[objectstack-fleet]

Requested by Sales · project thread

Part of #25467
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6270097840

Cut 7 of the protocol.ts split (#24586 ruling A, recorded in 6270097840). Cuts 1–6 landed as #25494, #25518, #25538, #25589, #25601 and #25623. The claim is 6384152373. The seat agreed the scope before it and made two calls (the .d.ts and the letters), both answered in the claim and below.

Four ObjectStackProtocolImplementation members, package install and update, move unedited into a new module, packages/metadata-protocol/src/protocol-package-install.ts, together with the three manifest-persist declarations that only they read. They are the tail of the class. protocol.ts loses 302 net lines.

The cut is move-only, and the card stays open for later cuts. Branch: claude/project-thread-uasfag, the harness-pinned branch for this session, restarted from origin/main at 9d9a06ea38 after cut 6 merged. The branch names no issue, so the claim comment is the identity record.

Serial with the file's in-flight PRs. Measured just before this PR was opened, on main ca80f05ec5:

• None of the 14 open PRs touches protocol.ts, protocol-package-install.ts or the bracketed-refusal pin (each PR's diff read against its merge base).
• git merge-tree of this head with each of them, and with main, is clean.
• Main has not touched packages/metadata-protocol since 9d9a06ea38.

What moves

Member	Base line	Visibility	Tokens
installPackage	:29853	public, annotated return	444
updatePackage	:30106	public, annotated return	217
packagePersistService	:30137	private	45
packageInstallUndo	:30165	private	181

installPackage and updatePackage are public, but their return types are annotated. That keeps them off the series' skip list, which holds public members with inferred return types. The class keeps both signatures byte-identical, so the published .d.ts still lists them as before.

The shape (#23050 shape B, as cuts 1–6 apply it)

• The class keeps every member with its name, docblock, signature and position, less async. Each body is now one host literal plus fn.call(host, …), marked [#25467 cut 7].
• Typing. PackageInstallHost types every member as the class member itself (ObjectStackProtocolImplementation['m']). Each moved function types its this as the Pick of the host over exactly the members its body reads, measured by AST. Each stub annotates its literal as ThisParameterType<typeof fn>. There is no cast, and no member changes visibility.
• Members read, measured by AST:
  • the fields engine and getServicesRegistry, as getters;
  • the methods packagePersistService and packageInstallUndo, as late-bound closures.
  • No field is assigned, and the host carries no elevation member.

Module-level declarations, by reader

Each declaration below was checked by an AST reader walk over the whole of base protocol.ts.

Move with the bodies, byte-identical and unexported. Each is read only by moved code and carries exactly its own docblock: persistPackageManifest, snapshotPackageRow, restorePackageRow.

Stay in protocol.ts and gain export in place. That is the only edit to each:

Declaration	Read by code that stays
packagePersistFailureError	deletePackage
PackagePersistService (interface)	the packagePersistService stub's signature

src/index.ts exports from ./protocol.js by name, so neither is published (measured below).

Import moved. In protocol.ts, the PackageInstallManifestSchema import loses its last reader. Its 2-line [#24086] comment moves with it onto the new module's import of the same name. The one new statement in protocol.ts is the import of the new module.

The published .d.ts

The series bar is ruling 6348891160, sorted-union identity. Measured first on merged main, as the seat asked, at base 9d9a06ea38 and at head. Both ends were built with pnpm --filter @objectstack/metadata-protocol build against the same dependency tree (turbo run build --filter='@objectstack/metadata-protocol^...' at base first).

