fix(metadata-protocol)!: the save door refuses every hook with no body, including one with neither a body nor a handler (#21689)

[objectstack-fleet]

Fixes #21689
Clause-②: no (narrowing)

This carries out triage's ruling on #21689 (comment 5977077883, unlocked in 5977495602): one predicate. The metadata save door refuses any hook with no body, with a named error and the prescription "give it a body". The handler-only refusal that #21658 landed (PR #21686, ced217ca30) is now one case of it. HookSchema is untouched.

What changes

runtimeHookWithoutBodyRefusal in packages/metadata-protocol/src/protocol.ts keeps its name, its one call site in saveMetaItem and its one envelope. Its predicate widens from "a non-empty handler string and no body object" to "no body object". It is the same judgement install-local's collectHooksWithoutBody makes on its own door (hookCarriesBody in packages/runtime/src/app-artifact-handlers.ts).

• Envelope: VALIDATION_ERROR / 400, unchanged. No code is added and the ledger is not edited.
• When and where: unchanged from The metadata save door answers 200 to a hook with a handler name and no body, which the runtime then refuses at bind: a runtime-authored hook holds no functions, so that form can never run #21658. It runs in draft and in publish mode, after the type-schema parse (a malformed body keeps the schema's located 422), and before the authoring gate and every write.
• Message, two readings of one rule:
  • With a handler that names a function, the message is byte-identical to the one The metadata save door answers 200 to a hook with a handler name and no body, which the runtime then refuses at bind: a runtime-authored hook holds no functions, so that form can never run #21658 shipped. It names the hook and the function.
  • With neither field, or an empty handler: "Invalid hook: 'NAME' carries no body, so it has nothing to run. Give it a body (sandboxed JS, { language: 'js', source }, or an expression), which is stored with the hook. A hook saved through the metadata API ships with no code package, so its body is the only code it can run."
  • Length: the handler form is 499 characters with 65-character names, as before. The neither form is 282 characters plus the hook name, well under the 500-character REST bound.
• What still saves: a hook with a body, with or without a handler beside it.

The PM's mechanism hypotheses, measured (at 1db5322ba2, then rerun on the merged head 15402d98f8)

#	Hypothesis	Reading
H1	Widen the existing predicate, one function, one call site, one code.	Holds. One early return removed, and the message chosen by whether handler names a function. The measured messages read right for both shapes (quoted above; the sweep's failure output below shows the neither text verbatim as the door produced it).
H2	Five suites use a bare hook as their schema-valid probe; report any others.	Holds, with two more. With the predicate widened and every probe untouched, the full metadata-protocol suite went 7 failed / 3461 passed (4 files), and the full objectql suite went 6 failed / 7446 passed (3 files). The five named suites, plus metadata-protocol protocol.save-receipt-wording and objectql metadata-validation-sweep. A grep of runtime, rest, plugins/*, services/*, cli, verify, qa and examples/** for hook saves through this door (type: 'hook' items, /meta/hook paths) found only runtime's two pin tests, which already carry bodies. See the fixture triage below.
H3	migrateStoredMetadata and duplicatePackage surface a stored bare row as their recorded failure; stored rows keep their bytes.	Holds. Measured with a one-off harness that is not committed (the stub engine of protocol.stored-residue-resave.test.ts). duplicatePackage over a package holding one bare hook row and one body hook row answered { success: false, copiedCount: 1, failedCount: 1 } with this refusal in failed[0].error, and the source rows' bytes were unchanged. migrateStoredMetadata({ apply: true }) over a bare row answered { scanned: 1, canonical: 1, rewritten: 0, failed: 0 } with the bytes unchanged. Population of stored bare hooks reachable from this repository: zero. examples/** and packages/qa/** seed no sys_metadata hook rows (zero type: 'hook' items).
H4	A built artifact's handler hook never passes saveMetaItem.	Holds at 1db5322ba2. Every production call site either saves a fixed type other than hook (automation.ts and flow-credential-migration.ts for flow, packages.ts for app, permission-set-projection.ts for permission) or forwards an author's or a stored row's type. The forwarding callers are the REST PUT /meta/:type/:name (rest-server.ts), the dispatcher's metadata save (domains/meta.ts), migrateStoredMetadata and duplicatePackage. AppPlugin, loadArtifactBundle, the install-local door and the boot path make zero saveMetaItem calls. The composed pin's X and Z controls hold it end to end.
H5	No first-party authoring path emits a hook with neither field through this door.	Holds for what this repository holds. os meta register forwards the author's own file and emits no hook of its own. The os create and scaffold templates author defineStack sources, which reach the artifact door and never this one. packages/mcp has no hook tool. Studio is at the objectui pin ab18797215, unchanged since #21658's census, which read its hook skeleton carrying a body. Not measured: the cloud AI build agent's metadata tools, which live outside this repository.

