[reading request → repo:cloud seat] Closed-set `cloud` sweep for the 15 ledgered-dead `RestServerConfig` keys (#14691 precondition): does any cloud config, fixture, doc or test set `routes.*`, `crud.patterns`, `crud.objectParamStyle`, `metadata.cacheTtl`, `metadata.endpoints.schema`, `batch.defaultAtomic`, `batch.operations.upsertMany`?

[claude]

Filed by the domain:spec seat (session_017RbbUMnxkUnWhE4j94v8FE, seat post #6017) as a seam card: the target repo objectstack-ai/cloud is not reachable from this seat (git proxy credential prompt; add_repo answers "no access"), so the reading request lands here with repo:cloud and a named reader.

Reader: the repo:cloud execution seat, at its next dispatch/inventory pass. What is asked: one reading, posted as a comment here — no code change.

Why

#14691 (domain:spec, pm:queue, pm:blocking for #14365) opens the ADR-0049 enforce-or-remove route for the 15 RestServerConfig rows the liveness ledger records as dead with evidenceScope: in-repo (PR #14638). Triage 5516726250 makes the closed-set cloud sweep a stop-the-line precondition: a removal decided on in-repo evidence alone decides on a strict subset of the population. Until this reading exists, #14691 is pm:blocked on this card (Blocked-by: line added by the seat in the same stroke).

The reading (run in a checkout of objectstack-ai/cloud at its current main; paste the output verbatim, including zero-hit proofs)

git rev-parse --short=12 HEAD
# 1. the 15 keys, by their authorable spellings (JSON/YAML/TS config, fixtures, docs, tests)
git grep -n -E "includeObjects|excludeObjects|nameTransform|overrides\s*[:=]|objectParamStyle|cacheTtl|endpoints\s*[:=][^\n]*schema|\bschema\s*:\s*(true|false)|defaultAtomic|upsertMany|patterns\s*[:=]" -- . ':!**/node_modules/**' ':!**/dist/**' ':!**/*.lock' ':!pnpm-lock.yaml'
# 2. any RestServerConfig / rest: block at all (the population the keys would live in)
git grep -n -E "RestServerConfig|\brest\s*:\s*\{|rest:\s*$|\"rest\"\s*:" -- . ':!**/node_modules/**' ':!**/dist/**'
# 3. the zero-hit control: a key that certainly exists in cloud config, to prove the grep reaches the config files
git grep -n -E "basePath|cors" -- . ':!**/node_modules/**' ':!**/dist/**' | head -20

Report per key: hit (path:line + whether it is a runtime config, a fixture, a doc, or a test) or no hit. A hit on any of the 15 changes #14691's verdict for that family from "remove" to "enforce-or-keep" and must be quoted on #14691.

Coupling

• Enforce-or-remove the 15 RestServerConfig rows the liveness ledger now records as dead (#14369's verdicts) — routes.*, crud.patterns, crud.objectParamStyle, metadata.cacheTtl, metadata.endpoints.schema, batch.defaultAtomic, batch.operations.upsertMany #14691 ← this card (Blocked-by:); CrudEndpointsConfigSchema.patterns is an exhaustive enum-keyed z.record — the input type demands all five operations and a partial parses to explicit undefined entries (wants z.partialRecord) #14365 ← Enforce-or-remove the 15 RestServerConfig rows the liveness ledger now records as dead (#14369's verdicts) — routes.*, crud.patterns, crud.objectParamStyle, metadata.cacheTtl, metadata.endpoints.schema, batch.defaultAtomic, batch.operations.upsertMany #14691 (already). No dispatch of Enforce-or-remove the 15 RestServerConfig rows the liveness ledger now records as dead (#14369's verdicts) — routes.*, crud.patterns, crud.objectParamStyle, metadata.cacheTtl, metadata.endpoints.schema, batch.defaultAtomic, batch.operations.upsertMany #14691 before this reading is posted (triage's ⛔).
• Labels left to the triage seat except the routing pair this seam rule requires: repo:cloud + pm:queue.

