fix(rest): a provider seam that throws synchronously no longer discards the whole execution context

[claude]

Fixes#13280

At RestServer.computeExecCtx, a host-wired provider that throws synchronously discarded the entire execution context — identity included — while the same provider failing as a rejected promise was absorbed and the caller was served. One fault, two wire answers, chosen by whether the host happened to spell its provider async.

The mechanism

The seams read provider(environmentId).catch(() => undefined). That handler is attached to the promise the call returns, so it can only ever see a rejection. A provider that throws before returning a promise — an ordinary non-async function, which the seam's own declared type (taking an optional environment id and returning a promise) cannot stop a host from wiring — throws while the expression is still being evaluated. There is no promise to attach to, the .catch is never reached, and the throw lands in computeExecCtx's outer catch, which returns no context at all.

Measured, before and after

Real RestServer, real registerPackageRoutes wired the way rest-api-plugin.ts wires it. Both callers hold a valid session and identical grants; the rows differ only in how the provider fails. The "before" column was re-measured by ablating this change on disk at this same commit, not quoted from the card.

seam	fails as	before	after
settingsServiceProvider	rejecting promise	200	200
settingsServiceProvider	synchronous throw	401 UNAUTHENTICATED	200
objectQLProvider	rejecting promise	403	403
objectQLProvider	synchronous throw	401 UNAUTHENTICATED	403
authServiceProvider	rejecting promise	401	401
authServiceProvider	synchronous throw	401	401

Two findings beyond the card: objectQLProvider diverged too (403 vs 401) and was not in the card's table; and authServiceProvider, though mechanically asymmetric, was never observably so — an absorbed auth provider yields nothing and the next line already returns no context.

What was normalised, and what deliberately was not

Normalised — the six seams inside computeExecCtx that call-then-.catch, now routed through one seamOrUndefined helper that invokes the provider inside a try: both kernel.getServiceAsync('auth') sites, authServiceProvider, kernel.getServiceAsync('objectql'), objectQLProvider, settingsServiceProvider.

Deliberately NOT touched:

• kernelManager.getOrCreate() and authService.getApi() — these carry no seam .catch at all, so they lose the context in both directions. They are already symmetric; giving them a swallow would be a new policy, not a normalisation.
• computeExecCtx's outer catch. Whether a post-identity fault should discard identity is the second of the two directions the finding recorded — a behaviour change on a public door, of the class [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 deferred, and still unruled. This change is decision-independent: under any answer to that question, one fault yielding 200 or 401 depending on how the host spelled its provider is a defect.
• Every seam of this shape elsewhere in rest-server.ts — other doors, out of this card's scope.

The branded permission-store outage is unaffected and pinned as such: AuthzStoreUnavailableError has exactly one construction site (tryFind, in resolve-authz-context.ts), reached from resolveAuthzContext — downstream of every seam here — so no normalised seam sits on its path.

Tests

packages/rest/src/package-door-execctx-fault-reachability.test.ts section 7 is inverted in place, not re-baselined: it asserted the divergence, and the superseded text is quoted beside the new assertions. It now pins agreement and the agreed value per seam, plus a guard that the three seams do not agree with each other (200 / 403 / 401) — so a future blanket-swallow regression, where every seam degrades to a served 200, fails this section instead of passing it.

SETTINGS_PROVIDER_SYNC_THROW is consequently gone from the section-2 class table — it is no longer a context-lost class — with a block in its place explaining why re-adding it would assert that a repaired seam is still broken.

• pnpm --filter @objectstack/rest test — 164 files, 2761 tests passed, at the final head 689001179d.
• pnpm --filter @objectstack/rest typecheck — green; check:test-typecheck OK, test-layer debt unchanged at 1 file / 2 errors / 1 pinned signature (shrink-only).
• Ablation, direction predicted in writing first: reverting only rest-server.ts to its pre-change bytes turns exactly the 5 predicted pins red and nothing else. Mutation proven on disk by blob hash (c600acc4 to b58d2056) and by the seamOrUndefined count going 7 to 0; restore proven by hash equality, empty git diff HEAD and clean git status --porcelain.
• The 500 that appears in the write cohort once identity is restored is the harness's own healthy answer (PACKAGE_DELETE_FAILED from its stub), measured identically before and after this change — not something this change introduced.

Census

packages/rest/src/execctx-consumer-census.test.ts did not move: its counts (75 sites, 95 mentions, 16/22/53) are unchanged and the file passes untouched.

A different census did move — content/docs/permissions/system-context.mdx, the generated anchor table. The helper added a net +62 lines to rest-server.ts, rotting 10 line anchors. Regenerated with check-system-context-census.mjs --fix, never hand-edited: flagged 16, rewrote 10 anchors across 4 lines. Rewritten is fewer than flagged, so the over-rewrite mode #13646 measured did not occur. Control: with all digits stripped, the file is byte-identical before and after, and every one of the 10 anchors moved by exactly +62 — matching the net line delta. Row count unchanged at 387.

Clause-②: no

Measured, not asserted: @objectstack/rest was built twice at the same commit, with and without this change. dist/index.d.ts is byte-identical (md5 ecb74c8a... both ways); dist/index.jsdiffers (md5 279edd63 vs a563b087), which is the control proving the rebuild picked the change up. seamOrUndefined appears 0 times in the .d.ts and 6 in the .js — it is module-private and never published. No schema changes; packages/spec is untouched.

This is a runtime behaviour change at a permission door with no published-contract-surface change, which the maintainer ruling of 2026-08-28 places outside Clause ② by its negative boundary.

Changeset

patch, for @objectstack/rest. A defect repair with no surface change: nothing exported is added, removed or renamed, no authorable key or schema moves, and the published type surface is byte-identical. Not minor (no new capability); not breaking (nothing removed or renamed, and no host can reasonably have depended on a settings outage revoking its callers' identity). The changeset states the wire-behaviour change explicitly so it reaches the release notes.

Gate reconciliation

Union derived by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands after merging origin/main and after the last edit, harvested at head 689001179d. Exit codes captured before any pipe.

union named 59, ran 59, unreconciled 0 — from comm -23 on the sorted lists, exact comparison.

54 green. Four are NOT MEASURED, in each gate's own words — none is a red, and none is caused by this diff:

• check-test-completeness (exit 3) — "PREREQUISITE NOT MET — this gate grades a saved turbo run test log, and no log was named… running the family locally, record this gate as NOT MEASURED."
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/… ⛔ This is NOT a pass: nothing was measured."
• check:type-check-debt (exit 1) — refuses rather than measures: "--re-measure cannot run: 25 workspace dependencies of the ledgered packages have no built type entry point on disk… measuring now would not fail, it would silently measure a DIFFERENT WORLD." Narrowing declared, with the positive control that the substance for the one package this diff touches was measured: @objectstack/rest's own typecheck and check:test-typecheck are green with the ledger entry unchanged, and check:type-check-coverage (the non-re-measure half) is green. No TEST_DEBT entry was raised; no ledger, debt or baseline file is touched.
• check-system-context-census (exit 1) — the anchor rot above; now green after regeneration, re-run on the final head.

check:skill-examples initially refused for an unbuilt client-react dist ("a FALSE GREEN on exactly the change it exists to catch"); the closure was built and it is now genuinely green — 260 prose examples type-check across 3 surfaces.

Ratchet family re-run on the final head after the last commit: check:type-check-coverage, check:published-files, check:test-source-alias, check-system-context-census, and rest's typecheck — all green.

CI convergence is left to the reviewing PM per the dispatch contract; this PR is reported at draft time.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/api/environment-routing.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/kernel/contracts/metadata-service.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/kernel/services-checklist.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/permissions/permission-sets.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/ui/apps.mdx(via /api/v1/packages (route, a path literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via /api/v1/packages (route, a path literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c532ef8ae66f8e514060ba4b4ee726382a39f407 — the merge of head 689001179d5d865db799ac6fa88cfb497b61391c into base 86e765a7704eff4de2eb070330ff66a0e211c3aa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c532ef8ae66f8e514060ba4b4ee726382a39f407 && git checkout c532ef8ae66f8e514060ba4b4ee726382a39f407
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 86e765a7704eff4de2eb070330ff66a0e211c3aa 689001179d5d865db799ac6fa88cfb497b61391c && git checkout -B drift-repro 86e765a7704eff4de2eb070330ff66a0e211c3aa && git merge --no-ff 689001179d5d865db799ac6fa88cfb497b61391c
node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 86e765a7704eff4de2eb070330ff66a0e211c3aa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13280

At RestServer.computeExecCtx, a host-wired provider that throws synchronously discarded the entire execution context — identity included — while the same provider failing as a rejected promise was absorbed and the caller was served. One fault, two wire answers, chosen by whether the host happened to spell its provider async.

