test(cli): derive the always-on slate boundary instead of pinning slice(0, 6)

[claude]

Fixes#11415

The third home of the literal pin #11046 retired — and the one whose comment stated the retired instruction most explicitly: "the list may grow beyond them (e.g. sharing) without churning this assertion, so we pin the prefix rather than the whole array." That instruction is the defect (#10250): an entry added past index 5 lands outside everything holding its position, which is exactly how sms came to sit at index 6 held by nothing. Widening the slice to slice(0, 7) would have been the same defect with a fresher number.

What changed

packages/cli/test/serve-defaults.test.ts — the one file in the diff. The literal prefix assertion is replaced by the derived-rule shape #11046 landed at the other two homes (platform-capabilities.test.ts in @objectstack/spec, commit 68e8b4b5; case 5 of serve-settings-ordering.pin.test.ts), transplanted rather than reinvented:

• BIND_TARGETS as a role — the always-on entries other entries bind into during their own kernel:ready phase — never a count;
• one shared orderingViolations predicate, so the pin and its controls cannot drift apart;
• a floor case (every bind target is on the slate — without it the rule constrains less without failing, and with every target gone it would constrain nothing and still pass);
• the derived boundary itself, with a non-vacuity check that the tail is non-empty;
• a falsifiability case carrying two positive controls: a hostile slate with settings mounted last, and the growth case the retired literal structurally could not see.

Run here over Serve.ALWAYS_ON_CAPABILITIES — the re-export serve actually appends to an app's requires. That is what this copy adds over the spec-side pin; the comment says so, and says what it deliberately does not try to cover (the membership of BIND_TARGETS, which serve-settings-ordering.pin.test.ts keeps honest by resolving the real plugin classes).

Ablation — the interesting direction is GROWTH, and it was predicted before it was run

Predictions were written down first (PREDICTIONS.txt, quoted verbatim in the report on the issue) and all four legs matched; nothing was fitted afterwards.

Mutation: a seventh foundational member os_ablation_secrets inserted into the always-on slate immediately after settings — legitimate growth of the bind-target block.

leg	test form	slate	predicted	measured
A	derived (this PR)	mutated	PASS	Tests 7 passed (7), exit 0
B	literal slice(0, 6) (origin/main text)	mutated	FAIL	Tests 1 failed / 4 passed, exit 1
C	literal slice(0, 6)	restored	PASS	Tests 5 passed (5), exit 0 — today's vacuous green
D	derived (this PR)	restored	PASS	Tests 7 passed (7), exit 0

Leg B's diff is the whole card in six lines:

 [
"queue", "job", "cache", "settings",
+ "os_ablation_secrets",
"email",
- "storage",
]

Resolution and how the mutation was proved on disk.packages/cli does not alias @objectstack/spec (packages/cli/vitest.config.ts aliases only service-cache, create-objectstack/created-summary and plugin-auth), so serve.ts resolves @objectstack/spec/kernel through that package's exports to packages/spec/dist/. The mutation was therefore applied to the resolved artifact itself, in all 8 non-map dist files carrying the slate — so the src-to-dist gap the rebuild step exists to close is not merely closed but absent. Both instruments confirmed it before any colour was believed:

• node scripts/ablation-dist-preflight.mjs @objectstack/spec os_ablation_secrets — "marker present in 8 built files -- the ablation is live in the artifact the suite consumes."
• property read of the built artifact: slate len 11 | index of marker 4 | ["queue","job","cache","settings","os_ablation_secrets","email",...]

The restore leg was run too, not skipped: ... --absent reported "marker absent from all 209 built files", the property read returned restored slate len 10 | marker index -1, and the script carried trap restore EXIT INT TERM throughout. Each test-form swap was proved on disk by grepping both texts (ALWAYS_ON_CAPABILITIES.slice(0, 6) = 1 / orderingViolations = 0 for the literal form; 0 / 4 for the derived form) rather than trusting an editor's exit code.

Verification — all on ef32d56e, the final commit, working tree clean

Every gate below was derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (11 path-matched + 6 convention-triggered families), not from a hand-built list. Each line quotes the gate's own verdict, and exit codes were captured before any pipe.

gate	verdict
pnpm lint (repo-wide eslint . --no-inline-config)	exit 0 — 5325 files linted, 0 errors, 0 warnings (count read from --format json, not estimated)
pnpm --filter @objectstack/cli exec vitest run test/serve-defaults.test.ts	Test Files 1 passed (1) / Tests 7 passed (7)
pnpm --filter @objectstack/cli typecheck	exit 0 (tsc --noEmit, silent)
check:nul-bytes	OK (scanned 6489 text file(s) ... no raw ASCII control bytes)
check:i18n	check-i18n-bundles: OK (9 package(s) — all bundles in sync, no undeclared authoring keys)
check:i18n-coverage	check-i18n-coverage: OK (12 config(s), 602 baselined untranslated string(s), none new)
check:published-files	69 publishable package(s) ... declare a files whitelist ...
check:slot-lookup	slot-lookup ratchet holds: 107 unswept site(s) in 25 file(s), none new
check:test-source-alias	OK — 72 packages with tests scanned; 61 registered as still resolving a workspace dep through dist/
check:type-check-coverage	exit 0
check:type-check-debt	--re-measure: OK — 32 ledger entr(ies) re-measured in 248.0s, 1897 raw tsc error(s) total, none above its recorded number
check:type-source-resolution	OK — 77 packages with a tsconfig.json scanned
check:query-options-erasure	ratchet holds: 67 unswept non-test site(s) in 17 file(s), none new
check:engine-double-contract	OK — 397 pinned, 133 in the DEBT ledger, 2 exempt
check:cross-package-test-inputs	OK: 16 package(s) read outside themselves, all declared
check:where-matcher	conformance holds: 292 matcher(s) discovered ... 0 silently-wrong
check-ci-filter-parity.mjs	OK: all 95 declared cross-package glob(s) ... covered
check-plugin-teardown-shape.mjs	63 Plugin implementation(s) across 4578 source(s) ... baseline fully burned down
scripts/docs-audit/check-affected-docs.mjs	exit 0

check:i18n and check:i18n-coverage both refused on first invocation (PREREQUISITE NOT MET — the workspace CLI is not built, then COULD NOT MEASURE — 1 of 12 config(s) failed to lint). Those refusals are recorded as NOT MEASURED and the gates were re-run after turbo run build; the verdicts in the table are from the runs that actually measured.

check:type-check-debt reports two pre-existing surplus entries (plugin-approvals 348→347, runtime 227→226) that predate this branch and are untouched by a one-file test change — informational, not errors, and not lowered here.

Changeset

None, deliberately: the diff is a single test file, so nothing published changes and there is no user-visible behaviour to describe. skip-changeset is applied.

Not in this PR

The issue also names a stale sentence in packages/services/service-sms/src/sms-plugin.ts ("one past the pinned slice(0, 6)", present tense about a pin that no longer exists). It sits in a second package, outside this card's declared file surface, and carrying it would widen this PR's verification surface for a comment with no behaviour — so it is tracked separately at #11594, filed unassigned. That item is out of scope here and #11594 remains open.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.