[objectstack-fleet]

Requested by Warren · project thread

Fixes #26535

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：只改注释。.gitattributes、scripts/regen-artifacts.mjs、scripts/git-merge-regen.mjs 里说 system-context.mdx「没有生成内容」「--fix 会改 file:line 锚点」的几段注释，改成现在的事实：这页自 docs(permissions): system-context.mdx is a hand-written per-site census of every isSystem read, edited 9 times in 30 days and held by a gate whose --fix is retired — generate it like tenant-audit-census.mdx #26442 起有一个生成区(site register，由 check-system-context-census.mjs --write 重建),tenant-audit-census.mdx 也有一个生成区，两页都不走合并驱动，原因写进 NOT_DRIVER_MANAGED 那一条。
• 为什么改：docs(permissions): generate the system-context site register; behaviour rows key their reads by symbol name #26522 让这页重新有了生成区，但三处注释还说它是纯手写文字，下一个读注释的人会据此做错判断(比如以为合并后不用跑 --write)。卡片还要求在同一个 PR 里决定这两页要不要交给合并驱动：结论是不要，理由已写进代码注释。
• 风险与回滚：零行为变化，没有改任何路由、脚本逻辑或发布内容;git check-attr merge 对两页仍答 unspecified。回滚即 revert。
• 先看：scripts/regen-artifacts.mjs 中 content/docs/permissions/** 条目的 why(不路由的四条理由);其次 .gitattributes 第 97 行起的那段;最后 scripts/git-merge-regen.mjs 的 MIXED_COMPARATORS 注释。
• 两分钟验证：git check-attr merge content/docs/permissions/system-context.mdx content/docs/permissions/tenant-audit-census.mdx，预期两行都是 merge: unspecified(路由没变)。
• 需要你做的：无，席位落地。

What changes

Comments only, in three files. No routing, no code path and no published file changes.

1. .gitattributes (the block from L97): no longer says "nothing on it is generated" / "It text-merges like its prose neighbours now". It now tells the history through [Decision] isSystem 提权清单页（system-context.mdx）：保留「每处提权都要登记」，正文统计数字删掉（B）、挪进生成文件（B'）、维持（A），还是整页删（C） #22927 (which removed this row and gen:system-context-census), then says docs(permissions): system-context.mdx is a hand-written per-site census of every isSystem read, edited 9 times in 30 days and held by a gate whose --fix is retired — generate it like tenant-audit-census.mdx #26442 gave the page a generated site register again (rebuilt by node scripts/check-system-context-census.mjs --write). It also says the page stays unrouted, like tenant-audit-census.mdx, and that each page's gate catches a merge that leaves its region wrong.
2. scripts/regen-artifacts.mjs, the NOT_DRIVER_MANAGED content/docs/permissions/** entry: the why no longer calls every page in the directory hand-written prose. It names the two MIXED pages and their --write commands, and records the routing decision with its reasons (below). Its last sentence used to say "Should a generated page arrive here, route that FILE", which the two unrouted mixed pages contradicted. It now says "a page generated WHOLE". The same file also had two passages that repeated the stale claim, and the new entry would have contradicted them: the mixed header paragraph ("its last generated half") and the retired-row comment ("Nothing on it is generated"). Both now point to the entry.
3. scripts/git-merge-regen.mjs MIXED_COMPARATORS: no longer says check-system-context-census.mjs --fix rewrites file:line numbers. That flag is retired: it refuses with exit 2 and names --write (scripts/check-system-context-census.mjs header, section "--fix is retired"). The comment now says the comparator was written for that page's old line anchors, is the identity on the page today, and is carried by no row. It also says the marker-region register is something this comparator does not blank. In the same file, deferralIsLossless's case 1 said "numbers --fix will re-derive" and "24 of the last 25 main commits" in the present tense. It now says the row's gen: re-derives the half, and gives the 24-of-25 figure as the measurement taken back then.

Bounded in-place fix, declared

The two extra passages in scripts/regen-artifacts.mjs and the deferralIsLossless sentence in scripts/git-merge-regen.mjs are outside the three locations the card names. All three are in files the claim already covers, have the same defect (a comment saying the page has no generated half, or that --fix re-derives it), are comment-only, and are read by the same gates. Leaving them would have made each file contradict itself.

