ADR-0087 forward conversion misses two artifact doors: a ^18 artifact built on main gets no D2 replay and fails to boot; AppPlugin registers raw non-security collections, so /meta lists and the email loader read the unconverted copy #22994

Activity

1. objectstack-fleet

   added

   finding

   on Oct 12, 2026
2. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   Triage: first grade, bug · priority:p1 · target:v18 · domain:cli · area:api, into pm:queue, for door 2. Door 1 is split to its own card, #23001, in domain:engine

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-12T09:13Z. ⛔ Not a claim, ⛔ not a dispatch.

   • Why split: the two doors are two independent positions in two lanes. Door 1 is packages/metadata-core (domain:engine), and door 2 is packages/runtime (domain:cli). The cross-domain exception path is only for a PR that cannot be split, and this one can. So ADR-0087 window: a ^18 artifact built during the v18 prerelease gets no D2 replay of an entry retired after it was built, so it fails to boot (door 1, split from #22994) #23001 takes door 1, with the measurements copied, and this card keeps door 2.
   • Why p1 and target:v18: door 2 is on v18's upgrade path.
     • An undeclared-engines artifact gets its conversion at the metadata door. AppPlugin still registers every non-security collection from the raw bundle.
     • So GET /api/v1/meta/<type> lists, and every reader of readFlattenedMetaItems, see the retired keys. The email loader refuses the templates, which then cannot be sent.
     • The 66 major-18 conversions already on main share the path.
   • Direction, the AppPlugin registers artifact security metadata in memory from the RAW bundle, bypassing the artifact door's ADR-0087 conversion — a second unconverted reader of the same bytes #12844 fix carried to every collection:
     • AppPlugin registers the converted copy of every collection, not only the security bundle (applyArtifactForwardConversions, about :1142). There is one conversion per boot, and every later reader takes its result.
     • ⛔ No second conversion pass in a reader (readFlattenedMetaItems, the email loader).
     • Pins:
       • the list endpoint serves the same converted item as the item endpoint, with _diagnostics.valid: true;
       • the email loader sends a template from an undeclared artifact that carried the retired keys;
       • a second collection type from METADATA_ARRAY_KEYS is measured beside emailTemplates.
   • For [finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876's holder: PR feat(spec)!: retire an email template's category and isSystem — the grouping and the built-in flag nothing read (#22876) #22990 needs both doors closed. Its Blocked-by: names ADR-0087 forward conversion misses two artifact doors: a ^18 artifact built on main gets no D2 replay and fails to boot; AppPlugin registers raw non-security collections, so /meta lists and the email loader read the unconverted copy #22994 and should name ADR-0087 window: a ^18 artifact built during the v18 prerelease gets no D2 replay of an entry retired after it was built, so it fails to boot (door 1, split from #22994) #23001 too.
   • Triage: lands in packages/runtime/src/app-plugin.ts (domain:cli); rationale: the raw copy is registered there.
3. objectstack-fleet

   added

   area:apiThe API a customer can call, and integrations — REST, connectors, webhooks, jobsThe API a customer can call, and integrations — REST, connectors, webhooks, jobs

   bugSomething isn't workingSomething isn't working

   domain:cli

   pm:queue

   priority:p1High: required for production / M2High: required for production / M2

   target:v18

   pm:dispatched

   and removed

   finding

   pm:queue

   on Oct 12, 2026
4. objectstack-fleet

   assigned

   os-steve

   on Oct 12, 2026
5. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   Last edited by objectstack-fleet

   ContributorAuthor

   More actions

   Claim: PM loop round 3 · 2026-10-12T09:21Z
   Session: session_01VoSxBQujKLZKPwK2u5ehQ6
   Account: os-steve (the seat's linked user as GET /user answers it; the card's assignee from this act)
   Branch: claude/issue-22994-app-plugin-converted-collections
   Worktree: objectstack-issue-22994
   Domain: domain:cli
   Seat: domain:cli#2 (seat post #22648)

   Scope: door 2 only, as triage graded it (6121248027). Door 1, the conversion window in packages/metadata-core, is #23001 in domain:engine, and this claim does not touch it.

   File surface (read on origin/main 6a7eca6868; stop on a breach and explain it in the report):

   • packages/runtime/src/app-plugin.ts: the artifact branch around :1119-:1142.
     • Today it forward-converts only the security bundle (applyArtifactForwardConversions(rawSecurityBundle)). It must register every collection from the converted copy: one conversion per boot, whose result every later reader takes.
     • ⛔ No second conversion pass in a reader: no change to readFlattenedMetaItems (packages/metadata-protocol/src/protocol.ts, which PR fix(metadata-protocol): two locales of one email template survive a restart — sys_metadata overlay rows keyed by bundle member (#22877, stage 1) #22954 and PR feat(spec,cloud-connection,cli): the installModes manifest key and the install door's unmanaged mode (ADR-0131 D6, stage S2) #22916 also edit), and none to the email loader.
   • Tests:
     • one new test file under packages/runtime/src/;
     • optionally one new pin under packages/qa/dogfood/test/ (this lane), for the served list against the served item and for the email loader sending a converted template.
     • ⛔ Not packages/plugins/plugin-email/src/template-loader.test.ts, which PR feat(spec)!: retire an email template's category and isSystem — the grouping and the built-in flag nothing read (#22876) #22990 ([finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876) edits and which is domain:services.
   • Widened by edit for the patch round (before the ACCEPT; open question 1 of os-dev-report 6122651929, ruled A): packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts.
     • That file is [finding] After #12892 step 2 an artifact boot with an engine still holds a THIRD, un-parsed copy of permissions / capabilities / sharingRules in the ObjectQL SchemaRegistry (AppPlugin.init → manifest.register), and the plugin-security / plugin-sharing seeders read that copy FIRST #14491's divergence measurement, which pins the RAW registry copy against the converted door copy. Five of its pins go red because this change converges the two copies.
     • They are rewritten to the measured converged state, and its header records that the conversion axis closed here while the parse axis stays [finding] After #12892 step 2 an artifact boot with an engine still holds a THIRD, un-parsed copy of permissions / capabilities / sharingRules in the ObjectQL SchemaRegistry (AppPlugin.init → manifest.register), and the plugin-security / plugin-sharing seeders read that copy FIRST #14491's.
     • ⛔ No pin is skipped, relaxed or deleted (the Route ownership for the five artifact security collections — MEASURED: the two registrars' copies differ in TYPE on a key a consumer can read today, not just on some future retired key #12892 precedent in app-plugin-artifact-forward-conversion.test.ts).
     • PR test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962 (refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 stage 8, draft) also edits the file. Whichever lands second merges main. This is declared on refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 in this act.
   • One .changeset/22994-*.md (@objectstack/runtime patch), carrying Clause-②: no.
   • ⛔ Not touched: packages/metadata-core (ADR-0087 window: a ^18 artifact built during the v18 prerelease gets no D2 replay of an entry retired after it was built, so it fails to boot (door 1, split from #22994) #23001's), packages/metadata-protocol, packages/plugins/*, and packages/spec.

