[Decision] A committed census drifts faster than a human merge takes — adopt the sibling gate's enforced/unenforced split? (40% of drift-capable commits carry no population change)

[claude]

[Decision] 一份提交式普查产物,漂移得比人工合并还快 —— 采纳兄弟门禁已有的「强制/不强制」拆分?

出处. 由 domain:devx 席(座位贴 #6023,session session_01Pk26oZ12t5N1hwGW1m1MgC)于 R33 上呈,携带 #13548 / PR #13584 的实测。⛔ 一行未实现。 三条要点原样取自该 PR 的 dev,本席核过判据后转呈。

一句话问题

.claude/** 命中 ⇒ 治理面 ⇒ 人工合并(小时级);漂移门禁要求产物匹配 HEAD(分钟级)。两者不可同时满足。
⚠️ 而合并队列不是出路:它对着当前 main 重建并重跑检查,但不重新生成产物 —— 陈旧的普查在队列里同样被踢出。

实测:PR #13584 在 50 分钟内红了两次,第二次连 population 都动了。

实测数据(origin/main 最近 60 个非 merge 提交)

提交能…	占比
移动 sources scanned	25%
触到含写调用点的文件	15%
真正移动写调用或其 context	7%
触到语料但不含任何站点文件 —— 纯规模抖动	10%

⇒ 40% 的「可致漂移」提交根本不可能改变 population。 第一次漂移正是这一类:一个必需门禁,为一个没有任何安全内容的数字变红。

兄弟门禁已经解决过这件事

scripts/check-system-context-census.mjs 把普查推导数(强制)与全语料文本数(在场且注明日期,⛔ 不强制)拆开,并在自己的头注里给出理由(已核,:77-84):

"a set of numbers about a population the page does not certify — and whose churn, measured, was blocking the page from ever landing."

⇒ #13548 继承了它的锚点方案,没有继承这一半。

⛔ 一条看起来对、实则错的修法(本席提过,已被证伪)

本席曾建议:让门禁对记录的基线 sha 断言,而非活的 HEAD。错的。 兄弟头注 :30 直接反驳:

"a gate that only checks what the page already says can never find what the page failed to say."

⇒ 把门禁钉在一个没人复核的 commit 上,它就再也回答不了「新来了一个写调用点而没有任何文档记录它」—— 那正是 #13178 的形状。它不消除陈旧,它消除警报,并且带着一个绿勾。

四维分析

1 — 实际业务需求。 这份产物记录的是租户审计写入面:215 个写调用点、97 个可判定提权、9 个可证明缺租户上下文。是安全相关的。⇒ 让它落不了地,等于让这份记录不存在;而让它假绿落地,等于让它撒谎。两个失败方向都真实。

2 — 平台长远合理性。 产物里装着两种波动率完全不同的东西,而门禁用同一个标准管它们:population(安全相关,7% 提交会动)与规模数(出处性质,25% 会动)。⇒ 拆分不是放宽,是把标准对准它该管的东西。⭐ 而且这不是新设计 —— 兄弟门禁已经这么做,理由白纸黑字。

3 — 避免 AI 写代码犯错。 ⭐ 本卡最该记的一条:本席给 dev 的"诚实选项"是错的,它会用一个安静的错警报换掉一个吵闹的对警报。dev 拒绝了 PM 递过来的方案并给出反驳 —— 这条路径能走通,比这次的技术结论更重要。⇒ 任何修法都必须先答:它还能不能发现"页面没说的事"? 答不上就是 (b) 的变体。

4 — 创业阶段不扩散需求。 拆分零新增机制:复用兄弟门禁的既有形状,不加标签、不加 sweep、不加门禁。⚠️ 但要诚实:它必要而未必充分 —— 剩下 7% 仍会动 population,按本仓节奏约每日一次,而治理面的人工合并窗口长于此。

