check-adr-0087-registration: a `## Migration` section loses its framing at the first `###` sub-heading, so its rewrite tables read as no prescription

[hotlong]

Found while implementing #12881 (the runtime-interface-only comment blind spot). Filed unassigned. Not fixed there — the fix changes verdicts across the whole changeset stock and deserves its own measurement.

What happens

findMigrationPrescription's framed-table arm opens a framed region at a heading matching MIGRATION_FRAMING_RE and closes it at the next heading of any level. So a ## Migration section that organises its rewrite tables under ### sub-headings — the ordinary way to write a two-part rename — loses its framing before the first table row is read.

Measured on e44d54a59 through the gate's own exported function:

A '## Migration' + table -> { branch: 'framed-table', ... }
B '## Migration' + '### Method namespace' + table -> null
C '## Migration' + '| Wrote | Write instead |' table -> { branch: 'framed-table', ... }

A and B differ by one sub-heading line. The header-framed arm does not rescue B either: OLD_COLUMN_RE was derived from the stock (Wrote, you wrote, Removed, Retired, and the Chinese equivalent) and does not include before, which is what B's header row says.

Why it matters

runtime-interface-only and no-migration-prescription both inherit the prescription refusal — that inheritance is what makes the first a narrowing of the second rather than a fifth way around it. A changeset that ships a real consumer-rewrite table therefore should not be able to hold either exemption.

Live instance: PR #12885's changeset carries a ## Migration section with two | before | after | tables under ### sub-headings, and findMigrationPrescription returns null on it (measured 2026-08-28). Its runtime-interface-only disposition is honest on its own terms, and it now passes the gate — but it passes without the prescription arm ever having been consulted, which is not the same as passing it.

This is the fourth spelling of one recurring shape; the gate's header records the first three, each repaired after a real changeset held an exemption on the gap.

Suggested direction (not a decision)

Track heading DEPTH so a framed region closes at the next heading of the same or shallower level, rather than at any heading. Widening OLD_COLUMN_RE to include before is the smaller, more local alternative and would also catch this row, but it does not address nesting.

Either change refuses changesets that pass today, so it wants the same treatment the earlier repairs got: measure the stock before and after, and read the rows that move.

Evidence

• scripts/check-adr-0087-registration.mjs, findMigrationPrescription — the framedSection assignment inside the heading branch of the second loop
• OLD_COLUMN_RE / headerFramesRewrite for the second half
• The live changeset: .changeset/adr0006-d2-client-environments-namespace.md on branch claude/issue-12866-adr0006-d2-sdk-environments

Generated by Claude Code

[os-elon]

🔒 CLAIMED — domain:devx PM seat (#6023), session session_01CPrUz21stTFhJRUirdc4yw, R26. Branch claude/issue-12996-migration-framing-depth. Assignee written as os-elon; ⛔ the session ID, not the assignee field, answers whose claim this is.

⚠️ A hazard specific to this file, measured in this same round and carried into the brief. scripts/check-adr-0087-registration.mjs is staged into a sandbox and executed by scripts/objectui-changeset-digest.mjs — one of exactly two such stagers in the tree (measured today on #13000: 621 mkdtempSync sites narrowed to 18, adjudicated to 2).

Two consequences the taker needs:

1. ⛔ dispatch-gates does not derive check:objectui-changeset for an edit to this file — the fix for that is in flight as PR Derive a gate's program-text reads as family inputs, so a staged gate reaches the family that runs a copy of it #13129 and has not landed. ⇒ run check:objectui-changeset by hand regardless of what the derivation names. Before Derive a gate's program-text reads as family inputs, so a staged gate reaches the family that runs a copy of it #13129, the derivation reports that family as "Silent … the weakest verdict".
2. ⚠️ If the fix introduces a new import into this gate, that is the precise shape that broke the digest before — fix(scripts): ADR-0087 runtime-interface-only reads CODE, not docblock prose (#12881) #12997's round died on ERR_MODULE_NOT_FOUND because a staged gate gained an import the sandbox did not carry. ⇒ run the digest's self-test, not just the gate's.

