feat(tooling): a DETERMINED register so the swallow-census worklist means what its heading says by claude[bot] · Pull Request #14433 · objectstack-ai/objectstack

claude · 2026-09-02T06:36:26Z

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
A DARK site with no determination written down gets no row.packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
`packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert`	fence lifted — the CALLER reports the refused insert at `error` (PR #13685)	`file` (the determination is recorded at the caller, in the same file)
`packages/runtime/src/domains/keys.ts::handleKeysRequest`	silent by design — every path out of the catch hands the caller a 500 envelope	`site`
`packages/verify/src/harness.ts::inviteForAudienceGate`	not a claim-to-persist — the helper answers `void` and the loss is refused one line later (batch 8)	`site`

The counts are byte-identical — full `diff` of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
- 1× packages/plugins/plugin-auth/src/ensure-default-organization.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
- 1× packages/runtime/src/domains/keys.ts- 1× packages/verify/src/harness.ts++ DETERMINED, not outstanding 3 site(s) in 3 file(s)+ read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —+ a determination is a reading of a site, never a change to it:+ packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert+ the fence is lifted — the CALLER reports the refused insert at `error` (PR #13685)+ packages/runtime/src/domains/keys.ts::handleKeysRequest+ silent BY DESIGN — every path out of the catch hands the caller a 500 envelope (#12981, in-file determination)+ packages/verify/src/harness.ts::inviteForAudienceGate+ NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later (#12981 batch 8, in-file determination)
⚠️ A green from check-durability-degradation-log-level.mjs over any file listed
above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED --self-test=gated -> exit 1
DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
"[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.
census, same tree:
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
1× packages/verify/src/harness.ts BACK on the worklist, NOT excused
DETERMINED, not outstanding 2 site(s) in 2 file(s)
✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above
RESTORED --self-test=gated -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

RAN-PASS (14, each exit 0):check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
NOT-MEASURED (1):node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
UNRUN (1), declared:pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

…t its heading says

github-actions · 2026-09-02T07:34:47Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。
⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

claude · 2026-09-02T06:36:26Z

Fixes#13886

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
A DARK site with no determination written down gets no row.packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
`packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert`	fence lifted — the CALLER reports the refused insert at `error` (PR #13685)	`file` (the determination is recorded at the caller, in the same file)
`packages/runtime/src/domains/keys.ts::handleKeysRequest`	silent by design — every path out of the catch hands the caller a 500 envelope	`site`
`packages/verify/src/harness.ts::inviteForAudienceGate`	not a claim-to-persist — the helper answers `void` and the loss is refused one line later (batch 8)	`site`

The counts are byte-identical — full `diff` of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
- 1× packages/plugins/plugin-auth/src/ensure-default-organization.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
- 1× packages/runtime/src/domains/keys.ts- 1× packages/verify/src/harness.ts++ DETERMINED, not outstanding 3 site(s) in 3 file(s)+ read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —+ a determination is a reading of a site, never a change to it:+ packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert+ the fence is lifted — the CALLER reports the refused insert at `error` (PR #13685)+ packages/runtime/src/domains/keys.ts::handleKeysRequest+ silent BY DESIGN — every path out of the catch hands the caller a 500 envelope (#12981, in-file determination)+ packages/verify/src/harness.ts::inviteForAudienceGate+ NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later (#12981 batch 8, in-file determination)
⚠️ A green from check-durability-degradation-log-level.mjs over any file listed
above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED --self-test=gated -> exit 1
DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
"[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.
census, same tree:
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
1× packages/verify/src/harness.ts BACK on the worklist, NOT excused
DETERMINED, not outstanding 2 site(s) in 2 file(s)
✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above
RESTORED --self-test=gated -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

RAN-PASS (14, each exit 0):check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
NOT-MEASURED (1):node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
UNRUN (1), declared:pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

