Declare the scripts/ population two Silent gate families walk but never named

[claude]

Part of #14325 — sitting 1 of the per-gate half. The card stays open: the residue is not exhausted, and this sitting's measurement changes what the rest of it is.

What landed

Two gate families now declare the scripts/ population they walk but never named, in their own module body under the ROOT_DIR_WATCH_HINTS idiom, each pinned in its own --self-test — the shape PR #14188 and PR #14323 landed.

family	declared	why it was silent	residue before ⇢ after	self-test pin
node scripts/check-self-test-wired.mjs	scripts/**/*.mjs, scripts/**/*.mts, scripts/**/*.sh	corpus root arrives as join(ROOT, 'scripts') — a bare single-segment word the extractor cannot see; its only other literals are the six scripts its ledger cites BY NAME (an artifact roster)	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	battery population declaration, 7 cases, floor pinned
node scripts/check-whole-set-label-write.mjs	scripts/**/*.mjs, scripts/**/*.ts, scripts/**/*.sh	two of three ROOTS carry a separator and were recovered; the third is the bare word scripts. The rest of its literals are two owner/repo action slugs and fixture sandbox filenames	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	8 POPULATION cases in selfTest()

Measured with the derivation's own --residue, probe scripts/check-nul-bytes.mjs: 14 matched families ⇢ 16, Silent 148 ⇢ 146. With an outside probe the verdict is unchanged, so neither declaration over-claims.

One hint per admitted extension, not the bare subtree.check-ratchet-remedy-authority.mjs sets that precedent at this same root and its own self-test refuses the subtree spelling. scripts/** would name both gates for the 91 JSON, Markdown and text files under the root that neither one opens. The declared set is SET-EQUAL to each gate's live walk — 221 of 312 and 219 of 312 tracked files, nothing walked left uncovered, nothing covered left unwalked. An extension the filter admits but the tree does not yet HOLD (.js, .cjs, .yml, .yaml) is deliberately absent: a hint reaching nothing tracked is a dead lead the consumer reports as a population. The pins redden the day such a file lands.

⚠️ The finding this sitting is really for: the residue head is NOT a hint-line backlog

The card's own warning — reads are an upper bound — turns out to be the whole story, and the number is now measured rather than suspected.

Census re-derived on this branch's base (2aa8456cf), method as the card specifies: --residue for the Silent bucket, then every enumerating candidate run under an fs-tracing preload, compared against the literals extractWatchHints recovers from its own sources and judged with the derivation's own hintCovers. 202 families discovered, 132 Silent and non-self-test, 82 of those enumerate a directory, 49 read 5 or more undeclared tracked files.

Of those 49:

bucket	n	disposition
whole-tree	6	out of scope, #14189's channel — includes the three this census re-confirms (check-closing-keyword-parity, check-self-test-workflow-commands, check:watch-hint-literal)
declared this sitting	2	the only members with a NARROW, high-precision, undeclared population
root-wide, ledger already REFUSED	13	scripts/pm/bare-root-worklist.mjs records a verdict for each
root-wide, same class, no ledger row	14	32–52% of a 5837-file root — the identical trade, unrecorded
low precision (under 10%)	14	incidental or artifact reads; no honest subtree to declare

The head of the residue is the REFUSE-WIDE class, and this repo has already adjudicated it.scripts/pm/bare-root-worklist.mjs is a maintained, self-tested ledger of exactly this species and reports 0 untriaged rows. Every one of the four members the card source-confirmed as the natural head of sitting 1 is either recorded there as refused, or is unrecorded but measures into the same class:

• check:engine-double-contract — REFUSE-WIDE on both roots (measured 90% / 84%), with the split refused by name
• check:error-code-casing — REFUSE-WIDE, "same trade as engine-double-contract"
• check:error-status-conformance — REFUSE-WIDE at 39%
• check:route-envelope — no ledger row; walks join(ROOT, 'packages') over non-test .ts, measured here at 2138 undeclared reads = 36.6% of the root. Same class as check:authz-resolver, which IS recorded REFUSE-WIDE at 39%.

The ledger states the trade in its own words: a bare-root declaration there "would be TRUE, and is refused anyway: it names the gate for every card under a root the fleet already declares wholesale, so the matched column stops discriminating and restates 'run the farm', which CI does regardless." It also records the maintainer ruling of 2026-08-26 that split the spellable-but-undeclared rows by measured downstream pull — rows with a recorded consumer get the declaration, rows without stay deferred.

⇒ Sitting 2 cannot be "the next 8 by read count". Continuing down this order means declaring packages/** on gates whose recorded verdict refuses exactly that, which is a re-decision of a maintainer-ruled map, not the mechanical repair this card scoped. Three honest routes, for triage rather than for a dev to pick:

1. Stop the per-gate half here. The narrow-subtree population the card describes was real and is now exhausted at two members; the rest of the residue is the width trade, already priced.
2. Per-member consumer evidence. Take the 14 unrecorded root-wide members one at a time, and declare only where a MEASURED consumer exists (a card that ran a green local union and lost a CI round to that gate) — the criterion the 2026-08-26 ruling already uses. That is a p2-per-member shape, as the triage says.
3. Record the 14 unrecorded members in the ledger so the class is closed by evidence rather than left looking like outstanding debt. This is a bare-root-worklist.mjs edit, so it belongs to a card that owns that file.

⛔ None of these is taken here. scripts/pm/dispatch-gates.mjs is untouched, as scoped.

Artifact-only by design, recorded rather than declared

check-self-test-wired and check-whole-set-label-write each ALSO name individual files — the ledger rows one cites, the action slugs and probe paths the other pins. Those stay as they are: they are artifacts the gate names, not a population it reads, and the new declaration sits beside them rather than replacing them. The 14 low-precision members above are the same shape at family scale and are recorded here, not declared.

Verification

Union derived in this worktree by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths passed — the script takes its own changeset), 17 commands, re-derived unchanged after merging origin/main. Run at be6800e2f:

• 16 of 17 green, including check:watch-hint-literal (47 declarations across 4 rostered names), check:ratchet-remedy-authority, check:pm-dispatch-gates (VERDICT command-exit 0, dispatch-gates self-test 1240 cases pass), and node scripts/pm/bare-root-worklist.mjs --self-test ("none stale, none missing, none contradicted" — the new declarations create no fresh untriaged row and contradict no recorded verdict)
• node scripts/check-declared-population-live.mjs — "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 8006 tracked file(s)"
• both gates' production leg and --self-test leg green; check-self-test-wired prints "scope: 221 file(s) under scripts/", which is the declared set exactly
• node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED by its own design — it needs a CI test log and says so in its own output. Not a red.

Ablation — the pins are proved able to go red. Five legs, each mutating the committed declaration, each proved on disk by counting the removed and injected text before reading any result, each restored via git checkout HEAD and verified by git hash-object against the HEAD blob (both MATCH):

leg	expected	observed
drop scripts/**/*.sh	RED	exit 1 — "a file this gate WALKS is left undeclared"
add scripts/**/*.json	RED	exit 1 — "a declared hint reaches nothing this gate walks — a dead lead"
rewrite as a computed .map() spelling	RED	exit 1 — "the declaration is not a single literal array of quoted strings"
drop scripts/**/*.ts	RED	exit 1 — "every file this gate walks under scripts/ is declared: expected true, got false"
replace with the bare scripts/**	RED	exit 1 — 4 failures, including the extension and dead-lead pins

⚠️ Reported rather than hidden: the FIRST ablation harness was a no-op — its perl replacer failed to compile on the glob metacharacters and changed nothing. The on-disk proof step caught it and the readings were voided; the table above is the re-run with an exact-literal replacer. Had that step been skipped, five green self-tests would have read as five passing ablations.

git diff --stat against the base: 2 files changed, 212 insertions(+), 1 deletion(-) — both under scripts/, so skip-changeset.

Serial check: every open PR's file list was read before editing; neither gate file is held. scripts/check-skills-token-ratchet.mjs (3 open PRs) and scripts/check-type-check-coverage.mjs (1) are held and were excluded from this sitting on that ground as well as on precision.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33678836122 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: expected 'SIGKILL' to be null
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 12 个 PR（fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499、fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0 #14593、lint(flows): warn on an uncontained loop body and on a try_catch with no catch, and document loop { try_catch } #14617、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(cli): let the dev artifact door own stack-declared security metadata on a host config #14631、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(cli): walk bulkActions, validation messages and datasets in i18n extract, so the coverage ratchet can see them #14651、fix(objectql,metadata): derive a view container's object through the shared helper, so the row's own name is LAST at every SOURCE registrar (#14399) #14665、fix(cli): remove the ghost field types from generate.ts's three vocabularies #14675、test(runtime): measure which declaration copy the security/sharing seeders consume on an artifact boot with an engine #14687、Declare the scripts/ population two Silent gate families walk but never named #14692），分属 11 条投机栈 ⇒ 11 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14720（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Part of #14325 — sitting 1 of the per-gate half. The card stays open: the residue is not exhausted, and this sitting's measurement changes what the rest of it is.

