docs(agents): stop telling authors to hand-edit generated CHANGELOG.md

[os-litant]

Fixes#14792

Post-task checklist item 6 in AGENTS.md told the author to hand-edit CHANGELOG.md. That file is generated output. This drops the CHANGELOG.md half of the line and keeps ROADMAP.md.

Before / after

AGENTS.md:1154

Before:

6. Update `CHANGELOG.md` / `ROADMAP.md` if user-facing or architectural.

After:

6. Update `ROADMAP.md` if user-facing or architectural.

Why

The same file says the opposite about CHANGELOG.md thirty-four lines above. At AGENTS.md:1120, inside checklist item 3, the changeset rule states that the changeset body "ships to consumers as CHANGELOG.md inside the npm package and is what an upgrading agent greps after the tombstone error". That makes CHANGELOG.md the output — written by the changesets release step from the .changeset/*.md entries item 3 already requires.

Item 6 treated the same file as an input. A contributor who obeyed it either hand-edited a generated artifact that the next Version Packages run overwrites or collides with, or read the two lines together and concluded the file contradicts itself on its most-traversed workflow. Nothing is lost by the trim: the changeset obligation is item 3, and it is unchanged here.

Neither reading of the name survives, which is what makes the trim safe rather than a judgement call. Item 6 could have meant the per-package CHANGELOG.md files or the repo-root one, so both were checked:

• The per-package files are generated. packages/core/CHANGELOG.md and its siblings carry changeset-emitted release sections keyed by commit hash.
• The root CHANGELOG.md disclaims hand-editing in its own header: the update history "is maintained in three layers rather than by hand-editing this file" — per-package detail "generated by [changesets] from the .changeset/ entries every PR adds", the curated per-major pages under content/docs/releases/, and this file "retained for its historical entries."

So there is no CHANGELOG.md in this repo that item 6 could have legitimately directed a PR author to update by hand.

ROADMAP.md is untouched and not in question, and the surviving half is not vacuous: the file exists at the repo root and its history shows real hand edits. This PR makes no claim about whether that obligation should stand.

Arithmetic

AGENTS.md is at its line-ratchet ceiling, so the edit adds no line and re-wraps nothing.

Measure	Before	After
Lines (wc -l)	1,162	1,162
Ratchet ceiling / headroom	1,162 / 0	1,162 / 0
Bytes (wc -c)	85,106	85,089 (-17)
The edited line	72 bytes	55 bytes (-17)
Widest table row	1,081 (pin 1,081)	1,081 (pin 1,081)
grep -c 'CHANGELOG.md' AGENTS.md	2 (:1120, :1154)	1 (:1120 only)

Byte-negative on one line, so nothing is paid same-file. git diff --stat is 1 file changed, 1 insertion(+), 1 deletion(-).

Scope held

Untouched, deliberately: the ROADMAP.md half of item 6, checklist item 3, and the changeset section at :1116-1122 — that region is being corrected by PR #14789, and a second PR editing it would be a merge conflict on a governed file for no gain. The hunk here at :1154 is disjoint from that one.

One argument recorded for the merging maintainer rather than acted on: a reading exists under which item 6 should be deleted outright rather than trimmed, on the grounds that ROADMAP.md updates are not obviously a per-PR obligation either. That is a scope decision, not this card's, so the line is trimmed as ruled and the argument is left here.

Gates

All run at head 9596a42386, exit codes captured by redirect before any pipe; each verdict below is the gate's own printed line.

Command	Exit	Verdict
pnpm check:pm-skill-ratchet	0	AGENTS.md is 1162 lines (ceiling 1162; headroom 0). · AGENTS.md: widest table row is 1081 bytes (pin 1081; headroom 0). · self-test 111 cases pass
pnpm check:pm-governed-prose	0	2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.
pnpm check:pm-skill-id-lint	0	23 file(s) clean (pattern /#[0-9]{3,}/g).
pnpm check:nul-bytes	0	OK (scanned 8064 text file(s) -- 8064 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
pnpm check:corpus-claim-drift	0	OK, no new claim sites beside a pinned spelling.
pnpm check:required-contexts	0	6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s).
node scripts/check-required-contexts.mjs	0	same sweep, direct invocation
pnpm check:agent-test-spelling	0	violating population empty, 9 separators judged and cleared on the rule
pnpm check:docs-audit-scope	0	docs-accuracy-audit scope is in sync with content/docs/: 190 hand-written doc(s)
pnpm check:pm-governed-merges	0	self-test 243 assertions; live: the real generator declared 9 output(s) and certified this tree

The family list was re-derived after the last edit, not taken from the dispatch:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands resolved its --repo assertion against this checkout's origin, derived the change set from git as 1 path (AGENTS.md, committed 1 / working tree 0 / untracked 0, three-dot against merge base fc648a256) and emitted 8 commands. All 8 ran; the two dispatch-named gates outside that union (check:nul-bytes, check:corpus-claim-drift) ran as well, so the set above is a superset.

ESLint

Not run repo-wide; narrowed, and the narrowing is a measurement rather than a skip:

1. Population, read from eslint.config.mjs and not guessed. Every files: selector in the config is a JS/TS extension glob (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and narrower variants; COMMENT_SWALLOW_FILES at :785 is that same glob). grep -cin 'markdown|[.]md' eslint.config.mjs returns 0 — no markdown processor, no .md selector anywhere. Confirmed through ESLint's own API: isPathIgnored('AGENTS.md') is true and calculateConfigForFile('AGENTS.md') yields no rules, against a positive control (eslint.config.mjs itself resolves 2 rules), so the API call is not vacuously quiet.
2. Count, from --format json.pnpm exec eslint AGENTS.md --no-inline-config --format json gives errorCount: 0, warningCount: 1, the one warning being ruleId: null / File ignored because no matching configuration was supplied — zero rule results, because the file is outside the population.
3. Invariance over untouched files. The config never enables type-aware linting for any file — no parserOptions.project, no typed rules, stated at eslint.config.mjs:325-332 with its own measured positive control. With no cross-file type program there is no mechanism by which an edit in one file moves a verdict on a file it does not touch, and this diff is one Markdown line in a file ESLint does not lint at all.

A full pnpm lint therefore measures the same nothing this narrowing measured.

Changeset

Labelled skip-changeset, route 2 of scripts/check-empty-changeset.mjs's own enumeration: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- delete the changeset and apply the 'skip-changeset' label". This diff is one line of the repo-root instruction file; no packages/** source is touched and nothing publishes from any package. Per that script, the label is a gate-level exemption that produces no input for changesets/action — the shape an empty-frontmatter changeset would have broken.

Landing

Draft, and it stays draft — governed AGENTS.md, human merge is the review record. Not flipped ready, not queued, no auto-merge armed, no reviewers requested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727530243 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 97 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729340857 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 105 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[os-litant]

Fixes#14792

Post-task checklist item 6 in AGENTS.md told the author to hand-edit CHANGELOG.md. That file is generated output. This drops the CHANGELOG.md half of the line and keeps ROADMAP.md.

