tooling(pm): record 14 unrecorded REFUSE-WIDE gate families

[baozhoutao]

Fixes#14695

What landed

All 14 of the 14 unrecorded REFUSE-WIDE members, recorded in a new CENSUS_REFUSE_WIDE table in scripts/pm/bare-root-worklist.mjs, each carrying its own measured share and the base commit it was measured at (2aa8456cf, the base #14325's own census used). Shipped in two sittings on this PR — 12 first, then the remaining 2 once the filing session supplied their names (see "Follow-up" below):

family	reads	of	share
check:route-envelope	2181	5837	37.4%
check:driver-memory-census	5352	5837	91.7%
check:parse-guard	5289	5837	90.6%
check:live-db-isolation	5269	5837	90.3%
check:org-identifier	2211	5837	37.9%
check:startup-registry-verdict	2182	5837	37.4%
check:wildcard-fallthrough	2182	5837	37.4%
check:init-service-contract	2182	5837	37.4%
check:settings-bind-window	2182	5837	37.4%
check:cli-command-ids	1951	5837	33.4%
check:type-check-coverage	3255	5837	55.8%
check:type-check-debt	3255 (shared with its sibling above)	5837	55.8%
check:error-code-provenance	2070	5837	35.5%
check:objectui-pin-citations	1192	5837	20.4%

Plus the folded second half: scripts/check-whole-set-label-write.mjs's three self-test SANDBOX filenames (scripts/w.mjs, scripts/writer.sh, .github/workflows/w.yml) — dead leads that existed in no tracked tree, spelled as bare literals in a top-level export const (not inside a selfTest()-shaped function, so maskSelfTests never hid them) — now renamed to three real, unrelated, already-tracked paths (scripts/check-nul-bytes.mjs, scripts/build-console.sh, .github/workflows/ci.yml). No behaviour change: check-whole-set-label-write --self-test and its production leg print byte-identical verdicts before and after; check:declared-population-live's "158 of 202 families … every one reaches this tree's tracked files" line is unchanged, but the family's own declared-hint set no longer contains a dead entry.

Follow-up: the last 2 of 14

The first sitting on this PR shipped 12 of 14 and left check:error-code-provenance and check:objectui-pin-citations (the "two packages/spec-filtered ones") as an open question — the issue text's claim that they were "named in PR #14692's body with their measured shares" did not hold up against that body's actual text, which states an exact share for only check:route-envelope and names the other 13 only in an aggregate bucket row.

The filing session (which ran the original #14325 census) supplied its own census artifacts directly, confirming both families sit in that census's "root-wide, same class, no ledger row" bucket as members 13 and 14: pnpm --filter @objectstack/spec run check:error-code-provenance (sitting-1 tracked_reads 2079, undeclared 2077, byRoot.packages 2069) and pnpm --filter @objectstack/spec run check:objectui-pin-citations (tracked_reads 1200, undeclared 1200, byRoot.packages 1192).

Both shares below are re-measured here by this table's own method — never copied from the filing session's numbers, to keep the table one-method/one-base — using the same strace -f -e trace=openat technique against a 2aa8456cf worktree, this time invoked as pnpm --filter @objectstack/spec run check:X (the tsx production leg, no --self-test) rather than a plain node scripts/check-X.mjs. Both land within 1 file of the filing session's own sitting-1 counts — 2070 vs 2069, and an exact 1192 vs 1192 — corroborating the method a second time, now on a tsx-run gate rather than a plain node one. check:objectui-pin-citations (20.4%) lands below the issue's summarised "32–52%" range for this bucket; recorded as measured rather than forced into the quoted band, matching how the earlier sitting handled the four members that measured above it.

Why a NEW table, not new TRIAGE rows

Recording one of the 14 as an ordinary TRIAGE row was tried first and self-reverts: TRIAGE is coupled to sweep(), which can only ever discover a const X_ROOTS = ['packages']-shaped bare-word population literal (this file's own narrow recogniser). None of these 14 families hold that shape — most declare no population constant of any kind; check:route-envelope's bare 'packages' word is a join(ROOT, 'packages')call argument, not an assignment. Confirmed empirically: adding check:route-envelope SCAN_ROOTS packages to TRIAGE makes --self-test fail immediately with STALE: check:route-envelope SCAN_ROOTS packages — sweep() never produces the key. These 14 rows were found by #14325's wider fs-trace census (PR #14692, PR #14323), a different and broader instrument than this file's own sweep — so they live in a new CENSUS_REFUSE_WIDE table with its own self-test battery, explicitly uncoupled from TRIAGE's stale/fresh/contradicted machinery (which would ask a question this table has no honest answer to).

Method — re-measured, not copied, and why

PR #14692's body, read in full before writing this (saved and live copies diff byte-for-byte but for a trailing newline), states an exact share for exactly one of the fourteen — check:route-envelope (36.6%, "2138 undeclared reads"). The other thirteen are named with no percentage in the issue/PR text; the body's own bucket table states only the aggregate "14 members, 32–52%". Carrying a share that isn't actually recorded anywhere reachable would be the exact "defect wearing fresher digits" bare-root-worklist.mjs's own docblock prices as the costlier error, so every one of the 14 shares is measured fresh, at the base #14695 names (2aa8456cf) — never mixed with this branch's later tree.

Method: strace -f -e trace=openat over each gate's own production CLI leg, run in a dedicated detached worktree checked out at 2aa8456cf (pnpm installd there), filtered to successful openat calls landing on a tracked file under packages/. This traces the syscall, so it counts what the process actually opened regardless of which Node API did the opening. A JS-level fs.readFileSync monkey-patch (--import preload) was tried first and measured empty — 0 reads — against check:route-envelope's known-nonzero population, because Node's ESM binding for a core module's named export does not reliably re-resolve through a later reassignment of the CJS-compat fs object property; recorded in the new table's docblock so the same dead end isn't re-walked. check:route-envelope traced at 2181/5837 (37.4%), within 2% of PR #14692's cited 2138 "undeclared reads" (36.6%) — the gap being that figure's own subtraction of the handful of route paths this gate already spells as literals elsewhere (already visible to extractWatchHints, hence excluded from "undeclared") — corroborating the method against the one figure available without reproducing its bookkeeping term for term.

What is NOT in this PR

No subtree was declared for any of the 14 — recording REFUSE-WIDE is the opposite action from declaring, per the card and the 2026-08-26 ruling it cites.

Six of the fourteen measure outside the issue's summarised "32–52%" range: four above it (check:driver-memory-census 91.7%, check:parse-guard 90.6%, check:live-db-isolation 90.3%, check:type-check-coverage/check:type-check-debt 55.8%) and one below it (check:objectui-pin-citations 20.4%) — each measured by the identical method as the rest, and the verdict is unaffected either direction: existing TRIAGE REFUSE-WIDE rows already span 39%–99% under the same trade.

Verification

• node scripts/pm/bare-root-worklist.mjs --self-test — green: 57 live TRIAGE rows unchanged (none stale/fresh/contradicted), plus 14 CENSUS row(s) … well-formed, disjoint from TRIAGE, contribute no hint of their own, and share one base commit.
• Ablation (both sittings): mutated a CENSUS_REFUSE_WIDE row's reads to an invalid value (9999999 > of, then -5) — --self-test went RED on exactly the new battery's shape assertion each time (direct exit-code capture, not piped); restored from a saved pre-mutation copy and reverified green both times.
• node scripts/check-whole-set-label-write.mjs --self-test and its production leg — byte-identical verdict text before/after the fixture rename.
• node scripts/check-declared-population-live.mjs — unchanged: "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's tracked files".
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 17 commands derived for this changeset (unchanged across both sittings); run under scripts/pm/os-verify-lock.sh at head a78607fe0c: 16 of 17 green, the one exception node scripts/check-test-completeness.mjs exiting 3 — NOT MEASURED by its own design (it needs a CI test log and says so), not a red. pnpm check:pm-dispatch-gates (the heaviest — its self-test respawns its own CLI many times) passed at 1240 cases. node scripts/pm/dispatch-gates.mjs --ran reconciliation: 17 derived, 17 run, 0 UNRUN.
• origin/main fetched and checked before both pushes; 0 commits behind at the second sitting's push.

git diff --stat (cumulative): 2 files changed, both under scripts/ — skip-changeset, per this card's explicit dispatch (tooling-only, publishes nothing from any package).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33724243099 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 29 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 93 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727523624 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 101 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729337914 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 103 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[baozhoutao]