What landed

Two gate families now declare the scripts/ population they walk but never named, in their own module body under the ROOT_DIR_WATCH_HINTS idiom, each pinned in its own --self-test — the shape PR #14188 and PR #14323 landed.

family	declared	why it was silent	residue before ⇢ after	self-test pin
node scripts/check-self-test-wired.mjs	scripts/**/*.mjs, scripts/**/*.mts, scripts/**/*.sh	corpus root arrives as join(ROOT, 'scripts') — a bare single-segment word the extractor cannot see; its only other literals are the six scripts its ledger cites BY NAME (an artifact roster)	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	battery population declaration, 7 cases, floor pinned
node scripts/check-whole-set-label-write.mjs	scripts/**/*.mjs, scripts/**/*.ts, scripts/**/*.sh	two of three ROOTS carry a separator and were recovered; the third is the bare word scripts. The rest of its literals are two owner/repo action slugs and fixture sandbox filenames	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	8 POPULATION cases in selfTest()

Measured with the derivation's own --residue, probe scripts/check-nul-bytes.mjs: 14 matched families ⇢ 16, Silent 148 ⇢ 146. With an outside probe the verdict is unchanged, so neither declaration over-claims.

One hint per admitted extension, not the bare subtree.check-ratchet-remedy-authority.mjs sets that precedent at this same root and its own self-test refuses the subtree spelling. scripts/** would name both gates for the 91 JSON, Markdown and text files under the root that neither one opens. The declared set is SET-EQUAL to each gate's live walk — 221 of 312 and 219 of 312 tracked files, nothing walked left uncovered, nothing covered left unwalked. An extension the filter admits but the tree does not yet HOLD (.js, .cjs, .yml, .yaml) is deliberately absent: a hint reaching nothing tracked is a dead lead the consumer reports as a population. The pins redden the day such a file lands.

⚠️ The finding this sitting is really for: the residue head is NOT a hint-line backlog

The card's own warning — reads are an upper bound — turns out to be the whole story, and the number is now measured rather than suspected.

Census re-derived on this branch's base (2aa8456cf), method as the card specifies: --residue for the Silent bucket, then every enumerating candidate run under an fs-tracing preload, compared against the literals extractWatchHints recovers from its own sources and judged with the derivation's own hintCovers. 202 families discovered, 132 Silent and non-self-test, 82 of those enumerate a directory, 49 read 5 or more undeclared tracked files.

Of those 49:

bucket	n	disposition
whole-tree	6	out of scope, #14189's channel — includes the three this census re-confirms (check-closing-keyword-parity, check-self-test-workflow-commands, check:watch-hint-literal)
declared this sitting	2	the only members with a NARROW, high-precision, undeclared population
root-wide, ledger already REFUSED	13	scripts/pm/bare-root-worklist.mjs records a verdict for each
root-wide, same class, no ledger row	14	32–52% of a 5837-file root — the identical trade, unrecorded
low precision (under 10%)	14	incidental or artifact reads; no honest subtree to declare

The head of the residue is the REFUSE-WIDE class, and this repo has already adjudicated it.scripts/pm/bare-root-worklist.mjs is a maintained, self-tested ledger of exactly this species and reports 0 untriaged rows. Every one of the four members the card source-confirmed as the natural head of sitting 1 is either recorded there as refused, or is unrecorded but measures into the same class:

• check:engine-double-contract — REFUSE-WIDE on both roots (measured 90% / 84%), with the split refused by name
• check:error-code-casing — REFUSE-WIDE, "same trade as engine-double-contract"
• check:error-status-conformance — REFUSE-WIDE at 39%
• check:route-envelope — no ledger row; walks join(ROOT, 'packages') over non-test .ts, measured here at 2138 undeclared reads = 36.6% of the root. Same class as check:authz-resolver, which IS recorded REFUSE-WIDE at 39%.

The ledger states the trade in its own words: a bare-root declaration there "would be TRUE, and is refused anyway: it names the gate for every card under a root the fleet already declares wholesale, so the matched column stops discriminating and restates 'run the farm', which CI does regardless." It also records the maintainer ruling of 2026-08-26 that split the spellable-but-undeclared rows by measured downstream pull — rows with a recorded consumer get the declaration, rows without stay deferred.

⇒ Sitting 2 cannot be "the next 8 by read count". Continuing down this order means declaring packages/** on gates whose recorded verdict refuses exactly that, which is a re-decision of a maintainer-ruled map, not the mechanical repair this card scoped. Three honest routes, for triage rather than for a dev to pick:

1. Stop the per-gate half here. The narrow-subtree population the card describes was real and is now exhausted at two members; the rest of the residue is the width trade, already priced.
2. Per-member consumer evidence. Take the 14 unrecorded root-wide members one at a time, and declare only where a MEASURED consumer exists (a card that ran a green local union and lost a CI round to that gate) — the criterion the 2026-08-26 ruling already uses. That is a p2-per-member shape, as the triage says.
3. Record the 14 unrecorded members in the ledger so the class is closed by evidence rather than left looking like outstanding debt. This is a bare-root-worklist.mjs edit, so it belongs to a card that owns that file.

⛔ None of these is taken here. scripts/pm/dispatch-gates.mjs is untouched, as scoped.

Artifact-only by design, recorded rather than declared

check-self-test-wired and check-whole-set-label-write each ALSO name individual files — the ledger rows one cites, the action slugs and probe paths the other pins. Those stay as they are: they are artifacts the gate names, not a population it reads, and the new declaration sits beside them rather than replacing them. The 14 low-precision members above are the same shape at family scale and are recorded here, not declared.

Verification

Union derived in this worktree by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths passed — the script takes its own changeset), 17 commands, re-derived unchanged after merging origin/main. Run at be6800e2f:

• 16 of 17 green, including check:watch-hint-literal (47 declarations across 4 rostered names), check:ratchet-remedy-authority, check:pm-dispatch-gates (VERDICT command-exit 0, dispatch-gates self-test 1240 cases pass), and node scripts/pm/bare-root-worklist.mjs --self-test ("none stale, none missing, none contradicted" — the new declarations create no fresh untriaged row and contradict no recorded verdict)
• node scripts/check-declared-population-live.mjs — "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 8006 tracked file(s)"
• both gates' production leg and --self-test leg green; check-self-test-wired prints "scope: 221 file(s) under scripts/", which is the declared set exactly
• node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED by its own design — it needs a CI test log and says so in its own output. Not a red.

Ablation — the pins are proved able to go red. Five legs, each mutating the committed declaration, each proved on disk by counting the removed and injected text before reading any result, each restored via git checkout HEAD and verified by git hash-object against the HEAD blob (both MATCH):

leg	expected	observed
drop scripts/**/*.sh	RED	exit 1 — "a file this gate WALKS is left undeclared"
add scripts/**/*.json	RED	exit 1 — "a declared hint reaches nothing this gate walks — a dead lead"
rewrite as a computed .map() spelling	RED	exit 1 — "the declaration is not a single literal array of quoted strings"
drop scripts/**/*.ts	RED	exit 1 — "every file this gate walks under scripts/ is declared: expected true, got false"
replace with the bare scripts/**	RED	exit 1 — 4 failures, including the extension and dead-lead pins

⚠️ Reported rather than hidden: the FIRST ablation harness was a no-op — its perl replacer failed to compile on the glob metacharacters and changed nothing. The on-disk proof step caught it and the readings were voided; the table above is the re-run with an exact-literal replacer. Had that step been skipped, five green self-tests would have read as five passing ablations.

git diff --stat against the base: 2 files changed, 212 insertions(+), 1 deletion(-) — both under scripts/, so skip-changeset.

Serial check: every open PR's file list was read before editing; neither gate file is held. scripts/check-skills-token-ratchet.mjs (3 open PRs) and scripts/check-type-check-coverage.mjs (1) are held and were excluded from this sitting on that ground as well as on precision.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33678836122 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: expected 'SIGKILL' to be null
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 12 个 PR（fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499、fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0 #14593、lint(flows): warn on an uncontained loop body and on a try_catch with no catch, and document loop { try_catch } #14617、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(cli): let the dev artifact door own stack-declared security metadata on a host config #14631、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(cli): walk bulkActions, validation messages and datasets in i18n extract, so the coverage ratchet can see them #14651、fix(objectql,metadata): derive a view container's object through the shared helper, so the row's own name is LAST at every SOURCE registrar (#14399) #14665、fix(cli): remove the ghost field types from generate.ts's three vocabularies #14675、test(runtime): measure which declaration copy the security/sharing seeders consume on an artifact boot with an engine #14687、Declare the scripts/ population two Silent gate families walk but never named #14692），分属 11 条投机栈 ⇒ 11 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14720（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Part of #14325 — sitting 1 of the per-gate half. The card stays open: the residue is not exhausted, and this sitting's measurement changes what the rest of it is.