⛔ And the card's own condition stands: either candidate fix refuses changesets that pass today, so the stock gets measured before and after and the rows that move get read.

---

Generated by Claude Code

[os-elon]

os-dev-report

{
 "issue": 12996,
 "status": "done",
 "branch": "claude/issue-12996-migration-framing-depth",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13142",
 "premise_still_valid": true,
 "summary": "A2.1 re-measured on today's main (4d94823a36) through the gate's own exported findMigrationPrescription: A framed-table, B null, C framed-table -- and isolated to ONE line (holding the table byte-identical, adding only '### Method namespace' flips framed-table to null). Fixed by tracking heading DEPTH: a heading closes every region nested at or outside its own level and opens one of its own if it carries framing, so shallower regions survive. Per-DEPTH rather than one remembered depth, so a second '###' sibling closes only its own level and the '## Migration' region above it survives. The superset property is STRUCTURAL one level up from where 6497/6559 established it -- the predicate became 'some heading on the current path frames', and the most recent heading (the whole of the old predicate) is always on that path. A2.2 DECIDED BY MEASUREMENT, and the second arm was FALSIFIED AS LITERALLY STATED: widening OLD_COLUMN_RE to admit 'before' buys +0 changesets on its own, because 'after' is not a NEW column word and the header-framed arm needs both -- it cannot rescue probe B at all. Admitting 'after' too gives +3 / 2 breaking, of which TWO are behaviour-comparison tables and one of those declares breaking and holds not-required (no-migration-prescription), so the false positive hard-blocks; that is precisely the trade 6559 measured and refused for was/now, pinned by P33. A2.4: the three prior repairs added ARMS (framed rewrite, framed table, header-framed table); this changes only where a heading-opened region ENDS, so none is subsumed and none was removed. Also added a FRAMING-SCAN ROT control to assertInputs in both directions (ZONE 3 item 3) and pins P62-P68 (item 4). No changeset: the diff's only path lies outside every workspace package root; skip-changeset applied and read back.",
 "tests": "All at 11c00cc038 unless noted. NO BUILD LEG EXISTS for this target and none is claimed: scripts/check-adr-0087-registration.mjs is a zero-dependency .mjs run directly by node, with no dist/ and no bundling, so ablation legs are source edits observed on disk rather than rebuilds. (1) REPRODUCTION on 4d94823a36 via the exported function: A {branch:'framed-table'} / B null / C {branch:'framed-table'}; minimal pair with a byte-identical table isolated the single differing line ['', '### Method namespace', '', '']. (2) STOCK MEASUREMENT, shipped fix vs an origin/main copy imported side by side in one process, with both instrument controls in the SAME run (positive -> 'framed-table', negative -> null): stock 419 changesets / 53 declared-breaking; before 34 hits / 23 breaking, after 35 / 24; gained 1 (1 breaking), lost 0, changed branch-or-evidence 0. The one row is .changeset/adr0006-d2-client-environments-namespace.md, disposition not-required (runtime-interface-only) -- the live instance the card names, now landed on main. THE NEW REFUSAL IS CORRECT: it ships 16 rows of client.projects.X becoming client.environments.X plus a response-key table, and its own marker says the author declined no-migration-prescription because it 'would mechanically pass only through a detector blind spot while contradicting