• Normalised sha256: ff7d6892b9f1161da356208d51301816c48dc021051544b9c28a3aa14329d57e at base and at head, on both dist/index.d.ts and dist/index.d.cts. Sorted-union identity holds. The normaliser, run from packages/metadata-protocol:

node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]*"(?:\s*\|\s*"[^"\n]*")+/g,r=>r.split(/\s*\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum

• Raw sha256: base 25da084d43455d125bfd41b85b1e70477ef7caf77f2cb7da23143b325e51a14e, head 2d66df37f8e4614df880b46d57781c248549913f7d2279bbd30aa0aa6f1ab290. Both files match at each end, and both are 770,690 bytes on each side. Raw identity does not hold.
• The full raw diff (diff base/index.d.ts head/index.d.ts; index.d.cts is the same):

2407c2407
<         environment: "production" | "development" | "sandbox";
---
>         environment: "sandbox" | "production" | "development";

It is one union reordered inside getDiscovery's inferred return type. getDiscovery is on the skip list and did not move. The declaration printer orders an inferred union by the order it first meets those types, and that order depends on where code sits in protocol.ts. Cut 3 met the same effect.

• Positive control on a copy of the head dist/index.d.ts: changing line 1361 from private engine; to engine; gives raw fee7168c23001a389dfae3060f76008adba0aed9a02aa2632a6f9edbde94f1d8 and normalised be0161971853121da3a941ad8936c6de5bdea6ad91bf0cc6072ded0c27054a58. Both differ from the real hashes, so the normalised hash moves on a real change.
• Export tables. The ESM and CJS bundles, loaded at runtime, each export the same 78 names at base and head. The sorted list hashes to e47ac7c753bcb8bee1e79c1a5f79f7394cf030bd526de81ea8bcbfcb71fa024a on all four. Neither packagePersistFailureError nor PackagePersistService appears.

No changeset: skip-changeset, per ruling 6348891160.

Proof of move-only

• Bodies and declarations, by AST token. For each moved function, the parameters (less the added this), the return type and the body have the same token sequence as the base method. Each moved declaration has the same tokens, and its own docblock is byte-identical. 1,243 tokens compared, 0 differ. Negative control: one changed token makes the check report a difference.
• Class side. The class has 299 members at base and at head. The 295 that did not move are byte-identical to base. Each of the 4 stubs keeps its docblock and signature byte-identical, less async.
• Top level of protocol.ts. 232 of the 238 base statements other than the class are byte-identical, leading comments included. The other 6 are:
  • the 3 moved declarations;
  • the 2 that gain export;
  • the moved import.
• Size. +427 / −339 over 3 files, 766 changed lines. protocol.ts goes from 30,312 to 30,010 lines, and protocol-package-install.ts has 388.

Readers of the moved lines

• Bracketed-refusal pin (protocol.bracketed-refusal-opener-absence.test.ts, PRODUCERS). 3 new Error( sites move. The new module is listed with its measured count as its floor, 'protocol-package-install.ts': 3, as cuts 3, 5 and 6 listed theirs. That is the only edit outside the move. No moved site opens with a bracketed tag.
• Durability checker (check-durability-degradation-log-level --list). Identical at both ends apart from line numbers (159 lines). None of the four members holds a seam.
• ADR anchors and decision letters. check:adr-anchors: 85 → 85 anchored files. Decision-letter citations on the anchored surface go 1,868 → 1,866, measured exactly at both ends.
  • The two that leave are ADR-0087 D1 (the protocol handshake, assertProtocolCompat) and ADR-0087 D2 (the authoring door runs no forward conversion), both in installPackage's body.
  • protocol.ts's anchor entry governs ADR-0087, but its ADR-0087 paragraph anchors addendum 2026-08-01b, which is saveMetaItem's storable view body (projectStorableViewBody, VIEW_CONSOLE_ROUND_TRIP_KEYS). It does not cover the install handshake.
  • protocol.ts keeps 26 ADR-0087 citations. So the new module gets no entry: this is the cut 13 rule, disclosed here, as the seat ruled in the scope call.
• Identical output at both ends:
  • check-adr-symbol-anchors;
  • check-platform-checklist (protocol.ts#installPackage and #updatePackage resolve on the shells, which stay and are not edited);
  • check-system-context-census and check-tenant-audit-census;
  • check-query-options-erasure-ratchet;
  • spec check-liveness.
• Engine-double contract. check-engine-double-contract differs only in productionFiles +1 (the new file).
• Governed surface. check-governed-merges --branch on the final 3-path list: NOT governed. 766 changed lines, under the 3,000-line human-merge bar.
• Path readers. These files name the moved methods: scripts/symbol-anchors.mjs, spec liveness/manifest.json, the platform checklist, core capability-providers.ts, host-engine.ts, the runtime packages.ts domain, and the package tests. Each names a method in prose or by anchor name, or calls it through the instance. None reads the moved lines by path, and all pass.