What landed

Two gate families now declare the scripts/ population they walk but never named, in their own module body under the ROOT_DIR_WATCH_HINTS idiom, each pinned in its own --self-test — the shape PR #14188 and PR #14323 landed.

family	declared	why it was silent	residue before ⇢ after	self-test pin
node scripts/check-self-test-wired.mjs	scripts/**/*.mjs, scripts/**/*.mts, scripts/**/*.sh	corpus root arrives as join(ROOT, 'scripts') — a bare single-segment word the extractor cannot see; its only other literals are the six scripts its ledger cites BY NAME (an artifact roster)	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	battery population declaration, 7 cases, floor pinned
node scripts/check-whole-set-label-write.mjs	scripts/**/*.mjs, scripts/**/*.ts, scripts/**/*.sh	two of three ROOTS carry a separator and were recovered; the third is the bare word scripts. The rest of its literals are two owner/repo action slugs and fixture sandbox filenames	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	8 POPULATION cases in selfTest()

Measured with the derivation's own --residue, probe scripts/check-nul-bytes.mjs: 14 matched families ⇢ 16, Silent 148 ⇢ 146. With an outside probe the verdict is unchanged, so neither declaration over-claims.

One hint per admitted extension, not the bare subtree.check-ratchet-remedy-authority.mjs sets that precedent at this same root and its own self-test refuses the subtree spelling. scripts/** would name both gates for the 91 JSON, Markdown and text files under the root that neither one opens. The declared set is SET-EQUAL to each gate's live walk — 221 of 312 and 219 of 312 tracked files, nothing walked left uncovered, nothing covered left unwalked. An extension the filter admits but the tree does not yet HOLD (.js, .cjs, .yml, .yaml) is deliberately absent: a hint reaching nothing tracked is a dead lead the consumer reports as a population. The pins redden the day such a file lands.

⚠️ The finding this sitting is really for: the residue head is NOT a hint-line backlog

The card's own warning — reads are an upper bound — turns out to be the whole story, and the number is now measured rather than suspected.

Census re-derived on this branch's base (2aa8456cf), method as the card specifies: --residue for the Silent bucket, then every enumerating candidate run under an fs-tracing preload, compared against the literals extractWatchHints recovers from its own sources and judged with the derivation's own hintCovers. 202 families discovered, 132 Silent and non-self-test, 82 of those enumerate a directory, 49 read 5 or more undeclared tracked files.

Of those 49:

bucket	n	disposition
whole-tree	6	out of scope, #14189's channel — includes the three this census re-confirms (check-closing-keyword-parity, check-self-test-workflow-commands, check:watch-hint-literal)
declared this sitting	2	the only members with a NARROW, high-precision, undeclared population
root-wide, ledger already REFUSED	13	scripts/pm/bare-root-worklist.mjs records a verdict for each
root-wide, same class, no ledger row	14	32–52% of a 5837-file root — the identical trade, unrecorded
low precision (under 10%)	14	incidental or artifact reads; no honest subtree to declare

The head of the residue is the REFUSE-WIDE class, and this repo has already adjudicated it.scripts/pm/bare-root-worklist.mjs is a maintained, self-tested ledger of exactly this species and reports 0 untriaged rows. Every one of the four members the card source-confirmed as the natural head of sitting 1 is either recorded there as refused, or is unrecorded but measures into the same class:

• check:engine-double-contract — REFUSE-WIDE on both roots (measured 90% / 84%), with the split refused by name
• check:error-code-casing — REFUSE-WIDE, "same trade as engine-double-contract"
• check:error-status-conformance — REFUSE-WIDE at 39%
• check:route-envelope — no ledger row; walks join(ROOT, 'packages') over non-test .ts, measured here at 2138 undeclared reads = 36.6% of the root. Same class as check:authz-resolver, which IS recorded REFUSE-WIDE at 39%.

The ledger states the trade in its own words: a bare-root declaration there "would be TRUE, and is refused anyway: it names the gate for every card under a root the fleet already declares wholesale, so the matched column stops discriminating and restates 'run the farm', which CI does regardless." It also records the maintainer ruling of 2026-08-26 that split the spellable-but-undeclared rows by measured downstream pull — rows with a recorded consumer get the declaration, rows without stay deferred.

⇒ Sitting 2 cannot be "the next 8 by read count". Continuing down this order means declaring packages/** on gates whose recorded verdict refuses exactly that, which is a re-decision of a maintainer-ruled map, not the mechanical repair this card scoped. Three honest routes, for triage rather than for a dev to pick:

1. Stop the per-gate half here. The narrow-subtree population the card describes was real and is now exhausted at two members; the rest of the residue is the width trade, already priced.
2. Per-member consumer evidence. Take the 14 unrecorded root-wide members one at a time, and declare only where a MEASURED consumer exists (a card that ran a green local union and lost a CI round to that gate) — the criterion the 2026-08-26 ruling already uses. That is a p2-per-member shape, as the triage says.
3. Record the 14 unrecorded members in the ledger so the class is closed by evidence rather than left looking like outstanding debt. This is a bare-root-worklist.mjs edit, so it belongs to a card that owns that file.

⛔ None of these is taken here. scripts/pm/dispatch-gates.mjs is untouched, as scoped.

Artifact-only by design, recorded rather than declared

check-self-test-wired and check-whole-set-label-write each ALSO name individual files — the ledger rows one cites, the action slugs and probe paths the other pins. Those stay as they are: they are artifacts the gate names, not a population it reads, and the new declaration sits beside them rather than replacing them. The 14 low-precision members above are the same shape at family scale and are recorded here, not declared.

Verification

Union derived in this worktree by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths passed — the script takes its own changeset), 17 commands, re-derived unchanged after merging origin/main. Run at be6800e2f:

• 16 of 17 green, including check:watch-hint-literal (47 declarations across 4 rostered names), check:ratchet-remedy-authority, check:pm-dispatch-gates (VERDICT command-exit 0, dispatch-gates self-test 1240 cases pass), and node scripts/pm/bare-root-worklist.mjs --self-test ("none stale, none missing, none contradicted" — the new declarations create no fresh untriaged row and contradict no recorded verdict)
• node scripts/check-declared-population-live.mjs — "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 8006 tracked file(s)"
• both gates' production leg and --self-test leg green; check-self-test-wired prints "scope: 221 file(s) under scripts/", which is the declared set exactly
• node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED by its own design — it needs a CI test log and says so in its own output. Not a red.

Ablation — the pins are proved able to go red. Five legs, each mutating the committed declaration, each proved on disk by counting the removed and injected text before reading any result, each restored via git checkout HEAD and verified by git hash-object against the HEAD blob (both MATCH):

leg	expected	observed
drop scripts/**/*.sh	RED	exit 1 — "a file this gate WALKS is left undeclared"
add scripts/**/*.json	RED	exit 1 — "a declared hint reaches nothing this gate walks — a dead lead"
rewrite as a computed .map() spelling	RED	exit 1 — "the declaration is not a single literal array of quoted strings"
drop scripts/**/*.ts	RED	exit 1 — "every file this gate walks under scripts/ is declared: expected true, got false"
replace with the bare scripts/**	RED	exit 1 — 4 failures, including the extension and dead-lead pins

⚠️ Reported rather than hidden: the FIRST ablation harness was a no-op — its perl replacer failed to compile on the glob metacharacters and changed nothing. The on-disk proof step caught it and the readings were voided; the table above is the re-run with an exact-literal replacer. Had that step been skipped, five green self-tests would have read as five passing ablations.

git diff --stat against the base: 2 files changed, 212 insertions(+), 1 deletion(-) — both under scripts/, so skip-changeset.

Serial check: every open PR's file list was read before editing; neither gate file is held. scripts/check-skills-token-ratchet.mjs (3 open PRs) and scripts/check-type-check-coverage.mjs (1) are held and were excluded from this sitting on that ground as well as on precision.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33678836122 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: expected 'SIGKILL' to be null
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 12 个 PR（fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499、fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0 #14593、lint(flows): warn on an uncontained loop body and on a try_catch with no catch, and document loop { try_catch } #14617、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(cli): let the dev artifact door own stack-declared security metadata on a host config #14631、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(cli): walk bulkActions, validation messages and datasets in i18n extract, so the coverage ratchet can see them #14651、fix(objectql,metadata): derive a view container's object through the shared helper, so the row's own name is LAST at every SOURCE registrar (#14399) #14665、fix(cli): remove the ghost field types from generate.ts's three vocabularies #14675、test(runtime): measure which declaration copy the security/sharing seeders consume on an artifact boot with an engine #14687、Declare the scripts/ population two Silent gate families walk but never named #14692），分属 11 条投机栈 ⇒ 11 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14720（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Part of #14325 — sitting 1 of the per-gate half. The card stays open: the residue is not exhausted, and this sitting's measurement changes what the rest of it is.