Before / after

AGENTS.md:1154

Before:

6. Update `CHANGELOG.md` / `ROADMAP.md` if user-facing or architectural.

After:

6. Update `ROADMAP.md` if user-facing or architectural.

Why

The same file says the opposite about CHANGELOG.md thirty-four lines above. At AGENTS.md:1120, inside checklist item 3, the changeset rule states that the changeset body "ships to consumers as CHANGELOG.md inside the npm package and is what an upgrading agent greps after the tombstone error". That makes CHANGELOG.md the output — written by the changesets release step from the .changeset/*.md entries item 3 already requires.

Item 6 treated the same file as an input. A contributor who obeyed it either hand-edited a generated artifact that the next Version Packages run overwrites or collides with, or read the two lines together and concluded the file contradicts itself on its most-traversed workflow. Nothing is lost by the trim: the changeset obligation is item 3, and it is unchanged here.

Neither reading of the name survives, which is what makes the trim safe rather than a judgement call. Item 6 could have meant the per-package CHANGELOG.md files or the repo-root one, so both were checked:

• The per-package files are generated. packages/core/CHANGELOG.md and its siblings carry changeset-emitted release sections keyed by commit hash.
• The root CHANGELOG.md disclaims hand-editing in its own header: the update history "is maintained in three layers rather than by hand-editing this file" — per-package detail "generated by [changesets] from the .changeset/ entries every PR adds", the curated per-major pages under content/docs/releases/, and this file "retained for its historical entries."

So there is no CHANGELOG.md in this repo that item 6 could have legitimately directed a PR author to update by hand.

ROADMAP.md is untouched and not in question, and the surviving half is not vacuous: the file exists at the repo root and its history shows real hand edits. This PR makes no claim about whether that obligation should stand.

Arithmetic

AGENTS.md is at its line-ratchet ceiling, so the edit adds no line and re-wraps nothing.

Measure	Before	After
Lines (wc -l)	1,162	1,162
Ratchet ceiling / headroom	1,162 / 0	1,162 / 0
Bytes (wc -c)	85,106	85,089 (-17)
The edited line	72 bytes	55 bytes (-17)
Widest table row	1,081 (pin 1,081)	1,081 (pin 1,081)
grep -c 'CHANGELOG.md' AGENTS.md	2 (:1120, :1154)	1 (:1120 only)

Byte-negative on one line, so nothing is paid same-file. git diff --stat is 1 file changed, 1 insertion(+), 1 deletion(-).

Scope held

Untouched, deliberately: the ROADMAP.md half of item 6, checklist item 3, and the changeset section at :1116-1122 — that region is being corrected by PR #14789, and a second PR editing it would be a merge conflict on a governed file for no gain. The hunk here at :1154 is disjoint from that one.

One argument recorded for the merging maintainer rather than acted on: a reading exists under which item 6 should be deleted outright rather than trimmed, on the grounds that ROADMAP.md updates are not obviously a per-PR obligation either. That is a scope decision, not this card's, so the line is trimmed as ruled and the argument is left here.

Gates

All run at head 9596a42386, exit codes captured by redirect before any pipe; each verdict below is the gate's own printed line.

Command	Exit	Verdict
pnpm check:pm-skill-ratchet	0	AGENTS.md is 1162 lines (ceiling 1162; headroom 0). · AGENTS.md: widest table row is 1081 bytes (pin 1081; headroom 0). · self-test 111 cases pass
pnpm check:pm-governed-prose	0	2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.
pnpm check:pm-skill-id-lint	0	23 file(s) clean (pattern /#[0-9]{3,}/g).
pnpm check:nul-bytes	0	OK (scanned 8064 text file(s) -- 8064 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
pnpm check:corpus-claim-drift	0	OK, no new claim sites beside a pinned spelling.
pnpm check:required-contexts	0	6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s).
node scripts/check-required-contexts.mjs	0	same sweep, direct invocation
pnpm check:agent-test-spelling	0	violating population empty, 9 separators judged and cleared on the rule
pnpm check:docs-audit-scope	0	docs-accuracy-audit scope is in sync with content/docs/: 190 hand-written doc(s)
pnpm check:pm-governed-merges	0	self-test 243 assertions; live: the real generator declared 9 output(s) and certified this tree

The family list was re-derived after the last edit, not taken from the dispatch:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands resolved its --repo assertion against this checkout's origin, derived the change set from git as 1 path (AGENTS.md, committed 1 / working tree 0 / untracked 0, three-dot against merge base fc648a256) and emitted 8 commands. All 8 ran; the two dispatch-named gates outside that union (check:nul-bytes, check:corpus-claim-drift) ran as well, so the set above is a superset.

ESLint

Not run repo-wide; narrowed, and the narrowing is a measurement rather than a skip:

1. Population, read from eslint.config.mjs and not guessed. Every files: selector in the config is a JS/TS extension glob (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and narrower variants; COMMENT_SWALLOW_FILES at :785 is that same glob). grep -cin 'markdown|[.]md' eslint.config.mjs returns 0 — no markdown processor, no .md selector anywhere. Confirmed through ESLint's own API: isPathIgnored('AGENTS.md') is true and calculateConfigForFile('AGENTS.md') yields no rules, against a positive control (eslint.config.mjs itself resolves 2 rules), so the API call is not vacuously quiet.
2. Count, from --format json.pnpm exec eslint AGENTS.md --no-inline-config --format json gives errorCount: 0, warningCount: 1, the one warning being ruleId: null / File ignored because no matching configuration was supplied — zero rule results, because the file is outside the population.
3. Invariance over untouched files. The config never enables type-aware linting for any file — no parserOptions.project, no typed rules, stated at eslint.config.mjs:325-332 with its own measured positive control. With no cross-file type program there is no mechanism by which an edit in one file moves a verdict on a file it does not touch, and this diff is one Markdown line in a file ESLint does not lint at all.

A full pnpm lint therefore measures the same nothing this narrowing measured.

Changeset

Labelled skip-changeset, route 2 of scripts/check-empty-changeset.mjs's own enumeration: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- delete the changeset and apply the 'skip-changeset' label". This diff is one line of the repo-root instruction file; no packages/** source is touched and nothing publishes from any package. Per that script, the label is a gate-level exemption that produces no input for changesets/action — the shape an empty-frontmatter changeset would have broken.

Landing

Draft, and it stays draft — governed AGENTS.md, human merge is the review record. Not flipped ready, not queued, no auto-merge armed, no reviewers requested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727530243 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 97 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729340857 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 105 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[os-litant]

Fixes#14792

Post-task checklist item 6 in AGENTS.md told the author to hand-edit CHANGELOG.md. That file is generated output. This drops the CHANGELOG.md half of the line and keeps ROADMAP.md.