Fixes#14695

What landed

All 14 of the 14 unrecorded REFUSE-WIDE members, recorded in a new CENSUS_REFUSE_WIDE table in scripts/pm/bare-root-worklist.mjs, each carrying its own measured share and the base commit it was measured at (2aa8456cf, the base #14325's own census used). Shipped in two sittings on this PR — 12 first, then the remaining 2 once the filing session supplied their names (see "Follow-up" below):

family	reads	of	share
check:route-envelope	2181	5837	37.4%
check:driver-memory-census	5352	5837	91.7%
check:parse-guard	5289	5837	90.6%
check:live-db-isolation	5269	5837	90.3%
check:org-identifier	2211	5837	37.9%
check:startup-registry-verdict	2182	5837	37.4%
check:wildcard-fallthrough	2182	5837	37.4%
check:init-service-contract	2182	5837	37.4%
check:settings-bind-window	2182	5837	37.4%
check:cli-command-ids	1951	5837	33.4%
check:type-check-coverage	3255	5837	55.8%
check:type-check-debt	3255 (shared with its sibling above)	5837	55.8%
check:error-code-provenance	2070	5837	35.5%
check:objectui-pin-citations	1192	5837	20.4%

Plus the folded second half: scripts/check-whole-set-label-write.mjs's three self-test SANDBOX filenames (scripts/w.mjs, scripts/writer.sh, .github/workflows/w.yml) — dead leads that existed in no tracked tree, spelled as bare literals in a top-level export const (not inside a selfTest()-shaped function, so maskSelfTests never hid them) — now renamed to three real, unrelated, already-tracked paths (scripts/check-nul-bytes.mjs, scripts/build-console.sh, .github/workflows/ci.yml). No behaviour change: check-whole-set-label-write --self-test and its production leg print byte-identical verdicts before and after; check:declared-population-live's "158 of 202 families … every one reaches this tree's tracked files" line is unchanged, but the family's own declared-hint set no longer contains a dead entry.

Follow-up: the last 2 of 14

The first sitting on this PR shipped 12 of 14 and left check:error-code-provenance and check:objectui-pin-citations (the "two packages/spec-filtered ones") as an open question — the issue text's claim that they were "named in PR #14692's body with their measured shares" did not hold up against that body's actual text, which states an exact share for only check:route-envelope and names the other 13 only in an aggregate bucket row.

The filing session (which ran the original #14325 census) supplied its own census artifacts directly, confirming both families sit in that census's "root-wide, same class, no ledger row" bucket as members 13 and 14: pnpm --filter @objectstack/spec run check:error-code-provenance (sitting-1 tracked_reads 2079, undeclared 2077, byRoot.packages 2069) and pnpm --filter @objectstack/spec run check:objectui-pin-citations (tracked_reads 1200, undeclared 1200, byRoot.packages 1192).

Both shares below are re-measured here by this table's own method — never copied from the filing session's numbers, to keep the table one-method/one-base — using the same strace -f -e trace=openat technique against a 2aa8456cf worktree, this time invoked as pnpm --filter @objectstack/spec run check:X (the tsx production leg, no --self-test) rather than a plain node scripts/check-X.mjs. Both land within 1 file of the filing session's own sitting-1 counts — 2070 vs 2069, and an exact 1192 vs 1192 — corroborating the method a second time, now on a tsx-run gate rather than a plain node one. check:objectui-pin-citations (20.4%) lands below the issue's summarised "32–52%" range for this bucket; recorded as measured rather than forced into the quoted band, matching how the earlier sitting handled the four members that measured above it.

Why a NEW table, not new TRIAGE rows

Recording one of the 14 as an ordinary TRIAGE row was tried first and self-reverts: TRIAGE is coupled to sweep(), which can only ever discover a const X_ROOTS = ['packages']-shaped bare-word population literal (this file's own narrow recogniser). None of these 14 families hold that shape — most declare no population constant of any kind; check:route-envelope's bare 'packages' word is a join(ROOT, 'packages')call argument, not an assignment. Confirmed empirically: adding check:route-envelope SCAN_ROOTS packages to TRIAGE makes --self-test fail immediately with STALE: check:route-envelope SCAN_ROOTS packages — sweep() never produces the key. These 14 rows were found by #14325's wider fs-trace census (PR #14692, PR #14323), a different and broader instrument than this file's own sweep — so they live in a new CENSUS_REFUSE_WIDE table with its own self-test battery, explicitly uncoupled from TRIAGE's stale/fresh/contradicted machinery (which would ask a question this table has no honest answer to).

Method — re-measured, not copied, and why

PR #14692's body, read in full before writing this (saved and live copies diff byte-for-byte but for a trailing newline), states an exact share for exactly one of the fourteen — check:route-envelope (36.6%, "2138 undeclared reads"). The other thirteen are named with no percentage in the issue/PR text; the body's own bucket table states only the aggregate "14 members, 32–52%". Carrying a share that isn't actually recorded anywhere reachable would be the exact "defect wearing fresher digits" bare-root-worklist.mjs's own docblock prices as the costlier error, so every one of the 14 shares is measured fresh, at the base #14695 names (2aa8456cf) — never mixed with this branch's later tree.

Method: strace -f -e trace=openat over each gate's own production CLI leg, run in a dedicated detached worktree checked out at 2aa8456cf (pnpm installd there), filtered to successful openat calls landing on a tracked file under packages/. This traces the syscall, so it counts what the process actually opened regardless of which Node API did the opening. A JS-level fs.readFileSync monkey-patch (--import preload) was tried first and measured empty — 0 reads — against check:route-envelope's known-nonzero population, because Node's ESM binding for a core module's named export does not reliably re-resolve through a later reassignment of the CJS-compat fs object property; recorded in the new table's docblock so the same dead end isn't re-walked. check:route-envelope traced at 2181/5837 (37.4%), within 2% of PR #14692's cited 2138 "undeclared reads" (36.6%) — the gap being that figure's own subtraction of the handful of route paths this gate already spells as literals elsewhere (already visible to extractWatchHints, hence excluded from "undeclared") — corroborating the method against the one figure available without reproducing its bookkeeping term for term.

What is NOT in this PR

No subtree was declared for any of the 14 — recording REFUSE-WIDE is the opposite action from declaring, per the card and the 2026-08-26 ruling it cites.

Six of the fourteen measure outside the issue's summarised "32–52%" range: four above it (check:driver-memory-census 91.7%, check:parse-guard 90.6%, check:live-db-isolation 90.3%, check:type-check-coverage/check:type-check-debt 55.8%) and one below it (check:objectui-pin-citations 20.4%) — each measured by the identical method as the rest, and the verdict is unaffected either direction: existing TRIAGE REFUSE-WIDE rows already span 39%–99% under the same trade.

Verification

• node scripts/pm/bare-root-worklist.mjs --self-test — green: 57 live TRIAGE rows unchanged (none stale/fresh/contradicted), plus 14 CENSUS row(s) … well-formed, disjoint from TRIAGE, contribute no hint of their own, and share one base commit.
• Ablation (both sittings): mutated a CENSUS_REFUSE_WIDE row's reads to an invalid value (9999999 > of, then -5) — --self-test went RED on exactly the new battery's shape assertion each time (direct exit-code capture, not piped); restored from a saved pre-mutation copy and reverified green both times.
• node scripts/check-whole-set-label-write.mjs --self-test and its production leg — byte-identical verdict text before/after the fixture rename.
• node scripts/check-declared-population-live.mjs — unchanged: "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's tracked files".
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 17 commands derived for this changeset (unchanged across both sittings); run under scripts/pm/os-verify-lock.sh at head a78607fe0c: 16 of 17 green, the one exception node scripts/check-test-completeness.mjs exiting 3 — NOT MEASURED by its own design (it needs a CI test log and says so), not a red. pnpm check:pm-dispatch-gates (the heaviest — its self-test respawns its own CLI many times) passed at 1240 cases. node scripts/pm/dispatch-gates.mjs --ran reconciliation: 17 derived, 17 run, 0 UNRUN.
• origin/main fetched and checked before both pushes; 0 commits behind at the second sitting's push.

git diff --stat (cumulative): 2 files changed, both under scripts/ — skip-changeset, per this card's explicit dispatch (tooling-only, publishes nothing from any package).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33724243099 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 29 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 93 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727523624 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 101 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729337914 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 103 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[baozhoutao]