What landed

Two gate families now declare the scripts/ population they walk but never named, in their own module body under the ROOT_DIR_WATCH_HINTS idiom, each pinned in its own --self-test — the shape PR #14188 and PR #14323 landed.

family	declared	why it was silent	residue before ⇢ after	self-test pin
node scripts/check-self-test-wired.mjs	scripts/**/*.mjs, scripts/**/*.mts, scripts/**/*.sh	corpus root arrives as join(ROOT, 'scripts') — a bare single-segment word the extractor cannot see; its only other literals are the six scripts its ledger cites BY NAME (an artifact roster)	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	battery population declaration, 7 cases, floor pinned
node scripts/check-whole-set-label-write.mjs	scripts/**/*.mjs, scripts/**/*.ts, scripts/**/*.sh	two of three ROOTS carry a separator and were recovered; the third is the bare word scripts. The rest of its literals are two owner/repo action slugs and fixture sandbox filenames	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	8 POPULATION cases in selfTest()

Measured with the derivation's own --residue, probe scripts/check-nul-bytes.mjs: 14 matched families ⇢ 16, Silent 148 ⇢ 146. With an outside probe the verdict is unchanged, so neither declaration over-claims.

One hint per admitted extension, not the bare subtree.check-ratchet-remedy-authority.mjs sets that precedent at this same root and its own self-test refuses the subtree spelling. scripts/** would name both gates for the 91 JSON, Markdown and text files under the root that neither one opens. The declared set is SET-EQUAL to each gate's live walk — 221 of 312 and 219 of 312 tracked files, nothing walked left uncovered, nothing covered left unwalked. An extension the filter admits but the tree does not yet HOLD (.js, .cjs, .yml, .yaml) is deliberately absent: a hint reaching nothing tracked is a dead lead the consumer reports as a population. The pins redden the day such a file lands.

⚠️ The finding this sitting is really for: the residue head is NOT a hint-line backlog

The card's own warning — reads are an upper bound — turns out to be the whole story, and the number is now measured rather than suspected.

Census re-derived on this branch's base (2aa8456cf), method as the card specifies: --residue for the Silent bucket, then every enumerating candidate run under an fs-tracing preload, compared against the literals extractWatchHints recovers from its own sources and judged with the derivation's own hintCovers. 202 families discovered, 132 Silent and non-self-test, 82 of those enumerate a directory, 49 read 5 or more undeclared tracked files.

Of those 49:

bucket	n	disposition
whole-tree	6	out of scope, #14189's channel — includes the three this census re-confirms (check-closing-keyword-parity, check-self-test-workflow-commands, check:watch-hint-literal)
declared this sitting	2	the only members with a NARROW, high-precision, undeclared population
root-wide, ledger already REFUSED	13	scripts/pm/bare-root-worklist.mjs records a verdict for each
root-wide, same class, no ledger row	14	32–52% of a 5837-file root — the identical trade, unrecorded
low precision (under 10%)	14	incidental or artifact reads; no honest subtree to declare

The head of the residue is the REFUSE-WIDE class, and this repo has already adjudicated it.scripts/pm/bare-root-worklist.mjs is a maintained, self-tested ledger of exactly this species and reports 0 untriaged rows. Every one of the four members the card source-confirmed as the natural head of sitting 1 is either recorded there as refused, or is unrecorded but measures into the same class:

• check:engine-double-contract — REFUSE-WIDE on both roots (measured 90% / 84%), with the split refused by name
• check:error-code-casing — REFUSE-WIDE, "same trade as engine-double-contract"
• check:error-status-conformance — REFUSE-WIDE at 39%
• check:route-envelope — no ledger row; walks join(ROOT, 'packages') over non-test .ts, measured here at 2138 undeclared reads = 36.6% of the root. Same class as check:authz-resolver, which IS recorded REFUSE-WIDE at 39%.

The ledger states the trade in its own words: a bare-root declaration there "would be TRUE, and is refused anyway: it names the gate for every card under a root the fleet already declares wholesale, so the matched column stops discriminating and restates 'run the farm', which CI does regardless." It also records the maintainer ruling of 2026-08-26 that split the spellable-but-undeclared rows by measured downstream pull — rows with a recorded consumer get the declaration, rows without stay deferred.

⇒ Sitting 2 cannot be "the next 8 by read count". Continuing down this order means declaring packages/** on gates whose recorded verdict refuses exactly that, which is a re-decision of a maintainer-ruled map, not the mechanical repair this card scoped. Three honest routes, for triage rather than for a dev to pick:

1. Stop the per-gate half here. The narrow-subtree population the card describes was real and is now exhausted at two members; the rest of the residue is the width trade, already priced.
2. Per-member consumer evidence. Take the 14 unrecorded root-wide members one at a time, and declare only where a MEASURED consumer exists (a card that ran a green local union and lost a CI round to that gate) — the criterion the 2026-08-26 ruling already uses. That is a p2-per-member shape, as the triage says.
3. Record the 14 unrecorded members in the ledger so the class is closed by evidence rather than left looking like outstanding debt. This is a bare-root-worklist.mjs edit, so it belongs to a card that owns that file.

⛔ None of these is taken here. scripts/pm/dispatch-gates.mjs is untouched, as scoped.

Artifact-only by design, recorded rather than declared

check-self-test-wired and check-whole-set-label-write each ALSO name individual files — the ledger rows one cites, the action slugs and probe paths the other pins. Those stay as they are: they are artifacts the gate names, not a population it reads, and the new declaration sits beside them rather than replacing them. The 14 low-precision members above are the same shape at family scale and are recorded here, not declared.

Verification

Union derived in this worktree by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths passed — the script takes its own changeset), 17 commands, re-derived unchanged after merging origin/main. Run at be6800e2f:

• 16 of 17 green, including check:watch-hint-literal (47 declarations across 4 rostered names), check:ratchet-remedy-authority, check:pm-dispatch-gates (VERDICT command-exit 0, dispatch-gates self-test 1240 cases pass), and node scripts/pm/bare-root-worklist.mjs --self-test ("none stale, none missing, none contradicted" — the new declarations create no fresh untriaged row and contradict no recorded verdict)
• node scripts/check-declared-population-live.mjs — "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 8006 tracked file(s)"
• both gates' production leg and --self-test leg green; check-self-test-wired prints "scope: 221 file(s) under scripts/", which is the declared set exactly
• node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED by its own design — it needs a CI test log and says so in its own output. Not a red.

Ablation — the pins are proved able to go red. Five legs, each mutating the committed declaration, each proved on disk by counting the removed and injected text before reading any result, each restored via git checkout HEAD and verified by git hash-object against the HEAD blob (both MATCH):

leg	expected	observed
drop scripts/**/*.sh	RED	exit 1 — "a file this gate WALKS is left undeclared"
add scripts/**/*.json	RED	exit 1 — "a declared hint reaches nothing this gate walks — a dead lead"
rewrite as a computed .map() spelling	RED	exit 1 — "the declaration is not a single literal array of quoted strings"
drop scripts/**/*.ts	RED	exit 1 — "every file this gate walks under scripts/ is declared: expected true, got false"
replace with the bare scripts/**	RED	exit 1 — 4 failures, including the extension and dead-lead pins

⚠️ Reported rather than hidden: the FIRST ablation harness was a no-op — its perl replacer failed to compile on the glob metacharacters and changed nothing. The on-disk proof step caught it and the readings were voided; the table above is the re-run with an exact-literal replacer. Had that step been skipped, five green self-tests would have read as five passing ablations.

git diff --stat against the base: 2 files changed, 212 insertions(+), 1 deletion(-) — both under scripts/, so skip-changeset.

Serial check: every open PR's file list was read before editing; neither gate file is held. scripts/check-skills-token-ratchet.mjs (3 open PRs) and scripts/check-type-check-coverage.mjs (1) are held and were excluded from this sitting on that ground as well as on precision.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33678836122 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: expected 'SIGKILL' to be null
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 12 个 PR（fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499、fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0 #14593、lint(flows): warn on an uncontained loop body and on a try_catch with no catch, and document loop { try_catch } #14617、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(cli): let the dev artifact door own stack-declared security metadata on a host config #14631、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(cli): walk bulkActions, validation messages and datasets in i18n extract, so the coverage ratchet can see them #14651、fix(objectql,metadata): derive a view container's object through the shared helper, so the row's own name is LAST at every SOURCE registrar (#14399) #14665、fix(cli): remove the ghost field types from generate.ts's three vocabularies #14675、test(runtime): measure which declaration copy the security/sharing seeders consume on an artifact boot with an engine #14687、Declare the scripts/ population two Silent gate families walk but never named #14692），分属 11 条投机栈 ⇒ 11 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14720（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Part of #14325 — sitting 1 of the per-gate half. The card stays open: the residue is not exhausted, and this sitting's measurement changes what the rest of it is.