Before / after

AGENTS.md:1154

Before:

6. Update `CHANGELOG.md` / `ROADMAP.md` if user-facing or architectural.

After:

6. Update `ROADMAP.md` if user-facing or architectural.

Why

The same file says the opposite about CHANGELOG.md thirty-four lines above. At AGENTS.md:1120, inside checklist item 3, the changeset rule states that the changeset body "ships to consumers as CHANGELOG.md inside the npm package and is what an upgrading agent greps after the tombstone error". That makes CHANGELOG.md the output — written by the changesets release step from the .changeset/*.md entries item 3 already requires.

Item 6 treated the same file as an input. A contributor who obeyed it either hand-edited a generated artifact that the next Version Packages run overwrites or collides with, or read the two lines together and concluded the file contradicts itself on its most-traversed workflow. Nothing is lost by the trim: the changeset obligation is item 3, and it is unchanged here.

Neither reading of the name survives, which is what makes the trim safe rather than a judgement call. Item 6 could have meant the per-package CHANGELOG.md files or the repo-root one, so both were checked:

• The per-package files are generated. packages/core/CHANGELOG.md and its siblings carry changeset-emitted release sections keyed by commit hash.
• The root CHANGELOG.md disclaims hand-editing in its own header: the update history "is maintained in three layers rather than by hand-editing this file" — per-package detail "generated by [changesets] from the .changeset/ entries every PR adds", the curated per-major pages under content/docs/releases/, and this file "retained for its historical entries."

So there is no CHANGELOG.md in this repo that item 6 could have legitimately directed a PR author to update by hand.

ROADMAP.md is untouched and not in question, and the surviving half is not vacuous: the file exists at the repo root and its history shows real hand edits. This PR makes no claim about whether that obligation should stand.

Arithmetic

AGENTS.md is at its line-ratchet ceiling, so the edit adds no line and re-wraps nothing.

Measure	Before	After
Lines (wc -l)	1,162	1,162
Ratchet ceiling / headroom	1,162 / 0	1,162 / 0
Bytes (wc -c)	85,106	85,089 (-17)
The edited line	72 bytes	55 bytes (-17)
Widest table row	1,081 (pin 1,081)	1,081 (pin 1,081)
grep -c 'CHANGELOG.md' AGENTS.md	2 (:1120, :1154)	1 (:1120 only)

Byte-negative on one line, so nothing is paid same-file. git diff --stat is 1 file changed, 1 insertion(+), 1 deletion(-).

Scope held

Untouched, deliberately: the ROADMAP.md half of item 6, checklist item 3, and the changeset section at :1116-1122 — that region is being corrected by PR #14789, and a second PR editing it would be a merge conflict on a governed file for no gain. The hunk here at :1154 is disjoint from that one.

One argument recorded for the merging maintainer rather than acted on: a reading exists under which item 6 should be deleted outright rather than trimmed, on the grounds that ROADMAP.md updates are not obviously a per-PR obligation either. That is a scope decision, not this card's, so the line is trimmed as ruled and the argument is left here.

Gates

All run at head 9596a42386, exit codes captured by redirect before any pipe; each verdict below is the gate's own printed line.

Command	Exit	Verdict
pnpm check:pm-skill-ratchet	0	AGENTS.md is 1162 lines (ceiling 1162; headroom 0). · AGENTS.md: widest table row is 1081 bytes (pin 1081; headroom 0). · self-test 111 cases pass
pnpm check:pm-governed-prose	0	2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.
pnpm check:pm-skill-id-lint	0	23 file(s) clean (pattern /#[0-9]{3,}/g).
pnpm check:nul-bytes	0	OK (scanned 8064 text file(s) -- 8064 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
pnpm check:corpus-claim-drift	0	OK, no new claim sites beside a pinned spelling.
pnpm check:required-contexts	0	6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s).
node scripts/check-required-contexts.mjs	0	same sweep, direct invocation
pnpm check:agent-test-spelling	0	violating population empty, 9 separators judged and cleared on the rule
pnpm check:docs-audit-scope	0	docs-accuracy-audit scope is in sync with content/docs/: 190 hand-written doc(s)
pnpm check:pm-governed-merges	0	self-test 243 assertions; live: the real generator declared 9 output(s) and certified this tree

The family list was re-derived after the last edit, not taken from the dispatch:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands resolved its --repo assertion against this checkout's origin, derived the change set from git as 1 path (AGENTS.md, committed 1 / working tree 0 / untracked 0, three-dot against merge base fc648a256) and emitted 8 commands. All 8 ran; the two dispatch-named gates outside that union (check:nul-bytes, check:corpus-claim-drift) ran as well, so the set above is a superset.

ESLint

Not run repo-wide; narrowed, and the narrowing is a measurement rather than a skip:

1. Population, read from eslint.config.mjs and not guessed. Every files: selector in the config is a JS/TS extension glob (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and narrower variants; COMMENT_SWALLOW_FILES at :785 is that same glob). grep -cin 'markdown|[.]md' eslint.config.mjs returns 0 — no markdown processor, no .md selector anywhere. Confirmed through ESLint's own API: isPathIgnored('AGENTS.md') is true and calculateConfigForFile('AGENTS.md') yields no rules, against a positive control (eslint.config.mjs itself resolves 2 rules), so the API call is not vacuously quiet.
2. Count, from --format json.pnpm exec eslint AGENTS.md --no-inline-config --format json gives errorCount: 0, warningCount: 1, the one warning being ruleId: null / File ignored because no matching configuration was supplied — zero rule results, because the file is outside the population.
3. Invariance over untouched files. The config never enables type-aware linting for any file — no parserOptions.project, no typed rules, stated at eslint.config.mjs:325-332 with its own measured positive control. With no cross-file type program there is no mechanism by which an edit in one file moves a verdict on a file it does not touch, and this diff is one Markdown line in a file ESLint does not lint at all.

A full pnpm lint therefore measures the same nothing this narrowing measured.

Changeset

Labelled skip-changeset, route 2 of scripts/check-empty-changeset.mjs's own enumeration: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- delete the changeset and apply the 'skip-changeset' label". This diff is one line of the repo-root instruction file; no packages/** source is touched and nothing publishes from any package. Per that script, the label is a gate-level exemption that produces no input for changesets/action — the shape an empty-frontmatter changeset would have broken.

Landing

Draft, and it stays draft — governed AGENTS.md, human merge is the review record. Not flipped ready, not queued, no auto-merge armed, no reviewers requested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727530243 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 97 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729340857 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 105 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[os-litant]

Fixes#14792

Post-task checklist item 6 in AGENTS.md told the author to hand-edit CHANGELOG.md. That file is generated output. This drops the CHANGELOG.md half of the line and keeps ROADMAP.md.