Fixes#14695

What landed

All 14 of the 14 unrecorded REFUSE-WIDE members, recorded in a new CENSUS_REFUSE_WIDE table in scripts/pm/bare-root-worklist.mjs, each carrying its own measured share and the base commit it was measured at (2aa8456cf, the base #14325's own census used). Shipped in two sittings on this PR — 12 first, then the remaining 2 once the filing session supplied their names (see "Follow-up" below):

family	reads	of	share
check:route-envelope	2181	5837	37.4%
check:driver-memory-census	5352	5837	91.7%
check:parse-guard	5289	5837	90.6%
check:live-db-isolation	5269	5837	90.3%
check:org-identifier	2211	5837	37.9%
check:startup-registry-verdict	2182	5837	37.4%
check:wildcard-fallthrough	2182	5837	37.4%
check:init-service-contract	2182	5837	37.4%
check:settings-bind-window	2182	5837	37.4%
check:cli-command-ids	1951	5837	33.4%
check:type-check-coverage	3255	5837	55.8%
check:type-check-debt	3255 (shared with its sibling above)	5837	55.8%
check:error-code-provenance	2070	5837	35.5%
check:objectui-pin-citations	1192	5837	20.4%

Plus the folded second half: scripts/check-whole-set-label-write.mjs's three self-test SANDBOX filenames (scripts/w.mjs, scripts/writer.sh, .github/workflows/w.yml) — dead leads that existed in no tracked tree, spelled as bare literals in a top-level export const (not inside a selfTest()-shaped function, so maskSelfTests never hid them) — now renamed to three real, unrelated, already-tracked paths (scripts/check-nul-bytes.mjs, scripts/build-console.sh, .github/workflows/ci.yml). No behaviour change: check-whole-set-label-write --self-test and its production leg print byte-identical verdicts before and after; check:declared-population-live's "158 of 202 families … every one reaches this tree's tracked files" line is unchanged, but the family's own declared-hint set no longer contains a dead entry.

Follow-up: the last 2 of 14

The first sitting on this PR shipped 12 of 14 and left check:error-code-provenance and check:objectui-pin-citations (the "two packages/spec-filtered ones") as an open question — the issue text's claim that they were "named in PR #14692's body with their measured shares" did not hold up against that body's actual text, which states an exact share for only check:route-envelope and names the other 13 only in an aggregate bucket row.

The filing session (which ran the original #14325 census) supplied its own census artifacts directly, confirming both families sit in that census's "root-wide, same class, no ledger row" bucket as members 13 and 14: pnpm --filter @objectstack/spec run check:error-code-provenance (sitting-1 tracked_reads 2079, undeclared 2077, byRoot.packages 2069) and pnpm --filter @objectstack/spec run check:objectui-pin-citations (tracked_reads 1200, undeclared 1200, byRoot.packages 1192).

Both shares below are re-measured here by this table's own method — never copied from the filing session's numbers, to keep the table one-method/one-base — using the same strace -f -e trace=openat technique against a 2aa8456cf worktree, this time invoked as pnpm --filter @objectstack/spec run check:X (the tsx production leg, no --self-test) rather than a plain node scripts/check-X.mjs. Both land within 1 file of the filing session's own sitting-1 counts — 2070 vs 2069, and an exact 1192 vs 1192 — corroborating the method a second time, now on a tsx-run gate rather than a plain node one. check:objectui-pin-citations (20.4%) lands below the issue's summarised "32–52%" range for this bucket; recorded as measured rather than forced into the quoted band, matching how the earlier sitting handled the four members that measured above it.

Why a NEW table, not new TRIAGE rows

Recording one of the 14 as an ordinary TRIAGE row was tried first and self-reverts: TRIAGE is coupled to sweep(), which can only ever discover a const X_ROOTS = ['packages']-shaped bare-word population literal (this file's own narrow recogniser). None of these 14 families hold that shape — most declare no population constant of any kind; check:route-envelope's bare 'packages' word is a join(ROOT, 'packages')call argument, not an assignment. Confirmed empirically: adding check:route-envelope SCAN_ROOTS packages to TRIAGE makes --self-test fail immediately with STALE: check:route-envelope SCAN_ROOTS packages — sweep() never produces the key. These 14 rows were found by #14325's wider fs-trace census (PR #14692, PR #14323), a different and broader instrument than this file's own sweep — so they live in a new CENSUS_REFUSE_WIDE table with its own self-test battery, explicitly uncoupled from TRIAGE's stale/fresh/contradicted machinery (which would ask a question this table has no honest answer to).

Method — re-measured, not copied, and why

PR #14692's body, read in full before writing this (saved and live copies diff byte-for-byte but for a trailing newline), states an exact share for exactly one of the fourteen — check:route-envelope (36.6%, "2138 undeclared reads"). The other thirteen are named with no percentage in the issue/PR text; the body's own bucket table states only the aggregate "14 members, 32–52%". Carrying a share that isn't actually recorded anywhere reachable would be the exact "defect wearing fresher digits" bare-root-worklist.mjs's own docblock prices as the costlier error, so every one of the 14 shares is measured fresh, at the base #14695 names (2aa8456cf) — never mixed with this branch's later tree.

Method: strace -f -e trace=openat over each gate's own production CLI leg, run in a dedicated detached worktree checked out at 2aa8456cf (pnpm installd there), filtered to successful openat calls landing on a tracked file under packages/. This traces the syscall, so it counts what the process actually opened regardless of which Node API did the opening. A JS-level fs.readFileSync monkey-patch (--import preload) was tried first and measured empty — 0 reads — against check:route-envelope's known-nonzero population, because Node's ESM binding for a core module's named export does not reliably re-resolve through a later reassignment of the CJS-compat fs object property; recorded in the new table's docblock so the same dead end isn't re-walked. check:route-envelope traced at 2181/5837 (37.4%), within 2% of PR #14692's cited 2138 "undeclared reads" (36.6%) — the gap being that figure's own subtraction of the handful of route paths this gate already spells as literals elsewhere (already visible to extractWatchHints, hence excluded from "undeclared") — corroborating the method against the one figure available without reproducing its bookkeeping term for term.

What is NOT in this PR

No subtree was declared for any of the 14 — recording REFUSE-WIDE is the opposite action from declaring, per the card and the 2026-08-26 ruling it cites.

Six of the fourteen measure outside the issue's summarised "32–52%" range: four above it (check:driver-memory-census 91.7%, check:parse-guard 90.6%, check:live-db-isolation 90.3%, check:type-check-coverage/check:type-check-debt 55.8%) and one below it (check:objectui-pin-citations 20.4%) — each measured by the identical method as the rest, and the verdict is unaffected either direction: existing TRIAGE REFUSE-WIDE rows already span 39%–99% under the same trade.

Verification

• node scripts/pm/bare-root-worklist.mjs --self-test — green: 57 live TRIAGE rows unchanged (none stale/fresh/contradicted), plus 14 CENSUS row(s) … well-formed, disjoint from TRIAGE, contribute no hint of their own, and share one base commit.
• Ablation (both sittings): mutated a CENSUS_REFUSE_WIDE row's reads to an invalid value (9999999 > of, then -5) — --self-test went RED on exactly the new battery's shape assertion each time (direct exit-code capture, not piped); restored from a saved pre-mutation copy and reverified green both times.
• node scripts/check-whole-set-label-write.mjs --self-test and its production leg — byte-identical verdict text before/after the fixture rename.
• node scripts/check-declared-population-live.mjs — unchanged: "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's tracked files".
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 17 commands derived for this changeset (unchanged across both sittings); run under scripts/pm/os-verify-lock.sh at head a78607fe0c: 16 of 17 green, the one exception node scripts/check-test-completeness.mjs exiting 3 — NOT MEASURED by its own design (it needs a CI test log and says so), not a red. pnpm check:pm-dispatch-gates (the heaviest — its self-test respawns its own CLI many times) passed at 1240 cases. node scripts/pm/dispatch-gates.mjs --ran reconciliation: 17 derived, 17 run, 0 UNRUN.
• origin/main fetched and checked before both pushes; 0 commits behind at the second sitting's push.

git diff --stat (cumulative): 2 files changed, both under scripts/ — skip-changeset, per this card's explicit dispatch (tooling-only, publishes nothing from any package).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33724243099 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 29 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 93 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727523624 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 101 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729337914 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 103 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[baozhoutao]