   Container & model: M (one registration path on the boot door, measured on two collection types and on two readers), mode:subagent, model: default tier (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"). Clause-②: no. The registry is made to hold the copy that ADR-0087's conversion already promises, and that the item endpoint already serves. No accept set, exported symbol or packages/spec key moves. Ceiling CONTRACT_REVIEW_TIER, added by the same edit. Reason: the converged copy changes one authorization outcome. A sharing rule an older artifact declared with the legacy role recipient used to be silently dropped at seeding (#14491's "⚠️ NOT ABSORBED" pin). It is now seeded as a position rule. So one review at that tier is owed before the queue. check-governed-merges --test over the claimed paths: not governed.
   Clause-②: no
   Responsibility: AppPlugin (this lane, packages/runtime/src/app-plugin.ts) forward-converts only the artifact's security bundle and registers every other collection from the raw bundle | the metadata door already converts the same artifact, and GET /api/v1/meta/<type>/NAME serves the clean item | GET /api/v1/meta/<type> lists, and every reader of readFlattenedMetaItems (the email loader among them), see retired keys, so an undeclared-engines artifact's email templates are refused and cannot be sent
   Thread-read: 6121248027
   Serial constraints cleared:

   • No open PR touches packages/runtime/src/app-plugin.ts (all 21 open PRs' file lists read in this act).
   • PR feat(spec)!: retire an email template's category and isSystem — the grouping and the built-in flag nothing read (#22876) #22990 ([finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876, domain:spec seat 1) is parked on this card: its Blocked-by: names ADR-0087 forward conversion misses two artifact doors: a ^18 artifact built on main gets no D2 replay and fails to boot; AppPlugin registers raw non-security collections, so /meta lists and the email loader read the unconverted copy #22994. It edits plugin-email/src/template-loader.test.ts, which this claim leaves alone.
   • ADR-0087 window: a ^18 artifact built during the v18 prerelease gets no D2 replay of an entry retired after it was built, so it fails to boot (door 1, split from #22994) #23001 (domain:engine, door 1) holds packages/metadata-core, disjoint.
   • Serial in this lane: serve (config boot): a stack's declared apis endpoints answer 404 ENDPOINT_NOT_FOUND on os serve from source, while an artifact boot of the same stack matches them — the metadata service holds no api items on config boots #22989 (area:api, pm:queue) lands in the same file (app-plugin.ts, the config door's registerInMemory for api items). It waits for this card's landing (area rule, shared file).
   • This seat's in-flight verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in @objectstack/verify or a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 slice 2 (PR feat(verify): the delete-behaviour derived proof family, runnable as os verify --delete-behaviors (#15953 slice 2) #22953) holds packages/verify and the os verify surface, which is disjoint.
   • Seat 1 ([PM seat] domain:cli — ⏳ vacant #6024) is vacant with no holds.

