[objectstack-fleet]

Requested by Sales · project thread

Part of #25467
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6270097840

Cut 2 of the protocol.ts split (#24586 ruling A, recorded in 6270097840). Cut 1 landed as #25494. The claim is 6370841668, amended in 6371139599 to the narrowed scope below, which the seat agreed before the amendment. One ObjectStackProtocolImplementation method body moves unedited into a new module, packages/metadata-protocol/src/protocol-meta-diagnostics.ts: getMetaDiagnostics, the sweep behind GET /api/v1/meta/diagnostics (216 lines at base, 26 of them from the last 30 days).

It is move-only, and the card stays open for the later cuts. Branch: claude/project-thread-uasfag, the harness-pinned branch for this session, restarted from origin/main at 5188e7f18f after cut 1 merged. It names no issue, so the claim comment is the identity record.

Serial with the file's in-flight PRs. At claim, none of the 12 open PRs touched protocol.ts (each PR's file list read; the Version Packages PR #24876 paged through all 395 files, which touch only CHANGELOG.md and package.json in this package). Re-measured at 17:54Z, just before this PR was opened, on all 13 open PRs: none touches protocol.ts; origin/main (fa06169c3c) has not touched this package since the base, and git merge-tree with it is clean.

Narrowed from the claim: getDiscovery stays

The claim named getDiscovery, listLiveMetadataTypes, getMetaDiagnostics and SERVICE_CONFIG. getDiscovery cannot move under the series' .d.ts bar, measured on a trial of the full claimed scope (not pushed):

• getDiscovery is public and its return type is inferred (async getDiscovery() {), so dist/index.d.ts prints the type the compiler infers for it.
• With the body moved in this series' shape, the stub's type is inferred from the new module, and the emitted .d.ts changed in two ways that are not union-member order. It dropped a property docblock (@deprecated Use name. Removed in protocol 18 (#4828).). It also spliced about 100 lines of an unrelated protocol.ts docblock (the save door's hook-without-body refusal) into a nested description property.
• Hashes: raw fc33e319… against base 8e1a224c…; normalised different from base's 5b98a8e8…, with a 111-line normalised diff. Under ruling 6348891160 that is a stop.
• On that trial the token proof and the package suite were clean; only the published surface moved.

listLiveMetadataTypes' body is barely longer than its stub would be, and SERVICE_CONFIG is read only by getDiscovery, so both stay with it.

Carry-forward for later cuts. A public member whose return type is inferred stays in protocol.ts in this series. Annotating its type would be a signature edit, and that needs a ruling. Measured on 5188e7f18f, these 15 public members declare no type, so later cuts skip them:

getDiscovery, getMetaTypes, getMetaItems, getMetaItemsForExecution, getMetaItem, getMetaItemForExecution, getUiView, findData, getData, validateData, createData, cloneData, updateData, deleteData, saveMetaItem.

The shape (#23050 shape B, as cut 1 applies it)

• The class keeps getMetaDiagnostics with its name, signature, docblock and position, because tsup emits members with their JSDoc into the .d.ts. Its body is now one host literal plus getMetaDiagnostics.call(host, request), marked [#25467 cut 2]. The method drops async and returns the moved function's promise.
• MetaDiagnosticsHost types every member as the class member itself (ObjectStackProtocolImplementation['m']). The moved function types its this as the Pick of the host over exactly the members its body reads (measured by AST), and the stub annotates its literal as ThisParameterType<typeof getMetaDiagnostics>. There is no cast, and no member becomes public or protected.
• The five members it reads go in as late-bound closures ((...a) => this.m(...a)), so a spy or double set on the instance is still the one the body reaches: getMetaItems, shippingPackagesOf, artifactLockLayerAt, servedLockState, isArtifactBacked. The body reads no field.

Module-level declarations.

• type ShippingPackages is also read by code that stays. It stays in protocol.ts and gains export in place, the only edit to it; the module imports it back as a type. src/index.ts exports from ./protocol.js by name, so it is not published (measured below).
• The module imports resolveItemLock (./item-lock.js), DEFAULT_METADATA_TYPE_REGISTRY and getMetadataTypeSchema (@objectstack/spec/kernel), and computeMetadataDiagnostics and type MetadataDiagnostics (./metadata-diagnostics.js), from the same specifiers protocol.ts uses.
• protocol.ts keeps all its imports, since each still has readers there. It gains one statement: the import of the new module.