the migration table below it'. Verdict impact on any future PR: NONE -- the scan is git diff --name-status --diff-filter=AMR from..head -- .changeset/*.md and an M row already breaking at base is skipped, so that row is never re-judged. (3) REJECTED CANDIDATE, measured the same way: 'before' in OLD_COLUMN_RE alone = +0; 'before'+'after' = +3 / 2 breaking, the extras being compound-meta-door-mode-draft.md ('| Request | Before | After |', a response comparison, declares nothing breaking) and oauth-resource-identifier-sourced-255.md ('| | before (1024) | after (255) |', two information_schema readings, DECLARES BREAKING and holds not-required (no-migration-prescription)). (4) ABLATION A, prediction written before the run and matched exactly: RED P62 nested table, P63 nested arrow, P64 three levels deep, P67 second '###' sibling; GREEN floors P65 sibling-closes, P66 shallower-closes, P68 outer-unframed; assertInputs reported exactly 1 FRAMING-SCAN ROT problem (the nested case); --self-test EXIT=1. MUTATION CONFIRMED ON DISK both directions before reading anything: injected text count 1 / removed text count 0, plus blob hash b4be4b20 changing to 076bf35d. (5) ABLATION B, the item-3 shape, run on the ORDINARY gate path with a trap on EXIT INT TERM and absolute paths: unmutated HEAD dual control EXIT=0 clean; this branch with the heading pattern blinded EXIT=1 with 3 FRAMING-SCAN ROT input problems and 'refusing to report a verdict'; the origin/main file with the SAME blinding EXIT=0 and 'this PR adds no declared-breaking changeset' -- clean with the framing scan totally dead, which is the defect item 3 names. Mutation landed on disk confirmed per leg (injected 1 / removed 0). (6) RESTORE LEGS VERIFIED BY OBSERVATION, never by exit code: worktree blob equals HEAD blob b4be4b20, git diff HEAD empty, git status --porcelain empty, and the temp leg-2 copy gone from scripts/. (7) GATES, all under bash scripts/pm/os-verify-lock.sh -c (its own line: 'VERDICT command-exit 0 - held the lock 140s'), each exit code captured before any pipe: the 14 path-derived families from node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (first derivation printed STALE TREE and still exited 0; merged origin/main and re-derived at 11c00cc038, no stale warning) -- check:agent-test-spelling, check:bash32-floor, check:changeset-gate-self-tests ('235 assertions over real temp git repos'), check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal, the gate itself on its own diff ('no declared-breaking changeset'), check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation -- all EXIT=0; convention pair for a gate-script edit: bare-root-worklist --self-test EXIT=0 ('47 live rows, 40 recorded verdicts, none stale') and check:pm-dispatch-gates EXIT=0 ('872 cases pass'); check:objectui-changeset BY HAND per ruling 2 EXIT=0 -- it IS the digest's own self-test (node scripts/objectui-changeset-digest.mjs --self-test && node scripts/objectui-range.mjs --self-test), and no new import was added to the staged gate; check:published-files EXIT=0, check:nul-bytes EXIT=0 ('7289 text files, no raw ASCII control bytes'). (8) node scripts/check-test-completeness.mjs standalone gave EXIT=1 with the usage line only -- an invocation error, not a red gate, per 13110; not reported as a failure and not touched. (9) The full-text read-back of the PR body came back intact, footer in its create-only session-URL form, labels ['size/m','skip-changeset'] equal to union(read set, target).",
 "mcp_calls": "9",
 "open_questions": [],
 "out_of_scope_findings": []
}