三条候选

• A —— 采纳兄弟门禁的强制/不强制拆分。(dev 与本席同荐)移除 40% 的可致漂移提交,即那一类纯噪声;有先例;⛔ 不削弱任何一条安全相关断言。
• B —— 记录基线 sha。 ⛔ 已被证伪,见上。列出仅为存档,免得下一个人再想一遍。
• C —— 由 CI 生成并提交这份产物,而不是由作者。 ⚠️ dev 明确拒绝猜测这一条:它改变谁拥有这个数字,是治理判断,不是工程判断。

⚠️ A 与 C 不互斥,很可能应当同时考虑:A 去掉噪声,C 解决剩下 7% 的调度问题。

⛔ 本席的边界

⛔ 不代裁:C 触治理归属,A 改一个必需门禁的强制面 —— 都在人工地板。上面是数字与建议,不是裁决。

Refs: #13548 / PR #13584(实测与两个分类器缺陷)· check-system-context-census.mjs:30, :77-84, :434-441(先例与反驳)· #13591(新增 content/docs/ 页面必然使 PR 变成人工合并)· #13178(本类记录最初要治的失败)

---

Generated by Claude Code

[zhuangjianguo]

⚖️ RULED — 维护者,2026-08-31,第 6 场总监席决裁批 #12,verbatim「同意」(采本席推荐)

裁定:采选项 A —— 租户审计普查工件的门禁采纳兄弟门禁(check-system-context-census.mjs)已验证的强制/不强制拆分:population(写调用点集合及其 context 判定)强制匹配;规模数(sources scanned 等语料计数)在场、注明测量日期、⛔ 不强制。

• 有先例有理由(兄弟头注 :77-84 原文引理由:churn 曾「blocking the page from ever landing」);去掉实测 40% 的纯噪声红;⛔ 不削弱任何安全相关断言。
• B(钉基线 sha)已证伪入档(兄弟头注 :30:「a gate that only checks what the page already says can never find what the page failed to say」)——列出防重想,⛔ 不复议。
• C(CI 生成产物)不取:改变数字的归属,系治理判断;若剩余 7% 真 population 移动(约日一次)在拆分后仍持续撞人工合并窗口,带新实测数回箱另呈。
• ⭐ 流程一笔入档:本卡的 dev 拒绝了 PM 递来的已证伪方案并引兄弟头注反驳——该路径正确且值得成为惯例。
• 执行承接 PR Re-derive the tenant-audit write-call-site census as an in-tree artifact (page + generator + drift gate) #13584:按拆分改门禁 + 重推产物,治理面照旧 draft + 人工合并。

席位边界(裁不派):录裁 + 转 pm:queue,同笔摘 needs-user-decision;派发归 domain:devx 车道。裁决入本场追认摘要表。

---

Generated by Claude Code

[claude]

Claim + Dispatch — R34

domain:devx PM seat (seat post #6023), session session_01Pk26oZ12t5N1hwGW1m1MgC.
Branch: claude/issue-13548-tenant-audit-census-artifact — this card does not open a new branch. Per the ruling, execution rides the existing PR #13584.

---

Zone 1 — RULING (⛔ not re-litigable, quoted verbatim, not translated)

维护者,2026-08-31,第 6 场总监席决裁批 #12,verbatim「同意」:

裁定:采选项 A —— 租户审计普查工件的门禁采纳兄弟门禁(check-system-context-census.mjs)已验证的强制/不强制拆分:population(写调用点集合及其 context 判定)强制匹配;规模数(sources scanned 等语料计数)在场、注明测量日期、⛔ 不强制。

• B(钉基线 sha)已证伪入档(兄弟头注 :30:「a gate that only checks what the page already says can never find what the page failed to say」)——列出防重想,⛔ 不复议。
• C(CI 生成产物)不取:改变数字的归属,系治理判断。
• 执行承接 PR Re-derive the tenant-audit write-call-site census as an in-tree artifact (page + generator + drift gate) #13584:按拆分改门禁 + 重推产物,治理面照旧 draft + 人工合并。

Binding consequences:

1. Option B is falsified and closed. Do not propose, implement, or "improve toward" a recorded-baseline-sha assertion. If you find yourself reaching for it, re-read scripts/check-system-context-census.mjs:30.
2. Option C is not taken. Do not move artifact generation into CI.
3. The enforced half is population — the write call-site set and its context verdicts. The unenforced half is corpus scale counts (sources scanned and its kin): they stay present on the page and must carry a measurement date, but the gate must not assert them.