Why — the routing decision: record why not (no routing)

Card's Wanted: "Decide in the same PR whether system-context.mdx (and tenant-audit-census.mdx) should be routed through the regen driver now that part of each is generated, or record why not in item 2's reason." Decision: not routed. The reason is recorded in item 2's why. Evidence, measured on origin/main 9dc8fba:

• A whole-side deferral would drop prose. Both pages are hand-written prose around one region between BEGIN/END GENERATED markers. system-context.mdx has its register at L517–654 of 661 lines. tenant-audit-census.mdx has its region at L230–319 of 319 lines. An unconditional merge=os-regen row keeps OURS whole, which is the exact failure [finding] #13646's fix routed a MIXED file to merge=os-regen — the driver keeps one side whole and drops the other's hand-written prose, and the census gate cannot see the loss #14064 measured on this page.
• The mixed limb would buy nothing. The only comparator is line-anchors (blankAnchorLineNumbers). Measured on both pages: extractLineAnchors(page).length === 0 and blankAnchorLineNumbers(page) === page, so it is the identity. With it, deferralIsLossless defers only when THEIRS is byte-equal to the ancestor or to OURS. Every real edit, register-only ones included, would take textMergeInPlace, which is the same text merge git does today, plus a pre-commit regeneration debt. A comparator that blanks a marker region does not exist.
• No gen: script exists. A REGEN_ARTIFACTS row needs a gen: and check: pair in its owner manifest, and the self-test verifies the names. Root package.json has check:system-context-census and no gen: for either page. [Decision] isSystem 提权清单页（system-context.mdx）：保留「每处提权都要登记」，正文统计数字删掉（B）、挪进生成文件（B'）、维持（A），还是整页删（C） #22927 removed gen:system-context-census, and the tenant-audit census has no manifest script at all; its gate runs straight from lint.yml. Routing would mean adding scripts, which goes beyond this card's comment-only scope.
• The driver is local. GitHub's server-side merge and the merge queue run no custom driver (AGENTS.md, Multi-agent discipline §11), so routing would not change the merges where a conflict blocks a PR.
• The page does not lose merges unrouted. Git text-merges both sides' prose. The register has one line per symbol and no total, so two read-adding branches change different lines. A merge that leaves either region wrong turns its gate red: check-system-context-census.mjs section F holds the register byte-equal to --write's output, and check-tenant-audit-census.mjs check A does the same for its region, masking only the dated corpus-scale rows. Both gates run in lint-repo-tooling, behind the required Lint & Repo Gates, on pull_request and merge_group. scripts/check-system-context-census.mjs's own header already says the page "is still not merge=os-regen routed: like tenant-audit-census.mdx, it text-merges".

Routing would change merge behaviour beyond this card's comment-only path. Nothing measured here argues for it, so it is not proposed.

Tests

No behaviour changed, so no test was added and no ablation applies. The edited scripts' own suites: pnpm check:merge-driver (git-env, git-merge-regen and check-regen-pending --self-test; the git-merge-regen self-test reconciles scripts/regen-artifacts.mjs) ran with exit 0. node --check passes on both scripts. The two packages/spec test files that name these scripts mention them only in comments, so they are not owed.

Census gates, run on the base tree and unchanged by this diff: node scripts/check-system-context-census.mjs exit 0, ending "the generated register (132 symbol(s)) matches the tree." node scripts/check-tenant-audit-census.mjs exit 0.

Verification

Head 07bd64c8. Local subset from node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (38 families), reconciled with --ran: "38 derived famil(ies) accounted for — 34 run, 4 NOT-MEASURED".

Local gate readings (exit codes captured before any pipe)

• 34 families exit 0. Among them: check:merge-driver, check:nul-bytes, check:entry-guard, check:scripts-symbol-anchors, check:ratchet-remedy-authority, check:cross-package-test-inputs, check:ci-filter-parity, check-self-test-wired (scan and --self-test), check-declaration-mirrors (scan and --self-test), check-comment-mask-corpus, and check:pm-dispatch-gates. That last one ran detached as its header requires and ended "dispatch-gates self-test (fast tier): 1935 cases pass". Its exit code came from the log's pass line, with no ELIFECYCLE line.
• NOT MEASURED (exit 3, PREREQUISITE NOT MET: no dist/ without a full pnpm build): check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content. This is a declared narrowing. These gates read built dist/ output, which a comment edit in root scripts/ and .gitattributes cannot change. CI's Lint & Repo Gates runs them on a fresh build.

pnpm lint and every family outside the derived list are left to CI.