Fixture triage: seven probe suites move to a body-carrying hook

Each probe item gains body: { language: 'js', source: 'return;' } and nothing else. No probe is deleted, and no assertion is changed or loosened.

Suite	What the probe measures	Still measures it
metadata-protocol protocol.code-only-types (2 probes)	The #5086 code-only gate does not catch hook (allowRuntimeCreate only) on either kernel; the #5264 matrix shows a hook save answers a repository receipt.	Yes: success: true and one row on both kernels, and the receipt fields.
metadata-protocol protocol.meta-types-mint-door-agreement	PUT /meta/hook behaves as /meta/types advertises (declared, creatable), read off one fact.	Yes: both cases are green.
metadata-protocol protocol.unrecognised-meta-type	A declared runtime-create-only type still saves past the unrecognised-type refusal.	Yes.
objectql overlay-precedence (3 probes: hook, plural hooks, single-kernel bypass)	The two-tier verdict: brand-new items of allowRuntimeCreate types pass the overlay whitelist, and a single kernel bypasses the overlay gate.	Yes.
objectql protocol-meta (3 probes)	The PR-10d.7 two-tier model: an artifact-backed hook is refused NOT_OVERRIDABLE / 403; a brand-new hook and an edit of a DB-only hook are accepted.	Yes. The NOT_OVERRIDABLE probe was green before the move too, because the provenance gate runs first. It moved anyway, so that the refusal it measures can only be the provenance gate's. The registry-seeded items there are scenery for provenance, not saves through the door, and keep their bytes.
Beyond the five: metadata-protocol protocol.save-receipt-wording (OVERLAYLESS_PROBES.hook)	The receipt sentence for a brand-new overlay-less type.	Yes.
Beyond the five: objectql metadata-validation-sweep (FIXTURES.hook)	Valid gets 200; invalid gets the schema's 422 naming events.	Yes. The invalid fixture carries the body too, so it stays the valid fixture minus the one field the schema must name.

The enumeration pin, on the real door (ADR-0112: each refusal asserts code and status)

Composed kernel, packages/runtime/src/hook-handler-package-scope.pin.test.ts, through PUT /api/v1/meta/hook/NAME as the signed-in administrator:

Pin	Case	Asserts
1. A body hook saves.	②b (existing)	2xx; it binds and runs, and so does one with both fields.
2. A handler-only hook is refused.	② (existing)	400 VALIDATION_ERROR, naming the hook and the function and prescribing a body; GET by name answers 404.
3. A hook with neither field is refused.	②c (new)	400 VALIDATION_ERROR, naming the hook and prescribing a body; GET by name answers 404.
(2 and 3) Nothing bound.	"② and ②c nothing bound" (widened)	After ②b's re-sync, the binder recorded no refusal of either hook and no skip of the bare one (skipsOf, a new reader of the engine logger's skipping hook warns).
4. A built artifact's handler hook through its own door is unchanged.	X and Z controls (existing)	App X's hook naming its own functions entry binds and runs. App Z's hook naming a function its --artifact runtime module exports binds and runs.

At unit level, section 8 of protocol.invalid-metadata-422-face-inventory.test.ts is new. It covers publish and draft with neither field, and an empty handler. Each case asserts code, status, the named hook, the prescription and an empty store. Section 7 (#21658) is unchanged and still green.