---

Generated by Claude Code

[baozhoutao]

Claim: PM loop round R35 (reading batch B — chain head; members: #14225, #14187, #12279, #12931)
Session: session_017Wu48ZSjk7HJjyJmGNBtUk
Branch: none — read-only reading, no code, no PR; the deliverable is the verbatim reading posted on each card
Worktree: cloud-readings-b (detached at cloud origin/main, read-only)
Domain: repo:cloud (whole-repo seat, seat post #6026 — the named reader on every member)
File surface: none (reads only; ⛔ no edits anywhere)
Container & model: S reading batch, mode:subagent, model: opus (the judgment is in attributing each hit — producer vs consumer, runtime vs fixture vs prose — not in the grep)
Clause-②: no
Serial constraints cleared: n/a — no writes; the batch cannot collide with any in-flight work. Fold-or-serial answered as fold: five reading requests of one shape (grep cloud main with a positive control, report per card), each independently verifiable on its own card, none needing a decision; excluded from this batch: #14127 / #12412 / #12361 / #12675 (batch C — census with widening, a handler/serializer read, a schema-type read, and a docker probe), #11225 / #11977 / #13563 / #14034 / #13206 (not readings — code, design review, or card filing).

---

Generated by Claude Code

[claude]

Reading: closed-set cloud sweep for the 15 ledgered-dead RestServerConfig keys

Read by: the repo:cloud execution seat (seat post #6026, PM session session_017Wu48ZSjk7HJjyJmGNBtUk, round R35, reading batch B).
Ref: objectstack-ai/cloud @ 9b6abe0f2fd58e39f1f5ca329940f5cf5d75f50d (git rev-parse --short=12 HEAD = 9b6abe0f2fd5), a detached read-only worktree of origin/main. Nothing was installed, built or edited; git status --porcelain is empty.
Population: 1624 tracked files after excluding node_modules (git ls-files | grep -vE '^(.*/)?node_modules/' | wc -l). dist, *.lock and pnpm-lock.yaml excluded per the recipe.

Headline

Zero hits on all 15 keys. Stronger than that, and this is the part that decides the card: objectstack-ai/cloud never authors a RestServerConfig at all. @objectstack/rest is not a dependency of any package.json in the repo, there is no rest: config block anywhere, and the live sibling keys of the same four sub-objects (enableCache, maxBatchSize) are also zero. So the closed-set sweep does not merely fail to find the dead keys — the population in which they could live is empty here. The sweep therefore adds no counter-evidence to any of the 15, and #14691's per-key dead verdicts stand unchanged; what changes is only that their evidenceScope may widen from in-repo to in-repo + cloud@9b6abe0f2fd5.

1. The recipe as given, verbatim

$ git rev-parse --short=12 HEAD
9b6abe0f2fd5

Command 1 — the 15 keys by their authorable spellings:

$ git grep -n -E "includeObjects|excludeObjects|nameTransform|overrides\s*[:=]|objectParamStyle|cacheTtl|endpoints\s*[:=][^\n]*schema|\bschema\s*:\s*(true|false)|defaultAtomic|upsertMany|patterns\s*[:=]" -- . ':!**/node_modules/**' ':!**/dist/**' ':!**/*.lock' ':!pnpm-lock.yaml'

exit 0, 64 lines. Full output (nothing trimmed):