The published .d.ts

Under the series bar (ruling 6348891160), measured on base 5188e7f18f and on the head. Both were built against the same dependency tree: turbo run build --filter=@objectstack/metadata-protocol... at base (13/13), then pnpm --filter @objectstack/metadata-protocol build at head.

• Raw sha256 of dist/index.d.ts and dist/index.d.cts: base 8e1a224c7d5a800c65c0174f9bc2245b70e0bab2106ab8dbf8a4b2dedd4ca35f (both files), head af5c30c9cb32b251f9a1b075e6347f372fe4be2561bee9c97731155b5d0a62a7 (both files).
• The raw diff is 2 lines, one swapped line: the services map's status union, "available" | "degraded" | "registered" | "unavailable" | "stub" at base and "registered" | "available" | "degraded" | "unavailable" | "stub" at head. That is a union-member order swap, the kind the ruling names.
• Normalised sha256, base and head (both files): 5b98a8e857554959f7561563d6a0742110c5d3d8ad6119065ed5a69b0bc06f95. The normaliser, run from packages/metadata-protocol:

node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]*"(?:\s*\|\s*"[^"\n]*")+/g,r=>r.split(/\s*\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum

• Positive control on a copy of the head dist/index.d.ts: line 1348, private engine;, made public (engine;), gives raw cbb86beef64be20057c3950401bc2d49d8cf9eefbcea52c02b59d47efa0e3baf and normalised f40390e5c426e0c6e24523cd6908726d3f3cab87f9a4ac36df20992bec04da95. Both differ from the real hashes.
• Export tables: the ESM and CJS bundles each export the same 78 names at base and head, loaded at runtime (import() and require of the built bundles). The sorted list hashes e47ac7c753bcb8bee1e79c1a5f79f7394cf030bd526de81ea8bcbfcb71fa024a on all four, as at cut 1.

No changeset: skip-changeset, per ruling 6348891160.

Proof of move-only

• Body, by AST token (recursive getChildren leaves): the moved function's parameters (less the added this), return type and body have the same token sequence as the base method, and each body line is the base line with four leading spaces removed; async matches. 626 tokens compared, 0 differ. Negative control: one changed token makes the check report a difference.
• Class side: the class has 298 members at base and head. The 297 that did not move are byte-identical to base. The stub keeps its docblock and signature byte-identical, less async.
• Top level of protocol.ts: 254 of the 255 base statements other than the class are byte-identical; the other is ShippingPackages, which gains export. The one new statement is the import of the new module.
• Size: +263 / -172 over 2 files. protocol.ts goes from 32,468 to 32,309 lines; protocol-meta-diagnostics.ts has 250.

Readers of the moved lines

None needed editing; each was read:

• ADR anchors. No paragraph of the protocol.ts entry in scripts/adr-anchors/ describes this body. The paragraphs cover ADR-0029 D9.8/D9.9 hydration seams, ADR-0119 batchData, ADR-0005/0087 view storage and ADR-0126 flow Regime C; getMetaDiagnostics calls getMetaItems, which stays. So no entry is added.
  • One decision letter in the body leaves the anchored surface: ADR-0110 D3, in the per-type catch.
  • check:adr-anchors: 82 → 82 anchored files; decision-letter citations on the anchored surface 1,979 → 1,978, measured at both ends.
• Platform checklist. docs/qa/platform-checklist/areas/studio-authoring.json anchors protocol.ts#getMetaDiagnostics. The method shell stays, so it still resolves; it is not edited, as cut 1 left protocol.ts#batchData. check-platform-checklist exits 0 at both ends with identical output.
• Bracketed-refusal pin. The moved text has no new Error(, so protocol.bracketed-refusal-opener-absence.test.ts's PRODUCERS floor for protocol.ts (5) is unaffected.
• Censuses and ledgers. No isSystem read: check-system-context-census shows 149 sites at both ends, identical output. No engine find/findOne/count/aggregate call, so the scripts/query-options-erasure-baseline.json count for protocol.ts is unaffected. No engine write: check-tenant-audit-census shows 238 sites at both ends, identical output, no --write. No engine-double contract seam.
• Source scans. The package's source scans that read ./protocol.ts (register-item, lookup-artifact-item and view-expansion-reconcile call-site pins, hydrate-overlay-canonical-type, object-registry-write-through-spelling, query-transport-dialect, read-verb-canonical-fold, the two recovery-door pins): none of their patterns occurs in the moved text, and all pass at head.
• Behaviour pins. The tests that call getMetaDiagnostics (diagnostics-store-outage, lock-one-resolution, lock-door-read-agree) pass at head.