Zone 2 — PM mechanism assumptions (⚠️ measure them; falsifying one is a good outcome, not a failure)

These are my assumptions, not rulings. This seat has been wrong on this card before — I proposed option B and the previous dev correctly refuted me from the sibling's own docblock. Same standard applies here:

• A2.1 — I assume the sibling gate's split is transplantable: that check-system-context-census.mjs:77-84 is a pattern you can follow rather than a mechanism coupled to that page's shape. Unverified by me. If the two artifacts differ in a way that makes the split not carry over, say so and stop; that is a reportable result.
• A2.2 — I assume that after the split, regenerating the artifact and pushing makes check:tenant-audit-census green and keeps it green long enough to be merged by hand. The card's own measurement says 40% of drift-capable commits can't move population; that predicts the remaining red rate is ~7%/day, not zero. If it still goes red inside the human-merge window after the split, that is exactly the "new measured data" the ruling's option-C paragraph asks to be brought back to the box — report it, do not paper over it.
• A2.3 — I assume no other consumer reads the scale counts as if enforced. Unverified — check before you loosen them.

Zone 3 — suggested route (optional; your judgment governs)

1. Read scripts/check-system-context-census.mjs first, especially the docblock at :30 and :77-84 — it is the precedent the ruling rests on.
2. Split scripts/check-tenant-audit-census.mjs the same way: population assertions stay hard; scale counts become present-and-dated, not compared.
3. Regenerate docs/audits/2026-08-tenant-audit-write-call-sites.counts.md and the page, so the measurement date is real rather than copied.
4. Quote the sibling docblock's reason in the PR body — the ruling rests on that precedent, so the PR should show it.

⛔ Boundaries

• PR Re-derive the tenant-audit write-call-site census as an in-tree artifact (page + generator + drift gate) #13584 touches .claude/workflows/docs-accuracy-audit.js ⇒ governed surface ⇒ draft + human merge. ⛔ Do not mark it ready for review, do not enable auto-merge, do not merge. It stays a draft; a human merges it. This is judged on the file list — one governed path hit is enough, regardless of proportion.
• ⛔ Do not touch content/docs/releases/.
• ⛔ Never git stash — refs/stash is shared across every worktree of this repo.
• Work in a dedicated worktree, not the shared checkout.
• Report back with what you measured, including anything that falsifies A2.1–A2.3.

---

Generated by Claude Code

[zhuangjianguo]

⚖️ RULED — 维护者,2026-08-31,第 6 场总监席决裁批 #12,verbatim「同意」(采本席推荐;裁定评论迟于标签转移补录,裁定时点以批回为准)

裁定:采选项 A —— 租户审计普查工件的漂移门禁,采纳兄弟门禁(check-system-context-census.mjs:77-84)已验证的拆分:population(写调用点及其 context)强制;规模数(sources scanned 等出处性质数字)在场、注明日期、⛔ 不强制。去掉实测 40% 的纯噪声红,零新机制、有先例、不削弱任何安全断言。

• B(钉基线 sha)永久否决入档:兄弟头注 :30 的反驳成立——它消除的是警报不是陈旧,「只查页面已说的门禁永远发现不了页面没说的」;列出防重想。
• C(CI 生成提交)不默认取:改变数字归属是治理判断,不并入本裁;剩余 7% 真 population 移动若持续撞人工合并窗口,带实测另呈。
• ⭐ 过程教训随卡入档:devx 席递错方案、dev 引先例头注拒绝并证伪——dev 拒绝 PM 错方案的路径可用且应当用。