…t its heading says

github-actions · 2026-09-02T07:34:47Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。
⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

claude · 2026-09-02T06:36:26Z

Fixes#13886

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
A DARK site with no determination written down gets no row.packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
`packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert`	fence lifted — the CALLER reports the refused insert at `error` (PR #13685)	`file` (the determination is recorded at the caller, in the same file)
`packages/runtime/src/domains/keys.ts::handleKeysRequest`	silent by design — every path out of the catch hands the caller a 500 envelope	`site`
`packages/verify/src/harness.ts::inviteForAudienceGate`	not a claim-to-persist — the helper answers `void` and the loss is refused one line later (batch 8)	`site`

The counts are byte-identical — full `diff` of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
- 1× packages/plugins/plugin-auth/src/ensure-default-organization.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
- 1× packages/runtime/src/domains/keys.ts- 1× packages/verify/src/harness.ts++ DETERMINED, not outstanding 3 site(s) in 3 file(s)+ read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —+ a determination is a reading of a site, never a change to it:+ packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert+ the fence is lifted — the CALLER reports the refused insert at `error` (PR #13685)+ packages/runtime/src/domains/keys.ts::handleKeysRequest+ silent BY DESIGN — every path out of the catch hands the caller a 500 envelope (#12981, in-file determination)+ packages/verify/src/harness.ts::inviteForAudienceGate+ NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later (#12981 batch 8, in-file determination)
⚠️ A green from check-durability-degradation-log-level.mjs over any file listed
above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED --self-test=gated -> exit 1
DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
"[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.
census, same tree:
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
1× packages/verify/src/harness.ts BACK on the worklist, NOT excused
DETERMINED, not outstanding 2 site(s) in 2 file(s)
✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above
RESTORED --self-test=gated -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

RAN-PASS (14, each exit 0):check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
NOT-MEASURED (1):node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
UNRUN (1), declared:pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

…t its heading says

github-actions · 2026-09-02T07:34:47Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。
⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

claude · 2026-09-02T06:36:26Z

Fixes#13886

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
A DARK site with no determination written down gets no row.packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
`packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert`	fence lifted — the CALLER reports the refused insert at `error` (PR #13685)	`file` (the determination is recorded at the caller, in the same file)
`packages/runtime/src/domains/keys.ts::handleKeysRequest`	silent by design — every path out of the catch hands the caller a 500 envelope	`site`
`packages/verify/src/harness.ts::inviteForAudienceGate`	not a claim-to-persist — the helper answers `void` and the loss is refused one line later (batch 8)	`site`

The counts are byte-identical — full `diff` of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
- 1× packages/plugins/plugin-auth/src/ensure-default-organization.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
- 1× packages/runtime/src/domains/keys.ts- 1× packages/verify/src/harness.ts++ DETERMINED, not outstanding 3 site(s) in 3 file(s)+ read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —+ a determination is a reading of a site, never a change to it:+ packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert+ the fence is lifted — the CALLER reports the refused insert at `error` (PR #13685)+ packages/runtime/src/domains/keys.ts::handleKeysRequest+ silent BY DESIGN — every path out of the catch hands the caller a 500 envelope (#12981, in-file determination)+ packages/verify/src/harness.ts::inviteForAudienceGate+ NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later (#12981 batch 8, in-file determination)
⚠️ A green from check-durability-degradation-log-level.mjs over any file listed
above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED --self-test=gated -> exit 1
DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
"[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.
census, same tree:
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
1× packages/verify/src/harness.ts BACK on the worklist, NOT excused
DETERMINED, not outstanding 2 site(s) in 2 file(s)
✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above
RESTORED --self-test=gated -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

RAN-PASS (14, each exit 0):check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
NOT-MEASURED (1):node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
UNRUN (1), declared:pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