Verification

• tsc --noEmit (package) exit 0; eslint on both source files exit 0.
• packages/metadata-protocol suite.
  • Base: 21,476 tests (21,457 passed, 0 failed, 19 skipped), 264 files.
  • Head: 21,476 (21,457 passed, 0 failed, 19 skipped), 264 files.
  • Compared per test name and status: none lost, none added, none changed status.
• Tests outside the package that read protocol.ts by path, run at head, all pass:
  • core row-serving-door-exposure.pin and second-object-read-exposure.pin (7)
  • objectql core-boundary.ratchet (2)
  • spec metadata-type-registry-allow-org-override-absence and scripts/liveness/evidence (44)
  • client and rest discovery-double-retired-key (3 + 2)
• Hand gates at base and head, all exit 0 at both: check-adr-symbol-anchors (2,384 anchors resolve at both, identical output), check-adr-anchors, check-tenant-audit-census, check-system-context-census, check-platform-checklist.
• Derived gates. dispatch-gates --commands --changed derives 51 gates; all 51 exit 0 and --ran reconciles 51 of 51 with 0 NOT-MEASURED, each run at head with its exit code. The full list and the --ran reconcile are in the report on this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J8pUyVs5eas1AjMdReJM7C

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 23 documentable anchor(s).

18 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json fa06169c3cfdb39d4b029963b20b5405e001e3d7.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fa06169c3cfdb39d4b029963b20b5405e001e3d7 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 411a906c7141ba4d4235f063ad4b9f23e9984f16 — the merge of head 9f403be528c4070bc4deb856a6320460dcac419e into base fa06169c3cfdb39d4b029963b20b5405e001e3d7, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 411a906c7141ba4d4235f063ad4b9f23e9984f16 && git checkout 411a906c7141ba4d4235f063ad4b9f23e9984f16
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fa06169c3cfdb39d4b029963b20b5405e001e3d7 9f403be528c4070bc4deb856a6320460dcac419e && git checkout -B drift-repro fa06169c3cfdb39d4b029963b20b5405e001e3d7 && git merge --no-ff 9f403be528c4070bc4deb856a6320460dcac419e

node scripts/docs-audit/affected-docs.mjs --json fa06169c3cfdb39d4b029963b20b5405e001e3d7