The mechanism

The seams read provider(environmentId).catch(() => undefined). That handler is attached to the promise the call returns, so it can only ever see a rejection. A provider that throws before returning a promise — an ordinary non-async function, which the seam's own declared type (taking an optional environment id and returning a promise) cannot stop a host from wiring — throws while the expression is still being evaluated. There is no promise to attach to, the .catch is never reached, and the throw lands in computeExecCtx's outer catch, which returns no context at all.

Measured, before and after

Real RestServer, real registerPackageRoutes wired the way rest-api-plugin.ts wires it. Both callers hold a valid session and identical grants; the rows differ only in how the provider fails. The "before" column was re-measured by ablating this change on disk at this same commit, not quoted from the card.

seam	fails as	before	after
settingsServiceProvider	rejecting promise	200	200
settingsServiceProvider	synchronous throw	401 UNAUTHENTICATED	200
objectQLProvider	rejecting promise	403	403
objectQLProvider	synchronous throw	401 UNAUTHENTICATED	403
authServiceProvider	rejecting promise	401	401
authServiceProvider	synchronous throw	401	401

Two findings beyond the card: objectQLProvider diverged too (403 vs 401) and was not in the card's table; and authServiceProvider, though mechanically asymmetric, was never observably so — an absorbed auth provider yields nothing and the next line already returns no context.

What was normalised, and what deliberately was not

Normalised — the six seams inside computeExecCtx that call-then-.catch, now routed through one seamOrUndefined helper that invokes the provider inside a try: both kernel.getServiceAsync('auth') sites, authServiceProvider, kernel.getServiceAsync('objectql'), objectQLProvider, settingsServiceProvider.

Deliberately NOT touched:

• kernelManager.getOrCreate() and authService.getApi() — these carry no seam .catch at all, so they lose the context in both directions. They are already symmetric; giving them a swallow would be a new policy, not a normalisation.
• computeExecCtx's outer catch. Whether a post-identity fault should discard identity is the second of the two directions the finding recorded — a behaviour change on a public door, of the class [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 deferred, and still unruled. This change is decision-independent: under any answer to that question, one fault yielding 200 or 401 depending on how the host spelled its provider is a defect.
• Every seam of this shape elsewhere in rest-server.ts — other doors, out of this card's scope.

The branded permission-store outage is unaffected and pinned as such: AuthzStoreUnavailableError has exactly one construction site (tryFind, in resolve-authz-context.ts), reached from resolveAuthzContext — downstream of every seam here — so no normalised seam sits on its path.

Tests

packages/rest/src/package-door-execctx-fault-reachability.test.ts section 7 is inverted in place, not re-baselined: it asserted the divergence, and the superseded text is quoted beside the new assertions. It now pins agreement and the agreed value per seam, plus a guard that the three seams do not agree with each other (200 / 403 / 401) — so a future blanket-swallow regression, where every seam degrades to a served 200, fails this section instead of passing it.

SETTINGS_PROVIDER_SYNC_THROW is consequently gone from the section-2 class table — it is no longer a context-lost class — with a block in its place explaining why re-adding it would assert that a repaired seam is still broken.

• pnpm --filter @objectstack/rest test — 164 files, 2761 tests passed, at the final head 689001179d.
• pnpm --filter @objectstack/rest typecheck — green; check:test-typecheck OK, test-layer debt unchanged at 1 file / 2 errors / 1 pinned signature (shrink-only).
• Ablation, direction predicted in writing first: reverting only rest-server.ts to its pre-change bytes turns exactly the 5 predicted pins red and nothing else. Mutation proven on disk by blob hash (c600acc4 to b58d2056) and by the seamOrUndefined count going 7 to 0; restore proven by hash equality, empty git diff HEAD and clean git status --porcelain.
• The 500 that appears in the write cohort once identity is restored is the harness's own healthy answer (PACKAGE_DELETE_FAILED from its stub), measured identically before and after this change — not something this change introduced.

Census

packages/rest/src/execctx-consumer-census.test.ts did not move: its counts (75 sites, 95 mentions, 16/22/53) are unchanged and the file passes untouched.

A different census did move — content/docs/permissions/system-context.mdx, the generated anchor table. The helper added a net +62 lines to rest-server.ts, rotting 10 line anchors. Regenerated with check-system-context-census.mjs --fix, never hand-edited: flagged 16, rewrote 10 anchors across 4 lines. Rewritten is fewer than flagged, so the over-rewrite mode #13646 measured did not occur. Control: with all digits stripped, the file is byte-identical before and after, and every one of the 10 anchors moved by exactly +62 — matching the net line delta. Row count unchanged at 387.

Clause-②: no

Measured, not asserted: @objectstack/rest was built twice at the same commit, with and without this change. dist/index.d.ts is byte-identical (md5 ecb74c8a... both ways); dist/index.jsdiffers (md5 279edd63 vs a563b087), which is the control proving the rebuild picked the change up. seamOrUndefined appears 0 times in the .d.ts and 6 in the .js — it is module-private and never published. No schema changes; packages/spec is untouched.

This is a runtime behaviour change at a permission door with no published-contract-surface change, which the maintainer ruling of 2026-08-28 places outside Clause ② by its negative boundary.

Changeset

patch, for @objectstack/rest. A defect repair with no surface change: nothing exported is added, removed or renamed, no authorable key or schema moves, and the published type surface is byte-identical. Not minor (no new capability); not breaking (nothing removed or renamed, and no host can reasonably have depended on a settings outage revoking its callers' identity). The changeset states the wire-behaviour change explicitly so it reaches the release notes.

Gate reconciliation

Union derived by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands after merging origin/main and after the last edit, harvested at head 689001179d. Exit codes captured before any pipe.

union named 59, ran 59, unreconciled 0 — from comm -23 on the sorted lists, exact comparison.

54 green. Four are NOT MEASURED, in each gate's own words — none is a red, and none is caused by this diff:

• check-test-completeness (exit 3) — "PREREQUISITE NOT MET — this gate grades a saved turbo run test log, and no log was named… running the family locally, record this gate as NOT MEASURED."
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/… ⛔ This is NOT a pass: nothing was measured."
• check:type-check-debt (exit 1) — refuses rather than measures: "--re-measure cannot run: 25 workspace dependencies of the ledgered packages have no built type entry point on disk… measuring now would not fail, it would silently measure a DIFFERENT WORLD." Narrowing declared, with the positive control that the substance for the one package this diff touches was measured: @objectstack/rest's own typecheck and check:test-typecheck are green with the ledger entry unchanged, and check:type-check-coverage (the non-re-measure half) is green. No TEST_DEBT entry was raised; no ledger, debt or baseline file is touched.
• check-system-context-census (exit 1) — the anchor rot above; now green after regeneration, re-run on the final head.

check:skill-examples initially refused for an unbuilt client-react dist ("a FALSE GREEN on exactly the change it exists to catch"); the closure was built and it is now genuinely green — 260 prose examples type-check across 3 surfaces.

Ratchet family re-run on the final head after the last commit: check:type-check-coverage, check:published-files, check:test-source-alias, check-system-context-census, and rest's typecheck — all green.

CI convergence is left to the reviewing PM per the dispatch contract; this PR is reported at draft time.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/api/environment-routing.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/kernel/contracts/metadata-service.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/kernel/services-checklist.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/permissions/permission-sets.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/ui/apps.mdx(via /api/v1/packages (route, a path literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via /api/v1/packages (route, a path literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c532ef8ae66f8e514060ba4b4ee726382a39f407 — the merge of head 689001179d5d865db799ac6fa88cfb497b61391c into base 86e765a7704eff4de2eb070330ff66a0e211c3aa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c532ef8ae66f8e514060ba4b4ee726382a39f407 && git checkout c532ef8ae66f8e514060ba4b4ee726382a39f407
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 86e765a7704eff4de2eb070330ff66a0e211c3aa 689001179d5d865db799ac6fa88cfb497b61391c && git checkout -B drift-repro 86e765a7704eff4de2eb070330ff66a0e211c3aa && git merge --no-ff 689001179d5d865db799ac6fa88cfb497b61391c
node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 86e765a7704eff4de2eb070330ff66a0e211c3aa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13280

At RestServer.computeExecCtx, a host-wired provider that throws synchronously discarded the entire execution context — identity included — while the same provider failing as a rejected promise was absorbed and the caller was served. One fault, two wire answers, chosen by whether the host happened to spell its provider async.