Fixes#14695

What landed

All 14 of the 14 unrecorded REFUSE-WIDE members, recorded in a new CENSUS_REFUSE_WIDE table in scripts/pm/bare-root-worklist.mjs, each carrying its own measured share and the base commit it was measured at (2aa8456cf, the base #14325's own census used). Shipped in two sittings on this PR — 12 first, then the remaining 2 once the filing session supplied their names (see "Follow-up" below):

family	reads	of	share
check:route-envelope	2181	5837	37.4%
check:driver-memory-census	5352	5837	91.7%
check:parse-guard	5289	5837	90.6%
check:live-db-isolation	5269	5837	90.3%
check:org-identifier	2211	5837	37.9%
check:startup-registry-verdict	2182	5837	37.4%
check:wildcard-fallthrough	2182	5837	37.4%
check:init-service-contract	2182	5837	37.4%
check:settings-bind-window	2182	5837	37.4%
check:cli-command-ids	1951	5837	33.4%
check:type-check-coverage	3255	5837	55.8%
check:type-check-debt	3255 (shared with its sibling above)	5837	55.8%
check:error-code-provenance	2070	5837	35.5%
check:objectui-pin-citations	1192	5837	20.4%

Plus the folded second half: scripts/check-whole-set-label-write.mjs's three self-test SANDBOX filenames (scripts/w.mjs, scripts/writer.sh, .github/workflows/w.yml) — dead leads that existed in no tracked tree, spelled as bare literals in a top-level export const (not inside a selfTest()-shaped function, so maskSelfTests never hid them) — now renamed to three real, unrelated, already-tracked paths (scripts/check-nul-bytes.mjs, scripts/build-console.sh, .github/workflows/ci.yml). No behaviour change: check-whole-set-label-write --self-test and its production leg print byte-identical verdicts before and after; check:declared-population-live's "158 of 202 families … every one reaches this tree's tracked files" line is unchanged, but the family's own declared-hint set no longer contains a dead entry.

Follow-up: the last 2 of 14

The first sitting on this PR shipped 12 of 14 and left check:error-code-provenance and check:objectui-pin-citations (the "two packages/spec-filtered ones") as an open question — the issue text's claim that they were "named in PR #14692's body with their measured shares" did not hold up against that body's actual text, which states an exact share for only check:route-envelope and names the other 13 only in an aggregate bucket row.

The filing session (which ran the original #14325 census) supplied its own census artifacts directly, confirming both families sit in that census's "root-wide, same class, no ledger row" bucket as members 13 and 14: pnpm --filter @objectstack/spec run check:error-code-provenance (sitting-1 tracked_reads 2079, undeclared 2077, byRoot.packages 2069) and pnpm --filter @objectstack/spec run check:objectui-pin-citations (tracked_reads 1200, undeclared 1200, byRoot.packages 1192).

Both shares below are re-measured here by this table's own method — never copied from the filing session's numbers, to keep the table one-method/one-base — using the same strace -f -e trace=openat technique against a 2aa8456cf worktree, this time invoked as pnpm --filter @objectstack/spec run check:X (the tsx production leg, no --self-test) rather than a plain node scripts/check-X.mjs. Both land within 1 file of the filing session's own sitting-1 counts — 2070 vs 2069, and an exact 1192 vs 1192 — corroborating the method a second time, now on a tsx-run gate rather than a plain node one. check:objectui-pin-citations (20.4%) lands below the issue's summarised "32–52%" range for this bucket; recorded as measured rather than forced into the quoted band, matching how the earlier sitting handled the four members that measured above it.

Why a NEW table, not new TRIAGE rows

Recording one of the 14 as an ordinary TRIAGE row was tried first and self-reverts: TRIAGE is coupled to sweep(), which can only ever discover a const X_ROOTS = ['packages']-shaped bare-word population literal (this file's own narrow recogniser). None of these 14 families hold that shape — most declare no population constant of any kind; check:route-envelope's bare 'packages' word is a join(ROOT, 'packages')call argument, not an assignment. Confirmed empirically: adding check:route-envelope SCAN_ROOTS packages to TRIAGE makes --self-test fail immediately with STALE: check:route-envelope SCAN_ROOTS packages — sweep() never produces the key. These 14 rows were found by #14325's wider fs-trace census (PR #14692, PR #14323), a different and broader instrument than this file's own sweep — so they live in a new CENSUS_REFUSE_WIDE table with its own self-test battery, explicitly uncoupled from TRIAGE's stale/fresh/contradicted machinery (which would ask a question this table has no honest answer to).

Method — re-measured, not copied, and why

PR #14692's body, read in full before writing this (saved and live copies diff byte-for-byte but for a trailing newline), states an exact share for exactly one of the fourteen — check:route-envelope (36.6%, "2138 undeclared reads"). The other thirteen are named with no percentage in the issue/PR text; the body's own bucket table states only the aggregate "14 members, 32–52%". Carrying a share that isn't actually recorded anywhere reachable would be the exact "defect wearing fresher digits" bare-root-worklist.mjs's own docblock prices as the costlier error, so every one of the 14 shares is measured fresh, at the base #14695 names (2aa8456cf) — never mixed with this branch's later tree.

Method: strace -f -e trace=openat over each gate's own production CLI leg, run in a dedicated detached worktree checked out at 2aa8456cf (pnpm installd there), filtered to successful openat calls landing on a tracked file under packages/. This traces the syscall, so it counts what the process actually opened regardless of which Node API did the opening. A JS-level fs.readFileSync monkey-patch (--import preload) was tried first and measured empty — 0 reads — against check:route-envelope's known-nonzero population, because Node's ESM binding for a core module's named export does not reliably re-resolve through a later reassignment of the CJS-compat fs object property; recorded in the new table's docblock so the same dead end isn't re-walked. check:route-envelope traced at 2181/5837 (37.4%), within 2% of PR #14692's cited 2138 "undeclared reads" (36.6%) — the gap being that figure's own subtraction of the handful of route paths this gate already spells as literals elsewhere (already visible to extractWatchHints, hence excluded from "undeclared") — corroborating the method against the one figure available without reproducing its bookkeeping term for term.

What is NOT in this PR

No subtree was declared for any of the 14 — recording REFUSE-WIDE is the opposite action from declaring, per the card and the 2026-08-26 ruling it cites.

Six of the fourteen measure outside the issue's summarised "32–52%" range: four above it (check:driver-memory-census 91.7%, check:parse-guard 90.6%, check:live-db-isolation 90.3%, check:type-check-coverage/check:type-check-debt 55.8%) and one below it (check:objectui-pin-citations 20.4%) — each measured by the identical method as the rest, and the verdict is unaffected either direction: existing TRIAGE REFUSE-WIDE rows already span 39%–99% under the same trade.

Verification

• node scripts/pm/bare-root-worklist.mjs --self-test — green: 57 live TRIAGE rows unchanged (none stale/fresh/contradicted), plus 14 CENSUS row(s) … well-formed, disjoint from TRIAGE, contribute no hint of their own, and share one base commit.
• Ablation (both sittings): mutated a CENSUS_REFUSE_WIDE row's reads to an invalid value (9999999 > of, then -5) — --self-test went RED on exactly the new battery's shape assertion each time (direct exit-code capture, not piped); restored from a saved pre-mutation copy and reverified green both times.
• node scripts/check-whole-set-label-write.mjs --self-test and its production leg — byte-identical verdict text before/after the fixture rename.
• node scripts/check-declared-population-live.mjs — unchanged: "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's tracked files".
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 17 commands derived for this changeset (unchanged across both sittings); run under scripts/pm/os-verify-lock.sh at head a78607fe0c: 16 of 17 green, the one exception node scripts/check-test-completeness.mjs exiting 3 — NOT MEASURED by its own design (it needs a CI test log and says so), not a red. pnpm check:pm-dispatch-gates (the heaviest — its self-test respawns its own CLI many times) passed at 1240 cases. node scripts/pm/dispatch-gates.mjs --ran reconciliation: 17 derived, 17 run, 0 UNRUN.
• origin/main fetched and checked before both pushes; 0 commits behind at the second sitting's push.

git diff --stat (cumulative): 2 files changed, both under scripts/ — skip-changeset, per this card's explicit dispatch (tooling-only, publishes nothing from any package).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33724243099 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 29 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 93 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727523624 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 101 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729337914 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 103 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[baozhoutao]