What landed

Two gate families now declare the scripts/ population they walk but never named, in their own module body under the ROOT_DIR_WATCH_HINTS idiom, each pinned in its own --self-test — the shape PR #14188 and PR #14323 landed.

family	declared	why it was silent	residue before ⇢ after	self-test pin
node scripts/check-self-test-wired.mjs	scripts/**/*.mjs, scripts/**/*.mts, scripts/**/*.sh	corpus root arrives as join(ROOT, 'scripts') — a bare single-segment word the extractor cannot see; its only other literals are the six scripts its ledger cites BY NAME (an artifact roster)	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	battery population declaration, 7 cases, floor pinned
node scripts/check-whole-set-label-write.mjs	scripts/**/*.mjs, scripts/**/*.ts, scripts/**/*.sh	two of three ROOTS carry a separator and were recovered; the third is the bare word scripts. The rest of its literals are two owner/repo action slugs and fixture sandbox filenames	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	8 POPULATION cases in selfTest()

Measured with the derivation's own --residue, probe scripts/check-nul-bytes.mjs: 14 matched families ⇢ 16, Silent 148 ⇢ 146. With an outside probe the verdict is unchanged, so neither declaration over-claims.

One hint per admitted extension, not the bare subtree.check-ratchet-remedy-authority.mjs sets that precedent at this same root and its own self-test refuses the subtree spelling. scripts/** would name both gates for the 91 JSON, Markdown and text files under the root that neither one opens. The declared set is SET-EQUAL to each gate's live walk — 221 of 312 and 219 of 312 tracked files, nothing walked left uncovered, nothing covered left unwalked. An extension the filter admits but the tree does not yet HOLD (.js, .cjs, .yml, .yaml) is deliberately absent: a hint reaching nothing tracked is a dead lead the consumer reports as a population. The pins redden the day such a file lands.

⚠️ The finding this sitting is really for: the residue head is NOT a hint-line backlog

The card's own warning — reads are an upper bound — turns out to be the whole story, and the number is now measured rather than suspected.

Census re-derived on this branch's base (2aa8456cf), method as the card specifies: --residue for the Silent bucket, then every enumerating candidate run under an fs-tracing preload, compared against the literals extractWatchHints recovers from its own sources and judged with the derivation's own hintCovers. 202 families discovered, 132 Silent and non-self-test, 82 of those enumerate a directory, 49 read 5 or more undeclared tracked files.

Of those 49:

bucket	n	disposition
whole-tree	6	out of scope, #14189's channel — includes the three this census re-confirms (check-closing-keyword-parity, check-self-test-workflow-commands, check:watch-hint-literal)
declared this sitting	2	the only members with a NARROW, high-precision, undeclared population
root-wide, ledger already REFUSED	13	scripts/pm/bare-root-worklist.mjs records a verdict for each
root-wide, same class, no ledger row	14	32–52% of a 5837-file root — the identical trade, unrecorded
low precision (under 10%)	14	incidental or artifact reads; no honest subtree to declare

The head of the residue is the REFUSE-WIDE class, and this repo has already adjudicated it.scripts/pm/bare-root-worklist.mjs is a maintained, self-tested ledger of exactly this species and reports 0 untriaged rows. Every one of the four members the card source-confirmed as the natural head of sitting 1 is either recorded there as refused, or is unrecorded but measures into the same class:

• check:engine-double-contract — REFUSE-WIDE on both roots (measured 90% / 84%), with the split refused by name
• check:error-code-casing — REFUSE-WIDE, "same trade as engine-double-contract"
• check:error-status-conformance — REFUSE-WIDE at 39%
• check:route-envelope — no ledger row; walks join(ROOT, 'packages') over non-test .ts, measured here at 2138 undeclared reads = 36.6% of the root. Same class as check:authz-resolver, which IS recorded REFUSE-WIDE at 39%.

The ledger states the trade in its own words: a bare-root declaration there "would be TRUE, and is refused anyway: it names the gate for every card under a root the fleet already declares wholesale, so the matched column stops discriminating and restates 'run the farm', which CI does regardless." It also records the maintainer ruling of 2026-08-26 that split the spellable-but-undeclared rows by measured downstream pull — rows with a recorded consumer get the declaration, rows without stay deferred.

⇒ Sitting 2 cannot be "the next 8 by read count". Continuing down this order means declaring packages/** on gates whose recorded verdict refuses exactly that, which is a re-decision of a maintainer-ruled map, not the mechanical repair this card scoped. Three honest routes, for triage rather than for a dev to pick:

1. Stop the per-gate half here. The narrow-subtree population the card describes was real and is now exhausted at two members; the rest of the residue is the width trade, already priced.
2. Per-member consumer evidence. Take the 14 unrecorded root-wide members one at a time, and declare only where a MEASURED consumer exists (a card that ran a green local union and lost a CI round to that gate) — the criterion the 2026-08-26 ruling already uses. That is a p2-per-member shape, as the triage says.
3. Record the 14 unrecorded members in the ledger so the class is closed by evidence rather than left looking like outstanding debt. This is a bare-root-worklist.mjs edit, so it belongs to a card that owns that file.

⛔ None of these is taken here. scripts/pm/dispatch-gates.mjs is untouched, as scoped.

Artifact-only by design, recorded rather than declared

check-self-test-wired and check-whole-set-label-write each ALSO name individual files — the ledger rows one cites, the action slugs and probe paths the other pins. Those stay as they are: they are artifacts the gate names, not a population it reads, and the new declaration sits beside them rather than replacing them. The 14 low-precision members above are the same shape at family scale and are recorded here, not declared.

Verification

Union derived in this worktree by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths passed — the script takes its own changeset), 17 commands, re-derived unchanged after merging origin/main. Run at be6800e2f:

• 16 of 17 green, including check:watch-hint-literal (47 declarations across 4 rostered names), check:ratchet-remedy-authority, check:pm-dispatch-gates (VERDICT command-exit 0, dispatch-gates self-test 1240 cases pass), and node scripts/pm/bare-root-worklist.mjs --self-test ("none stale, none missing, none contradicted" — the new declarations create no fresh untriaged row and contradict no recorded verdict)
• node scripts/check-declared-population-live.mjs — "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 8006 tracked file(s)"
• both gates' production leg and --self-test leg green; check-self-test-wired prints "scope: 221 file(s) under scripts/", which is the declared set exactly
• node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED by its own design — it needs a CI test log and says so in its own output. Not a red.

Ablation — the pins are proved able to go red. Five legs, each mutating the committed declaration, each proved on disk by counting the removed and injected text before reading any result, each restored via git checkout HEAD and verified by git hash-object against the HEAD blob (both MATCH):

leg	expected	observed
drop scripts/**/*.sh	RED	exit 1 — "a file this gate WALKS is left undeclared"
add scripts/**/*.json	RED	exit 1 — "a declared hint reaches nothing this gate walks — a dead lead"
rewrite as a computed .map() spelling	RED	exit 1 — "the declaration is not a single literal array of quoted strings"
drop scripts/**/*.ts	RED	exit 1 — "every file this gate walks under scripts/ is declared: expected true, got false"
replace with the bare scripts/**	RED	exit 1 — 4 failures, including the extension and dead-lead pins

⚠️ Reported rather than hidden: the FIRST ablation harness was a no-op — its perl replacer failed to compile on the glob metacharacters and changed nothing. The on-disk proof step caught it and the readings were voided; the table above is the re-run with an exact-literal replacer. Had that step been skipped, five green self-tests would have read as five passing ablations.

git diff --stat against the base: 2 files changed, 212 insertions(+), 1 deletion(-) — both under scripts/, so skip-changeset.

Serial check: every open PR's file list was read before editing; neither gate file is held. scripts/check-skills-token-ratchet.mjs (3 open PRs) and scripts/check-type-check-coverage.mjs (1) are held and were excluded from this sitting on that ground as well as on precision.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33678836122 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: expected 'SIGKILL' to be null
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 12 个 PR（fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499、fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0 #14593、lint(flows): warn on an uncontained loop body and on a try_catch with no catch, and document loop { try_catch } #14617、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(cli): let the dev artifact door own stack-declared security metadata on a host config #14631、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(cli): walk bulkActions, validation messages and datasets in i18n extract, so the coverage ratchet can see them #14651、fix(objectql,metadata): derive a view container's object through the shared helper, so the row's own name is LAST at every SOURCE registrar (#14399) #14665、fix(cli): remove the ghost field types from generate.ts's three vocabularies #14675、test(runtime): measure which declaration copy the security/sharing seeders consume on an artifact boot with an engine #14687、Declare the scripts/ population two Silent gate families walk but never named #14692），分属 11 条投机栈 ⇒ 11 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14720（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Part of #14325 — sitting 1 of the per-gate half. The card stays open: the residue is not exhausted, and this sitting's measurement changes what the rest of it is.