The mechanism

The seams read provider(environmentId).catch(() => undefined). That handler is attached to the promise the call returns, so it can only ever see a rejection. A provider that throws before returning a promise — an ordinary non-async function, which the seam's own declared type (taking an optional environment id and returning a promise) cannot stop a host from wiring — throws while the expression is still being evaluated. There is no promise to attach to, the .catch is never reached, and the throw lands in computeExecCtx's outer catch, which returns no context at all.

Measured, before and after

Real RestServer, real registerPackageRoutes wired the way rest-api-plugin.ts wires it. Both callers hold a valid session and identical grants; the rows differ only in how the provider fails. The "before" column was re-measured by ablating this change on disk at this same commit, not quoted from the card.

seam	fails as	before	after
settingsServiceProvider	rejecting promise	200	200
settingsServiceProvider	synchronous throw	401 UNAUTHENTICATED	200
objectQLProvider	rejecting promise	403	403
objectQLProvider	synchronous throw	401 UNAUTHENTICATED	403
authServiceProvider	rejecting promise	401	401
authServiceProvider	synchronous throw	401	401

Two findings beyond the card: objectQLProvider diverged too (403 vs 401) and was not in the card's table; and authServiceProvider, though mechanically asymmetric, was never observably so — an absorbed auth provider yields nothing and the next line already returns no context.

What was normalised, and what deliberately was not

Normalised — the six seams inside computeExecCtx that call-then-.catch, now routed through one seamOrUndefined helper that invokes the provider inside a try: both kernel.getServiceAsync('auth') sites, authServiceProvider, kernel.getServiceAsync('objectql'), objectQLProvider, settingsServiceProvider.

Deliberately NOT touched:

• kernelManager.getOrCreate() and authService.getApi() — these carry no seam .catch at all, so they lose the context in both directions. They are already symmetric; giving them a swallow would be a new policy, not a normalisation.
• computeExecCtx's outer catch. Whether a post-identity fault should discard identity is the second of the two directions the finding recorded — a behaviour change on a public door, of the class [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 deferred, and still unruled. This change is decision-independent: under any answer to that question, one fault yielding 200 or 401 depending on how the host spelled its provider is a defect.
• Every seam of this shape elsewhere in rest-server.ts — other doors, out of this card's scope.

The branded permission-store outage is unaffected and pinned as such: AuthzStoreUnavailableError has exactly one construction site (tryFind, in resolve-authz-context.ts), reached from resolveAuthzContext — downstream of every seam here — so no normalised seam sits on its path.

Tests

packages/rest/src/package-door-execctx-fault-reachability.test.ts section 7 is inverted in place, not re-baselined: it asserted the divergence, and the superseded text is quoted beside the new assertions. It now pins agreement and the agreed value per seam, plus a guard that the three seams do not agree with each other (200 / 403 / 401) — so a future blanket-swallow regression, where every seam degrades to a served 200, fails this section instead of passing it.

SETTINGS_PROVIDER_SYNC_THROW is consequently gone from the section-2 class table — it is no longer a context-lost class — with a block in its place explaining why re-adding it would assert that a repaired seam is still broken.

• pnpm --filter @objectstack/rest test — 164 files, 2761 tests passed, at the final head 689001179d.
• pnpm --filter @objectstack/rest typecheck — green; check:test-typecheck OK, test-layer debt unchanged at 1 file / 2 errors / 1 pinned signature (shrink-only).
• Ablation, direction predicted in writing first: reverting only rest-server.ts to its pre-change bytes turns exactly the 5 predicted pins red and nothing else. Mutation proven on disk by blob hash (c600acc4 to b58d2056) and by the seamOrUndefined count going 7 to 0; restore proven by hash equality, empty git diff HEAD and clean git status --porcelain.
• The 500 that appears in the write cohort once identity is restored is the harness's own healthy answer (PACKAGE_DELETE_FAILED from its stub), measured identically before and after this change — not something this change introduced.

Census

packages/rest/src/execctx-consumer-census.test.ts did not move: its counts (75 sites, 95 mentions, 16/22/53) are unchanged and the file passes untouched.

A different census did move — content/docs/permissions/system-context.mdx, the generated anchor table. The helper added a net +62 lines to rest-server.ts, rotting 10 line anchors. Regenerated with check-system-context-census.mjs --fix, never hand-edited: flagged 16, rewrote 10 anchors across 4 lines. Rewritten is fewer than flagged, so the over-rewrite mode #13646 measured did not occur. Control: with all digits stripped, the file is byte-identical before and after, and every one of the 10 anchors moved by exactly +62 — matching the net line delta. Row count unchanged at 387.

Clause-②: no

Measured, not asserted: @objectstack/rest was built twice at the same commit, with and without this change. dist/index.d.ts is byte-identical (md5 ecb74c8a... both ways); dist/index.jsdiffers (md5 279edd63 vs a563b087), which is the control proving the rebuild picked the change up. seamOrUndefined appears 0 times in the .d.ts and 6 in the .js — it is module-private and never published. No schema changes; packages/spec is untouched.

This is a runtime behaviour change at a permission door with no published-contract-surface change, which the maintainer ruling of 2026-08-28 places outside Clause ② by its negative boundary.

Changeset

patch, for @objectstack/rest. A defect repair with no surface change: nothing exported is added, removed or renamed, no authorable key or schema moves, and the published type surface is byte-identical. Not minor (no new capability); not breaking (nothing removed or renamed, and no host can reasonably have depended on a settings outage revoking its callers' identity). The changeset states the wire-behaviour change explicitly so it reaches the release notes.

Gate reconciliation

Union derived by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands after merging origin/main and after the last edit, harvested at head 689001179d. Exit codes captured before any pipe.

union named 59, ran 59, unreconciled 0 — from comm -23 on the sorted lists, exact comparison.

54 green. Four are NOT MEASURED, in each gate's own words — none is a red, and none is caused by this diff:

• check-test-completeness (exit 3) — "PREREQUISITE NOT MET — this gate grades a saved turbo run test log, and no log was named… running the family locally, record this gate as NOT MEASURED."
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/… ⛔ This is NOT a pass: nothing was measured."
• check:type-check-debt (exit 1) — refuses rather than measures: "--re-measure cannot run: 25 workspace dependencies of the ledgered packages have no built type entry point on disk… measuring now would not fail, it would silently measure a DIFFERENT WORLD." Narrowing declared, with the positive control that the substance for the one package this diff touches was measured: @objectstack/rest's own typecheck and check:test-typecheck are green with the ledger entry unchanged, and check:type-check-coverage (the non-re-measure half) is green. No TEST_DEBT entry was raised; no ledger, debt or baseline file is touched.
• check-system-context-census (exit 1) — the anchor rot above; now green after regeneration, re-run on the final head.

check:skill-examples initially refused for an unbuilt client-react dist ("a FALSE GREEN on exactly the change it exists to catch"); the closure was built and it is now genuinely green — 260 prose examples type-check across 3 surfaces.

Ratchet family re-run on the final head after the last commit: check:type-check-coverage, check:published-files, check:test-source-alias, check-system-context-census, and rest's typecheck — all green.

CI convergence is left to the reviewing PM per the dispatch contract; this PR is reported at draft time.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/api/environment-routing.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/kernel/contracts/metadata-service.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/kernel/services-checklist.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/permissions/permission-sets.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/ui/apps.mdx(via /api/v1/packages (route, a path literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via /api/v1/packages (route, a path literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c532ef8ae66f8e514060ba4b4ee726382a39f407 — the merge of head 689001179d5d865db799ac6fa88cfb497b61391c into base 86e765a7704eff4de2eb070330ff66a0e211c3aa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c532ef8ae66f8e514060ba4b4ee726382a39f407 && git checkout c532ef8ae66f8e514060ba4b4ee726382a39f407
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 86e765a7704eff4de2eb070330ff66a0e211c3aa 689001179d5d865db799ac6fa88cfb497b61391c && git checkout -B drift-repro 86e765a7704eff4de2eb070330ff66a0e211c3aa && git merge --no-ff 689001179d5d865db799ac6fa88cfb497b61391c
node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 86e765a7704eff4de2eb070330ff66a0e211c3aa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13280

At RestServer.computeExecCtx, a host-wired provider that throws synchronously discarded the entire execution context — identity included — while the same provider failing as a rejected promise was absorbed and the caller was served. One fault, two wire answers, chosen by whether the host happened to spell its provider async.