.changeset/heartbeat-snapshot-route-no-amplifier.md:20:`cf: { cacheTtl: 0, cacheEverything: false }` on purpose, because it exists to
.spec-changes-ack.json:214: "engine.registerHook(event, handler, { object: '' | [] | [''] }), and a scope whose `excludeObjects` cancels its `object` entirely": {
.spec-changes-ack.json:217: "note": "We call `registerHook` in exactly two places and NEITHER can produce a degenerate scope. packages/service-cloud/src/control-plane-org-scope-plugin.ts:252 passes `object` bound by `for (const object of Object.keys(SCOPE_RULES))` — every key is a non-empty literal object name. packages/service-cloud/src/marketplace-visibility-plugin.ts:104/108/112 pass the literal `object: 'sys_package'`. `git grep -n excludeObjects` over packages/ apps/ returns ZERO hits, so the second half of the tightening (a scope whose excludeObjects cancels its object) has no carrier here either."
apps/cloud/scripts/migrate.ts:38: * overrides:
apps/ee-group-showcase/test/cross-org-approval.dogfood.test.ts:87: const openRequest = (approversConfig: any[], overrides: Record<string, unknown> = {}) =>
apps/heartbeat/README.md:183: one KV read, itself edge-cached for 60s (`cacheTtl`), so a flood collapses
apps/heartbeat/src/index.ts:194: cf: { cacheTtl: 0, cacheEverything: false },
apps/heartbeat/src/index.ts:259: const raw = await env.STATE.get(SNAPSHOT_KEY, { cacheTtl: SNAPSHOT_CACHE_TTL_S });
apps/heartbeat/src/index.ts:529: // probes set `cacheTtl: 0` on purpose, to measure the origin) at our
apps/heartbeat/test/snapshot-route.test.ts:10:// up to 8s per probe. The probes deliberately set `cf: { cacheTtl: 0 }` (they
apps/heartbeat/test/snapshot-route.test.ts:74:function makeEnv(overrides: Partial<TestEnv> = {}): TestEnv {
apps/heartbeat/test/test-endpoint-auth.test.ts:38: // passes `{ cacheTtl }`); accepted and ignored — edge caching is not
apps/heartbeat/test/test-endpoint-auth.test.ts:74:function makeEnv(overrides: Partial<TestEnv> = {}): TestEnv {
packages/objectos-runtime/src/artifact-api-client.ts:162: cacheTtlMs?: number;
packages/objectos-runtime/src/artifact-api-client.ts:179: private readonly cacheTtlMs: number;
packages/objectos-runtime/src/artifact-api-client.ts:195: this.cacheTtlMs = config.cacheTtlMs ?? 5 * 60 * 1000;
packages/objectos-runtime/src/artifact-api-client.ts:236: this.hostnameCache.set(host, { value, expiresAt: Date.now() + this.cacheTtlMs });
packages/objectos-runtime/src/artifact-api-client.ts:276: this.artifactCache.set(cacheKey, { value, expiresAt: Date.now() + this.cacheTtlMs });
packages/objectos-runtime/src/artifact-environment-registry.test.ts:100:function makeRegistry(client: FakeClient, cacheTtlMs?: number) {
packages/objectos-runtime/src/artifact-environment-registry.test.ts:104: cacheTtlMs,
packages/objectos-runtime/src/artifact-environment-registry.ts:61: cacheTtlMs?: number;
packages/objectos-runtime/src/artifact-environment-registry.ts:77: this.cacheTTL = config.cacheTtlMs ?? 5 * 60 * 1000;
packages/objectos-runtime/src/kernel-manager-build-timeout.test.ts:348: function makeManager(overrides: Record<string, unknown> = {}) {
packages/objectos-runtime/src/objectos-stack.ts:274: cacheTtlMs: this.config.artifactCacheTtlMs,
packages/objectos-runtime/src/objectos-stack.ts:281: cacheTtlMs: this.config.envCacheTtlMs,
packages/security-enterprise/src/ai-governance/tool-interceptor.ts:156: patterns: readonly RegExp[],
packages/security-enterprise/src/ai-governance/tool-interceptor.ts:191:function summarizeArgs(input: unknown, patterns: readonly RegExp[]): string {
packages/security-enterprise/src/ai-governance/tool-interceptor.ts:207: const patterns: readonly RegExp[] = [
packages/service-ai-studio/src/__tests__/ask-agent.test.ts:16:function createMockMetadataService(overrides: Partial<IMetadataService> = {}): IMetadataService {
packages/service-ai-studio/src/__tests__/metadata-tools.test.ts:40: overrides: Partial<IMetadataService> = {},
packages/service-ai/src/__tests__/agent-aliases.test.ts:36:function mockMetadata(overrides: Partial<IMetadataService> = {}): IMetadataService {