Before / after

AGENTS.md:1154

Before:

6. Update `CHANGELOG.md` / `ROADMAP.md` if user-facing or architectural.

After:

6. Update `ROADMAP.md` if user-facing or architectural.

Why

The same file says the opposite about CHANGELOG.md thirty-four lines above. At AGENTS.md:1120, inside checklist item 3, the changeset rule states that the changeset body "ships to consumers as CHANGELOG.md inside the npm package and is what an upgrading agent greps after the tombstone error". That makes CHANGELOG.md the output — written by the changesets release step from the .changeset/*.md entries item 3 already requires.

Item 6 treated the same file as an input. A contributor who obeyed it either hand-edited a generated artifact that the next Version Packages run overwrites or collides with, or read the two lines together and concluded the file contradicts itself on its most-traversed workflow. Nothing is lost by the trim: the changeset obligation is item 3, and it is unchanged here.

Neither reading of the name survives, which is what makes the trim safe rather than a judgement call. Item 6 could have meant the per-package CHANGELOG.md files or the repo-root one, so both were checked:

• The per-package files are generated. packages/core/CHANGELOG.md and its siblings carry changeset-emitted release sections keyed by commit hash.
• The root CHANGELOG.md disclaims hand-editing in its own header: the update history "is maintained in three layers rather than by hand-editing this file" — per-package detail "generated by [changesets] from the .changeset/ entries every PR adds", the curated per-major pages under content/docs/releases/, and this file "retained for its historical entries."

So there is no CHANGELOG.md in this repo that item 6 could have legitimately directed a PR author to update by hand.

ROADMAP.md is untouched and not in question, and the surviving half is not vacuous: the file exists at the repo root and its history shows real hand edits. This PR makes no claim about whether that obligation should stand.

Arithmetic

AGENTS.md is at its line-ratchet ceiling, so the edit adds no line and re-wraps nothing.

Measure	Before	After
Lines (wc -l)	1,162	1,162
Ratchet ceiling / headroom	1,162 / 0	1,162 / 0
Bytes (wc -c)	85,106	85,089 (-17)
The edited line	72 bytes	55 bytes (-17)
Widest table row	1,081 (pin 1,081)	1,081 (pin 1,081)
grep -c 'CHANGELOG.md' AGENTS.md	2 (:1120, :1154)	1 (:1120 only)

Byte-negative on one line, so nothing is paid same-file. git diff --stat is 1 file changed, 1 insertion(+), 1 deletion(-).

Scope held

Untouched, deliberately: the ROADMAP.md half of item 6, checklist item 3, and the changeset section at :1116-1122 — that region is being corrected by PR #14789, and a second PR editing it would be a merge conflict on a governed file for no gain. The hunk here at :1154 is disjoint from that one.

One argument recorded for the merging maintainer rather than acted on: a reading exists under which item 6 should be deleted outright rather than trimmed, on the grounds that ROADMAP.md updates are not obviously a per-PR obligation either. That is a scope decision, not this card's, so the line is trimmed as ruled and the argument is left here.

Gates

All run at head 9596a42386, exit codes captured by redirect before any pipe; each verdict below is the gate's own printed line.

Command	Exit	Verdict
pnpm check:pm-skill-ratchet	0	AGENTS.md is 1162 lines (ceiling 1162; headroom 0). · AGENTS.md: widest table row is 1081 bytes (pin 1081; headroom 0). · self-test 111 cases pass
pnpm check:pm-governed-prose	0	2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.
pnpm check:pm-skill-id-lint	0	23 file(s) clean (pattern /#[0-9]{3,}/g).
pnpm check:nul-bytes	0	OK (scanned 8064 text file(s) -- 8064 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
pnpm check:corpus-claim-drift	0	OK, no new claim sites beside a pinned spelling.
pnpm check:required-contexts	0	6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s).
node scripts/check-required-contexts.mjs	0	same sweep, direct invocation
pnpm check:agent-test-spelling	0	violating population empty, 9 separators judged and cleared on the rule
pnpm check:docs-audit-scope	0	docs-accuracy-audit scope is in sync with content/docs/: 190 hand-written doc(s)
pnpm check:pm-governed-merges	0	self-test 243 assertions; live: the real generator declared 9 output(s) and certified this tree

The family list was re-derived after the last edit, not taken from the dispatch:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands resolved its --repo assertion against this checkout's origin, derived the change set from git as 1 path (AGENTS.md, committed 1 / working tree 0 / untracked 0, three-dot against merge base fc648a256) and emitted 8 commands. All 8 ran; the two dispatch-named gates outside that union (check:nul-bytes, check:corpus-claim-drift) ran as well, so the set above is a superset.

ESLint

Not run repo-wide; narrowed, and the narrowing is a measurement rather than a skip:

1. Population, read from eslint.config.mjs and not guessed. Every files: selector in the config is a JS/TS extension glob (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and narrower variants; COMMENT_SWALLOW_FILES at :785 is that same glob). grep -cin 'markdown|[.]md' eslint.config.mjs returns 0 — no markdown processor, no .md selector anywhere. Confirmed through ESLint's own API: isPathIgnored('AGENTS.md') is true and calculateConfigForFile('AGENTS.md') yields no rules, against a positive control (eslint.config.mjs itself resolves 2 rules), so the API call is not vacuously quiet.
2. Count, from --format json.pnpm exec eslint AGENTS.md --no-inline-config --format json gives errorCount: 0, warningCount: 1, the one warning being ruleId: null / File ignored because no matching configuration was supplied — zero rule results, because the file is outside the population.
3. Invariance over untouched files. The config never enables type-aware linting for any file — no parserOptions.project, no typed rules, stated at eslint.config.mjs:325-332 with its own measured positive control. With no cross-file type program there is no mechanism by which an edit in one file moves a verdict on a file it does not touch, and this diff is one Markdown line in a file ESLint does not lint at all.

A full pnpm lint therefore measures the same nothing this narrowing measured.

Changeset

Labelled skip-changeset, route 2 of scripts/check-empty-changeset.mjs's own enumeration: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- delete the changeset and apply the 'skip-changeset' label". This diff is one line of the repo-root instruction file; no packages/** source is touched and nothing publishes from any package. Per that script, the label is a gate-level exemption that produces no input for changesets/action — the shape an empty-frontmatter changeset would have broken.

Landing

Draft, and it stays draft — governed AGENTS.md, human merge is the review record. Not flipped ready, not queued, no auto-merge armed, no reviewers requested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727530243 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 97 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729340857 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 105 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[os-litant]

Fixes#14792

Post-task checklist item 6 in AGENTS.md told the author to hand-edit CHANGELOG.md. That file is generated output. This drops the CHANGELOG.md half of the line and keeps ROADMAP.md.

Before / after

AGENTS.md:1154

Before:

6. Update `CHANGELOG.md` / `ROADMAP.md` if user-facing or architectural.

After:

6. Update `ROADMAP.md` if user-facing or architectural.

Why

The same file says the opposite about CHANGELOG.md thirty-four lines above. At AGENTS.md:1120, inside checklist item 3, the changeset rule states that the changeset body "ships to consumers as CHANGELOG.md inside the npm package and is what an upgrading agent greps after the tombstone error". That makes CHANGELOG.md the output — written by the changesets release step from the .changeset/*.md entries item 3 already requires.