The mechanism

The seams read provider(environmentId).catch(() => undefined). That handler is attached to the promise the call returns, so it can only ever see a rejection. A provider that throws before returning a promise — an ordinary non-async function, which the seam's own declared type (taking an optional environment id and returning a promise) cannot stop a host from wiring — throws while the expression is still being evaluated. There is no promise to attach to, the .catch is never reached, and the throw lands in computeExecCtx's outer catch, which returns no context at all.

Measured, before and after

Real RestServer, real registerPackageRoutes wired the way rest-api-plugin.ts wires it. Both callers hold a valid session and identical grants; the rows differ only in how the provider fails. The "before" column was re-measured by ablating this change on disk at this same commit, not quoted from the card.

seam	fails as	before	after
settingsServiceProvider	rejecting promise	200	200
settingsServiceProvider	synchronous throw	401 UNAUTHENTICATED	200
objectQLProvider	rejecting promise	403	403
objectQLProvider	synchronous throw	401 UNAUTHENTICATED	403
authServiceProvider	rejecting promise	401	401
authServiceProvider	synchronous throw	401	401

Two findings beyond the card: objectQLProvider diverged too (403 vs 401) and was not in the card's table; and authServiceProvider, though mechanically asymmetric, was never observably so — an absorbed auth provider yields nothing and the next line already returns no context.

What was normalised, and what deliberately was not

Normalised — the six seams inside computeExecCtx that call-then-.catch, now routed through one seamOrUndefined helper that invokes the provider inside a try: both kernel.getServiceAsync('auth') sites, authServiceProvider, kernel.getServiceAsync('objectql'), objectQLProvider, settingsServiceProvider.

Deliberately NOT touched:

• kernelManager.getOrCreate() and authService.getApi() — these carry no seam .catch at all, so they lose the context in both directions. They are already symmetric; giving them a swallow would be a new policy, not a normalisation.
• computeExecCtx's outer catch. Whether a post-identity fault should discard identity is the second of the two directions the finding recorded — a behaviour change on a public door, of the class [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 deferred, and still unruled. This change is decision-independent: under any answer to that question, one fault yielding 200 or 401 depending on how the host spelled its provider is a defect.
• Every seam of this shape elsewhere in rest-server.ts — other doors, out of this card's scope.

The branded permission-store outage is unaffected and pinned as such: AuthzStoreUnavailableError has exactly one construction site (tryFind, in resolve-authz-context.ts), reached from resolveAuthzContext — downstream of every seam here — so no normalised seam sits on its path.

Tests

packages/rest/src/package-door-execctx-fault-reachability.test.ts section 7 is inverted in place, not re-baselined: it asserted the divergence, and the superseded text is quoted beside the new assertions. It now pins agreement and the agreed value per seam, plus a guard that the three seams do not agree with each other (200 / 403 / 401) — so a future blanket-swallow regression, where every seam degrades to a served 200, fails this section instead of passing it.

SETTINGS_PROVIDER_SYNC_THROW is consequently gone from the section-2 class table — it is no longer a context-lost class — with a block in its place explaining why re-adding it would assert that a repaired seam is still broken.

• pnpm --filter @objectstack/rest test — 164 files, 2761 tests passed, at the final head 689001179d.
• pnpm --filter @objectstack/rest typecheck — green; check:test-typecheck OK, test-layer debt unchanged at 1 file / 2 errors / 1 pinned signature (shrink-only).
• Ablation, direction predicted in writing first: reverting only rest-server.ts to its pre-change bytes turns exactly the 5 predicted pins red and nothing else. Mutation proven on disk by blob hash (c600acc4 to b58d2056) and by the seamOrUndefined count going 7 to 0; restore proven by hash equality, empty git diff HEAD and clean git status --porcelain.
• The 500 that appears in the write cohort once identity is restored is the harness's own healthy answer (PACKAGE_DELETE_FAILED from its stub), measured identically before and after this change — not something this change introduced.

Census

packages/rest/src/execctx-consumer-census.test.ts did not move: its counts (75 sites, 95 mentions, 16/22/53) are unchanged and the file passes untouched.

A different census did move — content/docs/permissions/system-context.mdx, the generated anchor table. The helper added a net +62 lines to rest-server.ts, rotting 10 line anchors. Regenerated with check-system-context-census.mjs --fix, never hand-edited: flagged 16, rewrote 10 anchors across 4 lines. Rewritten is fewer than flagged, so the over-rewrite mode #13646 measured did not occur. Control: with all digits stripped, the file is byte-identical before and after, and every one of the 10 anchors moved by exactly +62 — matching the net line delta. Row count unchanged at 387.

Clause-②: no

Measured, not asserted: @objectstack/rest was built twice at the same commit, with and without this change. dist/index.d.ts is byte-identical (md5 ecb74c8a... both ways); dist/index.jsdiffers (md5 279edd63 vs a563b087), which is the control proving the rebuild picked the change up. seamOrUndefined appears 0 times in the .d.ts and 6 in the .js — it is module-private and never published. No schema changes; packages/spec is untouched.

This is a runtime behaviour change at a permission door with no published-contract-surface change, which the maintainer ruling of 2026-08-28 places outside Clause ② by its negative boundary.

Changeset

patch, for @objectstack/rest. A defect repair with no surface change: nothing exported is added, removed or renamed, no authorable key or schema moves, and the published type surface is byte-identical. Not minor (no new capability); not breaking (nothing removed or renamed, and no host can reasonably have depended on a settings outage revoking its callers' identity). The changeset states the wire-behaviour change explicitly so it reaches the release notes.

Gate reconciliation

Union derived by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands after merging origin/main and after the last edit, harvested at head 689001179d. Exit codes captured before any pipe.

union named 59, ran 59, unreconciled 0 — from comm -23 on the sorted lists, exact comparison.

54 green. Four are NOT MEASURED, in each gate's own words — none is a red, and none is caused by this diff:

• check-test-completeness (exit 3) — "PREREQUISITE NOT MET — this gate grades a saved turbo run test log, and no log was named… running the family locally, record this gate as NOT MEASURED."
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/… ⛔ This is NOT a pass: nothing was measured."
• check:type-check-debt (exit 1) — refuses rather than measures: "--re-measure cannot run: 25 workspace dependencies of the ledgered packages have no built type entry point on disk… measuring now would not fail, it would silently measure a DIFFERENT WORLD." Narrowing declared, with the positive control that the substance for the one package this diff touches was measured: @objectstack/rest's own typecheck and check:test-typecheck are green with the ledger entry unchanged, and check:type-check-coverage (the non-re-measure half) is green. No TEST_DEBT entry was raised; no ledger, debt or baseline file is touched.
• check-system-context-census (exit 1) — the anchor rot above; now green after regeneration, re-run on the final head.

check:skill-examples initially refused for an unbuilt client-react dist ("a FALSE GREEN on exactly the change it exists to catch"); the closure was built and it is now genuinely green — 260 prose examples type-check across 3 surfaces.

Ratchet family re-run on the final head after the last commit: check:type-check-coverage, check:published-files, check:test-source-alias, check-system-context-census, and rest's typecheck — all green.

CI convergence is left to the reviewing PM per the dispatch contract; this PR is reported at draft time.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/api/environment-routing.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/kernel/contracts/metadata-service.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/kernel/services-checklist.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/permissions/permission-sets.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/ui/apps.mdx(via /api/v1/packages (route, a path literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via /api/v1/packages (route, a path literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c532ef8ae66f8e514060ba4b4ee726382a39f407 — the merge of head 689001179d5d865db799ac6fa88cfb497b61391c into base 86e765a7704eff4de2eb070330ff66a0e211c3aa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c532ef8ae66f8e514060ba4b4ee726382a39f407 && git checkout c532ef8ae66f8e514060ba4b4ee726382a39f407
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 86e765a7704eff4de2eb070330ff66a0e211c3aa 689001179d5d865db799ac6fa88cfb497b61391c && git checkout -B drift-repro 86e765a7704eff4de2eb070330ff66a0e211c3aa && git merge --no-ff 689001179d5d865db799ac6fa88cfb497b61391c
node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 86e765a7704eff4de2eb070330ff66a0e211c3aa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13280

At RestServer.computeExecCtx, a host-wired provider that throws synchronously discarded the entire execution context — identity included — while the same provider failing as a rejected promise was absorbed and the caller was served. One fault, two wire answers, chosen by whether the host happened to spell its provider async.