Acceptance notes

• scripts/doc-line-anchors.mjs's header ("Today, since [finding] system-context.mdx re-conflicts faster than one verification lap — the resolve→land window is measurably smaller than the gate union it requires #15921") still says the 'line-anchors' comparator is "selected by that page's mixed field" and that the census --fix "regenerates only the page's declared counts". Both stopped being true at [Decision] isSystem 提权清单页（system-context.mdx）：保留「每处提权都要登记」，正文统计数字删掉（B）、挪进生成文件（B'）、维持（A），还是整页删（C） #22927. This is the same stale-comment family, but outside this card's file list, so it is left for the seat.
• scripts/regen-artifacts.mjs's docs/audits/** entry calls the strictness ledger's .counts.md "The ONE exception". But docs/audits/2026-08-tenant-audit-write-call-sites.counts.md is also generated whole (by scripts/tenant-audit-census.mjs --write) and unrouted, and its own header explains why. Same family, outside this card.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (n/a: no schema touched.)
• 2. Every name I added uses the casing for its kind. (n/a: no names added.)
• 3. No formatter ran; pnpm lint passes. (No formatter ran; pnpm lint is CI's.)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (Publishes nothing: root scripts/ and .gitattributes, so skip-changeset.)
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (n/a)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JQwxbaFpnMwgpCgneKe2qS

[objectstack-fleet]

维护者速读

• 改了什么:三个合并驱动相关文件里的注释(.gitattributes、scripts/regen-artifacts.mjs、scripts/git-merge-regen.mjs),改成如实描述现状:system-context.mdx 自 docs(permissions): system-context.mdx is a hand-written per-site census of every isSystem read, edited 9 times in 30 days and held by a gate whose --fix is retired — generate it like tenant-audit-census.mdx #26442 起又有一段生成区(站点登记表),tenant-audit-census.mdx 一直有;两页都仍不走 regen 驱动,理由写进 NOT_DRIVER_MANAGED 那一条。
• 为什么改:旧注释说这页「没有任何生成内容」「--fix 会改行号」,两句都已不真;下一个读注释改合并路由的人会被带偏。
• 风险与回滚:只改注释,+57/−27,路由、合并行为、门禁都不变;回滚 = revert 本 PR。
• 先看:scripts/regen-artifacts.mjs 里 NOT_DRIVER_MANAGED 的 content/docs/permissions/** 一条,那是「为什么不走驱动」的落笔处。
• 两分钟验证:pnpm check:merge-driver 与 pnpm check:system-context-census 退出 0;CI 已全绿。
• 需要你做的:无,席位落地。
• 席位意见:不走驱动的五条理由逐条对过代码(见下 ②),结论稳;同族另两处过时注释已立卡 docs(devpath): two more merge-driver comments still describe the pre-#22927 census (doc-line-anchors header, NOT_DRIVER_MANAGED docs/audits entry) #26611。

席位核对

ACCEPT · domain:devx#1 · session_01JQwxbaFpnMwgpCgneKe2qS · head 07bd64c89f · 2026-10-27T10:37Z

1. Shape: three files, comments only (+57/−27), read via the PR diff; none governed (scripts/ and .gitattributes are outside the governed globs), not a merge=os-regen path. The surface widened inside the three claimed files to three more passages repeating the same stale claim; claim amended in 6439274734.
2. Premise and claims, measured by the seat on origin/main: system-context.mdx L517/L654 carry BEGIN/END GENERATED: system-context-census (scripts/check-system-context-census.mjs --write); tenant-audit-census.mdx L230/L319 carry its region, and scripts/tenant-audit-census.mjs takes --write; 0 file:line anchors on either page, so line-anchors is the identity there; check-system-context-census.mjs --fix is retired (refuses, exit 2, its header L11); no gen: script names either page in package.json; both gates (pnpm check:system-context-census at lint.yml L584, check-tenant-audit-census.mjs at L1912) run in Lint · repo & tooling gates, a member of the required Lint & Repo Gates aggregate (OS_AGGREGATOR_MEMBERS), on pull_request and merge_group.
3. Gates: head check-runs 43: 27 success, 16 skipped (path-gated UI / Dogfood / opt-in lanes, Check Changeset by skip-changeset), 0 failing. Dev's local --ran: 38 derived, 34 run, 4 not measured (dist-dependent check:dts-closure family, exit 3 prerequisite; CI ran them green).
4. Accepted deviations: the three extra passages (item 1); the commit trailer is the model-free pair the pre-push hook requires. Clause-②: no holds (no packages/spec/src/**).
5. Out of scope: scripts/doc-line-anchors.mjs header ("selected by that page's mixed field", census --fix "regenerates only the page's declared counts") and the NOT_DRIVER_MANAGED docs/audits/** entry ("The ONE exception", while the tenant-audit .counts.md is also generated whole) → filed docs(devpath): two more merge-driver comments still describe the pre-#22927 census (doc-line-anchors header, NOT_DRIVER_MANAGED docs/audits entry) #26611. Skills-docs: not owed (Metadata-protocol: none).
6. Landing: not governed, CI green on this head, mergeable clean ⇒ the seat readies it and arms auto-merge through the relay.

---

Generated by Claude Code