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fa06169c3cfdb39d4b029963b20b5405e001e3d7 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-uasfag",
"pr": "#25518",
"session": "session_01J8pUyVs5eas1AjMdReJM7C — this run's harness-stamped id, on the Claude-Session: trailer of the commit on the branch",
"premise_still_valid": true,
"summary": "Cut 2 of the protocol.ts split (#24586 ruling A, 6270097840; d.ts bar 6348891160). Claim 6370841668, amended 6371139599 to the narrowed scope the seat agreed: getMetaDiagnostics alone. Its body moved unedited to packages/metadata-protocol/src/protocol-meta-diagnostics.ts (host MetaDiagnosticsHost; members read getMetaItems, shippingPackagesOf, artifactLockLayerAt, servedLockState, isArtifactBacked, as late-bound closures; no field). Shape B as in cut 1: the method keeps name, signature, docblock and position less async. type ShippingPackages gained export in place (index.ts exports protocol.js by name, so it is not published). getDiscovery left the claimed scope: it is public with an inferred return type, and a trial move changed the published d.ts beyond union order (a property @deprecated docblock dropped, about 100 lines of an unrelated protocol.ts docblock spliced into a nested description property; normalised diff 111 lines); listLiveMetadataTypes and SERVICE_CONFIG stay with it. Carry-forward recorded in the PR body and the amendment: the 15 public members with no declared type stay in protocol.ts in this series (annotating one is a signature edit and needs a ruling). No path reader needed an edit; the platform-checklist anchor protocol.ts#getMetaDiagnostics still resolves on the method shell. One decision letter (ADR-0110 D3) leaves the anchored surface: 1,979 to 1,978. Serial rule: at claim none of 12 open PRs touched protocol.ts; at pr_create none of 13; at 18:29Z none of the other 9. No open question.",
"tests": "pnpm --filter @objectstack/metadata-protocol test (vitest run, JSON reporter) under os-verify-lock. Base 5188e7f: 21,476 tests (21,457 passed, 0 failed, 19 skipped), 264 files, 1,182 suites. Head 9f403be: the same counts. Compared per test name and status: 0 lost, 0 added, 0 changed. Move-only, so no ablation. Package tsc --noEmit exit 0; eslint on protocol.ts and protocol-meta-diagnostics.ts exit 0. Out-of-package tests that read protocol.ts by path, at head, all pass: core row-serving-door-exposure.pin and second-object-read-exposure.pin (7), objectql core-boundary.ratchet (2), spec metadata-type-registry-allow-org-override-absence and scripts/liveness/evidence (44), client and rest discovery-double-retired-key (3 + 2); spec check:liveness exit 0. Move proof: the moved function's parameters (less the added this), return type and body have the same TypeScript AST leaf-token sequence (recursive getChildren) as the base method, each body line is the base line minus four leading spaces, async matches; 626 tokens compared, 0 differ. Negative control: one changed token makes the check fail. Class: 298 members at base and head; the 297 that did not move byte-identical; the stub keeps docblock and signature byte-identical less async. Top level of protocol.ts: 254 of 255 base statements byte-identical, the other ShippingPackages (export added); one new statement, the module import. +263 / -172 over 2 files; protocol.ts 32,468 to 32,309 lines, the module 250. The getDiscovery trial (full claimed scope, not pushed) also passed its token proof (2,076 tokens) and the identical suite; only the published surface moved.",
"dts_block": {
"files": "packages/metadata-protocol dist/index.d.ts and dist/index.d.cts; base 5188e7f built with turbo run build --filter=@objectstack/metadata-protocol... (13/13), head 9f403be built with pnpm --filter @objectstack/metadata-protocol build against the same dependency tree",
"raw_sha256": "base index.d.ts and index.d.cts 8e1a224c7d5a800c65c0174f9bc2245b70e0bab2106ab8dbf8a4b2dedd4ca35f · head index.d.ts and index.d.cts af5c30c9cb32b251f9a1b075e6347f372fe4be2561bee9c97731155b5d0a62a7",
"normalised_sha256": "base 5b98a8e857554959f7561563d6a0742110c5d3d8ad6119065ed5a69b0bc06f95 · head 5b98a8e857554959f7561563d6a0742110c5d3d8ad6119065ed5a69b0bc06f95 (both files, both sides)",
"normaliser": "node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]"(?:\s\|\s*"[^"\n]")+/g,r=>r.split(/\s\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum",
"raw_diff_lines": 2,
"raw_diff": "one swapped line, line 2406: the services map status union, "available" | "degraded" | "registered" | "unavailable" | "stub" at base, "registered" | "available" | "degraded" | "unavailable" | "stub" at head; a union-member order swap, the kind ruling 6348891160 names. The normalised diff is empty.",
"positive_control": "head index.d.ts line 1348, private engine; made public (engine;): raw cbb86beef64be20057c3950401bc2d49d8cf9eefbcea52c02b59d47efa0e3baf, normalised f40390e5c426e0c6e24523cd6908726d3f3cab87f9a4ac36df20992bec04da95, both different from the real hashes.",
"exports": "ESM and CJS bundles loaded at runtime (import and require of the built bundles): 78 names each at base and head; sorted-list sha256 e47ac7c753bcb8bee1e79c1a5f79f7394cf030bd526de81ea8bcbfcb71fa024a on all four, as at cut 1.",