Verification

• tsc --noEmit (package) exits 0. eslint on protocol.ts and protocol-package-install.ts exits 0.
• packages/metadata-protocol suite, base and head, compared per test name and status:
  • Base 9d9a06ea38: 21,493 tests (21,474 passed, 0 failed, 19 skipped), 266 files.
  • Head: 21,494 (21,475 passed, 0 failed, 19 skipped), 266 files.
  • None lost and none changed status. One was added, the new PRODUCERS row (passed).
• Tests outside the package that read protocol.ts by path or exercise these methods, run at head, all pass:
  • core row-serving-door-exposure.pin and second-object-read-exposure.pin (7, at both ends);
  • runtime package domain and integration tests: packages-*, error-passthrough, package-dependencies-patch, package-promote-runtime-owner-refusal, package-uninstall-shared-object (190);
  • objectql core-boundary.ratchet, protocol-publish-canonical-fold, default-record-page-save-door and package-disable-enforcement (61);
  • cloud-connection marketplace install tests (29);
  • client discovery-double-retired-key and packages-write-envelope (7), rest discovery-double-retired-key (2);
  • spec liveness evidence and allow-org-override-absence (44).
• Hand gates at base and head, all exit 0, with identical output except the letter count above: check-adr-anchors, check-adr-symbol-anchors, check-platform-checklist, check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet, check-durability-degradation-log-level --list, and spec check-liveness.
• Derived gates. dispatch-gates --commands --changed derives 59 gates on the final tree (3 changed paths). All 59 exit 0 at head, and --ran reconciles 59 of 59 with 0 NOT-MEASURED.

Carry-forward

These stay in protocol.ts in this series:

• Public members whose return type is inferred. Annotating one would be a signature edit and needs a ruling. The list: getDiscovery, getMetaTypes, getMetaItems, getMetaItemsForExecution, getMetaItem, getMetaItemForExecution, getUiView, findData, getData, validateData, createData, cloneData, updateData, deleteData, saveMetaItem.
• Bodies kept by a reader:
  • probeRecord, the per-file erasure-baseline site;
  • getMetaItemCached, whose body the Three read-side /meta verbs (history, audit, references) never reach canonicalizeMetaRequestType — they still derive their key from the MANIFEST map #9157 pin reads by path;
  • packagelessAddress, refuseUnmintableMetaType and metaTypeNamespaceExists, plus every container the durability read-seam census follows (the durability read-seam census);
  • viewContainerNameCollisionRefusal and overlaidShippedContainerViewNames, for the lookupArtifactItem( call-site pin.
• Private-static readers.

getDiscovery's inferred-return .d.ts depends on byte offsets in protocol.ts (shown above), so each cut measures it under the sorted-union bar.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J8pUyVs5eas1AjMdReJM7C

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 21 documentable anchor(s).