The mechanism

The seams read provider(environmentId).catch(() => undefined). That handler is attached to the promise the call returns, so it can only ever see a rejection. A provider that throws before returning a promise — an ordinary non-async function, which the seam's own declared type (taking an optional environment id and returning a promise) cannot stop a host from wiring — throws while the expression is still being evaluated. There is no promise to attach to, the .catch is never reached, and the throw lands in computeExecCtx's outer catch, which returns no context at all.

Measured, before and after

Real RestServer, real registerPackageRoutes wired the way rest-api-plugin.ts wires it. Both callers hold a valid session and identical grants; the rows differ only in how the provider fails. The "before" column was re-measured by ablating this change on disk at this same commit, not quoted from the card.

seam	fails as	before	after
settingsServiceProvider	rejecting promise	200	200
settingsServiceProvider	synchronous throw	401 UNAUTHENTICATED	200
objectQLProvider	rejecting promise	403	403
objectQLProvider	synchronous throw	401 UNAUTHENTICATED	403
authServiceProvider	rejecting promise	401	401
authServiceProvider	synchronous throw	401	401

Two findings beyond the card: objectQLProvider diverged too (403 vs 401) and was not in the card's table; and authServiceProvider, though mechanically asymmetric, was never observably so — an absorbed auth provider yields nothing and the next line already returns no context.

What was normalised, and what deliberately was not

Normalised — the six seams inside computeExecCtx that call-then-.catch, now routed through one seamOrUndefined helper that invokes the provider inside a try: both kernel.getServiceAsync('auth') sites, authServiceProvider, kernel.getServiceAsync('objectql'), objectQLProvider, settingsServiceProvider.

Deliberately NOT touched:

• kernelManager.getOrCreate() and authService.getApi() — these carry no seam .catch at all, so they lose the context in both directions. They are already symmetric; giving them a swallow would be a new policy, not a normalisation.
• computeExecCtx's outer catch. Whether a post-identity fault should discard identity is the second of the two directions the finding recorded — a behaviour change on a public door, of the class [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 deferred, and still unruled. This change is decision-independent: under any answer to that question, one fault yielding 200 or 401 depending on how the host spelled its provider is a defect.
• Every seam of this shape elsewhere in rest-server.ts — other doors, out of this card's scope.

The branded permission-store outage is unaffected and pinned as such: AuthzStoreUnavailableError has exactly one construction site (tryFind, in resolve-authz-context.ts), reached from resolveAuthzContext — downstream of every seam here — so no normalised seam sits on its path.

Tests

packages/rest/src/package-door-execctx-fault-reachability.test.ts section 7 is inverted in place, not re-baselined: it asserted the divergence, and the superseded text is quoted beside the new assertions. It now pins agreement and the agreed value per seam, plus a guard that the three seams do not agree with each other (200 / 403 / 401) — so a future blanket-swallow regression, where every seam degrades to a served 200, fails this section instead of passing it.

SETTINGS_PROVIDER_SYNC_THROW is consequently gone from the section-2 class table — it is no longer a context-lost class — with a block in its place explaining why re-adding it would assert that a repaired seam is still broken.

• pnpm --filter @objectstack/rest test — 164 files, 2761 tests passed, at the final head 689001179d.
• pnpm --filter @objectstack/rest typecheck — green; check:test-typecheck OK, test-layer debt unchanged at 1 file / 2 errors / 1 pinned signature (shrink-only).
• Ablation, direction predicted in writing first: reverting only rest-server.ts to its pre-change bytes turns exactly the 5 predicted pins red and nothing else. Mutation proven on disk by blob hash (c600acc4 to b58d2056) and by the seamOrUndefined count going 7 to 0; restore proven by hash equality, empty git diff HEAD and clean git status --porcelain.
• The 500 that appears in the write cohort once identity is restored is the harness's own healthy answer (PACKAGE_DELETE_FAILED from its stub), measured identically before and after this change — not something this change introduced.

Census

packages/rest/src/execctx-consumer-census.test.ts did not move: its counts (75 sites, 95 mentions, 16/22/53) are unchanged and the file passes untouched.

A different census did move — content/docs/permissions/system-context.mdx, the generated anchor table. The helper added a net +62 lines to rest-server.ts, rotting 10 line anchors. Regenerated with check-system-context-census.mjs --fix, never hand-edited: flagged 16, rewrote 10 anchors across 4 lines. Rewritten is fewer than flagged, so the over-rewrite mode #13646 measured did not occur. Control: with all digits stripped, the file is byte-identical before and after, and every one of the 10 anchors moved by exactly +62 — matching the net line delta. Row count unchanged at 387.

Clause-②: no

Measured, not asserted: @objectstack/rest was built twice at the same commit, with and without this change. dist/index.d.ts is byte-identical (md5 ecb74c8a... both ways); dist/index.jsdiffers (md5 279edd63 vs a563b087), which is the control proving the rebuild picked the change up. seamOrUndefined appears 0 times in the .d.ts and 6 in the .js — it is module-private and never published. No schema changes; packages/spec is untouched.

This is a runtime behaviour change at a permission door with no published-contract-surface change, which the maintainer ruling of 2026-08-28 places outside Clause ② by its negative boundary.

Changeset

patch, for @objectstack/rest. A defect repair with no surface change: nothing exported is added, removed or renamed, no authorable key or schema moves, and the published type surface is byte-identical. Not minor (no new capability); not breaking (nothing removed or renamed, and no host can reasonably have depended on a settings outage revoking its callers' identity). The changeset states the wire-behaviour change explicitly so it reaches the release notes.

Gate reconciliation

Union derived by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands after merging origin/main and after the last edit, harvested at head 689001179d. Exit codes captured before any pipe.

union named 59, ran 59, unreconciled 0 — from comm -23 on the sorted lists, exact comparison.

54 green. Four are NOT MEASURED, in each gate's own words — none is a red, and none is caused by this diff:

• check-test-completeness (exit 3) — "PREREQUISITE NOT MET — this gate grades a saved turbo run test log, and no log was named… running the family locally, record this gate as NOT MEASURED."
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/… ⛔ This is NOT a pass: nothing was measured."
• check:type-check-debt (exit 1) — refuses rather than measures: "--re-measure cannot run: 25 workspace dependencies of the ledgered packages have no built type entry point on disk… measuring now would not fail, it would silently measure a DIFFERENT WORLD." Narrowing declared, with the positive control that the substance for the one package this diff touches was measured: @objectstack/rest's own typecheck and check:test-typecheck are green with the ledger entry unchanged, and check:type-check-coverage (the non-re-measure half) is green. No TEST_DEBT entry was raised; no ledger, debt or baseline file is touched.
• check-system-context-census (exit 1) — the anchor rot above; now green after regeneration, re-run on the final head.

check:skill-examples initially refused for an unbuilt client-react dist ("a FALSE GREEN on exactly the change it exists to catch"); the closure was built and it is now genuinely green — 260 prose examples type-check across 3 surfaces.

Ratchet family re-run on the final head after the last commit: check:type-check-coverage, check:published-files, check:test-source-alias, check-system-context-census, and rest's typecheck — all green.

CI convergence is left to the reviewing PM per the dispatch contract; this PR is reported at draft time.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/api/environment-routing.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/kernel/contracts/metadata-service.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/kernel/services-checklist.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/permissions/permission-sets.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/ui/apps.mdx(via /api/v1/packages (route, a path literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via /api/v1/packages (route, a path literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c532ef8ae66f8e514060ba4b4ee726382a39f407 — the merge of head 689001179d5d865db799ac6fa88cfb497b61391c into base 86e765a7704eff4de2eb070330ff66a0e211c3aa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c532ef8ae66f8e514060ba4b4ee726382a39f407 && git checkout c532ef8ae66f8e514060ba4b4ee726382a39f407
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 86e765a7704eff4de2eb070330ff66a0e211c3aa 689001179d5d865db799ac6fa88cfb497b61391c && git checkout -B drift-repro 86e765a7704eff4de2eb070330ff66a0e211c3aa && git merge --no-ff 689001179d5d865db799ac6fa88cfb497b61391c
node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 86e765a7704eff4de2eb070330ff66a0e211c3aa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13280

At RestServer.computeExecCtx, a host-wired provider that throws synchronously discarded the entire execution context — identity included — while the same provider failing as a rejected promise was absorbed and the caller was served. One fault, two wire answers, chosen by whether the host happened to spell its provider async.