…t its heading says

github-actions · 2026-09-02T07:34:47Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。
⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

claude · 2026-09-02T06:36:26Z

Fixes#13886

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
A DARK site with no determination written down gets no row.packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
`packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert`	fence lifted — the CALLER reports the refused insert at `error` (PR #13685)	`file` (the determination is recorded at the caller, in the same file)
`packages/runtime/src/domains/keys.ts::handleKeysRequest`	silent by design — every path out of the catch hands the caller a 500 envelope	`site`
`packages/verify/src/harness.ts::inviteForAudienceGate`	not a claim-to-persist — the helper answers `void` and the loss is refused one line later (batch 8)	`site`

The counts are byte-identical — full `diff` of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
- 1× packages/plugins/plugin-auth/src/ensure-default-organization.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
- 1× packages/runtime/src/domains/keys.ts- 1× packages/verify/src/harness.ts++ DETERMINED, not outstanding 3 site(s) in 3 file(s)+ read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —+ a determination is a reading of a site, never a change to it:+ packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert+ the fence is lifted — the CALLER reports the refused insert at `error` (PR #13685)+ packages/runtime/src/domains/keys.ts::handleKeysRequest+ silent BY DESIGN — every path out of the catch hands the caller a 500 envelope (#12981, in-file determination)+ packages/verify/src/harness.ts::inviteForAudienceGate+ NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later (#12981 batch 8, in-file determination)
⚠️ A green from check-durability-degradation-log-level.mjs over any file listed
above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED --self-test=gated -> exit 1
DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
"[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.
census, same tree:
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
1× packages/verify/src/harness.ts BACK on the worklist, NOT excused
DETERMINED, not outstanding 2 site(s) in 2 file(s)
✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above
RESTORED --self-test=gated -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

RAN-PASS (14, each exit 0):check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
NOT-MEASURED (1):node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
UNRUN (1), declared:pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

…t its heading says

github-actions · 2026-09-02T07:34:47Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。
⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

claude · 2026-09-02T06:36:26Z

Fixes#13886

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
A DARK site with no determination written down gets no row.packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
`packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert`	fence lifted — the CALLER reports the refused insert at `error` (PR #13685)	`file` (the determination is recorded at the caller, in the same file)
`packages/runtime/src/domains/keys.ts::handleKeysRequest`	silent by design — every path out of the catch hands the caller a 500 envelope	`site`
`packages/verify/src/harness.ts::inviteForAudienceGate`	not a claim-to-persist — the helper answers `void` and the loss is refused one line later (batch 8)	`site`

The counts are byte-identical — full `diff` of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
- 1× packages/plugins/plugin-auth/src/ensure-default-organization.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
- 1× packages/runtime/src/domains/keys.ts- 1× packages/verify/src/harness.ts++ DETERMINED, not outstanding 3 site(s) in 3 file(s)+ read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —+ a determination is a reading of a site, never a change to it:+ packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert+ the fence is lifted — the CALLER reports the refused insert at `error` (PR #13685)+ packages/runtime/src/domains/keys.ts::handleKeysRequest+ silent BY DESIGN — every path out of the catch hands the caller a 500 envelope (#12981, in-file determination)+ packages/verify/src/harness.ts::inviteForAudienceGate+ NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later (#12981 batch 8, in-file determination)
⚠️ A green from check-durability-degradation-log-level.mjs over any file listed
above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED --self-test=gated -> exit 1
DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
"[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.
census, same tree:
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
1× packages/verify/src/harness.ts BACK on the worklist, NOT excused
DETERMINED, not outstanding 2 site(s) in 2 file(s)
✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above
RESTORED --self-test=gated -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

RAN-PASS (14, each exit 0):check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
NOT-MEASURED (1):node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
UNRUN (1), declared:pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

…t its heading says

github-actions · 2026-09-02T07:34:47Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。
⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

claude · 2026-09-02T06:36:26Z

Fixes#13886

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
A DARK site with no determination written down gets no row.packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
`packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert`	fence lifted — the CALLER reports the refused insert at `error` (PR #13685)	`file` (the determination is recorded at the caller, in the same file)
`packages/runtime/src/domains/keys.ts::handleKeysRequest`	silent by design — every path out of the catch hands the caller a 500 envelope	`site`
`packages/verify/src/harness.ts::inviteForAudienceGate`	not a claim-to-persist — the helper answers `void` and the loss is refused one line later (batch 8)	`site`