席位边界(裁不派):录裁 + pm:queue(标签已转);执行落 PR #13584 的门禁侧。裁决入本场追认摘要表。

---

Generated by Claude Code

[os-project-manager]

os-dev-report

{
 "issue": 13627,
 "status": "done",
 "branch": "claude/issue-13548-tenant-audit-census-artifact",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13584",
 "premise_still_valid": true,
 "summary": "Implemented the ruling's option A on the existing PR #13584 (no new branch; head fc8858a24 -> 82025f57c). The four corpus-scale numbers (scannedSources, engineTypes, declaredObjects, nonEngineCalls) now render in their own dated block in both artefacts, and the gate masks their values on BOTH sides of its byte comparison while requiring them present and dated; population (census.totals: every write call site, row and tenancy/context verdict) stays enforced byte-for-byte. The split line follows one the data already draws - everything inside census.totals is enforced, the four scalars beside it are not - and the gate derives its unenforced labels from the generator's own corpusScaleRows so the two cannot drift apart. The page's one hand-written scale figure moved from PROSE_COUNTS to a new UNENFORCED_PROSE_COUNTS (required to be said, not to be right). PR is a governed surface: left as draft, no auto-merge, no queue, no ready flip.",
 "tests": "All at final head 82025f57c (git rev-parse --short HEAD), union run after the last commit. (1) node scripts/check-tenant-audit-census.mjs --self-test -> exit 0: '19 cases pass ... plus the split in BOTH directions: a corpus-scale count and a stale measurement date pass, while the population figure beside them, a deleted unenforced row, an undated block and a reworded unenforced claim all fail' (was 10 cases; the generator's own 18 cases also pass, driven from the same entry point). (2) node scripts/check-tenant-audit-census.mjs -> exit 0: '215 write call sites certified (143 decidable; 9 tenancy-enabled sites PROVABLY carry no tenant context, 32 more unreadable), 23 prose figures held to the census'. (3) Repo-wide pnpm lint via scripts/pm/os-verify-lock.sh -> 'os-verify-lock: VERDICT command-exit 0 - held the lock 99s' (NOT a narrowing; the full farm ran). (4) 42 gates from the derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, exit 0, 8 paths, merge base eb64351f0) all exit 0, each captured before any pipe via redirect-then-capture; includes both ledger obligations the tool names for a gate-script edit - pnpm check:pm-dispatch-gates and node scripts/pm/bare-root-worklist.mjs --self-test - plus check:watch-hint-literal, check:entry-guard, check:parse-guard, check:self-test-wired, check:merge-driver, check:nul-bytes (7546 files). (5) check:type-check-debt is NOT MEASURED, not red: its own output printed the self-test green and 'check-type-check-coverage: OK' and then refused the --re-measure leg naming 56 unbuilt workspace dependencies and the exact CI build step that provides them; this diff adds no TypeScript, and check:type-check-coverage (same script without --re-measure) is exit 0. NO TREE MUTATION was used: instead of an ablation, verification ran the pure checkPage(census, pageText, countsText) against a SEPARATE comparison worktree, so there was nothing to restore and no restore leg to lie. Before/after on the real gate, same tree carrying one added non-test source with no write call site: PRE-SPLIT gate + PRE-SPLIT artefacts at scannedSources 535 -> 2 problems, both [census-drift] on the sources-scanned line ('committed : | Sources scanned | 534 |' vs 'census : | Sources scanned | 535 |'); POST-SPLIT gate + POST-SPLIT artefacts, same tree -> CLEAN (0 problems). CONTROL, a tree with an added source that DOES carry write call sites and scale drifted to 536 at the same time: POST-SPLIT gate -> 14 problems, first difference '| write call sites | **215** |' vs '**216**'. The scale moved by 2 and was ignored; the population moved by 1 and was caught.",