Reverse verification (the fix committed first, at 0c32c32bb1)

Mutation. node scripts/ablation-replace.mjs restored the old handler-only guard after the body test: typeof hook.handler !== 'string' || hook.handler === '' returns undefined, behind a marker constant ABLATED_21689_NEITHER. The anchor count went 1 to 0 and the blob went 3059168d5703 to 237d2559c48b. @objectstack/metadata-protocol was rebuilt, and node scripts/ablation-dist-preflight.mjs @objectstack/metadata-protocol ABLATED_21689_NEITHER found the marker in dist/index.js and dist/index.cjs. A shell trap restore on EXIT, INT and TERM wrapped the whole run.

The first attempt was a no-op, and it is disclosed here. Its replacement re-contained the anchor line, so ablation-replace refused it ("the anchor count moved 1 to 1"), ran nothing and proved the restore. The second attempt re-spelled the body test (typeof hook.body === 'object' && hook.body, the same truth table), so the anchor left the file.

Prediction: pin 3 red, and pins 1, 2 and 4 green. Observed:

• Unit (src), sections 4 to 8: 3 failed, all three section 8 cases (publish neither, draft neither, empty handler). 15 passed, including all of section 7 (handler-only refused in both modes, the body CONTROL, body beside handler, malformed body 422).
• Composed (dist):
  • ②c failed. It received { status: 200 } with Saved hook 'scope_authored_bare' (env-wide, state=active).
  • "② and ②c nothing bound" failed. skipsOf('scope_authored_bare') held 3 binder skips, which also proves the new reader fires.
  • ① ✓, X control ✓, Z control ✓, ② ✓ and ②b ✓: 2 failed, 5 passed.

Restore.

• ablation-replace restored the file. The blob equals HEAD (3059168d5703) and git diff HEAD is empty. The outer trap's hash compare agreed.
• Whole-tree git status --porcelain is empty.
• After a rebuild, the --absent preflight found the marker in none of the 24 built files, and the tree was clean.
• The reruns are green: 26/26 (face inventory) and 7/7 (composed).

Tests (at 15402d98f8, after merging origin/main 8843505d91, which carries PR #21693)

• pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2: 210 files passed and 3 skipped; 3578 tests passed and 19 skipped.
• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 --project local: 372 files and 7455 tests passed.
• Runtime hook-handler-package-scope.pin.test.ts and stored-metadata-body-boundary.pin.test.ts: 14/14.
• Typecheck, exit 0 for all three packages:
  • metadata-protocol tsc --noEmit. Its program includes all five edited test files (--listFiles, one hit each).
  • objectql and runtime: tsc plus check:test-typecheck, OK, with the debt ledgers held. Their test layers compile under tsconfig.test.json (include: src/**/*).
• Dependency closure: pnpm turbo run build --filter='@objectstack/runtime^...' --concurrency=2, 29/29. packages/spec moved on main's side, so pnpm --filter @objectstack/spec check:generated also ran: all 15 generated artifacts are up to date.
• The rest of packages/runtime's suite is declared to CI.

Gates (at 15402d98f8)

Every family below ran first at 623b4a0b94 and ran again in full on the merged head 15402d98f8. The figures are the second run's.

Derived. node scripts/pm/dispatch-gates.mjs --commands (no paths) derives 66 families, the same list on both heads, and all 66 ran.

• All 66 exited 0. That includes check:dual-build-cjs-loads: 106 published require entry points across 66 packages load. On the first head it had exited 3, PREREQUISITE NOT MET, for want of a full build.
• --ran reconciliation: 66 accounted for, 66 run, 0 NOT-MEASURED (a derived zero), 0 UNRUN.

Artifact-roster block (54 families, outside the derived total). All 54 ran.

• 51 exited 0. These include check:error-status-conformance, check:error-code-casing, check:authz-resolver, check:route-ledger-census, check-changeset-fixed and check:engine-double-contract.
• 3 exited 2, NOT WIRED without PR context: check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths. They are rerun with this PR's context, and the results go in the os-dev report.

Symbol-anchor sweeps, all exit 0:

• check:adr-symbol-anchors: 2167 anchors across 140 records.
• check:scripts-symbol-anchors: 3760 anchors across 282 scripts.
• check:spec-docblock-symbol-anchors: 4867 anchors across 1861 spec sources.
• check:adr-anchors: OK.