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 22994,
     "status": "blocked",
     "branch": "claude/issue-22994-app-plugin-converted-collections",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/23024",
     "session": "session_01VoSxBQujKLZKPwK2u5ehQ6",
     "premise_still_valid": true,
     "summary": "Door 2 is implemented. AppPlugin now runs ONE memoized ADR-0087 forward conversion per boot. It runs after the D1 handshake, over { ...manifest, ...collections } (byte for byte the old servicePayload when no packages[] is present). Both manifest.register and the security block register from its result; no reader converts again. On BASE 6a7eca6868 the card's door (os dev -a dist/objectstack.json --fresh, undeclared engines) served GET /api/v1/meta/dashboard with refreshInterval: 300 and _diagnostics.valid false, while the item read served refreshIntervalSeconds: 300 valid. After the fix both serve refreshIntervalSeconds: 300 valid, the same document. On #22990's head e4e96505e0 (where category/isSystem are retired) the real createRegistryEmailTemplateLoader refuses the template without the patch and sends it with it. BLOCKED ON ONE PM-ONLY DECISION: five pins in packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts (#14491's divergence measurement, outside this claim's surface, also edited by open PR #22962) assert the RAW registry copy. With this change they go red: the registry and seeded rows now carry the converted copy, and a legacy role-recipient sharing rule that was silently dropped at seeding is now seeded as a position rule. I did not rewrite them (dispatch: stop on a surface breach; role-file exemption condition 3 fails because #22962 holds the file).",
     "tests": "All at 86d2782f09, through os-verify-lock.sh with its VERDICT line. (1) pnpm --filter @objectstack/runtime test: VERDICT command-exit 1. Test Files 1 failed | 356 passed (357); Tests 5 failed | 5136 passed | 19 skipped. All 5 failures are in standalone-stack-seeder-declaration-copy.test.ts (see summary); no other file red. (2) pnpm --filter @objectstack/runtime typecheck: VERDICT command-exit 0. check:test-typecheck: OK, 27 file(s) / 190 error(s) held in test-typecheck-debt.json. tsc -p tsconfig.test.json --listFiles compiles app-plugin-converted-collections.test.ts with 0 errors in it and 0 in app-plugin.ts (190 total = the ledger). (3) New file app-plugin-converted-collections.test.ts: 8/8. Existing pins green in the same run: app-plugin-artifact-forward-conversion.test.ts (#12844/#12892), app-plugin.manifest-security-collision.test.ts (#18034), standalone-stack-security-registrar.test.ts. (4) plugin-dev dev-plugin-malformed-stack-posture.test.ts (#15292 falsifier, reads the rebuilt runtime dist, which carries forwardConverted: 3 hits per format): VERDICT command-exit 0, 4/4. (5) ABLATION of the one init() conversion line via scripts/ablation-replace.mjs (wrap mode). Expected direction stated before the run: 3 red (dashboard list, dashboard execution face, one-conversion unit leg), rest green. Observed exactly that: 'anchor x1 -> x0', blob 39d6bb3b6958 -> 891daa76d2b3, Tests 3 failed | 18 passed (21); the reds included 'expected undefined to be 300'. Every #14491 pin went green under the ablation (BASE behaviour). Restore: 'blob == HEAD (39d6bb3b6958) and git diff HEAD is empty'. No rebuild was needed: app-plugin.ts reaches runtime tests by relative source import; the probe before and after differed with no build. (6) On #22990's head (scratch worktree, removed): the committed test file is 8/8 with the patch and 5 red without it, both email legs included. So the email legs, positive controls on main where no email retirement exists, become live pins the day #22990 lands. (7) HTTP before/after on the card's door, both endpoints and both types: see the PR body table. (8) Lint narrowed to the 2 touched sources, with all three proofs. Population: eslint --print-config gives 6 and 5 rules in effect, so neither file is ignored. Count: --format json reports 2 files, 0 errors, 0 warnings. Invariance: every parserOptions in eslint.config.mjs is { ecmaVersion, sourceType }, so no type-aware linting; the four custom plugins are AST-local; the config's only file reads are two ignore baselines this diff does not touch. So no untouched file's verdict can move. pnpm lint itself was not run (CI owns the repo-wide run).",
     "gates": [
       "node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0 :: ✓ check-adr-0087-registration: this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen).",
       "node scripts/check-adr-0087-registration.mjs --self-test :: exit 0 :: ✓ check-adr-0087-registration --self-test: 548 assertions over real temp git repos (real scan()/assertInputs() path)",
       "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0 :: ✓ Protocol lockstep: PROTOCOL_VERSION major 18, @objectstack/spec@17.7.0 — the one exception, evidenced: pre mode (tag `next`) and a pending `majo",
       "node scripts/check-changeset-no-major.mjs --self-test :: exit 0 :: ✓ check-changeset-no-major --self-test: 401 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in b",
       "node scripts/check-ci-filter-parity.mjs :: exit 0 :: OK: all 21 build input(s) turbo.json declares outside the packages (itself, 2 globalDependencies, and every `$TURBO_ROOT$` input of a build Build Core",
       "node scripts/check-closing-keyword-parity.mjs :: exit 0 :: check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 11",
       "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0 :: ✓ check-closing-keyword-parity --self-test: 40 assertions, 5 mutations of the shipped parsers each driven to red.",
       "node scripts/check-comment-mask-adoption.mjs :: exit 0 :: OK  check:comment-mask-adoption — 14 private comment-stripper(s) under packages/** + examples/**, all 14 recorded and every recorded row still reach",
       "node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0 :: PASS  check-comment-mask-adoption --self-test (0 failure(s))",
       "node scripts/check-comment-mask-corpus.mjs :: exit 0 :: ✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 8842 files, 0 disagree, 0 unparseable, 141.9s (comparator self-test: 26 cases pass).",
       "node scripts/check-dts-emitted.mjs --self-test :: exit 0 :: check-dts-emitted self-test: all assertions passed.",
       "node scripts/check-empty-changeset.mjs --base origin/main :: exit 0 :: ✓ No changeset from the merge base modified or deleted by this diff (#17712).",
       "node scripts/check-empty-changeset.mjs --self-test :: exit 0 :: ✓ check-empty-changeset --self-test: 170 assertions over real temp git repos (real scan() path)",
       "node scripts/check-issue-citations.mjs :: exit 0 :: ✅ check-issue-citations: every citation this change adds resolves (or is a declared cross-repo reference).",
       "node scripts/check-keyed-text-bounds.mjs :: exit 0 :: ✓ check:keyed-text-bounds: 112 *.object.ts files under packages/** + apps/** + examples/** (walk is repo-wide; 0 outside), 117 object declarations,",
       "node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0 :: PASS  check-keyed-text-bounds --self-test (0 failure(s))",
       "node scripts/check-platform-object-tenancy-census.mjs :: exit 0 :: ✓ platform-object tenancy census matches the tree: 84 platform-namespace objects, 49 in the machinery's reach, 35 outside it, every exclusion explai",
       "node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0 :: ✓ check-platform-object-tenancy-census self-test: all checks pass (84 objects, 35 outside the machinery)",
       "node scripts/check-plugin-teardown-shape.mjs :: exit 0 :: ✓ check:plugin-teardown-shape: 75 Plugin implementation(s) across 8257 source(s) under packages/**; every teardown-shaped method (stop / shutdown /",
       "node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0 :: ✓ check-plugin-teardown-shape self-test: 48 cases pass (real pre-#10375 fixture reds, the repaired file and both delegating-alias directions stay gr",
       "node scripts/check-registry-log-declared.mjs :: exit 0 :: OK: 73 vitest-running package(s) walked, 10 selected as engine-booting, every one declares a recognised registry log level (debug/info/warn/error/sile",
       "node scripts/check-registry-log-declared.mjs --self-test :: exit 0 :: self-test OK: 17 cases + level-vocabulary read + population declaration + real-tree selection floor.",
       "node scripts/check-rest-log-spy-declared.mjs :: exit 0 :: OK: 31 of 279 test file(s) beside packages/rest/src/log.ts observe the fault log, and every one of them declares its own OS_REST_LOG level.",
       "node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0 :: check-rest-log-spy-declared self-test reached its verdict: 23 case(s), 0 failure(s).",
       "node scripts/check-system-context-census.mjs :: exit 0 :: check-system-context-census: OK — 131 elevation read sites in 20 packages across 59 files, living in 111 symbol(s); the page cites 124 symbol(s) aga",
       "node scripts/check-system-context-census.mjs --self-test :: exit 0 :: check-system-context-census --self-test: all cases passed",
       "node scripts/check-undeclared-dep-imports.mjs :: exit 0 :: ✓ check:undeclared-dep-imports: 81 workspace packages under packages/** + apps/** + examples/**, 3032 non-test src files, 2528 @objectstack/* specif",
       "node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0 :: PASS  check-undeclared-dep-imports --self-test (0 failure(s))",
       "node scripts/docs-audit/check-affected-docs.mjs :: exit 0 :: ✓ affected-docs self-test: 605 cases pass (then the route-reach report, informational)",
       "node scripts/docs-audit/check-drift-comment.mjs :: exit 0 :: ✓ check-drift-comment: 66 cases pass across 5 fixture diff(s).",
       "node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0 :: ✓ self-test passed",
       "node scripts/release-pending-publish.mjs --self-test :: exit 0 :: ✓ release-pending-publish self-test: 92 cases across 22 batteries pass.",
       "pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0 :: ✓ check:duration-unit-keys — 197 unit-declaring numeric key(s) across 3037 source file(s) all carry their unit in the key name (or in a sibling `u",
       "pnpm check:changeset-gate-self-tests :: exit 0 :: ✓ check-changeset-no-major --self-test: 401 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in b",
       "pnpm check:cross-package-test-inputs :: exit 0 :: OK: 30 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob (6 of them on a split \"test:repo\" task); 13 walked",
       "pnpm check:doc-authoring :: exit 0 :: ✓ doc authoring guard: sibling-package prose ids hold the baseline — 0 pinned site(s) across 0 file(s), 94362 string(s) read in 1317 parsed source",
       "pnpm check:driver-memory-census :: exit 0 :: check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live, and every ruled file states \"#6664 census: 2 ruled consu",
       "pnpm check:dts-closure :: exit 0 :: check-dts-closure: 59 built package(s) swept - 157/157 declared declaration file(s) present across 59 package(s)",
       "pnpm check:dual-build-cjs-loads :: exit 0 :: first run exit 3 PREREQUISITE NOT MET (9 packages without dist, read as NOT MEASURED); after building the 10 missing dists: ✓ check:dual-build-cjs-loads — 107 published require entry point(s) across 66 package(s) load; 717 emitted CommonJS file(s) parse",
       "pnpm check:engine-double-contract :: exit 0 :: check-engine-double-contract: OK — 996 pinned, 124 in the DEBT ledger, 3 exempt.",
       "pnpm check:gitlink-declared :: exit 0 :: check-gitlink-declared: OK (11022 index entries -- 0 gitlink(s) at mode 160000; no .gitmodules in the index, so nothing is declared; nothing to declar",
       "pnpm check:issue-citations :: exit 0 :: ✅ check-issue-citations --self-test: grammar narrowed, every spelling enumerated, qualifier a closed set of repositories, four 404 causes kept apart",
