head 04c063a built with the same command against the same dependency tree",
"raw_sha256": "base index.d.ts and index.d.cts 25da084d43455d125bfd41b85b1e70477ef7caf77f2cb7da23143b325e51a14e · head index.d.ts and index.d.cts 25da084d43455d125bfd41b85b1e70477ef7caf77f2cb7da23143b325e51a14e",
"raw_diff_lines": 0,
"raw_diff": "none: raw identity at both ends, both files. No moved declaration prints anywhere new, and no docblock splices onto a neighbour where a declaration gains export.",
"exports": "ESM and CJS bundles loaded at runtime: 78 names each at base and head; sorted-list sha256 e47ac7c753bcb8bee1e79c1a5f79f7394cf030bd526de81ea8bcbfcb71fa024a on all four, as at cuts 1-5; none of MetadataIssueEntry, MetadataWriteFace, specValidationFindings or the moved declarations appears.",
"note": "Raw identity holds, so the normalised hash adds nothing (ruling 6348891160 reports raw identity when it holds). No changeset (skip-changeset), per 6348891160."
},
"adr_anchor_block": {
"gate": "node scripts/check-adr-symbol-anchors.mjs at base 60d8fd2 and head, exit 0 at both with identical output.",
"adr_anchors": "pnpm check:adr-anchors exit 0 at base and head; anchored files 85 to 85; decision-letter citations on the anchored surface 1,871 to 1,868, measured at both ends. The three that leave: ADR-0138 D2b in the moved import comment, ADR-0138 D2b in anonymousElevatedFlowRefusal's body, ADR-0131 D6 in a moved body. No entry added: protocol.ts's anchor entry governs ADR-0005/0029/0087/0119/0126 and names applyObjectRegistryMutation, loadMetaFromDb, removeObjectOverlay, the OBJECT_OVERLAY_PACKAGE_MISMATCH producer, batchData/transaction(, saveMetaItem/projectStorableViewBody/VIEW_CONSOLE_ROUND_TRIP_KEYS, hydrateOverlayIntoRegistry, readFlattenedMetaItems, isShippedFlowName/isStoredFlowEntryOfShippedName; none appears in the new module (0 hits) and both OBJECT_OVERLAY_PACKAGE_MISMATCH producers stay in protocol.ts."
},
"gates": "Local on the final head 04c063a: dispatch-gates --commands --changed derives 59 commands (3 changed paths), each run with its exit captured; all 59 exit 0. --ran: 59 derived, 59 run, 0 NOT-MEASURED (a derived zero). Run by hand, not derived, at base 60d8fd2 and head, all exit 0 with identical output except the letter count above: check-adr-symbol-anchors, check:adr-anchors, check-platform-checklist (protocol.ts#objectNamespacePrefixViolation resolves on the shell; not edited), check-tenant-audit-census, check-system-context-census, check-query-options-erasure-ratchet (no counted site moves, no file key added), spec check-liveness, check-durability-degradation-log-level --list (159 lines, identical modulo line numbers). check-engine-double-contract exit 0 at both; it differs only in productionFiles +1. check-governed-merges --branch on the final 3-path list: NOT governed, 872 lines. Bracketed-refusal PRODUCERS: 5 new Error( sites move; new module row 5 = its measured count. CI on head 04c063a: 46 check runs, 34 success, 12 skipped by their own filters, 0 failed or pending; mergeable_state clean. Success: Auto Label, Build Core, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Regression Gate, filter, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Test Core, Test Core (1/6) to (6/6), The card this PR closes must claim this branch, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check. Skipped: 18.x upgrade harness (opt-in) x2, Auto Label (second run), Build Docs, Check Changeset (second run), Check PR Size (second run), Console Pin Gate, the sharded Dogfood Regression Gate matrix, Dogfood Verify CLI, Packed-tarball smoke (opt-in) x2, Temporal Conformance (live PG + MySQL).",
"docs_drift": "Advisory. Re-derived with node scripts/docs-audit/affected-docs.mjs --json 60d8fd2 on the head: 59 docs plus 15 release-owned from 45 anchors (28 symbol, 18 literal), reached through the moved method and declaration names, the host name and literals inside the moved bodies; the bot's run on its merge tree counts 44 plus 15. Every method keeps its name, signature, docblock and behaviour and every literal moved unedited, so no page goes stale. No page reads the moved lines by path. Bot comment 6383199146.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "No MCP write tool. GitHub reads through the GitHub MCP read tools and gh api GET (open PRs, PR state, check runs). Also claude-code-remote subscribe_pr_activity on #25623 (a session subscription, not a GitHub write).",
"api_writes": "5 strokes, all through the scripts/pm relay or git: (1) post-stamped claim comment 6383176261 on #25467 (relay run 40086513159); (2) git push of claude/project-thread-uasfag at 04c063a (new branch on 60d8fd2; the merged cut 5 branch had been deleted by the queue); (3) fleet-write pr_create, PR #25623 draft with assignee os-sales and label skip-changeset (relay run 40086620391); (4) fleet-write pr_request_reviewers os-sales (relay run 40086661651); (5) this report, via post-stamped.",
"open_questions": [],
"out_of_scope_findings": []
}