Lint. CI owns pnpm lint. This PR records a proven narrowing instead:

• Population: eslint.config.mjs lints files: ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'].
• Count: eslint --no-inline-config --format json over the 10 changed TS files reports 10 files, 0 errors and 0 warnings.
• Invariance: the config enables no type-aware linting (no parserOptions.project), so this diff cannot move the verdict of any untouched file.

Changeset

.changeset/21689-hook-no-body-save-door.md: minor for @objectstack/metadata-protocol, Clause-②: no (narrowing), the BREAKING banner, and the ADR-0087 marker not-required (no-migration-prescription) with the census above. check-adr-0087-registration --base origin/main accepts it.

Landing point

As the claim predicted: packages/metadata-protocol/src/protocol.ts, runtimeHookWithoutBodyRefusal (saveMetaItem, type hook), plus the seven probe suites. No producer elsewhere needs a change. No governed surface is touched. PR #21693, which edits the read region and the import block of protocol.ts, landed on main before this PR opened. It is merged in here; the merge was clean, and this diff touches neither region.

Acceptance notes

• The draft-promotion and restore doors still do not re-ask this rule. The metadata save door answers 200 to a hook with a handler name and no body, which the runtime then refuses at bind: a runtime-authored hook holds no functions, so that form can never run #21658's PR recorded this for the handler form, and it now covers the neither form too. publishMetaItem, rollbackMetaItem and revertCommit can make a draft or a history version stored before this change into an active bare row, which the runtime skips at re-sync as before. Carrier: none.
• os meta register hook --data FILE forwards the author's file through this door, so a bare hook file now gets this 400 and the CLI prints its message. It needs no change of its own.
• The binder's skip line reads skipping hook with unresolved handler for a hook that has no handler. No stored row of that shape can be minted through this door any more. Noted, not filed.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 2 documentable anchor(s).

5 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/deployment/validating-metadata.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/kernel/cluster.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/kernel/services-checklist.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/permissions/authorization.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 16d241a6af00be4acce9883190fc333a5f560825 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 8889850e9246d840185c39e6f5c672a9d5e42417 — the merge of head 15402d98f8760f77e30a3058208925c460035ba6 into base 16d241a6af00be4acce9883190fc333a5f560825, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8889850e9246d840185c39e6f5c672a9d5e42417 && git checkout 8889850e9246d840185c39e6f5c672a9d5e42417
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 16d241a6af00be4acce9883190fc333a5f560825 15402d98f8760f77e30a3058208925c460035ba6 && git checkout -B drift-repro 16d241a6af00be4acce9883190fc333a5f560825 && git merge --no-ff 15402d98f8760f77e30a3058208925c460035ba6

node scripts/docs-audit/affected-docs.mjs --json 16d241a6af00be4acce9883190fc333a5f560825

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 16d241a6af00be4acce9883190fc333a5f560825 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

ACCEPT — PR #21706 at head 15402d98f8

domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi · read at 2026-10-04T08:26Z. The os-dev report is on #21689. Judged against GitHub and the branch, not against the report.

• Shape: draft, base main, assignee os-project-manager.

  • The first lines are Fixes #21689 and Clause-②: no (narrowing).
  • The closing-keyword scan finds #21689 only. #21658, #21686, #21693, #5086 and #5264 appear in the body with no verb next to them.

• Scope: 11 files, +202/-54:

  • protocol.ts, one helper's predicate and message;
  • seven probe suites;
  • the 422 face inventory and the composed pin;
  • the changeset.

  NOT governed. No packages/spec file is touched. A local git merge-tree against origin/main is clean. PR fix(metadata-protocol): the read envelope's lock / editable / deletable report the write doors' locked-base verdict #21693 is merged in, and its regions are untouched.

• The diff, read: one predicate, as ruled.