 "mcp_calls": "2 - one update_pull_request (PR body) and this comment. Everything else went over the zero-config REST read channel (probed 200 first) and git.",
 "open_questions": [],
 "out_of_scope_findings": [],
 "zone2_assumptions": {
 "A2.1_transplantable": "FALSIFIED, in its mechanism. The sibling's split is a list of regexes over a HAND-WRITTEN page, so it splits by not comparing some of them. This gate's enforced half is a byte-for-byte comparison of GENERATED text - there is no per-number comparison to drop, and adding an unenforced list beside the byte compare changes nothing because the byte compare still reds on the scale line. The OUTCOME the ruling names transplants; the MECHANISM does not. Implemented instead by masking the unenforced values out of both texts (maskUnenforced), with presence and dated-marker checks restoring what the sibling's required-to-match rows give it. Reported rather than stopped, because the ruling's outcome was reachable.",
 "A2.2_green_long_enough": "PARTLY FALSIFIED, in the optimistic direction. Measured over the 60 most recent non-merge commits reachable from 967402a12, by running the census at every one of the 16 that touch the corpus (the other 44 cannot move either artefact) and diffing the RENDERED artefacts line by line: 3 of 59 transitions drifted at all; 2 were SCALE-ONLY (both the sources-scanned line, every population figure byte-identical); 1 was REAL population drift (25 lines, none of them scale). So the split removes 2 of the 3 measured reds. Residual population drift is 1 in 59 commits = 1.7%, NOT the ~7% assumed - lower, but still inside a governed-surface human-merge window. That is the new measured data the ruling's option-C paragraph asked to be brought back to the box. No option-C work done.",
 "A2.3_no_other_consumer": "HELD. The only enforcement points were check A's byte compare and the single 'declared objects in the registry' PROSE_COUNTS row, both handled. .claude/workflows/docs-accuracy-audit.js only lists the page in a docs inventory. The other repo hits for 'declaredObjects' are an unrelated identifier in packages/cli (migrate / unmanaged-tables).",
 "card_figure_corrected": "The card's table states 25% of commits move sources scanned. Re-measured: 26.7% of commits (16 of 60) TOUCH the corpus but only 3.4% (2 of 59 transitions) MOVE the count. The classifier behind the 25% counted the touch, not the move. The card's argument direction holds; the benefit is roughly a seventh of the claimed size. Also measured: engineTypes, declaredObjects and nonEngineCalls did not move once in the window - only scannedSources churned."
 },
 "bounded_in_place_fixes": [
 ".github/workflows/lint.yml - a CI comment quoting a live '534 tracked sources' de-quoted. Same defect class as this card (a scale number quoted where nothing checks it), mechanical, file already in this PR's diff, same gate family. Named in the PR body.",
 "scripts/tenant-audit-census.mjs docblock - '297 objects' de-quoted for the same reason."
 ],
 "governed_surface": "PR #13584 touches .claude/workflows/docs-accuracy-audit.js. Confirmed from the remote after pushing: draft=true, auto_merge=null, state=open, labels ['documentation','ci/cd','size/xl','skip-changeset'] intact. Not flipped ready, not queued, not merged."
}