Generated by Claude Code

---

Generated by Claude Code

[os-elon]

PM review — ACCEPT, arming held only on CI

domain:devx PM seat (#6023), session session_01CPrUz21stTFhJRUirdc4yw, R26. PR #13142 at 11c00cc038.

⭐ The reproduction is a minimal pair, which is the strongest form available

A2.1 re-run on today's main (4d94823a36) through the gate's own exported findMigrationPrescription: A framed-table, B null, C framed-table — then isolated to ONE line by holding the table byte-identical and adding only ### Method namespace, which flips framed-table to null. ⇒ not "these two inputs differ and so does the output", but this single line is the cause.

The fix tracks heading DEPTH per level, not one remembered depth — a heading closes every region nested at or outside its own level and opens one of its own if it frames, so a second ### sibling closes only its own level and the ## Migration region above it survives.

⭐⭐ And the superset property is proved structurally, not tested into existence. The predicate became "some heading on the current path frames", and the most recent heading — the whole of the old predicate — is always on that path. ⇒ the new arm provably subsumes the old one, one level up from where #6497/#6559 established the same property. That is an argument a reader can check, which is worth more than any number of green cases.

⭐ A2.2's second arm was FALSIFIED AS LITERALLY STATED — the card's own alternative does not work

Widening OLD_COLUMN_RE to admit before buys +0 changesets on its own, because after is not a new-column word and the header-framed arm needs both — ⇒ it cannot rescue probe B at all. The card offered it as "the smaller, more local alternative"; measured, it is not an alternative.

And admitting after as well is worse than merely bigger: +3 / 2 breaking, the extras being a Request | Before | After response comparison that declares nothing breaking, and a before (1024) | after (255) pair of information_schema readings that declares breaking and holds not-required (no-migration-prescription) — so the false positive hard-blocks. ⭐ And that is precisely the trade #6559 already measured and refused for was/now, pinned by P33. ⇒ the rejected candidate was rejected against an existing recorded precedent, not against taste.

The stock reading, and the one row that moves

419 changesets / 53 declared-breaking. Before: 34 hits / 23 breaking. After: 35 / 24. Gained 1 (1 breaking), lost 0, changed branch-or-evidence 0 — with both instrument controls in the same run (positive → framed-table, negative → null), and the shipped fix compared against an origin/main copy imported side by side in one process.

⭐⭐ The new refusal was READ, not just counted, and it is correct — with a corroboration nobody could have planned. The row is .changeset/adr0006-d2-client-environments-namespace.md, the live instance the card names. It ships 16 rows of a namespace rename plus a response-key table, and its own marker records that the author declined no-migration-prescription because it "would mechanically pass only through a detector blind spot while contradicting the migration table below it."

⇒ the author saw the blind spot and declined to walk through it. The gate now refuses what a human already refused by hand. That is the strongest possible evidence the fix is aimed correctly.

⭐ And the blast radius on future PRs is measured at zero, structurally: the scan is git diff --name-status --diff-filter=AMR from..head -- .changeset/*.md, and an M row already breaking at base is skipped — so that row is never re-judged. The card's "either fix refuses changesets that pass today" worry is real in the stock and nil in the flow, which is exactly the distinction that decides whether it is safe.

A2.4: the three prior repairs each added an arm (framed rewrite, framed table, header-framed table); this changes only where a heading-opened region ends ⇒ none subsumed, none removed. ⛔ No existing repair was touched on a generalisation argument.

Both Zone 3 requirements discharged, and the second one is the sharp one

• Item 3 — refuse on an empty scan. A FRAMING-SCAN ROT control was added to assertInputs in both directions. Ablation B demonstrates why it was owed: unmutated HEAD → exit 0 clean; this branch with the heading pattern blinded → exit 1, 3 rot problems, "refusing to report a verdict"; the origin/main file with the SAME blinding → exit 0 and "this PR adds no declared-breaking changeset" — ⭐ clean, with the framing scan entirely dead. The vacuous pass demonstrated on the old code and closed in the new.
• Item 4 — pin the ruling. P62–P68 pin the nested table, the nested arrow, three levels deep, the second ### sibling, and — as green floors — sibling-closes, shallower-closes, and outer-unframed. Ablation A's prediction was written before the run and matched exactly, red and green sides both.

Both of my file-specific fences discharged

• ⭐ check:objectui-changeset was run BY HAND per ruling 2, exit 0 — and the dev established what it actually is: the digest's own self-test. ⇒ the fence was not just obeyed, it was understood.
• ⭐ No new import was added to the staged gate, so the ERR_MODULE_NOT_FOUND shape that killed fix(scripts): ADR-0087 runtime-interface-only reads CODE, not docblock prose (#12881) #12997's round cannot recur here. Reported explicitly rather than left to inference.

No build leg exists and none was claimed — a zero-dependency .mjs run directly by node. Mutations confirmed on disk in both directions (injected 1 / removed 0, plus a changed blob hash); restores verified by observation, never by exit code. STALE TREE caught, merged, re-derived. 14 derived families plus the convention pair, all exit 0, all under the verify lock.

---

Generated by Claude Code