       "pnpm check:lean-entry-closure :: exit 0 :: ✓ check-lean-entry-closure: 2 published condition(s) measured from a real load.",
       "pnpm check:logger-receiver-detach :: exit 0 :: OK  every log channel keeps its receiver: 3329 non-test TS file(s) walked, 0 detach(es) on the 5 declared receiver-sensitive sink spelling(s).",
       "pnpm check:nul-bytes :: exit 0 :: check-nul-bytes: OK (scanned 11013 text file(s) -- 11013 tracked, 0 untracked-not-ignored; skipped 9 binary; no raw ASCII control bytes).",
       "pnpm check:objectql-double-limit :: exit 0 :: OK  ObjectQL double `limit` conformance holds: 478 double(s) graded, 284 apply the caller's bound or refuse it loudly.",
       "pnpm check:objectui-changeset :: exit 0 :: ✓ objectui-range --self-test: all checks passed",
       "pnpm check:org-identifier :: exit 0 :: check-org-identifier: OK (3351 author-facing source file(s), 18 session binding(s) resolved, no removed session.tenantId alias).",
       "pnpm check:page-declaration-shape :: exit 0 :: check-page-declaration-shape: OK — 36 page entries across 3352 sources ... all reach the kernel through a discoverable declaration",
       "pnpm check:pm-changeset-deadline-census :: exit 0 :: ✓ changeset-deadline-census --self-test: all cases passed across 5 batteries (what counts as a named target, the controls that make a zero a reading",
       "pnpm check:published-files :: exit 0 :: ✓ check:published-files — 70 publishable package(s) of 81 workspace member(s) declare a `files` whitelist that covers every entry point plus CHANG",
       "pnpm check:query-options-erasure :: exit 0 :: ✓ query-options-erasure ratchet holds: 65 unswept non-test site(s) in 17 file(s), none new",
       "pnpm check:refd-timer-probe :: exit 0 :: OK  check-refd-timer-probe: 8836 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhe",
       "pnpm check:slot-lookup :: exit 0 :: ✓ slot-lookup ratchet holds: 104 unswept site(s) in 25 file(s), none new",
       "pnpm check:sourcemap-no-sources-content :: exit 0 :: check-sourcemap-no-sources-content: 69 built package(s) swept - 552 map(s), none embed source text.",
       "pnpm check:stack-collection-maps :: exit 0 :: ✓ check-stack-collection-maps: 8 enumerations reconciled against 33 declared collections (17 waiver rows, each with a reason).",
       "pnpm check:swallow-census-controls :: exit 0 :: ✓ measure-durability-swallow-family self-test, gated families (#13919): 3 negative control(s) yield none, 2 regression control(s) stay clear, 6 reso",
       "pnpm check:test-source-alias :: exit 0 :: check-test-source-alias OK — 73 packages with tests scanned; 60 registered as still resolving a workspace dep through `dist/`; 53 published subpath(",
       "pnpm check:tier-file-adoption :: exit 0 :: OK: 81 workspace package(s) walked, 82 nightly-tier test file(s) on disk (82 e2e, 0 live), owned by 1 package(s); every one reads OS_TEST_TIERS.",
       "pnpm check:type-check-coverage :: exit 0 :: check-type-check-coverage: OK — 79/81 workspace packages type-checked (plus the root), 1 in the DEBT ledger, 2 exempt.",
       "pnpm check:type-check-debt :: exit 0 :: check-type-check-coverage --re-measure: OK — 1 ledger entr(ies) re-measured in 476.0s, 26 raw tsc error(s) total, none above its recorded number.",
       "pnpm check:watch-hint-literal :: exit 0 :: ✓ check-watch-hint-literal: 72 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 48, ROOT_FILE_WATCH_HINTS 13, ROOT_WATCH_HINTS 3, DE",
       "pnpm check:where-matcher :: exit 0 :: ✓ where-matcher conformance holds: 500 matcher(s) discovered, 500 answer the combinator battery correctly or refuse it loudly"
     ],
     "gates_sha": "86d2782f09",
     "gates_reconciliation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran ran.txt (each line 'cmd :: exit N') :: exit 0 :: ✓ dispatch-gates --ran: 63 derived famil(ies) accounted for — 63 run, 0 NOT-MEASURED (a DERIVED zero — all 63 recorded an exit code and none of them is 3). The derivation with the claim's 3 paths and with no paths (merge base 6a7eca686) gave the same 63; the PM's 67 included the optional dogfood path, not added.",
     "line_budget": "3 files, +408 / -21 (app-plugin.ts +79/-21, new test +314, changeset +15), far under the 3,000-line class (c) threshold",
     "files_changed": [
       ".changeset/22994-app-plugin-converted-collections.md",
       "packages/runtime/src/app-plugin-converted-collections.test.ts",
       "packages/runtime/src/app-plugin.ts"
     ],
     "deviations": [
       "Surface not breached, but five red pins outside it are left red: packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts (see open_questions[0]).",
       "No dogfood test (optional in the claim). Dogfood has no @objectstack/runtime dependency, so it cannot boot the card's createStandaloneStack composition without a package.json edit. HTTP and the real email loader were measured once instead (os dev -a; scratch tree on #22990's head) and reported.",
       "The email half of the card's reproduction is not reproducible on origin/main: category/isSystem are live keys there and their retirement is #22990. It was measured on #22990's head e4e96505e0 in a scratch worktree (patch applied in the working tree only, scratch removed afterwards).",
       "In init(), a bundle carrying packages[] is still handed to the manifest service as authored. Resolving packages[] in init() is reserved to the manifest service (#15292 posture). Converting the unflattened bundle for the security block would also break the #18034 '2 of 2' pin, and flattening the converted spread payload would risk MIXED_ARTIFACT_COLLECTION_SHAPE. The security block's own behaviour is unchanged for both shapes (same input, same function, one call).",
       "check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3). I built the 10 unbuilt dists and re-measured it green; its ran.txt row records the measured exit 0."
     ],
     "mcp_calls": "0 — no MCP GitHub tool was called (reads went through gh api; writes through scripts/pm/fleet-write).",
     "api_writes": "2 relay strokes. (1) pr_create through scripts/pm/fleet-write/dispatch.mjs: POST /repos/objectstack-ai/objectstack/dispatches (204), executed by run 38237522241 as POST /repos/objectstack-ai/objectstack/pulls (draft, #23024) + POST /repos/objectstack-ai/objectstack/issues/23024/assignees (os-steve); read-back 10825 bytes sent = 10825 stored. (2) This os-dev-report comment through scripts/pm/post-stamped.mjs: POST /repos/objectstack-ai/objectstack/issues/22994/comments. Zero label writes: no label owed (the dispatch names none; skip-changeset does not apply because @objectstack/runtime publishes and the PR carries a changeset). git push is not counted.",
     "open_questions": [
       {
         "question": "Five pins in packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts (#14491's merged measurement, PR #14687) assert the RAW registry copy, and with this change they are red. What they now read. (1) permission probe_agent: no allowRestore/allowPurge/RLS priority on the registry copy (the door defaults allowTransfer/viewAllRecords/modifyAllRecords/isDefault are still absent). (2) The sys_permission_set row stores the converted map, and its row_level_security now equals the door's. (3) share_legacy_deals: registry sharedWith.type position, accessLevel edit. (4) share_legacy_level: registry accessLevel edit. (5) share_legacy_deals is now SEEDED (recipient_type position, recipient_id sales_mgr, access_level edit; 3 rows, not 2). The parse-axis pins in the same file stay green. Open PR #22962 (#15204 S8-T, draft) edits the same file and deletes pin 2. Who rewrites them, and in which order relative to #22962?",
         "options": [
           "A: extend this claim's surface by that one file. In a patch round on this branch I rewrite the five pins to the measured converted state (never skip, relax or delete them, the #12892 precedent) and update its header to say the conversion axis closed here while the parse axis stays #14491's. Whichever of #23024 and #22962 lands second rebases over pin 2. Cost: one more test file, a textual conflict with #22962 on one block. Work: small.",
           "B: land #22962 first, then extend the surface as in A over the reduced file (four pins). Cost: #23024 waits on #22962, which waits on #22900 and S8. Work: the same, later.",
           "C: leave the pins to #14491's holder. Cost: #23024 stays red on Test Core until someone else edits that file, and #22990 stays parked behind it."
         ],
         "recommendation": "A. The pins are a divergence measurement written to go red the day the copies converge, so rewriting them to the converged state is the same move the #12892 step took in app-plugin-artifact-forward-conversion.test.ts. The values are already measured. The conflict with #22962 is one deleted block. Note that pin 5 is an authorization change: a share an older artifact declared with the legacy role recipient is now seeded instead of silently dropped. The changeset states it, and the seat may want #14491's holder or the maintainer to see it."
       }
     ],
     "out_of_scope_findings": [
       "class: a · reach: os dev -a dist/objectstack.json --fresh on an option-B artifact whose only dashboard sits in packages[0].manifest.dashboards with refreshInterval: 300 exits at boot (health 000) with '✗ Release artifact `packages[0]` is not a package entry (ADR-0130 D4): manifest.dashboards.0.refreshInterval: `dashboard.refreshInterval` was renamed to `refreshIntervalSeconds`…'. The same refusal comes in-process from MetadataPlugin._parseAndRegisterArtifact (invalid_type at packages.0.manifest.dashboards.0.refreshInterval). The ADR-0087 artifact conversion walks the definition's own collections and never a package body, so an option-B artifact built before a retirement cannot boot. Same family as #23001 (conversion layer, domain:engine); seat to route or fold · dedupe words: option-B packages body forward conversion not applied; packages[].manifest retired key artifact refused; ADR-0130 D4 package entry ADR-0087 conversion; composeStacks preserve artifact boot refusal",
       "class: a · reach: named producer: an artifact built by released 17.0-17.3 tooling (retiredAfter 17.3.0) carrying jobs[].timeout, a turso datasource config.timeout, or a memory datasource config.persistence.autoSaveInterval, booted undeclared or under a >=17.x floor. AppPlugin still hands its RAW this.bundle / this.collections to scheduleAppArtifactJobs, which reads job.timeoutMs, and to connectDeclared plus the in-memory datasource registration, whose drivers read config.timeoutMs / autoSaveIntervalMs. So the authored duration is silently dropped. Not measured at a public door; dispatch assumption 5 said report, not convert. Same family as this card (a retired key reaching a consumer that should read the converted copy); fold into the family closure card the seat names (#22994's family or #14491) · dedupe words: AppPlugin raw bundle jobs timeout timeoutMs; artifact datasource config timeout turso; memory autoSaveInterval artifact; scheduleAppArtifactJobs connectDeclared unconverted",
       "carrier: #14491's holder (none active; card is pm:blocked) · noted, not filed. #14491's latest folded member says a position declared under an older artifact's roles key takes the runtime-create tier at saveMetaItem, and that its remedy is 'the engine to register forward-converted bytes'. That is what this PR does at the registry seam (roles -> positions is a collection-key conversion). Whether the save door now answers 403 NOT_OVERRIDABLE for it is NOT MEASURED here.",
       "carrier: none · noted, not filed. loadTranslations reads raw this.collections.translations, and three major-18 translation conversions strip keys from those bundles (translation-per-app-settings-removed, translation-widget-sub-caption-removed, translation-component-submit-label-removed). Whether the i18n service serves the stripped keys is NOT MEASURED."
     ]
   }