15 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via packages.disable (sdk, the route ledger binds it to PATCH /packages/:id/disable), packages.enable (sdk, the route ledger binds it to PATCH /packages/:id/enable))
• content/docs/api/declarative-endpoints.mdx (via manifest.id (literal, a string literal in installPackage))
• content/docs/api/environment-routing.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage))
• content/docs/api/metadata-api.mdx (via /packages/:id/disable (route, a path literal in a comment in installPackage), /packages/:id/enable (route, a path literal in a comment in installPackage))
• content/docs/deployment/cli.mdx (via manifest.id (literal, a string literal in installPackage))
• content/docs/deployment/publish-and-preview.mdx (via manifest.id (literal, a string literal in installPackage))
• content/docs/getting-started/examples.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage))
• content/docs/getting-started/quick-reference.mdx (via manifest.id (literal, a string literal in installPackage))
• content/docs/kernel/contracts/metadata-service.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage), /api/v1/packages/:packageId (route, bridged from symbol installPackage — its route source's handler names it))
• content/docs/kernel/services-checklist.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage))
• content/docs/permissions/permission-sets.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage))
• content/docs/plugins/packages.mdx (via manifest.id (literal, a string literal in installPackage))
• content/docs/protocol/kernel/error-handling.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage), /api/v1/packages/:packageId (route, bridged from symbol installPackage — its route source's handler names it))
• content/docs/protocol/kernel/http-protocol.mdx (via manifest.id (literal, a string literal in installPackage), /api/v1/packages (route, a path literal in a comment in installPackage))
• content/docs/ui/apps.mdx (via manifest.id (literal, a string literal in installPackage), /api/v1/packages (route, a path literal in a comment in installPackage))

⛔ 7 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v12.mdx (via installPackage (symbol, a method of class ObjectStackProtocolImplementation; a top-level function))
• content/docs/releases/v17/17-0.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage), /api/v1/packages/:packageId (route, bridged from symbol installPackage — its route source's handler names it))
• content/docs/releases/v17/17-4.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage), /api/v1/packages/:packageId (route, bridged from symbol installPackage — its route source's handler names it))
• content/docs/releases/v17/17-5.mdx (via manifest.id (literal, a string literal in installPackage), /api/v1/packages (route, a path literal in a comment in installPackage))
• content/docs/releases/v17/17-7.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage))
• content/docs/releases/v18/18-0.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage))
• content/docs/releases/v18/18-1.mdx (via /api/v1/packages (route, a path literal in a comment in installPackage))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ca80f05ec5c6aab22f31553cb5f8737a17450563 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from b751d6d8d53e9612dab34bd3968256f746f2c46f — the merge of head 2163cff5c06a84cc723a81e8b2ae61d77f9cbe9b into base ca80f05ec5c6aab22f31553cb5f8737a17450563, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin b751d6d8d53e9612dab34bd3968256f746f2c46f && git checkout b751d6d8d53e9612dab34bd3968256f746f2c46f
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ca80f05ec5c6aab22f31553cb5f8737a17450563 2163cff5c06a84cc723a81e8b2ae61d77f9cbe9b && git checkout -B drift-repro ca80f05ec5c6aab22f31553cb5f8737a17450563 && git merge --no-ff 2163cff5c06a84cc723a81e8b2ae61d77f9cbe9b

node scripts/docs-audit/affected-docs.mjs --json ca80f05ec5c6aab22f31553cb5f8737a17450563