What landed

Two gate families now declare the scripts/ population they walk but never named, in their own module body under the ROOT_DIR_WATCH_HINTS idiom, each pinned in its own --self-test — the shape PR #14188 and PR #14323 landed.

family	declared	why it was silent	residue before ⇢ after	self-test pin
node scripts/check-self-test-wired.mjs	scripts/**/*.mjs, scripts/**/*.mts, scripts/**/*.sh	corpus root arrives as join(ROOT, 'scripts') — a bare single-segment word the extractor cannot see; its only other literals are the six scripts its ledger cites BY NAME (an artifact roster)	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	battery population declaration, 7 cases, floor pinned
node scripts/check-whole-set-label-write.mjs	scripts/**/*.mjs, scripts/**/*.ts, scripts/**/*.sh	two of three ROOTS carry a separator and were recovered; the third is the bare word scripts. The rest of its literals are two owner/repo action slugs and fixture sandbox filenames	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	8 POPULATION cases in selfTest()

Measured with the derivation's own --residue, probe scripts/check-nul-bytes.mjs: 14 matched families ⇢ 16, Silent 148 ⇢ 146. With an outside probe the verdict is unchanged, so neither declaration over-claims.

One hint per admitted extension, not the bare subtree.check-ratchet-remedy-authority.mjs sets that precedent at this same root and its own self-test refuses the subtree spelling. scripts/** would name both gates for the 91 JSON, Markdown and text files under the root that neither one opens. The declared set is SET-EQUAL to each gate's live walk — 221 of 312 and 219 of 312 tracked files, nothing walked left uncovered, nothing covered left unwalked. An extension the filter admits but the tree does not yet HOLD (.js, .cjs, .yml, .yaml) is deliberately absent: a hint reaching nothing tracked is a dead lead the consumer reports as a population. The pins redden the day such a file lands.

⚠️ The finding this sitting is really for: the residue head is NOT a hint-line backlog

The card's own warning — reads are an upper bound — turns out to be the whole story, and the number is now measured rather than suspected.

Census re-derived on this branch's base (2aa8456cf), method as the card specifies: --residue for the Silent bucket, then every enumerating candidate run under an fs-tracing preload, compared against the literals extractWatchHints recovers from its own sources and judged with the derivation's own hintCovers. 202 families discovered, 132 Silent and non-self-test, 82 of those enumerate a directory, 49 read 5 or more undeclared tracked files.

Of those 49:

bucket	n	disposition
whole-tree	6	out of scope, #14189's channel — includes the three this census re-confirms (check-closing-keyword-parity, check-self-test-workflow-commands, check:watch-hint-literal)
declared this sitting	2	the only members with a NARROW, high-precision, undeclared population
root-wide, ledger already REFUSED	13	scripts/pm/bare-root-worklist.mjs records a verdict for each
root-wide, same class, no ledger row	14	32–52% of a 5837-file root — the identical trade, unrecorded
low precision (under 10%)	14	incidental or artifact reads; no honest subtree to declare

The head of the residue is the REFUSE-WIDE class, and this repo has already adjudicated it.scripts/pm/bare-root-worklist.mjs is a maintained, self-tested ledger of exactly this species and reports 0 untriaged rows. Every one of the four members the card source-confirmed as the natural head of sitting 1 is either recorded there as refused, or is unrecorded but measures into the same class:

• check:engine-double-contract — REFUSE-WIDE on both roots (measured 90% / 84%), with the split refused by name
• check:error-code-casing — REFUSE-WIDE, "same trade as engine-double-contract"
• check:error-status-conformance — REFUSE-WIDE at 39%
• check:route-envelope — no ledger row; walks join(ROOT, 'packages') over non-test .ts, measured here at 2138 undeclared reads = 36.6% of the root. Same class as check:authz-resolver, which IS recorded REFUSE-WIDE at 39%.

The ledger states the trade in its own words: a bare-root declaration there "would be TRUE, and is refused anyway: it names the gate for every card under a root the fleet already declares wholesale, so the matched column stops discriminating and restates 'run the farm', which CI does regardless." It also records the maintainer ruling of 2026-08-26 that split the spellable-but-undeclared rows by measured downstream pull — rows with a recorded consumer get the declaration, rows without stay deferred.

⇒ Sitting 2 cannot be "the next 8 by read count". Continuing down this order means declaring packages/** on gates whose recorded verdict refuses exactly that, which is a re-decision of a maintainer-ruled map, not the mechanical repair this card scoped. Three honest routes, for triage rather than for a dev to pick:

1. Stop the per-gate half here. The narrow-subtree population the card describes was real and is now exhausted at two members; the rest of the residue is the width trade, already priced.
2. Per-member consumer evidence. Take the 14 unrecorded root-wide members one at a time, and declare only where a MEASURED consumer exists (a card that ran a green local union and lost a CI round to that gate) — the criterion the 2026-08-26 ruling already uses. That is a p2-per-member shape, as the triage says.
3. Record the 14 unrecorded members in the ledger so the class is closed by evidence rather than left looking like outstanding debt. This is a bare-root-worklist.mjs edit, so it belongs to a card that owns that file.

⛔ None of these is taken here. scripts/pm/dispatch-gates.mjs is untouched, as scoped.

Artifact-only by design, recorded rather than declared

check-self-test-wired and check-whole-set-label-write each ALSO name individual files — the ledger rows one cites, the action slugs and probe paths the other pins. Those stay as they are: they are artifacts the gate names, not a population it reads, and the new declaration sits beside them rather than replacing them. The 14 low-precision members above are the same shape at family scale and are recorded here, not declared.

Verification

Union derived in this worktree by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths passed — the script takes its own changeset), 17 commands, re-derived unchanged after merging origin/main. Run at be6800e2f:

• 16 of 17 green, including check:watch-hint-literal (47 declarations across 4 rostered names), check:ratchet-remedy-authority, check:pm-dispatch-gates (VERDICT command-exit 0, dispatch-gates self-test 1240 cases pass), and node scripts/pm/bare-root-worklist.mjs --self-test ("none stale, none missing, none contradicted" — the new declarations create no fresh untriaged row and contradict no recorded verdict)
• node scripts/check-declared-population-live.mjs — "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 8006 tracked file(s)"
• both gates' production leg and --self-test leg green; check-self-test-wired prints "scope: 221 file(s) under scripts/", which is the declared set exactly
• node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED by its own design — it needs a CI test log and says so in its own output. Not a red.

Ablation — the pins are proved able to go red. Five legs, each mutating the committed declaration, each proved on disk by counting the removed and injected text before reading any result, each restored via git checkout HEAD and verified by git hash-object against the HEAD blob (both MATCH):

leg	expected	observed
drop scripts/**/*.sh	RED	exit 1 — "a file this gate WALKS is left undeclared"
add scripts/**/*.json	RED	exit 1 — "a declared hint reaches nothing this gate walks — a dead lead"
rewrite as a computed .map() spelling	RED	exit 1 — "the declaration is not a single literal array of quoted strings"
drop scripts/**/*.ts	RED	exit 1 — "every file this gate walks under scripts/ is declared: expected true, got false"
replace with the bare scripts/**	RED	exit 1 — 4 failures, including the extension and dead-lead pins

⚠️ Reported rather than hidden: the FIRST ablation harness was a no-op — its perl replacer failed to compile on the glob metacharacters and changed nothing. The on-disk proof step caught it and the readings were voided; the table above is the re-run with an exact-literal replacer. Had that step been skipped, five green self-tests would have read as five passing ablations.

git diff --stat against the base: 2 files changed, 212 insertions(+), 1 deletion(-) — both under scripts/, so skip-changeset.

Serial check: every open PR's file list was read before editing; neither gate file is held. scripts/check-skills-token-ratchet.mjs (3 open PRs) and scripts/check-type-check-coverage.mjs (1) are held and were excluded from this sitting on that ground as well as on precision.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33678836122 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: expected 'SIGKILL' to be null
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 12 个 PR（fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499、fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0 #14593、lint(flows): warn on an uncontained loop body and on a try_catch with no catch, and document loop { try_catch } #14617、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(cli): let the dev artifact door own stack-declared security metadata on a host config #14631、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(cli): walk bulkActions, validation messages and datasets in i18n extract, so the coverage ratchet can see them #14651、fix(objectql,metadata): derive a view container's object through the shared helper, so the row's own name is LAST at every SOURCE registrar (#14399) #14665、fix(cli): remove the ghost field types from generate.ts's three vocabularies #14675、test(runtime): measure which declaration copy the security/sharing seeders consume on an artifact boot with an engine #14687、Declare the scripts/ population two Silent gate families walk but never named #14692），分属 11 条投机栈 ⇒ 11 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14720（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Part of #14325 — sitting 1 of the per-gate half. The card stays open: the residue is not exhausted, and this sitting's measurement changes what the rest of it is.