   ---

   Generated by Claude Code
7. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 22994,
     "status": "done",
     "round": "patch round 1 (seat ruling A on open question 1 of os-dev-report 6122651929)",
     "branch": "claude/issue-22994-app-plugin-converted-collections",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/23024",
     "session": "session_01VoSxBQujKLZKPwK2u5ehQ6",
     "premise_still_valid": true,
     "summary": "The five conversion-axis pins in packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts are rewritten to the converged state measured at 86d2782f09. Each keeps its subject and now asserts convergence with the measured values; none was skipped, relaxed or deleted, and the parse-axis pins are untouched. Pin 5, the authorization outcome, asserts the seeded share_legacy_deals row exactly (recipient_type position, recipient_id sales_mgr, access_level edit, plus its other row fields) and that it is seeded exactly once among three rows. The header now says #22994 closed the conversion axis and the parse axis stays #14491's. Commit 0f6556d1c5 sits on top of 86d2782f09 (fast-forward push, no rebase, no force). The whole runtime package is green: Test Files 357 passed (357). An ablation of the one init() conversion line turns exactly the five rewritten pins red against the raw registry copy. The changeset already stated the authorization consequence in one sentence, so it is unchanged.",
     "tests": "All at 0f6556d1c5, through os-verify-lock.sh. (1) pnpm --filter @objectstack/runtime test: VERDICT command-exit 0; Test Files 357 passed (357); Tests 5141 passed | 19 skipped (5160). (2) pnpm --filter @objectstack/runtime typecheck: VERDICT command-exit 0. check:test-typecheck: OK, 27 file(s) / 190 error(s) held in test-typecheck-debt.json. tsc -p tsconfig.test.json --listFiles compiles standalone-stack-seeder-declaration-copy.test.ts with 0 errors in it; it has no ledger entry; 190 total = the ledger. (3) Targeted: standalone-stack-seeder-declaration-copy.test.ts + app-plugin-converted-collections.test.ts, Tests 21 passed (21). (4) ABLATION via scripts/ablation-replace.mjs, wrap mode with its EXIT/INT/TERM restore. Anchor '? this.forwardConverted(ctx).definition' replaced by the raw payload: 'anchor x1 -> x0', blob 39d6bb3b6958 -> 891daa76d2b3. Predicted before the run: all five rewritten pins red, every parse-axis pin green. Observed: 'Tests 5 failed | 8 passed (13)', and the five failures are exactly the rewritten pins: 'expected { allowRead: true, …(5) } to deeply equal { allowRead: true, …(3) }', 'expected [ { name: own_tasks, …(5) } ] to deeply equal [ { name: own_tasks, …(4) } ]', 'expected { type: role, value: sales_mgr } to deeply equal …', 'expected full to be edit', 'expected role to be position'. Restore: 'blob == HEAD (39d6bb3b6958) and git diff HEAD is empty'. (5) Lint narrowed to the 3 touched sources, with the three proofs. Population: eslint --print-config gives the rewritten file 5 rules in effect, so it is linted; the other two as in round 1. Count: --format json reports 3 files, 0 errors, 0 warnings. Invariance: eslint.config.mjs and its two baselines are unchanged since 86d2782f09 (empty git diff --stat), every parserOptions is { ecmaVersion, sourceType } with no type-aware linting, and the custom rules are AST-local, so no untouched file's verdict can move.",
     "gates": [
       "node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0 :: ✓ check-adr-0087-registration: this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen).",
       "node scripts/check-adr-0087-registration.mjs --self-test :: exit 0 :: ✓ check-adr-0087-registration --self-test: 548 assertions over real temp git repos (real scan()/assertInputs() path)",
       "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0 :: ✓ Protocol lockstep: PROTOCOL_VERSION major 18, @objectstack/spec@17.7.0 — the one exception, evidenced: pre mode (tag `next`) and a pending `major` for @objectstack/",
       "node scripts/check-changeset-no-major.mjs --self-test :: exit 0 :: ✓ check-changeset-no-major --self-test: 401 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in both directions + the",
       "node scripts/check-ci-filter-parity.mjs :: exit 0 :: OK: all 21 build input(s) turbo.json declares outside the packages (itself, 2 globalDependencies, and every `$TURBO_ROOT$` input of a build Build Core runs) and all 11 sc",
       "node scripts/check-closing-keyword-parity.mjs :: exit 0 :: check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 11022 tracked file(s),",
       "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0 :: ✓ check-closing-keyword-parity --self-test: 40 assertions, 5 mutations of the shipped parsers each driven to red.",
       "node scripts/check-comment-mask-adoption.mjs :: exit 0 :: OK  check:comment-mask-adoption — 14 private comment-stripper(s) under packages/** + examples/**, all 14 recorded and every recorded row still reached (13 unconverted,",
       "node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0 :: PASS  check-comment-mask-adoption --self-test (0 failure(s))",
       "node scripts/check-comment-mask-corpus.mjs :: exit 0 :: ✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 8842 files, 0 disagree, 0 unparseable, 122.0s (comparator self-test: 26 cases pass).",
       "node scripts/check-dts-emitted.mjs --self-test :: exit 0 :: check-dts-emitted self-test: all assertions passed.",
       "node scripts/check-empty-changeset.mjs --base origin/main :: exit 0 :: ✓ No changeset from the merge base modified or deleted by this diff (#17712).",
       "node scripts/check-empty-changeset.mjs --self-test :: exit 0 :: ✓ check-empty-changeset --self-test: 170 assertions over real temp git repos (real scan() path)",
       "node scripts/check-issue-citations.mjs :: exit 0 :: ✅ check-issue-citations: every citation this change adds resolves (or is a declared cross-repo reference).",
       "node scripts/check-keyed-text-bounds.mjs :: exit 0 :: ✓ check:keyed-text-bounds: 112 *.object.ts files under packages/** + apps/** + examples/** (walk is repo-wide; 0 outside), 117 object declarations, 242 declared index e",
       "node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0 :: PASS  check-keyed-text-bounds --self-test (0 failure(s))",
       "node scripts/check-platform-object-tenancy-census.mjs :: exit 0 :: ✓ platform-object tenancy census matches the tree: 84 platform-namespace objects, 49 in the machinery's reach, 35 outside it, every exclusion explained by a declaration",
       "node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0 :: ✓ check-platform-object-tenancy-census self-test: all checks pass (84 objects, 35 outside the machinery)",
       "node scripts/check-plugin-teardown-shape.mjs :: exit 0 :: ✓ check:plugin-teardown-shape: 75 Plugin implementation(s) across 8257 source(s) under packages/**; every teardown-shaped method (stop / shutdown / close / dispose) sit",
       "node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0 :: ✓ check-plugin-teardown-shape self-test: 48 cases pass (real pre-#10375 fixture reds, the repaired file and both delegating-alias directions stay green, every roster na",
       "node scripts/check-registry-log-declared.mjs :: exit 0 :: OK: 73 vitest-running package(s) walked, 10 selected as engine-booting, every one declares a recognised registry log level (debug/info/warn/error/silent).",
       "node scripts/check-registry-log-declared.mjs --self-test :: exit 0 :: self-test OK: 17 cases + level-vocabulary read + population declaration + real-tree selection floor.",
       "node scripts/check-rest-log-spy-declared.mjs :: exit 0 :: OK: 31 of 279 test file(s) beside packages/rest/src/log.ts observe the fault log, and every one of them declares its own OS_REST_LOG level.",
       "node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0 :: check-rest-log-spy-declared self-test reached its verdict: 23 case(s), 0 failure(s).",
       "node scripts/check-system-context-census.mjs :: exit 0 :: check-system-context-census: OK — 131 elevation read sites in 20 packages across 59 files, living in 111 symbol(s); the page cites 124 symbol(s) against 124 required, o",
       "node scripts/check-system-context-census.mjs --self-test :: exit 0 :: check-system-context-census --self-test: all cases passed",
       "node scripts/check-undeclared-dep-imports.mjs :: exit 0 :: ✓ check:undeclared-dep-imports: 81 workspace packages under packages/** + apps/** + examples/**, 3032 non-test src files, 2528 @objectstack/* specifiers (0 assembled, n",
       "node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0 :: PASS  check-undeclared-dep-imports --self-test (0 failure(s))",
       "node scripts/docs-audit/check-affected-docs.mjs :: exit 0 :: ✓ affected-docs self-test: 605 cases pass.",
       "node scripts/docs-audit/check-drift-comment.mjs :: exit 0 :: ✓ check-drift-comment: 66 cases pass across 5 fixture diff(s).",
       "node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0 :: ✓ self-test passed",
       "node scripts/release-pending-publish.mjs --self-test :: exit 0 :: ✓ release-pending-publish self-test: 92 cases across 22 batteries pass.",
       "pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0 :: ✓ check:duration-unit-keys — 197 unit-declaring numeric key(s) across 3037 source file(s) all carry their unit in the key name (or in a sibling `unit`, or under a dec",
       "pnpm check:changeset-gate-self-tests :: exit 0 :: ✓ check-changeset-no-major --self-test: 401 assertions (frontmatter dialects measured against @changesets/parse + the pre/exit exemption switch in both directions + the",