"note": "No changeset (skip-changeset), per 6348891160. getDiscovery trial for the record: head raw fc33e319fde8c54435d8822ef371f952e51ccfe7d0b8a6ea13e93a2f560b5ec9, normalised different from base, 111-line normalised diff; that is why it left the scope."
},
"adr_anchor_block": {
"gate": "node scripts/check-adr-symbol-anchors.mjs at base 5188e7f and head, exit 0 at both with identical output: 2,384 anchors across 142 records resolve.",
"adr_anchors": "pnpm check:adr-anchors exit 0 at base and head; anchored files 82 to 82; decision-letter citations on the anchored surface 1,979 to 1,978, measured at both ends. The one that leaves is ADR-0110 D3, in the per-type catch of the moved body. No entry added: no paragraph of the protocol.ts entry (ADR-0029 D9.8/D9.9 hydration seams, ADR-0119 batchData, ADR-0005/0087 view storage, ADR-0126 flow Regime C) describes this body; re-read for a half-paragraph match (the ADR-0126 paragraph's readFlattenedMetaItems is reached through getMetaItems, which stays)."
},
"gates": "Local on 9f403be: dispatch-gates --commands --changed derives 51 commands, each run with its exit captured; all 51 exit 0. --ran: 51 derived, 51 run, 0 NOT-MEASURED, 0 UNRUN (a derived zero). Run by hand, not derived, at base and head, all exit 0 at both: check-adr-symbol-anchors (identical output), check:adr-anchors (letters above), check-tenant-audit-census (238 write sites, identical output, no --write), check-system-context-census (149 elevation read sites, identical output), check-platform-checklist (identical output; the studio-authoring.json anchor protocol.ts#getMetaDiagnostics resolves on the shell, read and not edited, as cut 1 left protocol.ts#batchData). The moved text holds no new Error( (bracketed-refusal PRODUCERS floor for protocol.ts unaffected), no engine find/findOne/count/aggregate (erasure baseline unaffected), no engine write or engine-double seam, no isSystem read. Merge check: origin/main dc3e5b9 touched only protocol.meta-types-degenerate-derivation.test.ts in this package since the base; git merge-tree with this head is clean; PR mergeable_state clean. Serial re-check at 18:29Z: 10 open PRs, the Version Packages PR paged in full; none but this one touches protocol.ts. CI on head 9f403be: 46 check runs, 34 success, 12 skipped by their own filters, 0 failed or pending. Success: Auto Label, Build Core, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Regression Gate, filter, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Test Core, Test Core (1/6) to (6/6), The card this PR closes must claim this branch, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check. Skipped: 18.x upgrade harness (opt-in) x2, Auto Label (second run), Build Docs, Check Changeset (second run), Check PR Size (second run), Console Pin Gate, the sharded Dogfood Regression Gate matrix, Dogfood Verify CLI, Packed-tarball smoke (opt-in) x2, Temporal Conformance (live PG + MySQL).",
"docs_drift": "Advisory. Re-derived with node scripts/docs-audit/affected-docs.mjs --json 5188e7f on the head: 28 pages (18 hand-written, 10 release-owned) from 23 anchors, the same counts as the bot comment 6371331147. Every page is reached through a name the move relocated or a literal inside the moved body: INVALID_REQUEST and SERVICE_UNAVAILABLE in its comments (11 each), the routes and client methods bridged from getMetaItems and the diagnostics route (/forms/:slug 4, /book/:name/tree 3, meta.getDiagnostics, meta.getBookTree), and the member names the host interface lists. The method keeps its name, signature, docblock and behaviour and every literal moved unedited, so no page goes stale. No page reads the moved lines by path.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "No MCP write tool. GitHub reads through gh api GET (PR files for the serial checks, PR state, check runs, comments). Also claude-code-remote subscribe_pr_activity on #25518 (a session subscription, not a GitHub write).",
"api_writes": "6 strokes, all through the scripts/pm relay or git: (1) post-stamped claim comment 6370841668 on #25467 (relay run 39995612133); (2) post-stamped claim amendment 6371139599 on #25467 (relay run 39997769731); (3) git push of claude/project-thread-uasfag at 9f403be (new branch from 5188e7f; the merged cut 1 branch had been deleted by the queue); (4) fleet-write pr_create, PR #25518 draft with assignee os-sales and label skip-changeset (relay run 39998995858; body read back identical, 11,321 bytes); (5) fleet-write pr_request_reviewers os-sales (relay run 39999064752); (6) this report, via post-stamped.",
"open_questions": [],
"out_of_scope_findings": [
"The 15 public ObjectStackProtocolImplementation members with no declared return type (getDiscovery, getMetaTypes, getMetaItems, getMetaItemsForExecution, getMetaItem, getMetaItemForExecution, getUiView, findData, getData, validateData, createData, cloneData, updateData, deleteData, saveMetaItem) cannot move under the series bar: the d.ts re-infers their type from the new module and, on the getDiscovery trial, dropped and spliced docblocks. Moving one would need an explicit return annotation, a signature edit that needs a ruling. Recorded as a carry-forward in the PR body and the claim amendment; not acted on."
]
}