Fixes#14695

What landed

All 14 of the 14 unrecorded REFUSE-WIDE members, recorded in a new CENSUS_REFUSE_WIDE table in scripts/pm/bare-root-worklist.mjs, each carrying its own measured share and the base commit it was measured at (2aa8456cf, the base #14325's own census used). Shipped in two sittings on this PR — 12 first, then the remaining 2 once the filing session supplied their names (see "Follow-up" below):

family	reads	of	share
check:route-envelope	2181	5837	37.4%
check:driver-memory-census	5352	5837	91.7%
check:parse-guard	5289	5837	90.6%
check:live-db-isolation	5269	5837	90.3%
check:org-identifier	2211	5837	37.9%
check:startup-registry-verdict	2182	5837	37.4%
check:wildcard-fallthrough	2182	5837	37.4%
check:init-service-contract	2182	5837	37.4%
check:settings-bind-window	2182	5837	37.4%
check:cli-command-ids	1951	5837	33.4%
check:type-check-coverage	3255	5837	55.8%
check:type-check-debt	3255 (shared with its sibling above)	5837	55.8%
check:error-code-provenance	2070	5837	35.5%
check:objectui-pin-citations	1192	5837	20.4%

Plus the folded second half: scripts/check-whole-set-label-write.mjs's three self-test SANDBOX filenames (scripts/w.mjs, scripts/writer.sh, .github/workflows/w.yml) — dead leads that existed in no tracked tree, spelled as bare literals in a top-level export const (not inside a selfTest()-shaped function, so maskSelfTests never hid them) — now renamed to three real, unrelated, already-tracked paths (scripts/check-nul-bytes.mjs, scripts/build-console.sh, .github/workflows/ci.yml). No behaviour change: check-whole-set-label-write --self-test and its production leg print byte-identical verdicts before and after; check:declared-population-live's "158 of 202 families … every one reaches this tree's tracked files" line is unchanged, but the family's own declared-hint set no longer contains a dead entry.

Follow-up: the last 2 of 14

The first sitting on this PR shipped 12 of 14 and left check:error-code-provenance and check:objectui-pin-citations (the "two packages/spec-filtered ones") as an open question — the issue text's claim that they were "named in PR #14692's body with their measured shares" did not hold up against that body's actual text, which states an exact share for only check:route-envelope and names the other 13 only in an aggregate bucket row.

The filing session (which ran the original #14325 census) supplied its own census artifacts directly, confirming both families sit in that census's "root-wide, same class, no ledger row" bucket as members 13 and 14: pnpm --filter @objectstack/spec run check:error-code-provenance (sitting-1 tracked_reads 2079, undeclared 2077, byRoot.packages 2069) and pnpm --filter @objectstack/spec run check:objectui-pin-citations (tracked_reads 1200, undeclared 1200, byRoot.packages 1192).

Both shares below are re-measured here by this table's own method — never copied from the filing session's numbers, to keep the table one-method/one-base — using the same strace -f -e trace=openat technique against a 2aa8456cf worktree, this time invoked as pnpm --filter @objectstack/spec run check:X (the tsx production leg, no --self-test) rather than a plain node scripts/check-X.mjs. Both land within 1 file of the filing session's own sitting-1 counts — 2070 vs 2069, and an exact 1192 vs 1192 — corroborating the method a second time, now on a tsx-run gate rather than a plain node one. check:objectui-pin-citations (20.4%) lands below the issue's summarised "32–52%" range for this bucket; recorded as measured rather than forced into the quoted band, matching how the earlier sitting handled the four members that measured above it.

Why a NEW table, not new TRIAGE rows

Recording one of the 14 as an ordinary TRIAGE row was tried first and self-reverts: TRIAGE is coupled to sweep(), which can only ever discover a const X_ROOTS = ['packages']-shaped bare-word population literal (this file's own narrow recogniser). None of these 14 families hold that shape — most declare no population constant of any kind; check:route-envelope's bare 'packages' word is a join(ROOT, 'packages')call argument, not an assignment. Confirmed empirically: adding check:route-envelope SCAN_ROOTS packages to TRIAGE makes --self-test fail immediately with STALE: check:route-envelope SCAN_ROOTS packages — sweep() never produces the key. These 14 rows were found by #14325's wider fs-trace census (PR #14692, PR #14323), a different and broader instrument than this file's own sweep — so they live in a new CENSUS_REFUSE_WIDE table with its own self-test battery, explicitly uncoupled from TRIAGE's stale/fresh/contradicted machinery (which would ask a question this table has no honest answer to).

Method — re-measured, not copied, and why

PR #14692's body, read in full before writing this (saved and live copies diff byte-for-byte but for a trailing newline), states an exact share for exactly one of the fourteen — check:route-envelope (36.6%, "2138 undeclared reads"). The other thirteen are named with no percentage in the issue/PR text; the body's own bucket table states only the aggregate "14 members, 32–52%". Carrying a share that isn't actually recorded anywhere reachable would be the exact "defect wearing fresher digits" bare-root-worklist.mjs's own docblock prices as the costlier error, so every one of the 14 shares is measured fresh, at the base #14695 names (2aa8456cf) — never mixed with this branch's later tree.

Method: strace -f -e trace=openat over each gate's own production CLI leg, run in a dedicated detached worktree checked out at 2aa8456cf (pnpm installd there), filtered to successful openat calls landing on a tracked file under packages/. This traces the syscall, so it counts what the process actually opened regardless of which Node API did the opening. A JS-level fs.readFileSync monkey-patch (--import preload) was tried first and measured empty — 0 reads — against check:route-envelope's known-nonzero population, because Node's ESM binding for a core module's named export does not reliably re-resolve through a later reassignment of the CJS-compat fs object property; recorded in the new table's docblock so the same dead end isn't re-walked. check:route-envelope traced at 2181/5837 (37.4%), within 2% of PR #14692's cited 2138 "undeclared reads" (36.6%) — the gap being that figure's own subtraction of the handful of route paths this gate already spells as literals elsewhere (already visible to extractWatchHints, hence excluded from "undeclared") — corroborating the method against the one figure available without reproducing its bookkeeping term for term.

What is NOT in this PR

No subtree was declared for any of the 14 — recording REFUSE-WIDE is the opposite action from declaring, per the card and the 2026-08-26 ruling it cites.

Six of the fourteen measure outside the issue's summarised "32–52%" range: four above it (check:driver-memory-census 91.7%, check:parse-guard 90.6%, check:live-db-isolation 90.3%, check:type-check-coverage/check:type-check-debt 55.8%) and one below it (check:objectui-pin-citations 20.4%) — each measured by the identical method as the rest, and the verdict is unaffected either direction: existing TRIAGE REFUSE-WIDE rows already span 39%–99% under the same trade.

Verification

• node scripts/pm/bare-root-worklist.mjs --self-test — green: 57 live TRIAGE rows unchanged (none stale/fresh/contradicted), plus 14 CENSUS row(s) … well-formed, disjoint from TRIAGE, contribute no hint of their own, and share one base commit.
• Ablation (both sittings): mutated a CENSUS_REFUSE_WIDE row's reads to an invalid value (9999999 > of, then -5) — --self-test went RED on exactly the new battery's shape assertion each time (direct exit-code capture, not piped); restored from a saved pre-mutation copy and reverified green both times.
• node scripts/check-whole-set-label-write.mjs --self-test and its production leg — byte-identical verdict text before/after the fixture rename.
• node scripts/check-declared-population-live.mjs — unchanged: "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's tracked files".
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 17 commands derived for this changeset (unchanged across both sittings); run under scripts/pm/os-verify-lock.sh at head a78607fe0c: 16 of 17 green, the one exception node scripts/check-test-completeness.mjs exiting 3 — NOT MEASURED by its own design (it needs a CI test log and says so), not a red. pnpm check:pm-dispatch-gates (the heaviest — its self-test respawns its own CLI many times) passed at 1240 cases. node scripts/pm/dispatch-gates.mjs --ran reconciliation: 17 derived, 17 run, 0 UNRUN.
• origin/main fetched and checked before both pushes; 0 commits behind at the second sitting's push.

git diff --stat (cumulative): 2 files changed, both under scripts/ — skip-changeset, per this card's explicit dispatch (tooling-only, publishes nothing from any package).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33724243099 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 29 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 93 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727523624 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 101 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729337914 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 103 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[baozhoutao]