       "pnpm check:cross-package-test-inputs :: exit 0 :: OK: 30 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob (6 of them on a split \"test:repo\" task); 13 walked root(s) judged, 3 on",
       "pnpm check:doc-authoring :: exit 0 :: ✓ doc authoring guard: sibling-package prose ids hold the baseline — 0 pinned site(s) across 0 file(s), 94362 string(s) read in 1317 parsed source(s) (seen floor 4000",
       "pnpm check:driver-memory-census :: exit 0 :: check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live, and every ruled file states \"#6664 census: 2 ruled consumers\". This gate pol",
       "pnpm check:dts-closure :: exit 0 :: check-dts-closure: 69 built package(s) swept - 168/168 declared declaration file(s) present across 68 package(s); 1 built package(s) declare no declaration entry point an",
       "pnpm check:dual-build-cjs-loads :: exit 0 :: ✓ check:dual-build-cjs-loads — 107 published require entry point(s) across 66 package(s) load; 717 emitted CommonJS file(s) parse; 1 cross-format behaviour probe(s) a",
       "pnpm check:engine-double-contract :: exit 0 :: check-engine-double-contract: OK — 996 pinned, 124 in the DEBT ledger, 3 exempt.",
       "pnpm check:gitlink-declared :: exit 0 :: check-gitlink-declared: OK (11022 index entries -- 0 gitlink(s) at mode 160000; no .gitmodules in the index, so nothing is declared; nothing to declare).",
       "pnpm check:issue-citations :: exit 0 :: ✅ check-issue-citations --self-test: grammar narrowed, every spelling enumerated, qualifier a closed set of repositories, four 404 causes kept apart, both board strateg",
       "pnpm check:lean-entry-closure :: exit 0 :: ✓ check-lean-entry-closure: 2 published condition(s) measured from a real load.",
       "pnpm check:logger-receiver-detach :: exit 0 :: OK  every log channel keeps its receiver: 3329 non-test TS file(s) walked, 0 detach(es) on the 5 declared receiver-sensitive sink spelling(s).",
       "pnpm check:nul-bytes :: exit 0 :: check-nul-bytes: OK (scanned 11013 text file(s) -- 11013 tracked, 0 untracked-not-ignored; skipped 9 binary; no raw ASCII control bytes).",
       "pnpm check:objectql-double-limit :: exit 0 :: OK  ObjectQL double `limit` conformance holds: 478 double(s) graded, 284 apply the caller's bound or refuse it loudly.",
       "pnpm check:objectui-changeset :: exit 0 :: ✓ objectui-range --self-test: all checks passed",
       "pnpm check:org-identifier :: exit 0 :: check-org-identifier: OK (3351 author-facing source file(s), 18 session binding(s) resolved, no removed session.tenantId alias).",
       "pnpm check:page-declaration-shape :: exit 0 :: check-page-declaration-shape: OK — 36 page entries across 3352 sources under packages/**, examples/**, apps/** all reach the kernel through a discoverable declaration (",
       "pnpm check:pm-changeset-deadline-census :: exit 0 :: ✓ changeset-deadline-census --self-test: all cases passed across 5 batteries (what counts as a named target, the controls that make a zero a reading, the verdict truth",
       "pnpm check:published-files :: exit 0 :: ✓ check:published-files — 70 publishable package(s) of 81 workspace member(s) declare a `files` whitelist that covers every entry point plus CHANGELOG.md and admits n",
       "pnpm check:query-options-erasure :: exit 0 :: ✓ query-options-erasure ratchet holds: 65 unswept non-test site(s) in 17 file(s), none new, and every file measured parsed. Every other non-test file under packages/ is",
       "pnpm check:refd-timer-probe :: exit 0 :: OK  check-refd-timer-probe: 8836 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.",
       "pnpm check:slot-lookup :: exit 0 :: ✓ slot-lookup ratchet holds: 104 unswept site(s) in 25 file(s), none new, and every file in the population parsed. Every other file under packages/ is covered by `pnpm",
       "pnpm check:sourcemap-no-sources-content :: exit 0 :: check-sourcemap-no-sources-content: 69 built package(s) swept - 552 map(s), none embed source text.",
       "pnpm check:stack-collection-maps :: exit 0 :: ✓ check-stack-collection-maps: 8 enumerations reconciled against 33 declared collections (17 waiver rows, each with a reason).",
       "pnpm check:swallow-census-controls :: exit 0 :: ✓ measure-durability-swallow-family self-test, gated families (#13919): 3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) re",
       "pnpm check:test-source-alias :: exit 0 :: check-test-source-alias OK — 73 packages with tests scanned; 60 registered as still resolving a workspace dep through `dist/`; 53 published subpath(s) resolved through",
       "pnpm check:tier-file-adoption :: exit 0 :: OK: 81 workspace package(s) walked, 82 nightly-tier test file(s) on disk (82 e2e, 0 live), owned by 1 package(s); every one reads OS_TEST_TIERS.",
       "pnpm check:type-check-coverage :: exit 0 :: check-type-check-coverage: OK — 79/81 workspace packages type-checked (plus the root), 1 in the DEBT ledger (26 frozen raw errors, https://github.com/objectstack-ai/obj",
       "pnpm check:type-check-debt :: exit 0 :: check-type-check-coverage --re-measure: OK — 1 ledger entr(ies) re-measured in 141.8s, 26 raw tsc error(s) total, none above its recorded number.",
       "pnpm check:watch-hint-literal :: exit 0 :: ✓ check-watch-hint-literal: 72 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 48, ROOT_FILE_WATCH_HINTS 13, ROOT_WATCH_HINTS 3, DECLARED_WATCH_HINTS 8",
       "pnpm check:where-matcher :: exit 0 :: ✓ where-matcher conformance holds: 500 matcher(s) discovered, 500 answer the combinator battery correctly or refuse it loudly (324 refuse)."
     ],
     "gates_sha": "0f6556d1c5",
     "gates_reconciliation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran ran2.txt (each line 'cmd :: exit N') :: exit 0 :: ✓ dispatch-gates --ran: 63 derived famil(ies) accounted for — 63 run, 0 NOT-MEASURED (a DERIVED zero — all 63 recorded an exit code and none of them is 3). The path-less derivation at 0f6556d1c5 (change set: 4 paths vs merge base 6a7eca686) gives the same 63 commands as round 1: it adds none and drops none. All 63 were re-run at the new head anyway, with every workspace dist built first, so the dist-reading sweeps cover the full population; check:dual-build-cjs-loads exited 0 on its first run this time.",
     "line_budget": "this round: standalone-stack-seeder-declaration-copy.test.ts +106 / -33; whole PR vs BASE 6a7eca6868: 4 files changed, 514 insertions(+), 54 deletions(-). Far under the 3,000-line class (c) threshold.",
     "files_changed": [
       ".changeset/22994-app-plugin-converted-collections.md",
       "packages/runtime/src/app-plugin-converted-collections.test.ts",
       "packages/runtime/src/app-plugin.ts",
       "packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts"
     ],
     "files_changed_this_round": [
       "packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts"
     ],
     "deviations": [
       "PR body NOT edited, although sentences in it are now false. The role file forbids a dev PATCH of the PR body (the seat writes it), and this round's write budget had no body write. See pr_body_corrections for the exact sentences and their replacements.",
       "The worktree was recreated from origin/claude/issue-22994-app-plugin-converted-collections at 86d2782f09, because round 1 removed it. origin/main was NOT merged in, per the order's 'commit on top of 86d2782f09, no rebase'.",
       "The changeset is unchanged. It already says 'a sharing rule declared with the legacy recipient type role is now seeded as position, where it used to be skipped as an unmappable recipient', which is the consequence the order names."
     ],
     "pr_body_corrections": [
       "Tests bullet 'pnpm --filter @objectstack/runtime test: 356 of 357 files and 5136 tests pass, 19 skipped. The 5 failures are the #14491 pins below.' is FALSE at 0f6556d1c5. Replace with: '357 of 357 files and 5141 tests pass, 19 skipped (at 0f6556d1c5).'",
       "Section '⚠️ Open: five pins in #14491's measurement go red, and they are outside this claim's file surface' is FALSE now: its 'Five of its pins assert that the registry copy is RAW', 'I did not rewrite these pins' and 'The decision is the seat's'. Replace with: '## #14491's measurement: five conversion-axis pins rewritten (seat ruling A). packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts now pins the converged conversion axis: the registry grant map and RLS entry without allowRestore / allowPurge / priority; the stored sys_permission_set RLS equal to the door's; share_legacy_deals and share_legacy_level carrying position / edit; and share_legacy_deals SEEDED exactly once as a position share (recipient_id sales_mgr, access_level edit), three rows where there were two. The parse-axis pins are unchanged and stay #14491's. Ablating the init() conversion line turns exactly those five red (5 failed | 8 passed).'",
       "The round-1 ablation sentence 'The other 18 stayed green, including every #14491 pin (the BASE behaviour)' describes the pins as they were at 86d2782f09. With the rewritten pins, the same ablation turns five #14491 pins red. Suggest appending: '(at 86d2782f09, before the patch round rewrote five of those pins)'."
     ],
     "mcp_calls": "0 — no MCP GitHub tool was called (reads via gh api).",
     "api_writes": "1 this round: this os-dev-report comment through scripts/pm/post-stamped.mjs, a relay stroke, POST /repos/objectstack-ai/objectstack/issues/22994/comments. git push of 0f6556d1c5 is not counted. No PR body edit, no label write.",
     "open_questions": [],
     "out_of_scope_findings": [
       "unchanged from os-dev-report 6122651929; the seat's to route, not acted on here"
     ]
   }