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-24T11:15Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25467 cut 6 (claim 6383176261, os-dev-report 6383454333) · reviewed head 04c063af57 · merge base 60d8fd2ea6

• Shape: the save door's refusals (9 private methods) and the five lock-family declarations only they read move unedited into protocol-save-door-refusals.ts, using the cut 1 host pattern. Fields are passed as getters and methods as late-bound closures, with nothing assigned. The change touches 3 files, +551 / −321, 872 changed lines.
• Stays (accepted at scope): refuseUnmintableMetaType and metaTypeNamespaceExists stay because of the durability read seam. viewContainerNameCollisionRefusal and overlaidShippedContainerViewNames stay because of the lookupArtifactItem( call-site pin.
• Seat conditions from the scope call:
  • The re-measure was done on merged main.
  • The anchor entry needs no change: none of the mechanisms the entry names moved, and both OBJECT_OVERLAY_PACKAGE_MISMATCH producers stay in protocol.ts.
• .d.ts, ruling 6348891160 item 1, re-run by the seat in its own worktree:
  • Raw 25da084d43455d12… at base and at head, on both index.d.ts and index.d.cts, with a raw diff of 0 lines.
  • Normalised ff7d6892b9f1161d… at both ends.
  • Positive control: head line 1361, private engine;, made public, which moves the hashes to raw 4bea7ae08e75e20c… and normalised be0161971853121d….
  • CJS exports: 78 at both ends.
• Gates re-run by the seat, all exit 0 at base and at head:
  • check-adr-symbol-anchors (2,384 anchors)
  • check-tenant-audit-census (238)
  • check-system-context-census (149)
  • check-adr-anchors
  • check-dispatcher-error-vocabulary
  • check-platform-checklist
• Decision letters, read by the seat: 1871 at the merge base and 1868 at head, matching the report. Two ADR-0138 D2b citations and one ADR-0131 D6 citation leave with the moved text.
• PRODUCERS: new Error( counts 83 in protocol.ts at base. At head it counts 78 there plus 5 in the new module, which matches the new row 'protocol-save-door-refusals.ts': 5.
• Tests and gates (report):
  • The suite runs 21,490 tests at base and 21,491 at head; the one added test is the PRODUCERS row.
  • 59 of 59 derived gates exit 0, and --ran reconciles.
  • The durability list is identical at both ends apart from line numbers.
• CI: 34 success and 12 expected skips, none failed or pending (46 runs). main is green at 481ac62116.
• Mergeable: git merge-tree onto today's main is clean. The card's serial check is clean against all 11 open PRs.
• Body: the attribution header and the os-sales reviewer are in place, and the footers are present.
• Landing: the PR is not governed (check-governed-merges --pr 25623: 872 lines). The seat readies it and arms auto-merge through the relay.

---

Generated by Claude Code