The counts are byte-identical — full `diff` of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
- 1× packages/plugins/plugin-auth/src/ensure-default-organization.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
- 1× packages/runtime/src/domains/keys.ts- 1× packages/verify/src/harness.ts++ DETERMINED, not outstanding 3 site(s) in 3 file(s)+ read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —+ a determination is a reading of a site, never a change to it:+ packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert+ the fence is lifted — the CALLER reports the refused insert at `error` (PR #13685)+ packages/runtime/src/domains/keys.ts::handleKeysRequest+ silent BY DESIGN — every path out of the catch hands the caller a 500 envelope (#12981, in-file determination)+ packages/verify/src/harness.ts::inviteForAudienceGate+ NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later (#12981 batch 8, in-file determination)
⚠️ A green from check-durability-degradation-log-level.mjs over any file listed
above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED --self-test=gated -> exit 1
DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
"[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.
census, same tree:
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
1× packages/verify/src/harness.ts BACK on the worklist, NOT excused
DETERMINED, not outstanding 2 site(s) in 2 file(s)
✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above
RESTORED --self-test=gated -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

RAN-PASS (14, each exit 0):check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
NOT-MEASURED (1):node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
UNRUN (1), declared:pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

…t its heading says

github-actions · 2026-09-02T07:34:47Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。
⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

claude · 2026-09-02T06:36:26Z

Fixes#13886

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
A DARK site with no determination written down gets no row.packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
`packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert`	fence lifted — the CALLER reports the refused insert at `error` (PR #13685)	`file` (the determination is recorded at the caller, in the same file)
`packages/runtime/src/domains/keys.ts::handleKeysRequest`	silent by design — every path out of the catch hands the caller a 500 envelope	`site`
`packages/verify/src/harness.ts::inviteForAudienceGate`	not a claim-to-persist — the helper answers `void` and the loss is refused one line later (batch 8)	`site`

The counts are byte-identical — full `diff` of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
- 1× packages/plugins/plugin-auth/src/ensure-default-organization.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
- 1× packages/runtime/src/domains/keys.ts- 1× packages/verify/src/harness.ts++ DETERMINED, not outstanding 3 site(s) in 3 file(s)+ read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —+ a determination is a reading of a site, never a change to it:+ packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert+ the fence is lifted — the CALLER reports the refused insert at `error` (PR #13685)+ packages/runtime/src/domains/keys.ts::handleKeysRequest+ silent BY DESIGN — every path out of the catch hands the caller a 500 envelope (#12981, in-file determination)+ packages/verify/src/harness.ts::inviteForAudienceGate+ NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later (#12981 batch 8, in-file determination)
⚠️ A green from check-durability-degradation-log-level.mjs over any file listed
above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED --self-test=gated -> exit 1
DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
"[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.
census, same tree:
[1] DARK members, by file — the repair worklist:
1× packages/plugins/plugin-auth/src/auth-manager.ts
1× packages/plugins/plugin-sharing/src/share-link-service.ts
1× packages/verify/src/harness.ts BACK on the worklist, NOT excused
DETERMINED, not outstanding 2 site(s) in 2 file(s)
✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above
RESTORED --self-test=gated -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

RAN-PASS (14, each exit 0):check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
NOT-MEASURED (1):node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
UNRUN (1), declared:pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

…t its heading says

github-actions · 2026-09-02T07:34:47Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。
⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

claude added 2 commits September 2, 2026 06:17

feat(tooling): a DETERMINED register so the census worklist means wha…
39b90a8
…t its heading says