Fixes#14695

What landed

All 14 of the 14 unrecorded REFUSE-WIDE members, recorded in a new CENSUS_REFUSE_WIDE table in scripts/pm/bare-root-worklist.mjs, each carrying its own measured share and the base commit it was measured at (2aa8456cf, the base #14325's own census used). Shipped in two sittings on this PR — 12 first, then the remaining 2 once the filing session supplied their names (see "Follow-up" below):

family	reads	of	share
check:route-envelope	2181	5837	37.4%
check:driver-memory-census	5352	5837	91.7%
check:parse-guard	5289	5837	90.6%
check:live-db-isolation	5269	5837	90.3%
check:org-identifier	2211	5837	37.9%
check:startup-registry-verdict	2182	5837	37.4%
check:wildcard-fallthrough	2182	5837	37.4%
check:init-service-contract	2182	5837	37.4%
check:settings-bind-window	2182	5837	37.4%
check:cli-command-ids	1951	5837	33.4%
check:type-check-coverage	3255	5837	55.8%
check:type-check-debt	3255 (shared with its sibling above)	5837	55.8%
check:error-code-provenance	2070	5837	35.5%
check:objectui-pin-citations	1192	5837	20.4%

Plus the folded second half: scripts/check-whole-set-label-write.mjs's three self-test SANDBOX filenames (scripts/w.mjs, scripts/writer.sh, .github/workflows/w.yml) — dead leads that existed in no tracked tree, spelled as bare literals in a top-level export const (not inside a selfTest()-shaped function, so maskSelfTests never hid them) — now renamed to three real, unrelated, already-tracked paths (scripts/check-nul-bytes.mjs, scripts/build-console.sh, .github/workflows/ci.yml). No behaviour change: check-whole-set-label-write --self-test and its production leg print byte-identical verdicts before and after; check:declared-population-live's "158 of 202 families … every one reaches this tree's tracked files" line is unchanged, but the family's own declared-hint set no longer contains a dead entry.

Follow-up: the last 2 of 14

The first sitting on this PR shipped 12 of 14 and left check:error-code-provenance and check:objectui-pin-citations (the "two packages/spec-filtered ones") as an open question — the issue text's claim that they were "named in PR #14692's body with their measured shares" did not hold up against that body's actual text, which states an exact share for only check:route-envelope and names the other 13 only in an aggregate bucket row.

The filing session (which ran the original #14325 census) supplied its own census artifacts directly, confirming both families sit in that census's "root-wide, same class, no ledger row" bucket as members 13 and 14: pnpm --filter @objectstack/spec run check:error-code-provenance (sitting-1 tracked_reads 2079, undeclared 2077, byRoot.packages 2069) and pnpm --filter @objectstack/spec run check:objectui-pin-citations (tracked_reads 1200, undeclared 1200, byRoot.packages 1192).

Both shares below are re-measured here by this table's own method — never copied from the filing session's numbers, to keep the table one-method/one-base — using the same strace -f -e trace=openat technique against a 2aa8456cf worktree, this time invoked as pnpm --filter @objectstack/spec run check:X (the tsx production leg, no --self-test) rather than a plain node scripts/check-X.mjs. Both land within 1 file of the filing session's own sitting-1 counts — 2070 vs 2069, and an exact 1192 vs 1192 — corroborating the method a second time, now on a tsx-run gate rather than a plain node one. check:objectui-pin-citations (20.4%) lands below the issue's summarised "32–52%" range for this bucket; recorded as measured rather than forced into the quoted band, matching how the earlier sitting handled the four members that measured above it.

Why a NEW table, not new TRIAGE rows

Recording one of the 14 as an ordinary TRIAGE row was tried first and self-reverts: TRIAGE is coupled to sweep(), which can only ever discover a const X_ROOTS = ['packages']-shaped bare-word population literal (this file's own narrow recogniser). None of these 14 families hold that shape — most declare no population constant of any kind; check:route-envelope's bare 'packages' word is a join(ROOT, 'packages')call argument, not an assignment. Confirmed empirically: adding check:route-envelope SCAN_ROOTS packages to TRIAGE makes --self-test fail immediately with STALE: check:route-envelope SCAN_ROOTS packages — sweep() never produces the key. These 14 rows were found by #14325's wider fs-trace census (PR #14692, PR #14323), a different and broader instrument than this file's own sweep — so they live in a new CENSUS_REFUSE_WIDE table with its own self-test battery, explicitly uncoupled from TRIAGE's stale/fresh/contradicted machinery (which would ask a question this table has no honest answer to).

Method — re-measured, not copied, and why

PR #14692's body, read in full before writing this (saved and live copies diff byte-for-byte but for a trailing newline), states an exact share for exactly one of the fourteen — check:route-envelope (36.6%, "2138 undeclared reads"). The other thirteen are named with no percentage in the issue/PR text; the body's own bucket table states only the aggregate "14 members, 32–52%". Carrying a share that isn't actually recorded anywhere reachable would be the exact "defect wearing fresher digits" bare-root-worklist.mjs's own docblock prices as the costlier error, so every one of the 14 shares is measured fresh, at the base #14695 names (2aa8456cf) — never mixed with this branch's later tree.

Method: strace -f -e trace=openat over each gate's own production CLI leg, run in a dedicated detached worktree checked out at 2aa8456cf (pnpm installd there), filtered to successful openat calls landing on a tracked file under packages/. This traces the syscall, so it counts what the process actually opened regardless of which Node API did the opening. A JS-level fs.readFileSync monkey-patch (--import preload) was tried first and measured empty — 0 reads — against check:route-envelope's known-nonzero population, because Node's ESM binding for a core module's named export does not reliably re-resolve through a later reassignment of the CJS-compat fs object property; recorded in the new table's docblock so the same dead end isn't re-walked. check:route-envelope traced at 2181/5837 (37.4%), within 2% of PR #14692's cited 2138 "undeclared reads" (36.6%) — the gap being that figure's own subtraction of the handful of route paths this gate already spells as literals elsewhere (already visible to extractWatchHints, hence excluded from "undeclared") — corroborating the method against the one figure available without reproducing its bookkeeping term for term.

What is NOT in this PR

No subtree was declared for any of the 14 — recording REFUSE-WIDE is the opposite action from declaring, per the card and the 2026-08-26 ruling it cites.

Six of the fourteen measure outside the issue's summarised "32–52%" range: four above it (check:driver-memory-census 91.7%, check:parse-guard 90.6%, check:live-db-isolation 90.3%, check:type-check-coverage/check:type-check-debt 55.8%) and one below it (check:objectui-pin-citations 20.4%) — each measured by the identical method as the rest, and the verdict is unaffected either direction: existing TRIAGE REFUSE-WIDE rows already span 39%–99% under the same trade.

Verification

• node scripts/pm/bare-root-worklist.mjs --self-test — green: 57 live TRIAGE rows unchanged (none stale/fresh/contradicted), plus 14 CENSUS row(s) … well-formed, disjoint from TRIAGE, contribute no hint of their own, and share one base commit.
• Ablation (both sittings): mutated a CENSUS_REFUSE_WIDE row's reads to an invalid value (9999999 > of, then -5) — --self-test went RED on exactly the new battery's shape assertion each time (direct exit-code capture, not piped); restored from a saved pre-mutation copy and reverified green both times.
• node scripts/check-whole-set-label-write.mjs --self-test and its production leg — byte-identical verdict text before/after the fixture rename.
• node scripts/check-declared-population-live.mjs — unchanged: "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's tracked files".
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 17 commands derived for this changeset (unchanged across both sittings); run under scripts/pm/os-verify-lock.sh at head a78607fe0c: 16 of 17 green, the one exception node scripts/check-test-completeness.mjs exiting 3 — NOT MEASURED by its own design (it needs a CI test log and says so), not a red. pnpm check:pm-dispatch-gates (the heaviest — its self-test respawns its own CLI many times) passed at 1240 cases. node scripts/pm/dispatch-gates.mjs --ran reconciliation: 17 derived, 17 run, 0 UNRUN.
• origin/main fetched and checked before both pushes; 0 commits behind at the second sitting's push.

git diff --stat (cumulative): 2 files changed, both under scripts/ — skip-changeset, per this card's explicit dispatch (tooling-only, publishes nothing from any package).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33724243099 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 29 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 93 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727523624 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 101 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729337914 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 103 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[baozhoutao]