What landed

Two gate families now declare the scripts/ population they walk but never named, in their own module body under the ROOT_DIR_WATCH_HINTS idiom, each pinned in its own --self-test — the shape PR #14188 and PR #14323 landed.

family	declared	why it was silent	residue before ⇢ after	self-test pin
node scripts/check-self-test-wired.mjs	scripts/**/*.mjs, scripts/**/*.mts, scripts/**/*.sh	corpus root arrives as join(ROOT, 'scripts') — a bare single-segment word the extractor cannot see; its only other literals are the six scripts its ledger cites BY NAME (an artifact roster)	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	battery population declaration, 7 cases, floor pinned
node scripts/check-whole-set-label-write.mjs	scripts/**/*.mjs, scripts/**/*.ts, scripts/**/*.sh	two of three ROOTS carry a separator and were recovered; the third is the bare word scripts. The rest of its literals are two owner/repo action slugs and fixture sandbox filenames	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	8 POPULATION cases in selfTest()

Measured with the derivation's own --residue, probe scripts/check-nul-bytes.mjs: 14 matched families ⇢ 16, Silent 148 ⇢ 146. With an outside probe the verdict is unchanged, so neither declaration over-claims.

One hint per admitted extension, not the bare subtree.check-ratchet-remedy-authority.mjs sets that precedent at this same root and its own self-test refuses the subtree spelling. scripts/** would name both gates for the 91 JSON, Markdown and text files under the root that neither one opens. The declared set is SET-EQUAL to each gate's live walk — 221 of 312 and 219 of 312 tracked files, nothing walked left uncovered, nothing covered left unwalked. An extension the filter admits but the tree does not yet HOLD (.js, .cjs, .yml, .yaml) is deliberately absent: a hint reaching nothing tracked is a dead lead the consumer reports as a population. The pins redden the day such a file lands.

⚠️ The finding this sitting is really for: the residue head is NOT a hint-line backlog

The card's own warning — reads are an upper bound — turns out to be the whole story, and the number is now measured rather than suspected.

Census re-derived on this branch's base (2aa8456cf), method as the card specifies: --residue for the Silent bucket, then every enumerating candidate run under an fs-tracing preload, compared against the literals extractWatchHints recovers from its own sources and judged with the derivation's own hintCovers. 202 families discovered, 132 Silent and non-self-test, 82 of those enumerate a directory, 49 read 5 or more undeclared tracked files.

Of those 49:

bucket	n	disposition
whole-tree	6	out of scope, #14189's channel — includes the three this census re-confirms (check-closing-keyword-parity, check-self-test-workflow-commands, check:watch-hint-literal)
declared this sitting	2	the only members with a NARROW, high-precision, undeclared population
root-wide, ledger already REFUSED	13	scripts/pm/bare-root-worklist.mjs records a verdict for each
root-wide, same class, no ledger row	14	32–52% of a 5837-file root — the identical trade, unrecorded
low precision (under 10%)	14	incidental or artifact reads; no honest subtree to declare

The head of the residue is the REFUSE-WIDE class, and this repo has already adjudicated it.scripts/pm/bare-root-worklist.mjs is a maintained, self-tested ledger of exactly this species and reports 0 untriaged rows. Every one of the four members the card source-confirmed as the natural head of sitting 1 is either recorded there as refused, or is unrecorded but measures into the same class:

• check:engine-double-contract — REFUSE-WIDE on both roots (measured 90% / 84%), with the split refused by name
• check:error-code-casing — REFUSE-WIDE, "same trade as engine-double-contract"
• check:error-status-conformance — REFUSE-WIDE at 39%
• check:route-envelope — no ledger row; walks join(ROOT, 'packages') over non-test .ts, measured here at 2138 undeclared reads = 36.6% of the root. Same class as check:authz-resolver, which IS recorded REFUSE-WIDE at 39%.

The ledger states the trade in its own words: a bare-root declaration there "would be TRUE, and is refused anyway: it names the gate for every card under a root the fleet already declares wholesale, so the matched column stops discriminating and restates 'run the farm', which CI does regardless." It also records the maintainer ruling of 2026-08-26 that split the spellable-but-undeclared rows by measured downstream pull — rows with a recorded consumer get the declaration, rows without stay deferred.

⇒ Sitting 2 cannot be "the next 8 by read count". Continuing down this order means declaring packages/** on gates whose recorded verdict refuses exactly that, which is a re-decision of a maintainer-ruled map, not the mechanical repair this card scoped. Three honest routes, for triage rather than for a dev to pick:

1. Stop the per-gate half here. The narrow-subtree population the card describes was real and is now exhausted at two members; the rest of the residue is the width trade, already priced.
2. Per-member consumer evidence. Take the 14 unrecorded root-wide members one at a time, and declare only where a MEASURED consumer exists (a card that ran a green local union and lost a CI round to that gate) — the criterion the 2026-08-26 ruling already uses. That is a p2-per-member shape, as the triage says.
3. Record the 14 unrecorded members in the ledger so the class is closed by evidence rather than left looking like outstanding debt. This is a bare-root-worklist.mjs edit, so it belongs to a card that owns that file.

⛔ None of these is taken here. scripts/pm/dispatch-gates.mjs is untouched, as scoped.

Artifact-only by design, recorded rather than declared

check-self-test-wired and check-whole-set-label-write each ALSO name individual files — the ledger rows one cites, the action slugs and probe paths the other pins. Those stay as they are: they are artifacts the gate names, not a population it reads, and the new declaration sits beside them rather than replacing them. The 14 low-precision members above are the same shape at family scale and are recorded here, not declared.

Verification

Union derived in this worktree by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths passed — the script takes its own changeset), 17 commands, re-derived unchanged after merging origin/main. Run at be6800e2f:

• 16 of 17 green, including check:watch-hint-literal (47 declarations across 4 rostered names), check:ratchet-remedy-authority, check:pm-dispatch-gates (VERDICT command-exit 0, dispatch-gates self-test 1240 cases pass), and node scripts/pm/bare-root-worklist.mjs --self-test ("none stale, none missing, none contradicted" — the new declarations create no fresh untriaged row and contradict no recorded verdict)
• node scripts/check-declared-population-live.mjs — "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 8006 tracked file(s)"
• both gates' production leg and --self-test leg green; check-self-test-wired prints "scope: 221 file(s) under scripts/", which is the declared set exactly
• node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED by its own design — it needs a CI test log and says so in its own output. Not a red.

Ablation — the pins are proved able to go red. Five legs, each mutating the committed declaration, each proved on disk by counting the removed and injected text before reading any result, each restored via git checkout HEAD and verified by git hash-object against the HEAD blob (both MATCH):

leg	expected	observed
drop scripts/**/*.sh	RED	exit 1 — "a file this gate WALKS is left undeclared"
add scripts/**/*.json	RED	exit 1 — "a declared hint reaches nothing this gate walks — a dead lead"
rewrite as a computed .map() spelling	RED	exit 1 — "the declaration is not a single literal array of quoted strings"
drop scripts/**/*.ts	RED	exit 1 — "every file this gate walks under scripts/ is declared: expected true, got false"
replace with the bare scripts/**	RED	exit 1 — 4 failures, including the extension and dead-lead pins

⚠️ Reported rather than hidden: the FIRST ablation harness was a no-op — its perl replacer failed to compile on the glob metacharacters and changed nothing. The on-disk proof step caught it and the readings were voided; the table above is the re-run with an exact-literal replacer. Had that step been skipped, five green self-tests would have read as five passing ablations.

git diff --stat against the base: 2 files changed, 212 insertions(+), 1 deletion(-) — both under scripts/, so skip-changeset.

Serial check: every open PR's file list was read before editing; neither gate file is held. scripts/check-skills-token-ratchet.mjs (3 open PRs) and scripts/check-type-check-coverage.mjs (1) are held and were excluded from this sitting on that ground as well as on precision.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33678836122 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: expected 'SIGKILL' to be null
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 12 个 PR（fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499、fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0 #14593、lint(flows): warn on an uncontained loop body and on a try_catch with no catch, and document loop { try_catch } #14617、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(cli): let the dev artifact door own stack-declared security metadata on a host config #14631、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(cli): walk bulkActions, validation messages and datasets in i18n extract, so the coverage ratchet can see them #14651、fix(objectql,metadata): derive a view container's object through the shared helper, so the row's own name is LAST at every SOURCE registrar (#14399) #14665、fix(cli): remove the ghost field types from generate.ts's three vocabularies #14675、test(runtime): measure which declaration copy the security/sharing seeders consume on an artifact boot with an engine #14687、Declare the scripts/ population two Silent gate families walk but never named #14692），分属 11 条投机栈 ⇒ 11 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14720（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Part of #14325 — sitting 1 of the per-gate half. The card stays open: the residue is not exhausted, and this sitting's measurement changes what the rest of it is.