Merge origin/main into claude/issue-13886-census-determined-register
9c1beba

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 2, 2026

github-actionsBot added the size/m label Sep 2, 2026

claudeBot mentioned this pull request Sep 2, 2026
[PM seat] domain:devx @ objectstack — 🟢 session_01WLJQhde67SeTccsmnBVarV · R1 · 67 landed · 4 devs + 4 landing + 1 human-gate draft + 1 decision (W8) #6023
Open

baozhoutao marked this pull request as ready for review September 2, 2026 07:03

baozhoutao enabled auto-merge September 2, 2026 07:03

baozhoutao added this pull request to the merge queue Sep 2, 2026

github-merge-queueBot removed this pull request from the merge queue due to failed status checks Sep 2, 2026

github-actionsBot mentioned this pull request Sep 2, 2026
[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857
Open

baozhoutao added this pull request to the merge queue Sep 2, 2026

Merged via the queue into main with commit 5edc25eSep 2, 2026
36 checks passed

baozhoutao deleted the claude/issue-13886-census-determined-register branch September 2, 2026 08:36

claudeBot mentioned this pull request Sep 2, 2026
[finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886
Closed

claude added 2 commits September 2, 2026 06:17

feat(tooling): a DETERMINED register so the census worklist means wha…
39b90a8
…t its heading says

Merge origin/main into claude/issue-13886-census-determined-register
9c1beba

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 2, 2026

github-actionsBot added the size/m label Sep 2, 2026

claudeBot mentioned this pull request Sep 2, 2026
[PM seat] domain:devx @ objectstack — 🟢 session_01WLJQhde67SeTccsmnBVarV · R1 · 67 landed · 4 devs + 4 landing + 1 human-gate draft + 1 decision (W8) #6023
Open

baozhoutao marked this pull request as ready for review September 2, 2026 07:03

baozhoutao enabled auto-merge September 2, 2026 07:03

baozhoutao added this pull request to the merge queue Sep 2, 2026

github-merge-queueBot removed this pull request from the merge queue due to failed status checks Sep 2, 2026

github-actionsBot mentioned this pull request Sep 2, 2026
[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857
Open

baozhoutao added this pull request to the merge queue Sep 2, 2026

Merged via the queue into main with commit 5edc25eSep 2, 2026
36 checks passed

baozhoutao deleted the claude/issue-13886-census-determined-register branch September 2, 2026 08:36

claudeBot mentioned this pull request Sep 2, 2026
[finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886
Closed

claude added 2 commits September 2, 2026 06:17

feat(tooling): a DETERMINED register so the census worklist means wha…
39b90a8
…t its heading says

Merge origin/main into claude/issue-13886-census-determined-register
9c1beba

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 2, 2026

github-actionsBot added the size/m label Sep 2, 2026

claudeBot mentioned this pull request Sep 2, 2026
[PM seat] domain:devx @ objectstack — 🟢 session_01WLJQhde67SeTccsmnBVarV · R1 · 67 landed · 4 devs + 4 landing + 1 human-gate draft + 1 decision (W8) #6023
Open

baozhoutao marked this pull request as ready for review September 2, 2026 07:03

baozhoutao enabled auto-merge September 2, 2026 07:03

baozhoutao added this pull request to the merge queue Sep 2, 2026

github-merge-queueBot removed this pull request from the merge queue due to failed status checks Sep 2, 2026

github-actionsBot mentioned this pull request Sep 2, 2026
[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857
Open

baozhoutao added this pull request to the merge queue Sep 2, 2026

Merged via the queue into main with commit 5edc25eSep 2, 2026
36 checks passed

baozhoutao deleted the claude/issue-13886-census-determined-register branch September 2, 2026 08:36

claudeBot mentioned this pull request Sep 2, 2026
[finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886
Closed

claude added 2 commits September 2, 2026 06:17

feat(tooling): a DETERMINED register so the census worklist means wha…
39b90a8
…t its heading says