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ca80f05ec5c6aab22f31553cb5f8737a17450563 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-uasfag",
"pr": "#25642",
"session": "session_01J8pUyVs5eas1AjMdReJM7C — this run's harness-stamped id, on the Claude-Session: trailer of the commit on the branch",
"premise_still_valid": true,
"summary": "Cut 7 of the protocol.ts split (#24586 ruling A, 6270097840; d.ts bar 6348891160). Claim 6384152373; scope agreed with the seat before it, with its two calls answered in the claim (d.ts reported raw + full raw diff + a positive control on the normalised hash; ADR-0087 D1/D2 leaving disclosed under the cut 13 rule, no new entry). Four members, the tail of the class: installPackage and updatePackage (PUBLIC, annotated returns, not on the skip list) and the private packagePersistService and packageInstallUndo, moved unedited to packages/metadata-protocol/src/protocol-package-install.ts (host PackageInstallHost: engine and getServicesRegistry as getters, 2 methods as late-bound closures, nothing assigned, no elevation member). persistPackageManifest, snapshotPackageRow, restorePackageRow moved byte-identical with 0 outside readers; packagePersistFailureError (<- deletePackage) and the interface PackagePersistService (<- the packagePersistService stub's signature) gained export in place (index.ts names its exports, neither published); the PackageInstallManifestSchema import moved with its [#24086] comment. protocol.ts loses 302 net lines (30,312 to 30,010). PRODUCERS row 'protocol-package-install.ts': 3. Serial rule: no open PR touched these files at claim or at pr_create; merge-tree clean with all 14 and with main ca80f05. No open question.",
"tests": "pnpm --filter @objectstack/metadata-protocol vitest run (JSON reporter). Base 9d9a06e: 21,493 tests (21,474 passed, 0 failed, 19 skipped), 266 files. Head 2163cff: 21,494 (21,475 passed, 0 failed, 19 skipped), 266 files. Compared per test name and status: 0 lost, 0 changed, 1 added (the new PRODUCERS row, protocol-package-install.ts raises no message opening with a bracketed lowercase tag, passed). Move-only, so no ablation. Package tsc --noEmit exit 0; eslint on protocol.ts and protocol-package-install.ts exit 0. Out-of-package tests at head, all pass: core row-serving-door-exposure.pin and second-object-read-exposure.pin (7, at base and head); runtime packages domain and integration tests (packages-capability-gate, packages-manifest-patch-readonly, packages-patch-dependencies, packages-walled-write-refusal, error-passthrough, package-dependencies-patch, package-promote-runtime-owner-refusal, package-uninstall-shared-object: 190); objectql core-boundary.ratchet, protocol-publish-canonical-fold, default-record-page-save-door, package-disable-enforcement (61); cloud-connection marketplace install tests (29); client discovery-double-retired-key and packages-write-envelope (7); rest discovery-double-retired-key (2); spec liveness evidence and allow-org-override-absence (44). Move proof against base 9d9a06e: 1,243 AST leaf tokens compared, 0 differ; negative control fails. Class: 299 members both ends, 295 byte-identical, 4 stubs keep docblock and signature byte-identical less async. Top level: 232 of 238 base statements byte-identical with leading comments; the other 6 are 3 moved, 2 export added, 1 moved import; one new statement (the module import). +427 / -339 over 3 files (766 changed lines); protocol.ts 30,312 to 30,010 lines, the module 388.",
"dts_block": {
"files": "packages/metadata-protocol dist/index.d.ts and dist/index.d.cts; base 9d9a06e built with turbo run build --filter='@objectstack/metadata-protocol^...' then pnpm --filter @objectstack/metadata-protocol build; head 2163cff built with the same command against the same dependency tree",
"raw_sha256": "base index.d.ts and index.d.cts 25da084d43455d125bfd41b85b1e70477ef7caf77f2cb7da23143b325e51a14e · head index.d.ts and index.d.cts 2d66df37f8e4614df880b46d57781c248549913f7d2279bbd30aa0aa6f1ab290 (770,690 bytes all four)",
"normalised_sha256": "base ff7d6892b9f1161da356208d51301816c48dc021051544b9c28a3aa14329d57e · head ff7d6892b9f1161da356208d51301816c48dc021051544b9c28a3aa14329d57e (both files, both sides): sorted-union identity holds",
"normaliser": "node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]"(?:\s\|\s*"[^"\n]")+/g,r=>r.split(/\s\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum",
"raw_diff_lines": 1,
"raw_diff": "2407c2407 (index.d.ts; index.d.cts identical): < environment: "production" | "development" | "sandbox"; > environment: "sandbox" | "production" | "development"; — one union reordered inside getDiscovery's inferred return (getDiscovery is on the skip list and did not move); the offset-dependent printing cut 3 met. Nothing else differs.",