Item 6 treated the same file as an input. A contributor who obeyed it either hand-edited a generated artifact that the next Version Packages run overwrites or collides with, or read the two lines together and concluded the file contradicts itself on its most-traversed workflow. Nothing is lost by the trim: the changeset obligation is item 3, and it is unchanged here.

Neither reading of the name survives, which is what makes the trim safe rather than a judgement call. Item 6 could have meant the per-package CHANGELOG.md files or the repo-root one, so both were checked:

• The per-package files are generated. packages/core/CHANGELOG.md and its siblings carry changeset-emitted release sections keyed by commit hash.
• The root CHANGELOG.md disclaims hand-editing in its own header: the update history "is maintained in three layers rather than by hand-editing this file" — per-package detail "generated by [changesets] from the .changeset/ entries every PR adds", the curated per-major pages under content/docs/releases/, and this file "retained for its historical entries."

So there is no CHANGELOG.md in this repo that item 6 could have legitimately directed a PR author to update by hand.

ROADMAP.md is untouched and not in question, and the surviving half is not vacuous: the file exists at the repo root and its history shows real hand edits. This PR makes no claim about whether that obligation should stand.

Arithmetic

AGENTS.md is at its line-ratchet ceiling, so the edit adds no line and re-wraps nothing.

Measure	Before	After
Lines (wc -l)	1,162	1,162
Ratchet ceiling / headroom	1,162 / 0	1,162 / 0
Bytes (wc -c)	85,106	85,089 (-17)
The edited line	72 bytes	55 bytes (-17)
Widest table row	1,081 (pin 1,081)	1,081 (pin 1,081)
grep -c 'CHANGELOG.md' AGENTS.md	2 (:1120, :1154)	1 (:1120 only)

Byte-negative on one line, so nothing is paid same-file. git diff --stat is 1 file changed, 1 insertion(+), 1 deletion(-).

Scope held

Untouched, deliberately: the ROADMAP.md half of item 6, checklist item 3, and the changeset section at :1116-1122 — that region is being corrected by PR #14789, and a second PR editing it would be a merge conflict on a governed file for no gain. The hunk here at :1154 is disjoint from that one.

One argument recorded for the merging maintainer rather than acted on: a reading exists under which item 6 should be deleted outright rather than trimmed, on the grounds that ROADMAP.md updates are not obviously a per-PR obligation either. That is a scope decision, not this card's, so the line is trimmed as ruled and the argument is left here.

Gates

All run at head 9596a42386, exit codes captured by redirect before any pipe; each verdict below is the gate's own printed line.

Command	Exit	Verdict
pnpm check:pm-skill-ratchet	0	AGENTS.md is 1162 lines (ceiling 1162; headroom 0). · AGENTS.md: widest table row is 1081 bytes (pin 1081; headroom 0). · self-test 111 cases pass
pnpm check:pm-governed-prose	0	2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.
pnpm check:pm-skill-id-lint	0	23 file(s) clean (pattern /#[0-9]{3,}/g).
pnpm check:nul-bytes	0	OK (scanned 8064 text file(s) -- 8064 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
pnpm check:corpus-claim-drift	0	OK, no new claim sites beside a pinned spelling.
pnpm check:required-contexts	0	6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s).
node scripts/check-required-contexts.mjs	0	same sweep, direct invocation
pnpm check:agent-test-spelling	0	violating population empty, 9 separators judged and cleared on the rule
pnpm check:docs-audit-scope	0	docs-accuracy-audit scope is in sync with content/docs/: 190 hand-written doc(s)
pnpm check:pm-governed-merges	0	self-test 243 assertions; live: the real generator declared 9 output(s) and certified this tree

The family list was re-derived after the last edit, not taken from the dispatch:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands resolved its --repo assertion against this checkout's origin, derived the change set from git as 1 path (AGENTS.md, committed 1 / working tree 0 / untracked 0, three-dot against merge base fc648a256) and emitted 8 commands. All 8 ran; the two dispatch-named gates outside that union (check:nul-bytes, check:corpus-claim-drift) ran as well, so the set above is a superset.

ESLint

Not run repo-wide; narrowed, and the narrowing is a measurement rather than a skip:

1. Population, read from eslint.config.mjs and not guessed. Every files: selector in the config is a JS/TS extension glob (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and narrower variants; COMMENT_SWALLOW_FILES at :785 is that same glob). grep -cin 'markdown|[.]md' eslint.config.mjs returns 0 — no markdown processor, no .md selector anywhere. Confirmed through ESLint's own API: isPathIgnored('AGENTS.md') is true and calculateConfigForFile('AGENTS.md') yields no rules, against a positive control (eslint.config.mjs itself resolves 2 rules), so the API call is not vacuously quiet.
2. Count, from --format json.pnpm exec eslint AGENTS.md --no-inline-config --format json gives errorCount: 0, warningCount: 1, the one warning being ruleId: null / File ignored because no matching configuration was supplied — zero rule results, because the file is outside the population.
3. Invariance over untouched files. The config never enables type-aware linting for any file — no parserOptions.project, no typed rules, stated at eslint.config.mjs:325-332 with its own measured positive control. With no cross-file type program there is no mechanism by which an edit in one file moves a verdict on a file it does not touch, and this diff is one Markdown line in a file ESLint does not lint at all.

A full pnpm lint therefore measures the same nothing this narrowing measured.

Changeset

Labelled skip-changeset, route 2 of scripts/check-empty-changeset.mjs's own enumeration: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- delete the changeset and apply the 'skip-changeset' label". This diff is one line of the repo-root instruction file; no packages/** source is touched and nothing publishes from any package. Per that script, the label is a gate-level exemption that produces no input for changesets/action — the shape an empty-frontmatter changeset would have broken.

Landing

Draft, and it stays draft — governed AGENTS.md, human merge is the review record. Not flipped ready, not queued, no auto-merge armed, no reviewers requested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727530243 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 97 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729340857 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 105 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[os-litant]

Fixes#14792

Post-task checklist item 6 in AGENTS.md told the author to hand-edit CHANGELOG.md. That file is generated output. This drops the CHANGELOG.md half of the line and keeps ROADMAP.md.

Before / after

AGENTS.md:1154

Before:

6. Update `CHANGELOG.md` / `ROADMAP.md` if user-facing or architectural.

After:

6. Update `ROADMAP.md` if user-facing or architectural.

Why

The same file says the opposite about CHANGELOG.md thirty-four lines above. At AGENTS.md:1120, inside checklist item 3, the changeset rule states that the changeset body "ships to consumers as CHANGELOG.md inside the npm package and is what an upgrading agent greps after the tombstone error". That makes CHANGELOG.md the output — written by the changesets release step from the .changeset/*.md entries item 3 already requires.