Merge origin/main into claude/issue-13886-census-determined-register
9c1beba

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 2, 2026

github-actionsBot added the size/m label Sep 2, 2026

claudeBot mentioned this pull request Sep 2, 2026
[PM seat] domain:devx @ objectstack — 🟢 session_01WLJQhde67SeTccsmnBVarV · R1 · 67 landed · 4 devs + 4 landing + 1 human-gate draft + 1 decision (W8) #6023
Open

baozhoutao marked this pull request as ready for review September 2, 2026 07:03

baozhoutao enabled auto-merge September 2, 2026 07:03

baozhoutao added this pull request to the merge queue Sep 2, 2026

github-merge-queueBot removed this pull request from the merge queue due to failed status checks Sep 2, 2026

github-actionsBot mentioned this pull request Sep 2, 2026
[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857
Open

baozhoutao added this pull request to the merge queue Sep 2, 2026

Merged via the queue into main with commit 5edc25eSep 2, 2026
36 checks passed

baozhoutao deleted the claude/issue-13886-census-determined-register branch September 2, 2026 08:36

claudeBot mentioned this pull request Sep 2, 2026
[finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886
Closed

claude added 2 commits September 2, 2026 06:17

feat(tooling): a DETERMINED register so the census worklist means wha…
39b90a8
…t its heading says

Merge origin/main into claude/issue-13886-census-determined-register
9c1beba

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 2, 2026

github-actionsBot added the size/m label Sep 2, 2026

claudeBot mentioned this pull request Sep 2, 2026
[PM seat] domain:devx @ objectstack — 🟢 session_01WLJQhde67SeTccsmnBVarV · R1 · 67 landed · 4 devs + 4 landing + 1 human-gate draft + 1 decision (W8) #6023
Open

baozhoutao marked this pull request as ready for review September 2, 2026 07:03

baozhoutao enabled auto-merge September 2, 2026 07:03

baozhoutao added this pull request to the merge queue Sep 2, 2026

github-merge-queueBot removed this pull request from the merge queue due to failed status checks Sep 2, 2026

github-actionsBot mentioned this pull request Sep 2, 2026
[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857
Open

baozhoutao added this pull request to the merge queue Sep 2, 2026

Merged via the queue into main with commit 5edc25eSep 2, 2026
36 checks passed

baozhoutao deleted the claude/issue-13886-census-determined-register branch September 2, 2026 08:36

claudeBot mentioned this pull request Sep 2, 2026
[finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886
Closed

claude added 2 commits September 2, 2026 06:17

feat(tooling): a DETERMINED register so the census worklist means wha…
39b90a8
…t its heading says

Merge origin/main into claude/issue-13886-census-determined-register
9c1beba

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 2, 2026

github-actionsBot added the size/m label Sep 2, 2026

claudeBot mentioned this pull request Sep 2, 2026
[PM seat] domain:devx @ objectstack — 🟢 session_01WLJQhde67SeTccsmnBVarV · R1 · 67 landed · 4 devs + 4 landing + 1 human-gate draft + 1 decision (W8) #6023
Open

baozhoutao marked this pull request as ready for review September 2, 2026 07:03

baozhoutao enabled auto-merge September 2, 2026 07:03

baozhoutao added this pull request to the merge queue Sep 2, 2026

github-merge-queueBot removed this pull request from the merge queue due to failed status checks Sep 2, 2026

github-actionsBot mentioned this pull request Sep 2, 2026
[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857
Open

baozhoutao added this pull request to the merge queue Sep 2, 2026

Merged via the queue into main with commit 5edc25eSep 2, 2026
36 checks passed

baozhoutao deleted the claude/issue-13886-census-determined-register branch September 2, 2026 08:36

claudeBot mentioned this pull request Sep 2, 2026
[finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886
Closed

claude added 2 commits September 2, 2026 06:17

feat(tooling): a DETERMINED register so the census worklist means wha…
39b90a8
…t its heading says