Fixes#14695

What landed

All 14 of the 14 unrecorded REFUSE-WIDE members, recorded in a new CENSUS_REFUSE_WIDE table in scripts/pm/bare-root-worklist.mjs, each carrying its own measured share and the base commit it was measured at (2aa8456cf, the base #14325's own census used). Shipped in two sittings on this PR — 12 first, then the remaining 2 once the filing session supplied their names (see "Follow-up" below):

family	reads	of	share
check:route-envelope	2181	5837	37.4%
check:driver-memory-census	5352	5837	91.7%
check:parse-guard	5289	5837	90.6%
check:live-db-isolation	5269	5837	90.3%
check:org-identifier	2211	5837	37.9%
check:startup-registry-verdict	2182	5837	37.4%
check:wildcard-fallthrough	2182	5837	37.4%
check:init-service-contract	2182	5837	37.4%
check:settings-bind-window	2182	5837	37.4%
check:cli-command-ids	1951	5837	33.4%
check:type-check-coverage	3255	5837	55.8%
check:type-check-debt	3255 (shared with its sibling above)	5837	55.8%
check:error-code-provenance	2070	5837	35.5%
check:objectui-pin-citations	1192	5837	20.4%

Plus the folded second half: scripts/check-whole-set-label-write.mjs's three self-test SANDBOX filenames (scripts/w.mjs, scripts/writer.sh, .github/workflows/w.yml) — dead leads that existed in no tracked tree, spelled as bare literals in a top-level export const (not inside a selfTest()-shaped function, so maskSelfTests never hid them) — now renamed to three real, unrelated, already-tracked paths (scripts/check-nul-bytes.mjs, scripts/build-console.sh, .github/workflows/ci.yml). No behaviour change: check-whole-set-label-write --self-test and its production leg print byte-identical verdicts before and after; check:declared-population-live's "158 of 202 families … every one reaches this tree's tracked files" line is unchanged, but the family's own declared-hint set no longer contains a dead entry.

Follow-up: the last 2 of 14

The first sitting on this PR shipped 12 of 14 and left check:error-code-provenance and check:objectui-pin-citations (the "two packages/spec-filtered ones") as an open question — the issue text's claim that they were "named in PR #14692's body with their measured shares" did not hold up against that body's actual text, which states an exact share for only check:route-envelope and names the other 13 only in an aggregate bucket row.

The filing session (which ran the original #14325 census) supplied its own census artifacts directly, confirming both families sit in that census's "root-wide, same class, no ledger row" bucket as members 13 and 14: pnpm --filter @objectstack/spec run check:error-code-provenance (sitting-1 tracked_reads 2079, undeclared 2077, byRoot.packages 2069) and pnpm --filter @objectstack/spec run check:objectui-pin-citations (tracked_reads 1200, undeclared 1200, byRoot.packages 1192).

Both shares below are re-measured here by this table's own method — never copied from the filing session's numbers, to keep the table one-method/one-base — using the same strace -f -e trace=openat technique against a 2aa8456cf worktree, this time invoked as pnpm --filter @objectstack/spec run check:X (the tsx production leg, no --self-test) rather than a plain node scripts/check-X.mjs. Both land within 1 file of the filing session's own sitting-1 counts — 2070 vs 2069, and an exact 1192 vs 1192 — corroborating the method a second time, now on a tsx-run gate rather than a plain node one. check:objectui-pin-citations (20.4%) lands below the issue's summarised "32–52%" range for this bucket; recorded as measured rather than forced into the quoted band, matching how the earlier sitting handled the four members that measured above it.

Why a NEW table, not new TRIAGE rows

Recording one of the 14 as an ordinary TRIAGE row was tried first and self-reverts: TRIAGE is coupled to sweep(), which can only ever discover a const X_ROOTS = ['packages']-shaped bare-word population literal (this file's own narrow recogniser). None of these 14 families hold that shape — most declare no population constant of any kind; check:route-envelope's bare 'packages' word is a join(ROOT, 'packages')call argument, not an assignment. Confirmed empirically: adding check:route-envelope SCAN_ROOTS packages to TRIAGE makes --self-test fail immediately with STALE: check:route-envelope SCAN_ROOTS packages — sweep() never produces the key. These 14 rows were found by #14325's wider fs-trace census (PR #14692, PR #14323), a different and broader instrument than this file's own sweep — so they live in a new CENSUS_REFUSE_WIDE table with its own self-test battery, explicitly uncoupled from TRIAGE's stale/fresh/contradicted machinery (which would ask a question this table has no honest answer to).

Method — re-measured, not copied, and why

PR #14692's body, read in full before writing this (saved and live copies diff byte-for-byte but for a trailing newline), states an exact share for exactly one of the fourteen — check:route-envelope (36.6%, "2138 undeclared reads"). The other thirteen are named with no percentage in the issue/PR text; the body's own bucket table states only the aggregate "14 members, 32–52%". Carrying a share that isn't actually recorded anywhere reachable would be the exact "defect wearing fresher digits" bare-root-worklist.mjs's own docblock prices as the costlier error, so every one of the 14 shares is measured fresh, at the base #14695 names (2aa8456cf) — never mixed with this branch's later tree.

Method: strace -f -e trace=openat over each gate's own production CLI leg, run in a dedicated detached worktree checked out at 2aa8456cf (pnpm installd there), filtered to successful openat calls landing on a tracked file under packages/. This traces the syscall, so it counts what the process actually opened regardless of which Node API did the opening. A JS-level fs.readFileSync monkey-patch (--import preload) was tried first and measured empty — 0 reads — against check:route-envelope's known-nonzero population, because Node's ESM binding for a core module's named export does not reliably re-resolve through a later reassignment of the CJS-compat fs object property; recorded in the new table's docblock so the same dead end isn't re-walked. check:route-envelope traced at 2181/5837 (37.4%), within 2% of PR #14692's cited 2138 "undeclared reads" (36.6%) — the gap being that figure's own subtraction of the handful of route paths this gate already spells as literals elsewhere (already visible to extractWatchHints, hence excluded from "undeclared") — corroborating the method against the one figure available without reproducing its bookkeeping term for term.

What is NOT in this PR

No subtree was declared for any of the 14 — recording REFUSE-WIDE is the opposite action from declaring, per the card and the 2026-08-26 ruling it cites.

Six of the fourteen measure outside the issue's summarised "32–52%" range: four above it (check:driver-memory-census 91.7%, check:parse-guard 90.6%, check:live-db-isolation 90.3%, check:type-check-coverage/check:type-check-debt 55.8%) and one below it (check:objectui-pin-citations 20.4%) — each measured by the identical method as the rest, and the verdict is unaffected either direction: existing TRIAGE REFUSE-WIDE rows already span 39%–99% under the same trade.

Verification

• node scripts/pm/bare-root-worklist.mjs --self-test — green: 57 live TRIAGE rows unchanged (none stale/fresh/contradicted), plus 14 CENSUS row(s) … well-formed, disjoint from TRIAGE, contribute no hint of their own, and share one base commit.
• Ablation (both sittings): mutated a CENSUS_REFUSE_WIDE row's reads to an invalid value (9999999 > of, then -5) — --self-test went RED on exactly the new battery's shape assertion each time (direct exit-code capture, not piped); restored from a saved pre-mutation copy and reverified green both times.
• node scripts/check-whole-set-label-write.mjs --self-test and its production leg — byte-identical verdict text before/after the fixture rename.
• node scripts/check-declared-population-live.mjs — unchanged: "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's tracked files".
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 17 commands derived for this changeset (unchanged across both sittings); run under scripts/pm/os-verify-lock.sh at head a78607fe0c: 16 of 17 green, the one exception node scripts/check-test-completeness.mjs exiting 3 — NOT MEASURED by its own design (it needs a CI test log and says so), not a red. pnpm check:pm-dispatch-gates (the heaviest — its self-test respawns its own CLI many times) passed at 1240 cases. node scripts/pm/dispatch-gates.mjs --ran reconciliation: 17 derived, 17 run, 0 UNRUN.
• origin/main fetched and checked before both pushes; 0 commits behind at the second sitting's push.

git diff --stat (cumulative): 2 files changed, both under scripts/ — skip-changeset, per this card's explicit dispatch (tooling-only, publishes nothing from any package).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33724243099 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 29 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 93 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727523624 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 101 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729337914 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 103 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[baozhoutao]