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-23T18:50Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25467 cut 2 (claim 6370841668, amended 6371139599 to getMetaDiagnostics alone; os-dev-report 6371997225) · reviewed head 9f403be528 · merge base 5188e7f18f

• Shape: getMetaDiagnostics moves unedited into protocol-meta-diagnostics.ts, using the same host pattern as cut 1. ShippingPackages gains export and nothing else. getDiscovery stays, because its return type is inferred. The 15 public inferred-return members are carried forward in the PR body. 2 files, +263 / −172.
• .d.ts, ruling 6348891160 item 1, re-run by the seat in its own worktree:
  • turbo run build --filter=@objectstack/metadata-protocol at 5188e7f18f and at this head.
  • Raw goes from 8e1a224c7d5a800c… to af5c30c9cb32b251… on both index.d.ts and index.d.cts. The raw diff is one line, line 2406: the services status string-literal union is emitted in a different member order. No member is added or removed.
  • Normalised: 5b98a8e857554959… at both ends. The series bar is sorted-union identity, so this cut meets it.
  • The seat's positive control makes head line 1348, private engine;, public. That moves both hashes, to raw cbb86beef64be200… and normalised f40390e5c426e0c6….
  • CJS exports: 78 at both ends.
• Gates re-run by the seat, all exit 0 at base and at head:
  • check-adr-symbol-anchors: byte-identical output.
  • check-tenant-audit-census: 238 sites.
  • check-system-context-census: 149 sites.
  • check-adr-anchors
  • check-dispatcher-error-vocabulary
  • check-platform-checklist
• Decision-letter count, read by the seat: 1979 at base and 1978 at head, with anchored files 82 at both. ADR-0110 D3 leaves with the body. No paragraph of the protocol.ts entry describes this body, so no entry is owed. Accepted as measured.
• Tests and gates (report): 626 AST tokens are identical, and a negative control exits 1. 297 of 298 class members are byte-identical. 21,476 tests give identical results per test at both ends. 51 of 51 derived gates exit 0.
• CI: 34 success and 12 expected skips, none failed or pending (46 runs).
• Mergeable: git merge-tree onto today's main (aa2dbab7b6) is clean. It is also clean pairwise against refactor(plugin-security): move the everyone anchor, the explanation, the sharing verdicts and the authored-row write verdict out of security-plugin.ts (#25223 cut 10) #25516, refactor(service-automation): move the Plugin Extension API bodies into plugin-extension-api.ts (#25222 slice 2) #25520 and feat(security): an external organization role — portal users read their own identity rows and reach data only through explicit grants #25515, and no other open PR touches protocol.ts.
• Body: the attribution header and the os-sales reviewer are in place. The footers are present.
• Declarations: refactor(metadata-protocol), Clause-②: no, Metadata-protocol: none, skip-changeset. No contract-review record or dogfood battery is owed.
• Landing: not governed (check-governed-merges --pr 25518: 435 lines). Ready + auto-merge through the relay. The card stays open and dispatched. The next cut is claimed afresh on the merged main.

---

Generated by Claude Code