Merge origin/main into claude/issue-13886-census-determined-register
9c1beba

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 2, 2026

github-actionsBot added the size/m label Sep 2, 2026

claudeBot mentioned this pull request Sep 2, 2026
[PM seat] domain:devx @ objectstack — 🟢 session_01WLJQhde67SeTccsmnBVarV · R1 · 67 landed · 4 devs + 4 landing + 1 human-gate draft + 1 decision (W8) #6023
Open

baozhoutao marked this pull request as ready for review September 2, 2026 07:03

baozhoutao enabled auto-merge September 2, 2026 07:03

baozhoutao added this pull request to the merge queue Sep 2, 2026

github-merge-queueBot removed this pull request from the merge queue due to failed status checks Sep 2, 2026

github-actionsBot mentioned this pull request Sep 2, 2026
[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857
Open

baozhoutao added this pull request to the merge queue Sep 2, 2026

Merged via the queue into main with commit 5edc25eSep 2, 2026
36 checks passed

baozhoutao deleted the claude/issue-13886-census-determined-register branch September 2, 2026 08:36

claudeBot mentioned this pull request Sep 2, 2026
[finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886
Closed

claude added 2 commits September 2, 2026 06:17

feat(tooling): a DETERMINED register so the census worklist means wha…
39b90a8
…t its heading says

Merge origin/main into claude/issue-13886-census-determined-register
9c1beba

claudeBot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 2, 2026

github-actionsBot added the size/m label Sep 2, 2026

claudeBot mentioned this pull request Sep 2, 2026
[PM seat] domain:devx @ objectstack — 🟢 session_01WLJQhde67SeTccsmnBVarV · R1 · 67 landed · 4 devs + 4 landing + 1 human-gate draft + 1 decision (W8) #6023
Open

baozhoutao marked this pull request as ready for review September 2, 2026 07:03

baozhoutao enabled auto-merge September 2, 2026 07:03

baozhoutao added this pull request to the merge queue Sep 2, 2026

github-merge-queueBot removed this pull request from the merge queue due to failed status checks Sep 2, 2026

github-actionsBot mentioned this pull request Sep 2, 2026
[Half-state patrol] check-half-states live sweep — generated view (please pin) #9857
Open

baozhoutao added this pull request to the merge queue Sep 2, 2026

Merged via the queue into main with commit 5edc25eSep 2, 2026
36 checks passed

baozhoutao deleted the claude/issue-13886-census-determined-register branch September 2, 2026 08:36

claudeBot mentioned this pull request Sep 2, 2026
[finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886
Closed

Uh oh!

Conversation

claudeBot commented Sep 2, 2026

What it does — and the one thing it must not do

The counts are byte-identical — full diff of the census output

Self-test — the register family is asserted in BOTH modes

Ablation — the STALE leg fires, and the site is not silently excused

Gates

Changeset

Coordination

Uh oh!

Uh oh!

github-actionsBot commented Sep 2, 2026

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

claudeBot commented Sep 2, 2026

What it does — and the one thing it must not do

The counts are byte-identical — full diff of the census output

Self-test — the register family is asserted in BOTH modes

Ablation — the STALE leg fires, and the site is not silently excused

Gates

Changeset

Coordination

Uh oh!

Uh oh!

github-actionsBot commented Sep 2, 2026

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

claudeBot commented Sep 2, 2026

What it does — and the one thing it must not do

The counts are byte-identical — full diff of the census output

Self-test — the register family is asserted in BOTH modes

Ablation — the STALE leg fires, and the site is not silently excused

Gates

Changeset

Coordination

Uh oh!

Uh oh!

github-actionsBot commented Sep 2, 2026

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

claudeBot commented Sep 2, 2026

What it does — and the one thing it must not do

The counts are byte-identical — full diff of the census output

Self-test — the register family is asserted in BOTH modes

Ablation — the STALE leg fires, and the site is not silently excused

Gates

The counts are byte-identical — full `diff` of the census output

The counts are byte-identical — full `diff` of the census output

The counts are byte-identical — full `diff` of the census output

The counts are byte-identical — full `diff` of the census output

The counts are byte-identical — full `diff` of the census output