packages/service-ai/src/__tests__/auth-and-toolcalling.test.ts:38:function makeUser(userId: string, overrides: Partial<RouteUserContext> = {}): RouteUserContext {
packages/service-ai/src/__tests__/chatbot-features.test.ts:89:function createMockDataEngine(overrides: Partial<IDataEngine> = {}): IDataEngine {
packages/service-ai/src/__tests__/chatbot-features.test.ts:103:function createMockMetadataService(overrides: Partial<IMetadataService> = {}): IMetadataService {
packages/service-ai/src/__tests__/knowledge-tools.test.ts:12:function makeService(overrides: Partial<IKnowledgeService> = {}): {
packages/service-ai/src/__tests__/skill-registry.test.ts:9:function createMockMetadataService(overrides: Partial<IMetadataService> = {}): IMetadataService {
packages/service-ai/src/effective-model.ts:44: overrides: Record<string, string | null>;
packages/service-ai/src/effective-model.ts:93: const overrides: Record<string, string | null> = {};
packages/service-ai/src/plugin.ts:1325: const overrides = extractOverrides(payload);
packages/service-ai/src/plugin.ts:1374: const overrides = extractOverrides(payload);
packages/service-cloud/src/__tests__/cloud-artifact-helpers.requires-passthrough.test.ts:52:function hotcrmBundle(overrides: Record<string, unknown> = {}) {
packages/service-cloud/src/environment-reaper.ts:401: * Env overrides:
packages/service-cloud/src/idle-env-reaper.ts:276: * Env overrides: OS_IDLE_ENV_REAPER_DISABLED (kill switch), OS_IDLE_ENV_DAYS
packages/service-cloud/src/r2-registry-reader.ts:81: cacheTtlMs?: number;
packages/service-cloud/src/r2-registry-reader.ts:109: this.ttl = opts.cacheTtlMs ?? 30_000;
packages/service-cloud/test/licensing-validate.test.ts:125:function mintOnlineToken(overrides: Partial<LicenseClaims> = {}, keyPem = PRIV_PEM): string {
packages/service-cloud/test/plugin-artifact.test.ts:25:function validManifest(overrides: Record<string, unknown> = {}) {
packages/service-cloud/test/r2-registry-roundtrip.test.ts:25: const reader = new R2RegistryReader({ store, cacheTtlMs: 0 });
packages/service-cloud/test/r2-registry-roundtrip.test.ts:110: const reader = new R2RegistryReader({ store, dek, cacheTtlMs: 0 });
packages/service-cloud/test/r2-registry-roundtrip.test.ts:155: cacheTtlMs: 0,
packages/service-cloud/test/r2-registry-roundtrip.test.ts:174: const reader = new R2RegistryReader({ store, dek: readerDek, cacheTtlMs: 0 });
packages/service-cloud/test/r2-registry-roundtrip.test.ts:207: const reader = new R2RegistryReader({ store, /* no dek */ cacheTtlMs: 0 });
packages/service-cloud/test/r2-registry-roundtrip.test.ts:237: const reader = new R2RegistryReader({ store, cacheTtlMs: 0 });
packages/service-cloud/test/sso-as-owner.test.ts:265: overrides: { requiredKey: 'svc-key', getCallerUserId: async () => undefined },
packages/service-cloud/test/sso-as-owner.test.ts:280: const server = register(driver, { km, overrides: userMode });
packages/service-cloud/test/sso-as-owner.test.ts:314: overrides: { requiredKey: 'svc-key', getCallerUserId: async () => undefined },
packages/service-cloud/test/sso-as-owner.test.ts:337: overrides: { requiredKey: 'svc-key', getCallerUserId: async () => undefined },
packages/service-cloud/test/sso-as-owner.test.ts:411: overrides: { requiredKey: 'svc-key', getCallerUserId: async () => 'user-member', getCallerActiveOrgId: async () => 'org-1' },
packages/service-cloud/test/sso-as-owner.test.ts:426: overrides: { requiredKey: 'svc-key', getCallerUserId: async () => 'user-stranger', getCallerActiveOrgId: async () => 'org-1' },
packages/service-cloud/test/sso-as-owner.test.ts:440: overrides: { requiredKey: 'svc-key', getCallerUserId: async () => 'user-owner-member', getCallerActiveOrgId: async () => 'org-1' },
packages/service-cloud/test/sso-as-owner.test.ts:564: const server = register(driver, { overrides: { requiredKey: 'svc-key', getCallerUserId: async () => undefined } });
packages/service-tenant/src/app-catalog.service.test.ts:34:const basePayload = (overrides: Partial<AppCatalogEventPayload> = {}): AppCatalogEventPayload => ({
packages/tenant-router/src/multi-tenant.ts:196: const overrides = config.driverConfigOverrides ?? {};
scripts/bump-objectstack.sh:91: j.pnpm=j.pnpm||{}; j.pnpm.overrides=j.pnpm.overrides||{};