Item 6 treated the same file as an input. A contributor who obeyed it either hand-edited a generated artifact that the next Version Packages run overwrites or collides with, or read the two lines together and concluded the file contradicts itself on its most-traversed workflow. Nothing is lost by the trim: the changeset obligation is item 3, and it is unchanged here.

Neither reading of the name survives, which is what makes the trim safe rather than a judgement call. Item 6 could have meant the per-package CHANGELOG.md files or the repo-root one, so both were checked:

• The per-package files are generated. packages/core/CHANGELOG.md and its siblings carry changeset-emitted release sections keyed by commit hash.
• The root CHANGELOG.md disclaims hand-editing in its own header: the update history "is maintained in three layers rather than by hand-editing this file" — per-package detail "generated by [changesets] from the .changeset/ entries every PR adds", the curated per-major pages under content/docs/releases/, and this file "retained for its historical entries."

So there is no CHANGELOG.md in this repo that item 6 could have legitimately directed a PR author to update by hand.

ROADMAP.md is untouched and not in question, and the surviving half is not vacuous: the file exists at the repo root and its history shows real hand edits. This PR makes no claim about whether that obligation should stand.

Arithmetic

AGENTS.md is at its line-ratchet ceiling, so the edit adds no line and re-wraps nothing.

Measure	Before	After
Lines (wc -l)	1,162	1,162
Ratchet ceiling / headroom	1,162 / 0	1,162 / 0
Bytes (wc -c)	85,106	85,089 (-17)
The edited line	72 bytes	55 bytes (-17)
Widest table row	1,081 (pin 1,081)	1,081 (pin 1,081)
grep -c 'CHANGELOG.md' AGENTS.md	2 (:1120, :1154)	1 (:1120 only)

Byte-negative on one line, so nothing is paid same-file. git diff --stat is 1 file changed, 1 insertion(+), 1 deletion(-).

Scope held

Untouched, deliberately: the ROADMAP.md half of item 6, checklist item 3, and the changeset section at :1116-1122 — that region is being corrected by PR #14789, and a second PR editing it would be a merge conflict on a governed file for no gain. The hunk here at :1154 is disjoint from that one.

One argument recorded for the merging maintainer rather than acted on: a reading exists under which item 6 should be deleted outright rather than trimmed, on the grounds that ROADMAP.md updates are not obviously a per-PR obligation either. That is a scope decision, not this card's, so the line is trimmed as ruled and the argument is left here.

Gates

All run at head 9596a42386, exit codes captured by redirect before any pipe; each verdict below is the gate's own printed line.

Command	Exit	Verdict
pnpm check:pm-skill-ratchet	0	AGENTS.md is 1162 lines (ceiling 1162; headroom 0). · AGENTS.md: widest table row is 1081 bytes (pin 1081; headroom 0). · self-test 111 cases pass
pnpm check:pm-governed-prose	0	2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.
pnpm check:pm-skill-id-lint	0	23 file(s) clean (pattern /#[0-9]{3,}/g).
pnpm check:nul-bytes	0	OK (scanned 8064 text file(s) -- 8064 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
pnpm check:corpus-claim-drift	0	OK, no new claim sites beside a pinned spelling.
pnpm check:required-contexts	0	6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s).
node scripts/check-required-contexts.mjs	0	same sweep, direct invocation
pnpm check:agent-test-spelling	0	violating population empty, 9 separators judged and cleared on the rule
pnpm check:docs-audit-scope	0	docs-accuracy-audit scope is in sync with content/docs/: 190 hand-written doc(s)
pnpm check:pm-governed-merges	0	self-test 243 assertions; live: the real generator declared 9 output(s) and certified this tree

The family list was re-derived after the last edit, not taken from the dispatch:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands resolved its --repo assertion against this checkout's origin, derived the change set from git as 1 path (AGENTS.md, committed 1 / working tree 0 / untracked 0, three-dot against merge base fc648a256) and emitted 8 commands. All 8 ran; the two dispatch-named gates outside that union (check:nul-bytes, check:corpus-claim-drift) ran as well, so the set above is a superset.

ESLint

Not run repo-wide; narrowed, and the narrowing is a measurement rather than a skip:

1. Population, read from eslint.config.mjs and not guessed. Every files: selector in the config is a JS/TS extension glob (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and narrower variants; COMMENT_SWALLOW_FILES at :785 is that same glob). grep -cin 'markdown|[.]md' eslint.config.mjs returns 0 — no markdown processor, no .md selector anywhere. Confirmed through ESLint's own API: isPathIgnored('AGENTS.md') is true and calculateConfigForFile('AGENTS.md') yields no rules, against a positive control (eslint.config.mjs itself resolves 2 rules), so the API call is not vacuously quiet.
2. Count, from --format json.pnpm exec eslint AGENTS.md --no-inline-config --format json gives errorCount: 0, warningCount: 1, the one warning being ruleId: null / File ignored because no matching configuration was supplied — zero rule results, because the file is outside the population.
3. Invariance over untouched files. The config never enables type-aware linting for any file — no parserOptions.project, no typed rules, stated at eslint.config.mjs:325-332 with its own measured positive control. With no cross-file type program there is no mechanism by which an edit in one file moves a verdict on a file it does not touch, and this diff is one Markdown line in a file ESLint does not lint at all.

A full pnpm lint therefore measures the same nothing this narrowing measured.

Changeset

Labelled skip-changeset, route 2 of scripts/check-empty-changeset.mjs's own enumeration: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- delete the changeset and apply the 'skip-changeset' label". This diff is one line of the repo-root instruction file; no packages/** source is touched and nothing publishes from any package. Per that script, the label is a gate-level exemption that produces no input for changesets/action — the shape an empty-frontmatter changeset would have broken.

Landing

Draft, and it stays draft — governed AGENTS.md, human merge is the review record. Not flipped ready, not queued, no auto-merge armed, no reviewers requested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727530243 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 97 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729340857 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 105 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[os-litant]

Fixes#14792

Post-task checklist item 6 in AGENTS.md told the author to hand-edit CHANGELOG.md. That file is generated output. This drops the CHANGELOG.md half of the line and keeps ROADMAP.md.

Before / after

AGENTS.md:1154

Before:

6. Update `CHANGELOG.md` / `ROADMAP.md` if user-facing or architectural.

After:

6. Update `ROADMAP.md` if user-facing or architectural.

Why

The same file says the opposite about CHANGELOG.md thirty-four lines above. At AGENTS.md:1120, inside checklist item 3, the changeset rule states that the changeset body "ships to consumers as CHANGELOG.md inside the npm package and is what an upgrading agent greps after the tombstone error". That makes CHANGELOG.md the output — written by the changesets release step from the .changeset/*.md entries item 3 already requires.