The mechanism

The seams read provider(environmentId).catch(() => undefined). That handler is attached to the promise the call returns, so it can only ever see a rejection. A provider that throws before returning a promise — an ordinary non-async function, which the seam's own declared type (taking an optional environment id and returning a promise) cannot stop a host from wiring — throws while the expression is still being evaluated. There is no promise to attach to, the .catch is never reached, and the throw lands in computeExecCtx's outer catch, which returns no context at all.

Measured, before and after

Real RestServer, real registerPackageRoutes wired the way rest-api-plugin.ts wires it. Both callers hold a valid session and identical grants; the rows differ only in how the provider fails. The "before" column was re-measured by ablating this change on disk at this same commit, not quoted from the card.

seam	fails as	before	after
settingsServiceProvider	rejecting promise	200	200
settingsServiceProvider	synchronous throw	401 UNAUTHENTICATED	200
objectQLProvider	rejecting promise	403	403
objectQLProvider	synchronous throw	401 UNAUTHENTICATED	403
authServiceProvider	rejecting promise	401	401
authServiceProvider	synchronous throw	401	401

Two findings beyond the card: objectQLProvider diverged too (403 vs 401) and was not in the card's table; and authServiceProvider, though mechanically asymmetric, was never observably so — an absorbed auth provider yields nothing and the next line already returns no context.

What was normalised, and what deliberately was not

Normalised — the six seams inside computeExecCtx that call-then-.catch, now routed through one seamOrUndefined helper that invokes the provider inside a try: both kernel.getServiceAsync('auth') sites, authServiceProvider, kernel.getServiceAsync('objectql'), objectQLProvider, settingsServiceProvider.

Deliberately NOT touched:

• kernelManager.getOrCreate() and authService.getApi() — these carry no seam .catch at all, so they lose the context in both directions. They are already symmetric; giving them a swallow would be a new policy, not a normalisation.
• computeExecCtx's outer catch. Whether a post-identity fault should discard identity is the second of the two directions the finding recorded — a behaviour change on a public door, of the class [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 deferred, and still unruled. This change is decision-independent: under any answer to that question, one fault yielding 200 or 401 depending on how the host spelled its provider is a defect.
• Every seam of this shape elsewhere in rest-server.ts — other doors, out of this card's scope.

The branded permission-store outage is unaffected and pinned as such: AuthzStoreUnavailableError has exactly one construction site (tryFind, in resolve-authz-context.ts), reached from resolveAuthzContext — downstream of every seam here — so no normalised seam sits on its path.

Tests

packages/rest/src/package-door-execctx-fault-reachability.test.ts section 7 is inverted in place, not re-baselined: it asserted the divergence, and the superseded text is quoted beside the new assertions. It now pins agreement and the agreed value per seam, plus a guard that the three seams do not agree with each other (200 / 403 / 401) — so a future blanket-swallow regression, where every seam degrades to a served 200, fails this section instead of passing it.

SETTINGS_PROVIDER_SYNC_THROW is consequently gone from the section-2 class table — it is no longer a context-lost class — with a block in its place explaining why re-adding it would assert that a repaired seam is still broken.

• pnpm --filter @objectstack/rest test — 164 files, 2761 tests passed, at the final head 689001179d.
• pnpm --filter @objectstack/rest typecheck — green; check:test-typecheck OK, test-layer debt unchanged at 1 file / 2 errors / 1 pinned signature (shrink-only).
• Ablation, direction predicted in writing first: reverting only rest-server.ts to its pre-change bytes turns exactly the 5 predicted pins red and nothing else. Mutation proven on disk by blob hash (c600acc4 to b58d2056) and by the seamOrUndefined count going 7 to 0; restore proven by hash equality, empty git diff HEAD and clean git status --porcelain.
• The 500 that appears in the write cohort once identity is restored is the harness's own healthy answer (PACKAGE_DELETE_FAILED from its stub), measured identically before and after this change — not something this change introduced.

Census

packages/rest/src/execctx-consumer-census.test.ts did not move: its counts (75 sites, 95 mentions, 16/22/53) are unchanged and the file passes untouched.

A different census did move — content/docs/permissions/system-context.mdx, the generated anchor table. The helper added a net +62 lines to rest-server.ts, rotting 10 line anchors. Regenerated with check-system-context-census.mjs --fix, never hand-edited: flagged 16, rewrote 10 anchors across 4 lines. Rewritten is fewer than flagged, so the over-rewrite mode #13646 measured did not occur. Control: with all digits stripped, the file is byte-identical before and after, and every one of the 10 anchors moved by exactly +62 — matching the net line delta. Row count unchanged at 387.

Clause-②: no

Measured, not asserted: @objectstack/rest was built twice at the same commit, with and without this change. dist/index.d.ts is byte-identical (md5 ecb74c8a... both ways); dist/index.jsdiffers (md5 279edd63 vs a563b087), which is the control proving the rebuild picked the change up. seamOrUndefined appears 0 times in the .d.ts and 6 in the .js — it is module-private and never published. No schema changes; packages/spec is untouched.

This is a runtime behaviour change at a permission door with no published-contract-surface change, which the maintainer ruling of 2026-08-28 places outside Clause ② by its negative boundary.

Changeset

patch, for @objectstack/rest. A defect repair with no surface change: nothing exported is added, removed or renamed, no authorable key or schema moves, and the published type surface is byte-identical. Not minor (no new capability); not breaking (nothing removed or renamed, and no host can reasonably have depended on a settings outage revoking its callers' identity). The changeset states the wire-behaviour change explicitly so it reaches the release notes.

Gate reconciliation

Union derived by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands after merging origin/main and after the last edit, harvested at head 689001179d. Exit codes captured before any pipe.

union named 59, ran 59, unreconciled 0 — from comm -23 on the sorted lists, exact comparison.

54 green. Four are NOT MEASURED, in each gate's own words — none is a red, and none is caused by this diff:

• check-test-completeness (exit 3) — "PREREQUISITE NOT MET — this gate grades a saved turbo run test log, and no log was named… running the family locally, record this gate as NOT MEASURED."
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/… ⛔ This is NOT a pass: nothing was measured."
• check:type-check-debt (exit 1) — refuses rather than measures: "--re-measure cannot run: 25 workspace dependencies of the ledgered packages have no built type entry point on disk… measuring now would not fail, it would silently measure a DIFFERENT WORLD." Narrowing declared, with the positive control that the substance for the one package this diff touches was measured: @objectstack/rest's own typecheck and check:test-typecheck are green with the ledger entry unchanged, and check:type-check-coverage (the non-re-measure half) is green. No TEST_DEBT entry was raised; no ledger, debt or baseline file is touched.
• check-system-context-census (exit 1) — the anchor rot above; now green after regeneration, re-run on the final head.

check:skill-examples initially refused for an unbuilt client-react dist ("a FALSE GREEN on exactly the change it exists to catch"); the closure was built and it is now genuinely green — 260 prose examples type-check across 3 surfaces.

Ratchet family re-run on the final head after the last commit: check:type-check-coverage, check:published-files, check:test-source-alias, check-system-context-census, and rest's typecheck — all green.

CI convergence is left to the reviewing PM per the dispatch contract; this PR is reported at draft time.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/api/environment-routing.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/kernel/contracts/metadata-service.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/kernel/services-checklist.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/permissions/permission-sets.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/ui/apps.mdx(via /api/v1/packages (route, a path literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via /api/v1/packages (route, a path literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c532ef8ae66f8e514060ba4b4ee726382a39f407 — the merge of head 689001179d5d865db799ac6fa88cfb497b61391c into base 86e765a7704eff4de2eb070330ff66a0e211c3aa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c532ef8ae66f8e514060ba4b4ee726382a39f407 && git checkout c532ef8ae66f8e514060ba4b4ee726382a39f407
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 86e765a7704eff4de2eb070330ff66a0e211c3aa 689001179d5d865db799ac6fa88cfb497b61391c && git checkout -B drift-repro 86e765a7704eff4de2eb070330ff66a0e211c3aa && git merge --no-ff 689001179d5d865db799ac6fa88cfb497b61391c
node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 86e765a7704eff4de2eb070330ff66a0e211c3aa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13280

At RestServer.computeExecCtx, a host-wired provider that throws synchronously discarded the entire execution context — identity included — while the same provider failing as a rejected promise was absorbed and the caller was served. One fault, two wire answers, chosen by whether the host happened to spell its provider async.