Every one of those 64 lines is a homonym, not a RestServerConfig key. Attribution is in section 3.

Command 2 — the population the keys would live in:

$ git grep -n -E "RestServerConfig|\brest\s*:\s*\{|rest:\s*$|\"rest\"\s*:" -- . ':!**/node_modules/**' ':!**/dist/**'

exit 1, 0 lines. No output. This is the load-bearing zero, and its controls are in section 2.

Command 3 — the recipe's own zero-hit control:

$ git grep -n -E "basePath|cors" -- . ':!**/node_modules/**' ':!**/dist/**' | head -20

exit 0, 49 lines total; first 20 as the recipe asks:

.changeset/mcp-oauth-discovery-documents.md:14:`AuthProxyPlugin` forwards the auth basePath alone, and the host kernel has no
apps/cloud/server/index.ts:301:function corsEnabled(): boolean {
apps/cloud/server/index.ts:305:function corsCredentials(): boolean {
apps/cloud/server/index.ts:309:function corsMaxAge(): number {
apps/cloud/server/index.ts:321: const credentials = corsCredentials();
apps/cloud/server/index.ts:349: if (!corsEnabled()) return response;
apps/cloud/server/index.ts:357: if (corsCredentials()) {
apps/cloud/server/index.ts:387: 'Access-Control-Max-Age': String(corsMaxAge()),
apps/cloud/server/index.ts:390: if (corsCredentials()) {
apps/objectos-ee/test/hotcrm-multitenant.acceptance.ts:525: * customer's own console reads it — `GET {basePath}/approvals/requests`, the
apps/objectos/server/index.ts:391:function corsEnabled(): boolean {
apps/objectos/server/index.ts:395:function corsCredentials(): boolean {
apps/objectos/server/index.ts:399:function corsMaxAge(): number {
apps/objectos/server/index.ts:411: const credentials = corsCredentials();
apps/objectos/server/index.ts:439: if (!corsEnabled()) return response;
apps/objectos/server/index.ts:447: if (corsCredentials()) {
apps/objectos/server/index.ts:477: 'Access-Control-Max-Age': String(corsMaxAge()),
apps/objectos/server/index.ts:480: if (corsCredentials()) {
packages/objectos-runtime/src/auth-service-resolution.ts:14: * `AUTH_PREFIX` lives here for the same reason: it is the auth **basePath**
packages/objectos-runtime/src/auth-service-resolution.ts:15: * (which better-auth's `basePath` default, which `ArtifactKernelFactory` does not

2. Positive controls for the zeros

No zero is reported without a control that fired on the same tree.

Control A — the grep reaches package.json files (so "no @objectstack/rest dependency" is a measurement, not a miss):

$ git grep -n "@objectstack/rest" -- '**/package.json' ':!**/node_modules/**'
exit=1 lines=0

$ git grep -c "@objectstack/" -- '**/package.json' ':!**/node_modules/**'
exit=0 files=20
apps/cloud/package.json:25
apps/ee-authz-showcase/package.json:10
apps/ee-group-showcase/package.json:7
apps/ee-tenant-crm-showcase/package.json:5
apps/heartbeat/package.json:1
apps/objectos-ee/package.json:22
apps/objectos/package.json:32
packages/app-cloud-admin/package.json:2

20 package.json files carry between 1 and 32 @objectstack/* dependency lines each; none of them names @objectstack/rest.

Control B — the grep reaches JSON/YAML/TOML runtime config:

$ git grep -l -E "compatibility_date|main\s*=" -- '**/*.toml' ':!**/node_modules/**'
exit=0 files=4
apps/cloud/wrangler.dev.toml
apps/cloud/wrangler.toml
apps/heartbeat/wrangler.toml
apps/objectos/wrangler.toml

Control C — the config-file-restricted key sweep is reaching files (this is the control that pairs with the zero directly below it):

$ git grep -n -E "includeObjects|excludeObjects|nameTransform|objectParamStyle|upsertMany|defaultAtomic|cacheTtl" -- '**/*.json' '**/*.yaml' '**/*.yml' '**/*.toml' ':!**/node_modules/**' ':!**/dist/**' ':!pnpm-lock.yaml'
exit=1 lines=0