---

Generated by Claude Code

[claude]

✅ ACCEPT — PR #13584 (head 82025f57c). ⛔ Governed surface: draft, un-armed, awaiting a human merge.

domain:devx PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC, R34 review.

Governed-surface state verified by this seat on the remote, not taken from the report: draft = true, auto_merge = null, state = open, and .claude/workflows/docs-accuracy-audit.js is in the diff. ⛔ Not flipped ready, ⛔ not queued, ⛔ never armed by this seat. It needs a human merge.

⭐ Both of my Zone 2 assumptions were falsified. Both falsifications improved the work.

A2.1 — "the sibling's split is transplantable" — FALSIFIED IN ITS MECHANISM.

I assumed check-system-context-census.mjs:77-84 was a pattern to copy. It is not: the sibling splits a list of regexes over a HAND-WRITTEN page, so it splits by simply not comparing some of them. This gate's enforced half is a byte-for-byte comparison of GENERATED text — there is no per-number comparison to drop, and bolting an unenforced list beside a byte-compare changes nothing, because the byte-compare still reds on the scale line.

⇒ The ruling's OUTCOME transplants; its MECHANISM does not. The dev implemented the outcome a different way — masking the unenforced values out of both sides of the comparison, with presence + dated-marker checks restoring what the sibling's required-to-match rows provide. ⭐ And it reported rather than stopped, because the ruling's outcome was still reachable. That is exactly the right call: a Zone 1 outcome with a Zone 2 mechanism that turns out false is a re-implementation, not a blocker.

⭐ The gate derives its unenforced labels from the generator's own corpusScaleRows, so the two cannot drift apart — the split is enforced by construction rather than by two lists agreeing.

A2.2 — "green long enough to be hand-merged" — PARTLY FALSIFIED, in the OPTIMISTIC direction.

I predicted ~7% residual population drift. Measured over the 60 most recent non-merge commits, by running the census at each of the 16 that touch the corpus and diffing rendered artefacts line by line: 3 of 59 transitions drifted at all — 2 scale-only, 1 real population drift.

⇒ residual = 1 in 59 = 1.7%, not ~7%. The split removes 2 of the 3 measured reds. Still nonzero inside a governed human-merge window, but ~4× better than I assumed.

⚠️ And the card's own headline number was corrected — downward, against the card's interest

The card's table says 25% of commits move sources scanned. Re-measured: 26.7% of commits TOUCH the corpus, but only 3.4% (2 of 59 transitions) MOVE the count. The classifier behind the 25% counted the touch, not the move.

⇒ The card's argument direction holds; the benefit is roughly a seventh of the claimed size. I carried that 25% into the decision box and into the dispatch without questioning it. Recording the correction here rather than letting the ruled card keep a 7×-inflated number.

Also measured: of the four scale figures, only scannedSources ever churned — engineTypes, declaredObjects and nonEngineCalls did not move once in the window.

⭐ The verification method deserves its own note

⛔ No tree mutation. Rather than mutating and restoring (where the restore leg can silently lie), the dev ran the pure checkPage(census, pageText, countsText) against a separate comparison worktree — nothing to restore, no restore leg to be wrong about.

And it is a genuine two-sided test, not a one-sided pass:

tree	result
pre-split gate + pre-split artefacts, one added source with no write call site	2 problems, both census-drift on the sources-scanned line (534 vs 535)
post-split gate + post-split artefacts, same tree	CLEAN
⭐ control — added source that does carry write call sites, scale drifted at the same time	14 problems, first being write call sites 215 vs 216

⇒ the scale moved by 2 and was ignored; the population moved by 1 and was caught. That is the ruling's split, demonstrated in both directions rather than asserted.

Self-test grew 10 → 19 cases, and the new ones pin the split both ways (a corpus-scale count and a stale date pass; a population figure, a deleted unenforced row, an undated block and a reworded unenforced claim all fail).

Bounded in-place fixes — reviewed and kept

Three, all the same defect class as this card (a scale number quoted where nothing checks it), all in files already in this PR's diff: a lint.yml comment quoting a live "534 tracked sources", the census script's docblock quoting "297 objects", and the PR body's own stale figures (214/41 → 215/9). ⭐ The historical ablation block in the PR body was left intact as the record of the run it describes — correct: it documents a past run, not a current claim.

⛔ Not re-opening the decision box

A2.2's 1.7% is available to the ruling's option-C paragraph, which asks for new measured data if residual drift "在拆分后仍持续撞人工合并窗口". That condition is about observed behaviour after the split lands — it has not been observed yet. ⇒ recorded here, ⛔ not re-presented as a decision. No option-C work was done, correctly.

Waiting on: a human merge. Nothing else blocks it.

---

Generated by Claude Code