The mechanism

The seams read provider(environmentId).catch(() => undefined). That handler is attached to the promise the call returns, so it can only ever see a rejection. A provider that throws before returning a promise — an ordinary non-async function, which the seam's own declared type (taking an optional environment id and returning a promise) cannot stop a host from wiring — throws while the expression is still being evaluated. There is no promise to attach to, the .catch is never reached, and the throw lands in computeExecCtx's outer catch, which returns no context at all.

Measured, before and after

Real RestServer, real registerPackageRoutes wired the way rest-api-plugin.ts wires it. Both callers hold a valid session and identical grants; the rows differ only in how the provider fails. The "before" column was re-measured by ablating this change on disk at this same commit, not quoted from the card.

seam	fails as	before	after
settingsServiceProvider	rejecting promise	200	200
settingsServiceProvider	synchronous throw	401 UNAUTHENTICATED	200
objectQLProvider	rejecting promise	403	403
objectQLProvider	synchronous throw	401 UNAUTHENTICATED	403
authServiceProvider	rejecting promise	401	401
authServiceProvider	synchronous throw	401	401

Two findings beyond the card: objectQLProvider diverged too (403 vs 401) and was not in the card's table; and authServiceProvider, though mechanically asymmetric, was never observably so — an absorbed auth provider yields nothing and the next line already returns no context.

What was normalised, and what deliberately was not

Normalised — the six seams inside computeExecCtx that call-then-.catch, now routed through one seamOrUndefined helper that invokes the provider inside a try: both kernel.getServiceAsync('auth') sites, authServiceProvider, kernel.getServiceAsync('objectql'), objectQLProvider, settingsServiceProvider.

Deliberately NOT touched:

• kernelManager.getOrCreate() and authService.getApi() — these carry no seam .catch at all, so they lose the context in both directions. They are already symmetric; giving them a swallow would be a new policy, not a normalisation.
• computeExecCtx's outer catch. Whether a post-identity fault should discard identity is the second of the two directions the finding recorded — a behaviour change on a public door, of the class [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 deferred, and still unruled. This change is decision-independent: under any answer to that question, one fault yielding 200 or 401 depending on how the host spelled its provider is a defect.
• Every seam of this shape elsewhere in rest-server.ts — other doors, out of this card's scope.

The branded permission-store outage is unaffected and pinned as such: AuthzStoreUnavailableError has exactly one construction site (tryFind, in resolve-authz-context.ts), reached from resolveAuthzContext — downstream of every seam here — so no normalised seam sits on its path.

Tests

packages/rest/src/package-door-execctx-fault-reachability.test.ts section 7 is inverted in place, not re-baselined: it asserted the divergence, and the superseded text is quoted beside the new assertions. It now pins agreement and the agreed value per seam, plus a guard that the three seams do not agree with each other (200 / 403 / 401) — so a future blanket-swallow regression, where every seam degrades to a served 200, fails this section instead of passing it.

SETTINGS_PROVIDER_SYNC_THROW is consequently gone from the section-2 class table — it is no longer a context-lost class — with a block in its place explaining why re-adding it would assert that a repaired seam is still broken.

• pnpm --filter @objectstack/rest test — 164 files, 2761 tests passed, at the final head 689001179d.
• pnpm --filter @objectstack/rest typecheck — green; check:test-typecheck OK, test-layer debt unchanged at 1 file / 2 errors / 1 pinned signature (shrink-only).
• Ablation, direction predicted in writing first: reverting only rest-server.ts to its pre-change bytes turns exactly the 5 predicted pins red and nothing else. Mutation proven on disk by blob hash (c600acc4 to b58d2056) and by the seamOrUndefined count going 7 to 0; restore proven by hash equality, empty git diff HEAD and clean git status --porcelain.
• The 500 that appears in the write cohort once identity is restored is the harness's own healthy answer (PACKAGE_DELETE_FAILED from its stub), measured identically before and after this change — not something this change introduced.

Census

packages/rest/src/execctx-consumer-census.test.ts did not move: its counts (75 sites, 95 mentions, 16/22/53) are unchanged and the file passes untouched.

A different census did move — content/docs/permissions/system-context.mdx, the generated anchor table. The helper added a net +62 lines to rest-server.ts, rotting 10 line anchors. Regenerated with check-system-context-census.mjs --fix, never hand-edited: flagged 16, rewrote 10 anchors across 4 lines. Rewritten is fewer than flagged, so the over-rewrite mode #13646 measured did not occur. Control: with all digits stripped, the file is byte-identical before and after, and every one of the 10 anchors moved by exactly +62 — matching the net line delta. Row count unchanged at 387.

Clause-②: no

Measured, not asserted: @objectstack/rest was built twice at the same commit, with and without this change. dist/index.d.ts is byte-identical (md5 ecb74c8a... both ways); dist/index.jsdiffers (md5 279edd63 vs a563b087), which is the control proving the rebuild picked the change up. seamOrUndefined appears 0 times in the .d.ts and 6 in the .js — it is module-private and never published. No schema changes; packages/spec is untouched.

This is a runtime behaviour change at a permission door with no published-contract-surface change, which the maintainer ruling of 2026-08-28 places outside Clause ② by its negative boundary.

Changeset

patch, for @objectstack/rest. A defect repair with no surface change: nothing exported is added, removed or renamed, no authorable key or schema moves, and the published type surface is byte-identical. Not minor (no new capability); not breaking (nothing removed or renamed, and no host can reasonably have depended on a settings outage revoking its callers' identity). The changeset states the wire-behaviour change explicitly so it reaches the release notes.

Gate reconciliation

Union derived by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands after merging origin/main and after the last edit, harvested at head 689001179d. Exit codes captured before any pipe.

union named 59, ran 59, unreconciled 0 — from comm -23 on the sorted lists, exact comparison.

54 green. Four are NOT MEASURED, in each gate's own words — none is a red, and none is caused by this diff:

• check-test-completeness (exit 3) — "PREREQUISITE NOT MET — this gate grades a saved turbo run test log, and no log was named… running the family locally, record this gate as NOT MEASURED."
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/… ⛔ This is NOT a pass: nothing was measured."
• check:type-check-debt (exit 1) — refuses rather than measures: "--re-measure cannot run: 25 workspace dependencies of the ledgered packages have no built type entry point on disk… measuring now would not fail, it would silently measure a DIFFERENT WORLD." Narrowing declared, with the positive control that the substance for the one package this diff touches was measured: @objectstack/rest's own typecheck and check:test-typecheck are green with the ledger entry unchanged, and check:type-check-coverage (the non-re-measure half) is green. No TEST_DEBT entry was raised; no ledger, debt or baseline file is touched.
• check-system-context-census (exit 1) — the anchor rot above; now green after regeneration, re-run on the final head.

check:skill-examples initially refused for an unbuilt client-react dist ("a FALSE GREEN on exactly the change it exists to catch"); the closure was built and it is now genuinely green — 260 prose examples type-check across 3 surfaces.

Ratchet family re-run on the final head after the last commit: check:type-check-coverage, check:published-files, check:test-source-alias, check-system-context-census, and rest's typecheck — all green.

CI convergence is left to the reviewing PM per the dispatch contract; this PR is reported at draft time.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/api/environment-routing.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/kernel/contracts/metadata-service.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/kernel/services-checklist.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/permissions/permission-sets.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/ui/apps.mdx(via /api/v1/packages (route, a path literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via /api/v1/packages (route, a path literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c532ef8ae66f8e514060ba4b4ee726382a39f407 — the merge of head 689001179d5d865db799ac6fa88cfb497b61391c into base 86e765a7704eff4de2eb070330ff66a0e211c3aa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c532ef8ae66f8e514060ba4b4ee726382a39f407 && git checkout c532ef8ae66f8e514060ba4b4ee726382a39f407
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 86e765a7704eff4de2eb070330ff66a0e211c3aa 689001179d5d865db799ac6fa88cfb497b61391c && git checkout -B drift-repro 86e765a7704eff4de2eb070330ff66a0e211c3aa && git merge --no-ff 689001179d5d865db799ac6fa88cfb497b61391c
node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 86e765a7704eff4de2eb070330ff66a0e211c3aa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[claude]

Fixes#13280

At RestServer.computeExecCtx, a host-wired provider that throws synchronously discarded the entire execution context — identity included — while the same provider failing as a rejected promise was absorbed and the caller was served. One fault, two wire answers, chosen by whether the host happened to spell its provider async.