"positive_control": "head index.d.ts line 1361, private engine; made public (engine;): raw fee7168c23001a389dfae3060f76008adba0aed9a02aa2632a6f9edbde94f1d8, normalised be0161971853121da3a941ad8936c6de5bdea6ad91bf0cc6072ded0c27054a58, both different from the real hashes: the normalised hash moves on a real change.",
"exports": "ESM and CJS bundles loaded at runtime: 78 names each at base and head; sorted-list sha256 e47ac7c753bcb8bee1e79c1a5f79f7394cf030bd526de81ea8bcbfcb71fa024a on all four; neither packagePersistFailureError nor PackagePersistService appears.",
"note": "No changeset (skip-changeset), per 6348891160."
},
"adr_anchor_block": {
"gate": "node scripts/check-adr-symbol-anchors.mjs at base 9d9a06e and head, exit 0 at both with identical output.",
"adr_anchors": "pnpm check:adr-anchors exit 0 at base and head; anchored files 85 to 85; decision-letter citations on the anchored surface 1,868 to 1,866, measured at both ends. The two that leave: ADR-0087 D1 (protocol handshake, assertProtocolCompat) and ADR-0087 D2 (authoring door runs no forward conversion), both in installPackage's body. No entry added (seat call, cut 13 rule, disclosed): protocol.ts's ADR-0087 paragraph anchors addendum 2026-08-01b (saveMetaItem's storable view body: projectStorableViewBody, VIEW_CONSOLE_ROUND_TRIP_KEYS), not the install handshake, and protocol.ts keeps 26 ADR-0087 citations."
},
"gates": "Local on the final head 2163cff: dispatch-gates --commands --changed derives 59 commands (3 changed paths), each run with its exit captured; all 59 exit 0. --ran: 59 derived, 59 run, 0 NOT-MEASURED (a derived zero). Run by hand, not derived, at base 9d9a06e and head, all exit 0 with identical output except the letter count above: check-adr-symbol-anchors, check:adr-anchors, check-platform-checklist (protocol.ts#installPackage and #updatePackage resolve on the shells; not edited), check-tenant-audit-census, check-system-context-census, check-query-options-erasure-ratchet (no counted site moves, no file key added), spec check-liveness, check-durability-degradation-log-level --list (159 lines, identical modulo line numbers). check-engine-double-contract exit 0 at both; it differs only in productionFiles +1. check-governed-merges --branch on the final 3-path list: NOT governed, 766 lines. Bracketed-refusal PRODUCERS: 3 new Error( sites move; new module row 3 = its measured count. CI on head 2163cff: 46 check runs, 34 success, 12 skipped by their own filters, 0 failed or pending; mergeable_state clean. Success: Auto Label, Build Core, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Regression Gate, filter, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Test Core, Test Core (1/6) to (6/6), The card this PR closes must claim this branch, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check. Skipped: 18.x upgrade harness (opt-in) x2, Auto Label (second run), Build Docs, Check Changeset (second run), Check PR Size (second run), Console Pin Gate, the sharded Dogfood Regression Gate matrix, Dogfood Verify CLI, Packed-tarball smoke (opt-in) x2, Temporal Conformance (live PG + MySQL).",
"docs_drift": "Advisory. Re-derived with node scripts/docs-audit/affected-docs.mjs --json 9d9a06e on the head: 22 docs plus 7 release-owned from 21 anchors, reached through literals inside installPackage (manifest.id, /api/v1/packages and the enable/disable paths in comments) and the moved names; the bot's run on its merge tree lists 15 plus 7. Every method keeps its name, signature, docblock and behaviour and every literal moved unedited, so no page goes stale. No page reads the moved lines by path. Bot comment 6384177247.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "No MCP write tool. GitHub reads through the GitHub MCP read tools and gh api GET (open PRs, PR state, check runs). Also claude-code-remote subscribe_pr_activity on #25642 (a session subscription, not a GitHub write).",
"api_writes": "5 strokes, all through the scripts/pm relay or git: (1) post-stamped claim comment 6384152373 on #25467 (relay run 40093609840); (2) git push of claude/project-thread-uasfag at 2163cff (new branch on 9d9a06e; the merged cut 6 branch had been deleted by the queue); (3) fleet-write pr_create, PR #25642 draft with assignee os-sales and label skip-changeset (relay run 40093709010); (4) fleet-write pr_request_reviewers os-sales (relay run 40093765799); (5) this report, via post-stamped.",
"open_questions": [],
"out_of_scope_findings": []
}