Fixes#14695

What landed

All 14 of the 14 unrecorded REFUSE-WIDE members, recorded in a new CENSUS_REFUSE_WIDE table in scripts/pm/bare-root-worklist.mjs, each carrying its own measured share and the base commit it was measured at (2aa8456cf, the base #14325's own census used). Shipped in two sittings on this PR — 12 first, then the remaining 2 once the filing session supplied their names (see "Follow-up" below):

family	reads	of	share
check:route-envelope	2181	5837	37.4%
check:driver-memory-census	5352	5837	91.7%
check:parse-guard	5289	5837	90.6%
check:live-db-isolation	5269	5837	90.3%
check:org-identifier	2211	5837	37.9%
check:startup-registry-verdict	2182	5837	37.4%
check:wildcard-fallthrough	2182	5837	37.4%
check:init-service-contract	2182	5837	37.4%
check:settings-bind-window	2182	5837	37.4%
check:cli-command-ids	1951	5837	33.4%
check:type-check-coverage	3255	5837	55.8%
check:type-check-debt	3255 (shared with its sibling above)	5837	55.8%
check:error-code-provenance	2070	5837	35.5%
check:objectui-pin-citations	1192	5837	20.4%

Plus the folded second half: scripts/check-whole-set-label-write.mjs's three self-test SANDBOX filenames (scripts/w.mjs, scripts/writer.sh, .github/workflows/w.yml) — dead leads that existed in no tracked tree, spelled as bare literals in a top-level export const (not inside a selfTest()-shaped function, so maskSelfTests never hid them) — now renamed to three real, unrelated, already-tracked paths (scripts/check-nul-bytes.mjs, scripts/build-console.sh, .github/workflows/ci.yml). No behaviour change: check-whole-set-label-write --self-test and its production leg print byte-identical verdicts before and after; check:declared-population-live's "158 of 202 families … every one reaches this tree's tracked files" line is unchanged, but the family's own declared-hint set no longer contains a dead entry.

Follow-up: the last 2 of 14

The first sitting on this PR shipped 12 of 14 and left check:error-code-provenance and check:objectui-pin-citations (the "two packages/spec-filtered ones") as an open question — the issue text's claim that they were "named in PR #14692's body with their measured shares" did not hold up against that body's actual text, which states an exact share for only check:route-envelope and names the other 13 only in an aggregate bucket row.

The filing session (which ran the original #14325 census) supplied its own census artifacts directly, confirming both families sit in that census's "root-wide, same class, no ledger row" bucket as members 13 and 14: pnpm --filter @objectstack/spec run check:error-code-provenance (sitting-1 tracked_reads 2079, undeclared 2077, byRoot.packages 2069) and pnpm --filter @objectstack/spec run check:objectui-pin-citations (tracked_reads 1200, undeclared 1200, byRoot.packages 1192).

Both shares below are re-measured here by this table's own method — never copied from the filing session's numbers, to keep the table one-method/one-base — using the same strace -f -e trace=openat technique against a 2aa8456cf worktree, this time invoked as pnpm --filter @objectstack/spec run check:X (the tsx production leg, no --self-test) rather than a plain node scripts/check-X.mjs. Both land within 1 file of the filing session's own sitting-1 counts — 2070 vs 2069, and an exact 1192 vs 1192 — corroborating the method a second time, now on a tsx-run gate rather than a plain node one. check:objectui-pin-citations (20.4%) lands below the issue's summarised "32–52%" range for this bucket; recorded as measured rather than forced into the quoted band, matching how the earlier sitting handled the four members that measured above it.

Why a NEW table, not new TRIAGE rows

Recording one of the 14 as an ordinary TRIAGE row was tried first and self-reverts: TRIAGE is coupled to sweep(), which can only ever discover a const X_ROOTS = ['packages']-shaped bare-word population literal (this file's own narrow recogniser). None of these 14 families hold that shape — most declare no population constant of any kind; check:route-envelope's bare 'packages' word is a join(ROOT, 'packages')call argument, not an assignment. Confirmed empirically: adding check:route-envelope SCAN_ROOTS packages to TRIAGE makes --self-test fail immediately with STALE: check:route-envelope SCAN_ROOTS packages — sweep() never produces the key. These 14 rows were found by #14325's wider fs-trace census (PR #14692, PR #14323), a different and broader instrument than this file's own sweep — so they live in a new CENSUS_REFUSE_WIDE table with its own self-test battery, explicitly uncoupled from TRIAGE's stale/fresh/contradicted machinery (which would ask a question this table has no honest answer to).

Method — re-measured, not copied, and why

PR #14692's body, read in full before writing this (saved and live copies diff byte-for-byte but for a trailing newline), states an exact share for exactly one of the fourteen — check:route-envelope (36.6%, "2138 undeclared reads"). The other thirteen are named with no percentage in the issue/PR text; the body's own bucket table states only the aggregate "14 members, 32–52%". Carrying a share that isn't actually recorded anywhere reachable would be the exact "defect wearing fresher digits" bare-root-worklist.mjs's own docblock prices as the costlier error, so every one of the 14 shares is measured fresh, at the base #14695 names (2aa8456cf) — never mixed with this branch's later tree.

Method: strace -f -e trace=openat over each gate's own production CLI leg, run in a dedicated detached worktree checked out at 2aa8456cf (pnpm installd there), filtered to successful openat calls landing on a tracked file under packages/. This traces the syscall, so it counts what the process actually opened regardless of which Node API did the opening. A JS-level fs.readFileSync monkey-patch (--import preload) was tried first and measured empty — 0 reads — against check:route-envelope's known-nonzero population, because Node's ESM binding for a core module's named export does not reliably re-resolve through a later reassignment of the CJS-compat fs object property; recorded in the new table's docblock so the same dead end isn't re-walked. check:route-envelope traced at 2181/5837 (37.4%), within 2% of PR #14692's cited 2138 "undeclared reads" (36.6%) — the gap being that figure's own subtraction of the handful of route paths this gate already spells as literals elsewhere (already visible to extractWatchHints, hence excluded from "undeclared") — corroborating the method against the one figure available without reproducing its bookkeeping term for term.

What is NOT in this PR

No subtree was declared for any of the 14 — recording REFUSE-WIDE is the opposite action from declaring, per the card and the 2026-08-26 ruling it cites.

Six of the fourteen measure outside the issue's summarised "32–52%" range: four above it (check:driver-memory-census 91.7%, check:parse-guard 90.6%, check:live-db-isolation 90.3%, check:type-check-coverage/check:type-check-debt 55.8%) and one below it (check:objectui-pin-citations 20.4%) — each measured by the identical method as the rest, and the verdict is unaffected either direction: existing TRIAGE REFUSE-WIDE rows already span 39%–99% under the same trade.

Verification

• node scripts/pm/bare-root-worklist.mjs --self-test — green: 57 live TRIAGE rows unchanged (none stale/fresh/contradicted), plus 14 CENSUS row(s) … well-formed, disjoint from TRIAGE, contribute no hint of their own, and share one base commit.
• Ablation (both sittings): mutated a CENSUS_REFUSE_WIDE row's reads to an invalid value (9999999 > of, then -5) — --self-test went RED on exactly the new battery's shape assertion each time (direct exit-code capture, not piped); restored from a saved pre-mutation copy and reverified green both times.
• node scripts/check-whole-set-label-write.mjs --self-test and its production leg — byte-identical verdict text before/after the fixture rename.
• node scripts/check-declared-population-live.mjs — unchanged: "158 of 202 famil(ies) declare a path population, and every one of them reaches this tree's tracked files".
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 17 commands derived for this changeset (unchanged across both sittings); run under scripts/pm/os-verify-lock.sh at head a78607fe0c: 16 of 17 green, the one exception node scripts/check-test-completeness.mjs exiting 3 — NOT MEASURED by its own design (it needs a CI test log and says so), not a red. pnpm check:pm-dispatch-gates (the heaviest — its self-test respawns its own CLI many times) passed at 1240 cases. node scripts/pm/dispatch-gates.mjs --ran reconciliation: 17 derived, 17 run, 0 UNRUN.
• origin/main fetched and checked before both pushes; 0 commits behind at the second sitting's push.

git diff --stat (cumulative): 2 files changed, both under scripts/ — skip-changeset, per this card's explicit dispatch (tooling-only, publishes nothing from any package).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33724243099 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 29 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 93 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727523624 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 101 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729337914 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 103 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)