What landed

Two gate families now declare the scripts/ population they walk but never named, in their own module body under the ROOT_DIR_WATCH_HINTS idiom, each pinned in its own --self-test — the shape PR #14188 and PR #14323 landed.

family	declared	why it was silent	residue before ⇢ after	self-test pin
node scripts/check-self-test-wired.mjs	scripts/**/*.mjs, scripts/**/*.mts, scripts/**/*.sh	corpus root arrives as join(ROOT, 'scripts') — a bare single-segment word the extractor cannot see; its only other literals are the six scripts its ledger cites BY NAME (an artifact roster)	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	battery population declaration, 7 cases, floor pinned
node scripts/check-whole-set-label-write.mjs	scripts/**/*.mjs, scripts/**/*.ts, scripts/**/*.sh	two of three ROOTS carry a separator and were recovered; the third is the bare word scripts. The rest of its literals are two owner/repo action slugs and fixture sandbox filenames	Silent ⇢ matched on scripts/check-nul-bytes.mjs; still Silent on packages/metadata-protocol/src/protocol.ts	8 POPULATION cases in selfTest()

Measured with the derivation's own --residue, probe scripts/check-nul-bytes.mjs: 14 matched families ⇢ 16, Silent 148 ⇢ 146. With an outside probe the verdict is unchanged, so neither declaration over-claims.

One hint per admitted extension, not the bare subtree.check-ratchet-remedy-authority.mjs sets that precedent at this same root and its own self-test refuses the subtree spelling. scripts/** would name both gates for the 91 JSON, Markdown and text files under the root that neither one opens. The declared set is SET-EQUAL to each gate's live walk — 221 of 312 and 219 of 312 tracked files, nothing walked left uncovered, nothing covered left unwalked. An extension the filter admits but the tree does not yet HOLD (.js, .cjs, .yml, .yaml) is deliberately absent: a hint reaching nothing tracked is a dead lead the consumer reports as a population. The pins redden the day such a file lands.

⚠️ The finding this sitting is really for: the residue head is NOT a hint-line backlog

The card's own warning — reads are an upper bound — turns out to be the whole story, and the number is now measured rather than suspected.

Census re-derived on this branch's base (2aa8456cf), method as the card specifies: --residue for the Silent bucket, then every enumerating candidate run under an fs-tracing preload, compared against the literals extractWatchHints recovers from its own sources and judged with the derivation's own hintCovers. 202 families discovered, 132 Silent and non-self-test, 82 of those enumerate a directory, 49 read 5 or more undeclared tracked files.

Of those 49:

bucket	n	disposition
whole-tree	6	out of scope, #14189's channel — includes the three this census re-confirms (check-closing-keyword-parity, check-self-test-workflow-commands, check:watch-hint-literal)
declared this sitting	2	the only members with a NARROW, high-precision, undeclared population
root-wide, ledger already REFUSED	13	scripts/pm/bare-root-worklist.mjs records a verdict for each
root-wide, same class, no ledger row	14	32–52% of a 5837-file root — the identical trade, unrecorded
low precision (under 10%)	14	incidental or artifact reads; no honest subtree to declare

The head of the residue is the REFUSE-WIDE class, and this repo has already adjudicated it.scripts/pm/bare-root-worklist.mjs is a maintained, self-tested ledger of exactly this species and reports 0 untriaged rows. Every one of the four members the card source-confirmed as the natural head of sitting 1 is either recorded there as refused, or is unrecorded but measures into the same class:

• check:engine-double-contract — REFUSE-WIDE on both roots (measured 90% / 84%), with the split refused by name
• check:error-code-casing — REFUSE-WIDE, "same trade as engine-double-contract"
• check:error-status-conformance — REFUSE-WIDE at 39%
• check:route-envelope — no ledger row; walks join(ROOT, 'packages') over non-test .ts, measured here at 2138 undeclared reads = 36.6% of the root. Same class as check:authz-resolver, which IS recorded REFUSE-WIDE at 39%.

The ledger states the trade in its own words: a bare-root declaration there "would be TRUE, and is refused anyway: it names the gate for every card under a root the fleet already declares wholesale, so the matched column stops discriminating and restates 'run the farm', which CI does regardless." It also records the maintainer ruling of 2026-08-26 that split the spellable-but-undeclared rows by measured downstream pull — rows with a recorded consumer get the declaration, rows without stay deferred.

⇒ Sitting 2 cannot be "the next 8 by read count". Continuing down this order means declaring packages/** on gates whose recorded verdict refuses exactly that, which is a re-decision of a maintainer-ruled map, not the mechanical repair this card scoped. Three honest routes, for triage rather than for a dev to pick:

1. Stop the per-gate half here. The narrow-subtree population the card describes was real and is now exhausted at two members; the rest of the residue is the width trade, already priced.
2. Per-member consumer evidence. Take the 14 unrecorded root-wide members one at a time, and declare only where a MEASURED consumer exists (a card that ran a green local union and lost a CI round to that gate) — the criterion the 2026-08-26 ruling already uses. That is a p2-per-member shape, as the triage says.
3. Record the 14 unrecorded members in the ledger so the class is closed by evidence rather than left looking like outstanding debt. This is a bare-root-worklist.mjs edit, so it belongs to a card that owns that file.

⛔ None of these is taken here. scripts/pm/dispatch-gates.mjs is untouched, as scoped.

Artifact-only by design, recorded rather than declared

check-self-test-wired and check-whole-set-label-write each ALSO name individual files — the ledger rows one cites, the action slugs and probe paths the other pins. Those stay as they are: they are artifacts the gate names, not a population it reads, and the new declaration sits beside them rather than replacing them. The 14 low-precision members above are the same shape at family scale and are recorded here, not declared.

Verification

Union derived in this worktree by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths passed — the script takes its own changeset), 17 commands, re-derived unchanged after merging origin/main. Run at be6800e2f:

• 16 of 17 green, including check:watch-hint-literal (47 declarations across 4 rostered names), check:ratchet-remedy-authority, check:pm-dispatch-gates (VERDICT command-exit 0, dispatch-gates self-test 1240 cases pass), and node scripts/pm/bare-root-worklist.mjs --self-test ("none stale, none missing, none contradicted" — the new declarations create no fresh untriaged row and contradict no recorded verdict)
• node scripts/check-declared-population-live.mjs — "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's 8006 tracked file(s)"
• both gates' production leg and --self-test leg green; check-self-test-wired prints "scope: 221 file(s) under scripts/", which is the declared set exactly
• node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED by its own design — it needs a CI test log and says so in its own output. Not a red.

Ablation — the pins are proved able to go red. Five legs, each mutating the committed declaration, each proved on disk by counting the removed and injected text before reading any result, each restored via git checkout HEAD and verified by git hash-object against the HEAD blob (both MATCH):

leg	expected	observed
drop scripts/**/*.sh	RED	exit 1 — "a file this gate WALKS is left undeclared"
add scripts/**/*.json	RED	exit 1 — "a declared hint reaches nothing this gate walks — a dead lead"
rewrite as a computed .map() spelling	RED	exit 1 — "the declaration is not a single literal array of quoted strings"
drop scripts/**/*.ts	RED	exit 1 — "every file this gate walks under scripts/ is declared: expected true, got false"
replace with the bare scripts/**	RED	exit 1 — 4 failures, including the extension and dead-lead pins

⚠️ Reported rather than hidden: the FIRST ablation harness was a no-op — its perl replacer failed to compile on the glob metacharacters and changed nothing. The on-disk proof step caught it and the readings were voided; the table above is the re-run with an exact-literal replacer. Had that step been skipped, five green self-tests would have read as five passing ablations.

git diff --stat against the base: 2 files changed, 212 insertions(+), 1 deletion(-) — both under scripts/, so skip-changeset.

Serial check: every open PR's file list was read before editing; neither gate file is held. scripts/check-skills-token-ratchet.mjs (3 open PRs) and scripts/check-type-check-coverage.mjs (1) are held and were excluded from this sitting on that ground as well as on precision.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33678836122 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: expected 'SIGKILL' to be null
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 12 个 PR（fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499、fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、fix(devx): guard the last two run-on-import gate scripts — KNOWN_IMPORT_UNSAFE 2 to 0 #14593、lint(flows): warn on an uncontained loop body and on a try_catch with no catch, and document loop { try_catch } #14617、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(cli): let the dev artifact door own stack-declared security metadata on a host config #14631、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(cli): walk bulkActions, validation messages and datasets in i18n extract, so the coverage ratchet can see them #14651、fix(objectql,metadata): derive a view container's object through the shared helper, so the row's own name is LAST at every SOURCE registrar (#14399) #14665、fix(cli): remove the ghost field types from generate.ts's three vocabularies #14675、test(runtime): measure which declaration copy the security/sharing seeders consume on an artifact boot with an engine #14687、Declare the scripts/ population two Silent gate families walk but never named #14692），分属 11 条投机栈 ⇒ 11 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14720（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 20 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)