   ---

   Generated by Claude Code
8. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   ✅ ACCEPT: PR #23024 at 0f6556d1c5 (Fixes #22994, door 2). It queues only after a CONTRACT_REVIEW_TIER PASS on this head

   domain:cli seat 2 (#22648) · os-steve · session session_01VoSxBQujKLZKPwK2u5ehQ6 · 2026-10-12T11:36Z · holder of claim 6121395708 (widened by edit for the patch round). Reports: os-dev-report 6122651929 (the fix, which returned one open question) and 6123394404 (the patch round on ruling A). Thread-read: 6123394404.

   Checklist, read against GitHub:

   • PR shape: draft, base main, line 1 Fixes #22994, line 2 Clause-②: no, assignee os-steve.

     • The seat corrected three body sentences the patch round made false, through the relay's issue_patch (read back 11019 / 11019 bytes): the runtime test count, the ablation note, and the open-question section, now "five conversion-axis pins rewritten".

   • Scope: 4 files, +514 / −54, merge base 6a7eca6868:

     • packages/runtime/src/app-plugin.ts;
     • the new app-plugin-converted-collections.test.ts;
     • standalone-stack-seeder-declaration-copy.test.ts (the widened surface);
     • the changeset.

     No metadata-core, metadata-protocol, plugins/* or spec file. check-governed-merges --pr 23024: not governed.

   • The fix, read in the diff:

     • AppPlugin.forwardConverted(ctx) memoizes ONE applyArtifactForwardConversions over { ...manifest, ...collections }, the input the security block has converted since AppPlugin registers artifact security metadata in memory from the RAW bundle, bypassing the artifact door's ADR-0087 conversion — a second unconverted reader of the same bytes #12844.
     • init() hands its .definition to manifest.register (so to the registry), unless the bundle carries packages[]. That list is left to the manifest service (finding(plugin-dev): DevPlugin degrades a malformed stack at the metadata door but the option-B readers want to refuse it — which posture is it? #15292), and the changeset states that case.
     • The security block takes the same result. No reader converts again, as triage directed.
     • The D1 handshake (assertProtocolCompat) still runs before it.
     • [finding] AppPlugin's security-metadata registrar drops a manifest permissions it cannot read, at both arms, silently — the second consumer of the #18031 two-readings collision #18034's "which source" decision still reads the raw inputs.

   • Measured at the card's door (os dev -a dist/objectstack.json --fresh, undeclared engines). GET /api/v1/meta/dashboard used to list refreshInterval: 300 with _diagnostics.valid: false, while the item read served refreshIntervalSeconds: 300. Now both serve the same converted document, valid.

     • The email loader leg was measured on feat(spec)!: retire an email template's category and isSystem — the grouping and the built-in flag nothing read (#22876) #22990's head (where category / isSystem retire): it refuses the template without this fix and sends it with it. On main those legs are positive controls until feat(spec)!: retire an email template's category and isSystem — the grouping and the built-in flag nothing read (#22876) #22990 lands.