Item 6 treated the same file as an input. A contributor who obeyed it either hand-edited a generated artifact that the next Version Packages run overwrites or collides with, or read the two lines together and concluded the file contradicts itself on its most-traversed workflow. Nothing is lost by the trim: the changeset obligation is item 3, and it is unchanged here.

Neither reading of the name survives, which is what makes the trim safe rather than a judgement call. Item 6 could have meant the per-package CHANGELOG.md files or the repo-root one, so both were checked:

• The per-package files are generated. packages/core/CHANGELOG.md and its siblings carry changeset-emitted release sections keyed by commit hash.
• The root CHANGELOG.md disclaims hand-editing in its own header: the update history "is maintained in three layers rather than by hand-editing this file" — per-package detail "generated by [changesets] from the .changeset/ entries every PR adds", the curated per-major pages under content/docs/releases/, and this file "retained for its historical entries."

So there is no CHANGELOG.md in this repo that item 6 could have legitimately directed a PR author to update by hand.

ROADMAP.md is untouched and not in question, and the surviving half is not vacuous: the file exists at the repo root and its history shows real hand edits. This PR makes no claim about whether that obligation should stand.

Arithmetic

AGENTS.md is at its line-ratchet ceiling, so the edit adds no line and re-wraps nothing.

Measure	Before	After
Lines (wc -l)	1,162	1,162
Ratchet ceiling / headroom	1,162 / 0	1,162 / 0
Bytes (wc -c)	85,106	85,089 (-17)
The edited line	72 bytes	55 bytes (-17)
Widest table row	1,081 (pin 1,081)	1,081 (pin 1,081)
grep -c 'CHANGELOG.md' AGENTS.md	2 (:1120, :1154)	1 (:1120 only)

Byte-negative on one line, so nothing is paid same-file. git diff --stat is 1 file changed, 1 insertion(+), 1 deletion(-).

Scope held

Untouched, deliberately: the ROADMAP.md half of item 6, checklist item 3, and the changeset section at :1116-1122 — that region is being corrected by PR #14789, and a second PR editing it would be a merge conflict on a governed file for no gain. The hunk here at :1154 is disjoint from that one.

One argument recorded for the merging maintainer rather than acted on: a reading exists under which item 6 should be deleted outright rather than trimmed, on the grounds that ROADMAP.md updates are not obviously a per-PR obligation either. That is a scope decision, not this card's, so the line is trimmed as ruled and the argument is left here.

Gates

All run at head 9596a42386, exit codes captured by redirect before any pipe; each verdict below is the gate's own printed line.

Command	Exit	Verdict
pnpm check:pm-skill-ratchet	0	AGENTS.md is 1162 lines (ceiling 1162; headroom 0). · AGENTS.md: widest table row is 1081 bytes (pin 1081; headroom 0). · self-test 111 cases pass
pnpm check:pm-governed-prose	0	2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.
pnpm check:pm-skill-id-lint	0	23 file(s) clean (pattern /#[0-9]{3,}/g).
pnpm check:nul-bytes	0	OK (scanned 8064 text file(s) -- 8064 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
pnpm check:corpus-claim-drift	0	OK, no new claim sites beside a pinned spelling.
pnpm check:required-contexts	0	6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s).
node scripts/check-required-contexts.mjs	0	same sweep, direct invocation
pnpm check:agent-test-spelling	0	violating population empty, 9 separators judged and cleared on the rule
pnpm check:docs-audit-scope	0	docs-accuracy-audit scope is in sync with content/docs/: 190 hand-written doc(s)
pnpm check:pm-governed-merges	0	self-test 243 assertions; live: the real generator declared 9 output(s) and certified this tree

The family list was re-derived after the last edit, not taken from the dispatch:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands resolved its --repo assertion against this checkout's origin, derived the change set from git as 1 path (AGENTS.md, committed 1 / working tree 0 / untracked 0, three-dot against merge base fc648a256) and emitted 8 commands. All 8 ran; the two dispatch-named gates outside that union (check:nul-bytes, check:corpus-claim-drift) ran as well, so the set above is a superset.

ESLint

Not run repo-wide; narrowed, and the narrowing is a measurement rather than a skip:

1. Population, read from eslint.config.mjs and not guessed. Every files: selector in the config is a JS/TS extension glob (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and narrower variants; COMMENT_SWALLOW_FILES at :785 is that same glob). grep -cin 'markdown|[.]md' eslint.config.mjs returns 0 — no markdown processor, no .md selector anywhere. Confirmed through ESLint's own API: isPathIgnored('AGENTS.md') is true and calculateConfigForFile('AGENTS.md') yields no rules, against a positive control (eslint.config.mjs itself resolves 2 rules), so the API call is not vacuously quiet.
2. Count, from --format json.pnpm exec eslint AGENTS.md --no-inline-config --format json gives errorCount: 0, warningCount: 1, the one warning being ruleId: null / File ignored because no matching configuration was supplied — zero rule results, because the file is outside the population.
3. Invariance over untouched files. The config never enables type-aware linting for any file — no parserOptions.project, no typed rules, stated at eslint.config.mjs:325-332 with its own measured positive control. With no cross-file type program there is no mechanism by which an edit in one file moves a verdict on a file it does not touch, and this diff is one Markdown line in a file ESLint does not lint at all.

A full pnpm lint therefore measures the same nothing this narrowing measured.

Changeset

Labelled skip-changeset, route 2 of scripts/check-empty-changeset.mjs's own enumeration: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- delete the changeset and apply the 'skip-changeset' label". This diff is one line of the repo-root instruction file; no packages/** source is touched and nothing publishes from any package. Per that script, the label is a gate-level exemption that produces no input for changesets/action — the shape an empty-frontmatter changeset would have broken.

Landing

Draft, and it stays draft — governed AGENTS.md, human merge is the review record. Not flipped ready, not queued, no auto-merge armed, no reviewers requested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727530243 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 97 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729340857 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 105 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[os-litant]

Fixes#14792

Post-task checklist item 6 in AGENTS.md told the author to hand-edit CHANGELOG.md. That file is generated output. This drops the CHANGELOG.md half of the line and keeps ROADMAP.md.

Before / after

AGENTS.md:1154

Before:

6. Update `CHANGELOG.md` / `ROADMAP.md` if user-facing or architectural.

After:

6. Update `ROADMAP.md` if user-facing or architectural.

Why

The same file says the opposite about CHANGELOG.md thirty-four lines above. At AGENTS.md:1120, inside checklist item 3, the changeset rule states that the changeset body "ships to consumers as CHANGELOG.md inside the npm package and is what an upgrading agent greps after the tombstone error". That makes CHANGELOG.md the output — written by the changesets release step from the .changeset/*.md entries item 3 already requires.

Item 6 treated the same file as an input. A contributor who obeyed it either hand-edited a generated artifact that the next Version Packages run overwrites or collides with, or read the two lines together and concluded the file contradicts itself on its most-traversed workflow. Nothing is lost by the trim: the changeset obligation is item 3, and it is unchanged here.