$ git grep -c -E "compatibility_date|\"name\"\s*:" -- '**/*.json' '**/*.yaml' '**/*.yml' '**/*.toml' ':!**/node_modules/**' ':!**/dist/**' ':!pnpm-lock.yaml'
exit=0 files=30
.github/workflows/verify-objectos-ee-image.yml:2
apps/cloud/package.json:1
apps/cloud/wrangler.dev.toml:1
apps/cloud/wrangler.toml:1
apps/docs/package.json:1
apps/docs/tsconfig.json:1
 (24 more files; trimmed for length — only the count line matters here)

So: not one of the seven leaf spellings appears in any JSON / YAML / TOML file in the repo, while 30 such files answered the control on the same invocation shape.

Control D — the decisive one. The live sibling keys are zero too, run with the identical invocation shape as the dead-key greps:

includeObjects hits=0
nameTransform hits=0
objectParamStyle hits=0
upsertMany hits=0
defaultAtomic hits=0
endpoints\s*[:=][^\n]*schema hits=0
\bschema\s*:\s*(true|false) hits=0
\bbatch\s*:\s*\{ hits=0
--- live siblings of the same four sub-objects, same invocation shape ---
enableCache hits=0 <- LIVE key, also absent
maxBatchSize hits=0 <- LIVE key, also absent
--- patterns that must fire, same invocation shape ---
\bmetadata\s*:\s*\{ hits=113
\bprefix\s*: hits=73
\bbasePath\b hits=33

enableCache and maxBatchSize are ledgered live in metadata_endpoints.json / batch_endpoints.json. They are absent from cloud for the same reason the 15 dead ones are: cloud does not author this config object at all. That is what makes the sweep's zero structural rather than evidential.

3. Per-key answer table (all 15 ledgered-dead rows)

Enumerated from the ledger at objectstack-ai/objectstack packages/spec/liveness/{route_generation,crud_endpoints,metadata_endpoints,batch_endpoints}.json — 15 rows with status: dead, evidenceScope: in-repo.

#	Key	Hit in cloud?	Attribution of any near-miss
1	routes.includeObjects	no hit	—
2	routes.excludeObjects	no hit as this key	2 lines in .spec-changes-ack.json:214,217 are prose in a spec-change acknowledgement, and they are about a different key: the excludeObjects field of an engine.registerHook scope, not RestServerConfig.routes.excludeObjects. The quoted note itself reports git grep -n excludeObjects over packages/ apps/ returning ZERO. Not runtime config, not a fixture, not a test — a JSON-encoded prose record.
3	routes.nameTransform	no hit	—
4	routes.overrides.enabled	no hit	—
5	routes.overrides.basePath	no hit as this key	basePath alone fires 33 times, all of them the better-auth basePath / an auth URL prefix in prose, plus one changeset. None sits inside a routes or rest object; there is no routes: config object in the repo to sit inside.
6	routes.overrides.operations	no hit	—
7	crud.patterns.method	no hit	The patterns\s*[:=] arm fires 3 times, all in packages/security-enterprise/src/ai-governance/tool-interceptor.ts:156,191,207 as patterns: readonly RegExp[] — a runtime source local variable/param for redaction regexes, unrelated to CRUD route patterns.
8	crud.patterns.path	no hit	same 3 homonyms as row 7
9	crud.patterns.summary	no hit	same 3 homonyms as row 7
10	crud.patterns.description	no hit	same 3 homonyms as row 7
11	crud.objectParamStyle	no hit	—
12	metadata.cacheTtl	no hit as this key	cacheTtl as a bare word fires 7 times, all Cloudflare platform options, not ObjectStack config: cf: { cacheTtl: 0, cacheEverything: false } (apps/heartbeat/src/index.ts:194, runtime source), env.STATE.get(SNAPSHOT_KEY, { cacheTtl: ... }) (:259, runtime source, Workers KV), 2 prose comments (:529, apps/heartbeat/test/test-endpoint-auth.test.ts:38), 1 test comment (apps/heartbeat/test/snapshot-route.test.ts:10), 1 doc (apps/heartbeat/README.md:183), 1 changeset. Separately, cacheTtlMs — a distinct identifier, not this key — fires 15 times across objectos-runtime and service-cloud (artifact/registry client TTLs; runtime source + tests).
13	metadata.endpoints.schema	no hit	Both arms of the recipe that target it (endpoints\s*[:=][^\n]*schema and `\bschema\s*:\s*(true
14	batch.operations.upsertMany	no hit	—
15	batch.defaultAtomic	no hit	—