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-24T13:06Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25467 cut 7 (claim 6384152373, os-dev-report 6384473842) · reviewed head 2163cff5c0 · merge base 9d9a06ea38

• Shape: installPackage, updatePackage, packagePersistService and packageInstallUndo move unedited into protocol-package-install.ts, using the cut 1 host pattern. The two public members keep their annotated signatures on the class. engine and getServicesRegistry go as getters, and nothing is assigned. persistPackageManifest, snapshotPackageRow and restorePackageRow move byte-identical. packagePersistFailureError and PackagePersistService gain export in place, and neither is published. The PR touches 3 files, +427 / −339, 766 changed lines.
• Seat calls from the scope (.d.ts and letters), both met:
  • .d.ts, ruling 6348891160 item 1, re-run by the seat in its own worktree:
    • Normalised ff7d6892b9f1161d… at base and at head, on both index.d.ts and index.d.cts.
    • Raw 25da084d43455d12… becomes 2d66df37f8e4614d…. The seat's full raw diff is one line, 2407c2407: environment: "production" | "development" | "sandbox" becomes "sandbox" | "production" | "development" inside getDiscovery's inferred return. That is cut 3's offset-dependent printing, within the sorted-union bar, and there is nothing else.
    • Positive control: head line 1361, private engine;, made public, which moves the hashes to raw fee7168c23001a38… and normalised be0161971853121d….
    • CJS exports: 78 at both ends.
  • Decision letters, read by the seat: 1868 at the merge base and 1866 at head. ADR-0087 D1 and ADR-0087 D2 leave with installPackage's body. No anchor entry is owed: the protocol.ts entry's ADR-0087 paragraph anchors addendum 2026-08-01b (saveMetaItem's storable view body), and the file keeps its other ADR-0087 citations.
• Gates re-run by the seat, all exit 0 at base and at head:
  • check-adr-symbol-anchors (2,384 anchors)
  • check-tenant-audit-census (238)
  • check-system-context-census (149)
  • check-adr-anchors
  • check-dispatcher-error-vocabulary
  • check-platform-checklist
• PRODUCERS: new Error( counts 78 in protocol.ts at base. At head it counts 75 there plus 3 in the new module, which matches the new row 'protocol-package-install.ts': 3.
• Tests and gates (report): the suite has 0 per-test changes plus the PRODUCERS row. 59 of 59 derived gates exit 0, and --ran reconciles. The durability --list is identical apart from line numbers. 333 out-of-package reader tests pass.
• CI: 34 success and 12 expected skips, none failed or pending (46 runs).
• Mergeable: git merge-tree onto today's main is clean. The card's serial check is clean against all 14 open PRs.
• Body: the attribution header and the os-sales reviewer are in place, and the footers are present.
• Landing: the PR is not governed (check-governed-merges --pr 25642: 766 lines).
  • main's 2026-10-24T12:01Z scheduled full run (40092202961, at abdc7f22a5) is red in Test Core 2/6 on @objectstack/plugin-auth#test.
  • The seat re-ran that suite at abdc7f22a5 and it is green: 193 files, 3,667 passed, 10 skipped.
  • The seat readies and arms this PR once the next full run (40096369748) settles that red.

---

Generated by Claude Code