Neither reading of the name survives, which is what makes the trim safe rather than a judgement call. Item 6 could have meant the per-package CHANGELOG.md files or the repo-root one, so both were checked:

• The per-package files are generated. packages/core/CHANGELOG.md and its siblings carry changeset-emitted release sections keyed by commit hash.
• The root CHANGELOG.md disclaims hand-editing in its own header: the update history "is maintained in three layers rather than by hand-editing this file" — per-package detail "generated by [changesets] from the .changeset/ entries every PR adds", the curated per-major pages under content/docs/releases/, and this file "retained for its historical entries."

So there is no CHANGELOG.md in this repo that item 6 could have legitimately directed a PR author to update by hand.

ROADMAP.md is untouched and not in question, and the surviving half is not vacuous: the file exists at the repo root and its history shows real hand edits. This PR makes no claim about whether that obligation should stand.

Arithmetic

AGENTS.md is at its line-ratchet ceiling, so the edit adds no line and re-wraps nothing.

Measure	Before	After
Lines (wc -l)	1,162	1,162
Ratchet ceiling / headroom	1,162 / 0	1,162 / 0
Bytes (wc -c)	85,106	85,089 (-17)
The edited line	72 bytes	55 bytes (-17)
Widest table row	1,081 (pin 1,081)	1,081 (pin 1,081)
grep -c 'CHANGELOG.md' AGENTS.md	2 (:1120, :1154)	1 (:1120 only)

Byte-negative on one line, so nothing is paid same-file. git diff --stat is 1 file changed, 1 insertion(+), 1 deletion(-).

Scope held

Untouched, deliberately: the ROADMAP.md half of item 6, checklist item 3, and the changeset section at :1116-1122 — that region is being corrected by PR #14789, and a second PR editing it would be a merge conflict on a governed file for no gain. The hunk here at :1154 is disjoint from that one.

One argument recorded for the merging maintainer rather than acted on: a reading exists under which item 6 should be deleted outright rather than trimmed, on the grounds that ROADMAP.md updates are not obviously a per-PR obligation either. That is a scope decision, not this card's, so the line is trimmed as ruled and the argument is left here.

Gates

All run at head 9596a42386, exit codes captured by redirect before any pipe; each verdict below is the gate's own printed line.

Command	Exit	Verdict
pnpm check:pm-skill-ratchet	0	AGENTS.md is 1162 lines (ceiling 1162; headroom 0). · AGENTS.md: widest table row is 1081 bytes (pin 1081; headroom 0). · self-test 111 cases pass
pnpm check:pm-governed-prose	0	2 instruction surface(s) name all 5 registered governed surfaces (docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md) and claim no others.
pnpm check:pm-skill-id-lint	0	23 file(s) clean (pattern /#[0-9]{3,}/g).
pnpm check:nul-bytes	0	OK (scanned 8064 text file(s) -- 8064 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
pnpm check:corpus-claim-drift	0	OK, no new claim sites beside a pinned spelling.
pnpm check:required-contexts	0	6 required context name(s) pinned across 2 workflow(s); 5 instruction surface(s) scanned against 2 retired name(s).
node scripts/check-required-contexts.mjs	0	same sweep, direct invocation
pnpm check:agent-test-spelling	0	violating population empty, 9 separators judged and cleared on the rule
pnpm check:docs-audit-scope	0	docs-accuracy-audit scope is in sync with content/docs/: 190 hand-written doc(s)
pnpm check:pm-governed-merges	0	self-test 243 assertions; live: the real generator declared 9 output(s) and certified this tree

The family list was re-derived after the last edit, not taken from the dispatch:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands resolved its --repo assertion against this checkout's origin, derived the change set from git as 1 path (AGENTS.md, committed 1 / working tree 0 / untracked 0, three-dot against merge base fc648a256) and emitted 8 commands. All 8 ran; the two dispatch-named gates outside that union (check:nul-bytes, check:corpus-claim-drift) ran as well, so the set above is a superset.

ESLint

Not run repo-wide; narrowed, and the narrowing is a measurement rather than a skip:

1. Population, read from eslint.config.mjs and not guessed. Every files: selector in the config is a JS/TS extension glob (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} and narrower variants; COMMENT_SWALLOW_FILES at :785 is that same glob). grep -cin 'markdown|[.]md' eslint.config.mjs returns 0 — no markdown processor, no .md selector anywhere. Confirmed through ESLint's own API: isPathIgnored('AGENTS.md') is true and calculateConfigForFile('AGENTS.md') yields no rules, against a positive control (eslint.config.mjs itself resolves 2 rules), so the API call is not vacuously quiet.
2. Count, from --format json.pnpm exec eslint AGENTS.md --no-inline-config --format json gives errorCount: 0, warningCount: 1, the one warning being ruleId: null / File ignored because no matching configuration was supplied — zero rule results, because the file is outside the population.
3. Invariance over untouched files. The config never enables type-aware linting for any file — no parserOptions.project, no typed rules, stated at eslint.config.mjs:325-332 with its own measured positive control. With no cross-file type program there is no mechanism by which an edit in one file moves a verdict on a file it does not touch, and this diff is one Markdown line in a file ESLint does not lint at all.

A full pnpm lint therefore measures the same nothing this narrowing measured.

Changeset

Labelled skip-changeset, route 2 of scripts/check-empty-changeset.mjs's own enumeration: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- delete the changeset and apply the 'skip-changeset' label". This diff is one line of the repo-root instruction file; no packages/** source is touched and nothing publishes from any package. Per that script, the label is a gate-level exemption that produces no input for changesets/action — the shape an empty-frontmatter changeset would have broken.

Landing

Draft, and it stays draft — governed AGENTS.md, human merge is the review record. Not flipped ready, not queued, no auto-merge armed, no reviewers requested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33727530243 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 5 条投机栈 ⇒ 5 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 97 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33729340857 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 31 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(driver-sql): give the seven unconditionally-live hooks an explicit 60_000 budget #14629、fix(metadata): drop the leftover boot-time debug probe from MetadataPlugin.init #14649、fix(rest): consult the bespoke structured arms before the declared-status passthrough, so both error doors answer one refusal with one body #14713、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、perf(datasource): size the primary SQL pool from OS_DATABASE_POOL_MAX #14776、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、tooling(pm): record 14 unrecorded REFUSE-WIDE gate families #14800、docs(agents): stop telling authors to hand-edit generated CHANGELOG.md #14802、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、docs(devx): re-aim two stale comments in cross-package-test-inputs.mjs #14807、fix(cli): make os explain flow teach a flow that actually parses #14809、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、docs(cli): stop naming the out-of-repo apps/objectos as serve.ts's in-repo host-config example #14812、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815、fix(lint): report a controlled_by_parent object whose security master is decided by field declaration order #14818），分属 3 条投机栈 ⇒ 3 次独立命中。汇总 issue：Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 105 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)