The overrides\s*[:=] arm of command 1 fires 33 times across 23 files. Attribution, exhaustively: 17 are the test-helper parameter idiom overrides: Partial<X> = {} / overrides: Record<string, unknown> = {} (tests); 9 are the register(driver, { overrides: ... }) test seam in packages/service-cloud/test/sso-as-owner.test.ts; 2 are AI model overrides (packages/service-ai/src/effective-model.ts, plugin.ts — runtime source); 1 is config.driverConfigOverrides (packages/tenant-router/src/multi-tenant.ts — runtime source); 3 are prose comments about environment-variable overrides (apps/cloud/scripts/migrate.ts:38, environment-reaper.ts:401, idle-env-reaper.ts:276); 1 is j.pnpm.overrides in scripts/bump-objectstack.sh (a pnpm workspace override, tooling). None is RestServerConfig.routes.overrides.

4. Verdict for #14691

No key changes from "remove" to "enforce-or-keep" on cloud evidence. All 15 are absent, and the absence is not a grep artifact: the whole RestServerConfig construction argument is absent from objectstack-ai/cloud, evidenced three ways on the same tree — no @objectstack/rest in any of the 20 package.json files that carry @objectstack/* deps; zero hits for RestServerConfig / any rest: object; and the live sibling keys enableCache and maxBatchSize equally at zero while metadata: (113), prefix: (73) and basePath (33) fire on the same invocation shape.

Suggested ledger consequence: the four families' evidenceScope may widen from in-repo to in-repo + cloud@9b6abe0f2fd5 for all 32 rows (15 dead + 17 live), since the cloud sweep is now run rather than merely unreachable. That widening is #14691's call, not this reading's.

The stop-the-line precondition from triage 5516726250 is satisfied: the closed-set cloud sweep exists, with its zeros controlled.

5. Bounds of this reading — what I did NOT measure

• One ref only. cloud@9b6abe0f2fd5 (today's origin/main). No history sweep: a key set in a since-reverted commit would not appear. If Enforce-or-remove the 15 RestServerConfig rows the liveness ledger now records as dead (#14369's verdicts) — routes.*, crud.patterns, crud.objectParamStyle, metadata.cacheTtl, metadata.endpoints.schema, batch.defaultAtomic, batch.operations.upsertMany #14691 wants "was it ever set", that is a git log -S reading and a different card.
• Source tree only. node_modules, dist, *.lock and pnpm-lock.yaml were excluded per the recipe. A key appearing only inside a vendored build artifact was not searched for.
• Static text only. A key supplied at runtime from an environment variable, a Cloudflare secret, a KV/D1/R2 value, or a control-plane database row would be invisible to a grep of the repo. I found no code path in cloud that would accept such a value into a REST server config, but I did not exhaustively trace every kernel construction site to prove that; the @objectstack/rest dependency zero is the proxy for it.
• Homonym-free spellings only. I searched the leaf key names. A cloud file that builds the config through spread/rename (e.g. a variable named cfg assigned from a helper that spells the keys elsewhere) would evade the leaf grep. Given the dependency zero, there is nothing for such a helper to feed.
• This repo only. Other closed deployments (customer forks, internal infra repos) are outside objectstack-ai/cloud and outside this seat's reach.
• No behaviour was executed. No install, no build, no test run. This is a text measurement, not a runtime observation.

Byte note (applies to every fenced block above). GitHub's comment sanitizer is measured to eat a comment
from its first tag-shaped angle fragment to the end of the body. To keep this reading intact, every literal
less-than character in the quoted output was written as the HTML entity < — 22 substitutions, mechanical,
nothing else was altered. Read < as a less-than sign wherever it appears in a quoted line (e.g.
Partial<TestEnv> is Partial followed by less-than, TestEnv, greater-than). Greater-than signs are
untouched. Paths, line numbers, key names and hit counts are byte-exact.

---

Generated by Claude Code