  • runtimeHookWithoutBodyRefusal keeps its name, its single call site in saveMetaItem (after the type-schema parse, before the authoring gate and every write) and its one envelope, VALIDATION_ERROR / 400.
  • The handler guard is gone, so every hook without a body object is refused. That is install-local's collectHooksWithoutBody judgement.
  • The handler-only message is byte-identical to The metadata save door answers 200 to a hook with a handler name and no body, which the runtime then refuses at bind: a runtime-authored hook holds no functions, so that form can never run #21658's once the shared prescription string is substituted back.
  • The neither-field message names the hook and prescribes a body first.
  • HookSchema is untouched.

• Fixtures: seven suites, the five triage named plus protocol.save-receipt-wording and metadata-validation-sweep, found by running the widened predicate.

  • Each probe item only gained body: { language: 'js', source: 'return;' }, with a comment saying what the suite still measures.
  • The seat read every hunk: no expect line was removed or changed.
  • metadata-validation-sweep's invalid case still lacks events, so it still measures the schema refusal.
  • protocol-meta's NOT_OVERRIDABLE probe was moved too, so the refusal it measures can only be the provenance gate's. Accepted.

• Pins: the enumeration, on the real door.

  • The composed kernel's PUT /api/v1/meta/hook/NAME: ② handler-only refused, ②c neither refused ({ status: 400, code: 'VALIDATION_ERROR' }, by-name GET 404), and ②b body saves. Neither refused hook reaches the binder after the re-sync.
  • The X and Z controls hold the artifact door unchanged.
  • The 422 face inventory asserts { code, status } for both shapes in draft and in publish mode (ADR-0112).

• Reverse verification: the old handler guard was restored behind a marker, and the dist preflight found it in the built files. Exactly the neither-shape cases went red (3 unit cases, plus ②c and the nothing-bound case composed), and the rest stayed green. The restore was proved by blob equality, an empty git diff HEAD and status, and an --absent preflight.

• Clause-②: no (narrowing) — accepted. The door refuses one more shape it used to answer 200. Nothing widens, no code is added, and there is no path leg, so no contract review is owed.

• Changeset, checked sentence by sentence:

  • minor, the BREAKING banner, and adr-0087: not-required (no-migration-prescription) with its census.
  • "One rule … the same envelope and the same message" matches the code.
  • "Before and after" matches pin ②c.
  • "What still saves" matches ②b and the both-fields case.
  • "What is unchanged" matches HookSchema and the artifact door, held by X and Z.
  • "Rows stored before" matches the dev's one-off H3 readings: duplication copied 1 and failed 1, and the stored migration left the row canonical and unchanged.

• Census:

  • H2: 7 probe suites.
  • H3: 0 stored bare hooks reachable.
  • H4: forwarding callers only.
  • H5: 0 first-party emitters of the neither shape in this repository. The cloud AI build agent is NOT MEASURED, which the changeset states.

• Evidence: metadata-protocol passes 3578 tests, objectql 7455, and the runtime pins 14 of 14. Typecheck exits 0 for all three packages, with the ledgers held.

• Gates:

  • dispatch-gates --ran at the final head: 66 derived, 66 run, every one exit 0.
  • The artifact-roster block (54 families) is green, including the 3 PR-context guards re-run with this PR's context.
  • The four symbol-anchor sweeps exit 0, as the order asked ([finding] dispatch-gates derives the symbol-anchor sweeps only from their corpus paths, so a change that removes an anchored symbol from a TARGET file passes every local gate and reds CI #21697).

• Deviations — accepted: seven suites rather than five, the probe moved for clarity, one no-op ablation attempt that the tool refused, two merges of main, and the attribution following AGENTS.md.

• CI: read by the seat at landing. The seat lands only once every check is green or an expected skip.

Out-of-scope findings — Acceptance notes, not filed: none has a measured public-door reach.

• The draft-promotion and restore doors (publishMetaItem, rollbackMetaItem, revertCommit) do not re-ask this rule, as The metadata save door answers 200 to a hook with a handler name and no body, which the runtime then refuses at bind: a runtime-authored hook holds no functions, so that form can never run #21658 already recorded.
• The binder's skip line says "unresolved handler" for a hook that has none.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 37190715356 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Console Pin Gate — 失败步骤: Build the Console SPA at the pinned objectui SHA

  ✗ Built console still carries the PUBLISHED @objectstack/spec.
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 6 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)