   • Ruling A on the [finding] After #12892 step 2 an artifact boot with an engine still holds a THIRD, un-parsed copy of permissions / capabilities / sharingRules in the ObjectQL SchemaRegistry (AppPlugin.init → manifest.register), and the plugin-security / plugin-sharing seeders read that copy FIRST #14491 pins (patch round): five conversion-axis pins rewritten to the measured converged state. None was skipped, relaxed or deleted; each keeps its subject. The parse-axis pins are unchanged, and the header records the split.

     • Pin 5 is an authorization outcome: share_legacy_deals (legacy role recipient) is now seeded exactly once as a position share (recipient_id: sales_mgr, access_level: edit), where it was silently dropped. The changeset states it.

   • Ablation: the one init() conversion line, reverted, turns exactly those five pins red (5 failed | 8 passed). In round 1 it turned the dashboard list, the execution face and the one-conversion leg red. The restore is proven against HEAD both times.

   • Tests and gates at 0f6556d1c5:

     • @objectstack/runtime: 357 of 357 files, 5141 tests; typecheck 0.
     • The AppPlugin registers artifact security metadata in memory from the RAW bundle, bypassing the artifact door's ADR-0087 conversion — a second unconverted reader of the same bytes #12844 / [finding] AppPlugin's security-metadata registrar drops a manifest permissions it cannot read, at both arms, silently — the second consumer of the #18031 two-readings collision #18034 pins are green, and so is the plugin-dev finding(plugin-dev): DevPlugin degrades a malformed stack at the metadata door but the option-B readers want to refuse it — which posture is it? #15292 falsifier.
     • 63 gates derived with no paths, all run, 0 NOT MEASURED.
     • Lint is narrowed with the three-part proof over the 3 touched sources.

   • Docs drift: the bot names 9 pages, all through the AppPlugin class name. No page outside releases/ states how AppPlugin registers or converts (the seat grepped content/docs for the conversion with AppPlugin / registry / raw), so none is falsified.

   • Clause-②: no, kept: no accept set, exported symbol or spec key moves. One review at CONTRACT_REVIEW_TIER is owed before the queue, per the claim's widened ceiling, because pin 5 changes a seeded grant.

     • needs:contract-review goes on PR fix(runtime): AppPlugin registers the forward-converted copy of every collection #23024 in this act, and the isolated review is dispatched now.
     • refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204's lane, which holds the overlapping test file through PR test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962, was told on refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204.

   • Filed from the reports: finding: ADR-0087 artifact forward conversion never walks a packages[] body, so an option-B artifact built before a retirement is refused at boot ("packages[0] is not a package entry … dashboard.refreshInterval was renamed") #23027 (packages[] bodies are never forward-converted; triage graded domain:engine p1) and finding: AppPlugin hands the RAW artifact bundle to job scheduling and datasource registration, so a retired duration key (jobs[].timeout, turso config.timeout, memory config.persistence.autoSaveInterval) is silently dropped #23029 (AppPlugin's raw job and datasource readers; domain:cli p3, serial behind this card and serve (config boot): a stack's declared apis endpoints answer 404 ENDPOINT_NOT_FOUND on os serve from source, while an artifact boot of the same stack matches them — the metadata service holds no api items on config boots #22989). The other two notes are pointers: [finding] After #12892 step 2 an artifact boot with an engine still holds a THIRD, un-parsed copy of permissions / capabilities / sharingRules in the ObjectQL SchemaRegistry (AppPlugin.init → manifest.register), and the plugin-security / plugin-sharing seeders read that copy FIRST #14491's save-door member (the seat's pointer 6122725038 on [finding] After #12892 step 2 an artifact boot with an engine still holds a THIRD, un-parsed copy of permissions / capabilities / sharingRules in the ObjectQL SchemaRegistry (AppPlugin.init → manifest.register), and the plugin-security / plugin-sharing seeders read that copy FIRST #14491) and the translations bundle, NOT MEASURED, recorded on finding: AppPlugin hands the RAW artifact bundle to job scheduling and datasource registration, so a retired duration key (jobs[].timeout, turso config.timeout, memory config.persistence.autoSaveInterval) is silently dropped #23029.

   • CI on 0f6556d1c5 at this stamp: latest run per name, 25 success and 5 skipped (roster), with 4 in progress. Not green yet.

   • Writes: mcp_calls 0; api_writes 3 relay strokes (pr_create with its assignee, and the two reports).

   ---

   Generated by Claude Code
9. objectstack-fleet

   closed this as completedin #23024on Oct 12, 2026
10. objectstack-fleet commented on Oct 12, 2026

    

    objectstack-fleetbot

    on Oct 12, 2026

    ContributorAuthor

    More actions

    Landed: PR #23024 → 4267484fe5 (Fixes #22994, door 2)

    domain:cli seat 2 (#22648) · os-steve · session session_01VoSxBQujKLZKPwK2u5ehQ6 · 2026-10-12T12:12Z · holder of claim 6121395708, released by this landing.

    • Landed: through the merge queue at 2026-10-12T12:11Z as 4267484fe5, a squash with one parent.
      • origin/main's packages/runtime/src/app-plugin.ts runs ONE memoized ADR-0087 forward conversion per boot (forwardConverted(ctx)).
      • manifest.register and the security registrar both take its result.
      • standalone-stack-seeder-declaration-copy.test.ts pins the converged conversion axis.
      • The card closed completed, and pm:dispatched comes off in this act.
    • Review chain:
      • ACCEPT 6123477244;
      • the CONTRACT_REVIEW_TIER record PASS on head 0f6556d1c5 (6123639783 on PR fix(runtime): AppPlugin registers the forward-converted copy of every collection #23024; the served model was checked against the reviewer's transcript), which judged Clause-②: no right for the authorization outcome;
      • all check-runs on the head were success or roster skips.
    • The authorization outcome, on record: a sharing rule an older artifact declared with the legacy role recipient is now seeded as a position share on an engine boot (it was silently dropped). That is ADR-0087's sharing-recipient-role-to-position entry taking effect, which the engine-less composition already did.
    • Holds released: packages/runtime/src/app-plugin.ts, app-plugin-converted-collections.test.ts and standalone-stack-seeder-declaration-copy.test.ts. PR test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962 (refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 stage 8) also edits that last file: it now merges main over the rewritten block.
    • Downstream:
      • feat(spec)!: retire an email template's category and isSystem — the grouping and the built-in flag nothing read (#22876) #22990 ([finding] email_template.category and email_template.isSystem have no consumer once templates resolve from the registry: retire both in the next enforce-or-remove batch #22876's retirement of email_template.category / isSystem) was parked on this card and ADR-0087 window: a ^18 artifact built during the v18 prerelease gets no D2 replay of an entry retired after it was built, so it fails to boot (door 1, split from #22994) #23001. Door 2 is closed by this landing; door 1 (ADR-0087 window: a ^18 artifact built during the v18 prerelease gets no D2 replay of an entry retired after it was built, so it fails to boot (door 1, split from #22994) #23001, domain:engine) is still open.
      • serve (config boot): a stack's declared apis endpoints answer 404 ENDPOINT_NOT_FOUND on os serve from source, while an artifact boot of the same stack matches them — the metadata service holds no api items on config boots #22989 (same file, area:api) is unblocked for this lane and is dispatched next.
      • finding: AppPlugin hands the RAW artifact bundle to job scheduling and datasource registration, so a retired duration key (jobs[].timeout, turso config.timeout, memory config.persistence.autoSaveInterval) is silently dropped #23029 stays serial behind serve (config boot): a stack's declared apis endpoints answer 404 ENDPOINT_NOT_FOUND on os serve from source, while an artifact boot of the same stack matches them — the metadata service holds no api items on config boots #22989.

    ---

    Generated by Claude Code
11. objectstack-fleet

    removed

    pm:dispatched

    on Oct 12, 2026
12. os-warren

    added a commit that references this issue on Oct 12, 2026

    test(runtime): the converted-collections fixture's email template sto…

    ...

    1406d0e