The mechanism

The seams read provider(environmentId).catch(() => undefined). That handler is attached to the promise the call returns, so it can only ever see a rejection. A provider that throws before returning a promise — an ordinary non-async function, which the seam's own declared type (taking an optional environment id and returning a promise) cannot stop a host from wiring — throws while the expression is still being evaluated. There is no promise to attach to, the .catch is never reached, and the throw lands in computeExecCtx's outer catch, which returns no context at all.

Measured, before and after

Real RestServer, real registerPackageRoutes wired the way rest-api-plugin.ts wires it. Both callers hold a valid session and identical grants; the rows differ only in how the provider fails. The "before" column was re-measured by ablating this change on disk at this same commit, not quoted from the card.

seam	fails as	before	after
settingsServiceProvider	rejecting promise	200	200
settingsServiceProvider	synchronous throw	401 UNAUTHENTICATED	200
objectQLProvider	rejecting promise	403	403
objectQLProvider	synchronous throw	401 UNAUTHENTICATED	403
authServiceProvider	rejecting promise	401	401
authServiceProvider	synchronous throw	401	401

Two findings beyond the card: objectQLProvider diverged too (403 vs 401) and was not in the card's table; and authServiceProvider, though mechanically asymmetric, was never observably so — an absorbed auth provider yields nothing and the next line already returns no context.

What was normalised, and what deliberately was not

Normalised — the six seams inside computeExecCtx that call-then-.catch, now routed through one seamOrUndefined helper that invokes the provider inside a try: both kernel.getServiceAsync('auth') sites, authServiceProvider, kernel.getServiceAsync('objectql'), objectQLProvider, settingsServiceProvider.

Deliberately NOT touched:

• kernelManager.getOrCreate() and authService.getApi() — these carry no seam .catch at all, so they lose the context in both directions. They are already symmetric; giving them a swallow would be a new policy, not a normalisation.
• computeExecCtx's outer catch. Whether a post-identity fault should discard identity is the second of the two directions the finding recorded — a behaviour change on a public door, of the class [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 deferred, and still unruled. This change is decision-independent: under any answer to that question, one fault yielding 200 or 401 depending on how the host spelled its provider is a defect.
• Every seam of this shape elsewhere in rest-server.ts — other doors, out of this card's scope.

The branded permission-store outage is unaffected and pinned as such: AuthzStoreUnavailableError has exactly one construction site (tryFind, in resolve-authz-context.ts), reached from resolveAuthzContext — downstream of every seam here — so no normalised seam sits on its path.

Tests

packages/rest/src/package-door-execctx-fault-reachability.test.ts section 7 is inverted in place, not re-baselined: it asserted the divergence, and the superseded text is quoted beside the new assertions. It now pins agreement and the agreed value per seam, plus a guard that the three seams do not agree with each other (200 / 403 / 401) — so a future blanket-swallow regression, where every seam degrades to a served 200, fails this section instead of passing it.

SETTINGS_PROVIDER_SYNC_THROW is consequently gone from the section-2 class table — it is no longer a context-lost class — with a block in its place explaining why re-adding it would assert that a repaired seam is still broken.

• pnpm --filter @objectstack/rest test — 164 files, 2761 tests passed, at the final head 689001179d.
• pnpm --filter @objectstack/rest typecheck — green; check:test-typecheck OK, test-layer debt unchanged at 1 file / 2 errors / 1 pinned signature (shrink-only).
• Ablation, direction predicted in writing first: reverting only rest-server.ts to its pre-change bytes turns exactly the 5 predicted pins red and nothing else. Mutation proven on disk by blob hash (c600acc4 to b58d2056) and by the seamOrUndefined count going 7 to 0; restore proven by hash equality, empty git diff HEAD and clean git status --porcelain.
• The 500 that appears in the write cohort once identity is restored is the harness's own healthy answer (PACKAGE_DELETE_FAILED from its stub), measured identically before and after this change — not something this change introduced.

Census

packages/rest/src/execctx-consumer-census.test.ts did not move: its counts (75 sites, 95 mentions, 16/22/53) are unchanged and the file passes untouched.

A different census did move — content/docs/permissions/system-context.mdx, the generated anchor table. The helper added a net +62 lines to rest-server.ts, rotting 10 line anchors. Regenerated with check-system-context-census.mjs --fix, never hand-edited: flagged 16, rewrote 10 anchors across 4 lines. Rewritten is fewer than flagged, so the over-rewrite mode #13646 measured did not occur. Control: with all digits stripped, the file is byte-identical before and after, and every one of the 10 anchors moved by exactly +62 — matching the net line delta. Row count unchanged at 387.

Clause-②: no

Measured, not asserted: @objectstack/rest was built twice at the same commit, with and without this change. dist/index.d.ts is byte-identical (md5 ecb74c8a... both ways); dist/index.jsdiffers (md5 279edd63 vs a563b087), which is the control proving the rebuild picked the change up. seamOrUndefined appears 0 times in the .d.ts and 6 in the .js — it is module-private and never published. No schema changes; packages/spec is untouched.

This is a runtime behaviour change at a permission door with no published-contract-surface change, which the maintainer ruling of 2026-08-28 places outside Clause ② by its negative boundary.

Changeset

patch, for @objectstack/rest. A defect repair with no surface change: nothing exported is added, removed or renamed, no authorable key or schema moves, and the published type surface is byte-identical. Not minor (no new capability); not breaking (nothing removed or renamed, and no host can reasonably have depended on a settings outage revoking its callers' identity). The changeset states the wire-behaviour change explicitly so it reaches the release notes.

Gate reconciliation

Union derived by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands after merging origin/main and after the last edit, harvested at head 689001179d. Exit codes captured before any pipe.

union named 59, ran 59, unreconciled 0 — from comm -23 on the sorted lists, exact comparison.

54 green. Four are NOT MEASURED, in each gate's own words — none is a red, and none is caused by this diff:

• check-test-completeness (exit 3) — "PREREQUISITE NOT MET — this gate grades a saved turbo run test log, and no log was named… running the family locally, record this gate as NOT MEASURED."
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/… ⛔ This is NOT a pass: nothing was measured."
• check:type-check-debt (exit 1) — refuses rather than measures: "--re-measure cannot run: 25 workspace dependencies of the ledgered packages have no built type entry point on disk… measuring now would not fail, it would silently measure a DIFFERENT WORLD." Narrowing declared, with the positive control that the substance for the one package this diff touches was measured: @objectstack/rest's own typecheck and check:test-typecheck are green with the ledger entry unchanged, and check:type-check-coverage (the non-re-measure half) is green. No TEST_DEBT entry was raised; no ledger, debt or baseline file is touched.
• check-system-context-census (exit 1) — the anchor rot above; now green after regeneration, re-run on the final head.

check:skill-examples initially refused for an unbuilt client-react dist ("a FALSE GREEN on exactly the change it exists to catch"); the closure was built and it is now genuinely green — 260 prose examples type-check across 3 surfaces.

Ratchet family re-run on the final head after the last commit: check:type-check-coverage, check:published-files, check:test-source-alias, check-system-context-census, and rest's typecheck — all green.

CI convergence is left to the reviewing PM per the dispatch contract; this PR is reported at draft time.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 4 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/api/environment-routing.mdx(via packages.list (sdk, the route ledger binds it to GET /api/v1/packages))
• content/docs/kernel/contracts/metadata-service.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/kernel/services-checklist.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/permissions/permission-sets.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx(via /api/v1/packages (route, a path literal on a changed line))
• content/docs/ui/apps.mdx(via /api/v1/packages (route, a path literal on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via /api/v1/packages (route, a path literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c532ef8ae66f8e514060ba4b4ee726382a39f407 — the merge of head 689001179d5d865db799ac6fa88cfb497b61391c into base 86e765a7704eff4de2eb070330ff66a0e211c3aa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c532ef8ae66f8e514060ba4b4ee726382a39f407 && git checkout c532ef8ae66f8e514060ba4b4ee726382a39f407
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 86e765a7704eff4de2eb070330ff66a0e211c3aa 689001179d5d865db799ac6fa88cfb497b61391c && git checkout -B drift-repro 86e765a7704eff4de2eb070330ff66a0e211c3aa && git merge --no-ff 689001179d5d865db799ac6fa88cfb497b61391c
node scripts/docs-audit/affected-docs.mjs --json 86e765a7704eff4de2eb070330ff66a0e211c3aa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 86e765a7704eff4de2eb070330ff66a0e211c3aa → pass the list as
args.docs, on the commit named under Which tree this was computed on.