[objectstack-fleet]

Requested by Elon · project thread

Fixes #33429

Clause-②: no — a test-only change in the private @objectstack/dogfood package; nothing publishes.
Metadata-protocol: none

Maintainer quick read

• What changes: one dogfood test now picks its search words from rows the admin can actually see, so it stops failing at random in the merge queue.
• Why: it ejected fix(console): a docs cross-link to a section keeps its #section through the flat-permalink redirect, and the page scrolls to it #33364 and fix(metadata-protocol): seed reference probe filters on the target's resolved tenant column #33409 from the queue. It is not a product bug. Sometimes the word it picked came from an activity row about an internal object (sys_oauth_resource) that no one is allowed to read through the data API, so the admin's search correctly found nothing.
• Risk and rollback: test only. Rollback is a revert.
• Needed from you: nothing.

Cause (measured locally on the stock showcase boot)

• The test took its term from ql.find(table, { limit: 1 }) under the system context, with no sort. That row varied between boots: four boots gave showcase_invoice_line, showcase_expense_line, showcase_task and sys_oauth_resource.
• The boot writes one sys_activity row about sys_oauth_resource (the MCP resource registration, no actor). GET /data/sys_oauth_resource answers 404 OBJECT_API_DISABLED, and the activity read gate serves a row only to a reader who can read its parent, so the stock admin is served none of that object's activity rows.
• A probe over every object_name the boot wrote: the admin's $search and its $filter on the name both answer more than 0 rows for every name except sys_oauth_resource, where both answer 0. When that row came first, line 96 saw 0. Both victims failed on that assertion, not on a timeout.

No wait or retry is added.

What changes

• packages/qa/dogfood/test/audit-log-admin-search.dogfood.test.ts: each term is the object_name of the newest row the stock admin reads through the same data door ($orderby=created_at desc on sys_audit_log, timestamp desc on sys_activity, $top=1). The armed control and the comment say so.

Verification

• The changed file, run 3 times on a built tree: 3/3 passed each run.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (Nothing publishes here.)
• 6. packages/spec is not touched.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4cz2MxDkQYCC4U8indM

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 19cc8976bfc88e6314e0e9d41be012a1035279e9 → packageMentionDocs.

[objectstack-fleet]

domain:server#5 · os-elon-musk · session_016WV4cz2MxDkQYCC4U8indM

ACCEPT — area A2 (permissions / audit / messaging / settings), area-lease pilot #33059.

• Fixes Queue-flake anchor: test/audit-log-admin-search.dogfood.test.ts #33429 (queue-flake anchor). The cause is measured on the card (claim 6884412955): the test took its term from an unsorted system-context first row, and the one boot row about sys_oauth_resource is never served to the admin (not API-exposed, so the activity read gate withholds it). This is not a product regression, and no wait or retry was added.
• Review: self-review under the pilot rule (A2 test-only PR). I re-read the diff at 349df5b6. It changes one dogfood file: the two terms are now read through the admin's own data door, newest first (created_at desc / timestamp desc, $top=1), and the armed control and the comment say so. Every assertion is unchanged.
• Verification: the changed file passed 3 of 3 local runs on a built tree.
• Governed: check-governed-merges.mjs --pr 33449 reports NOT governed.
• Checks at 349df5b6: every check is green or an expected skip. The two Check Changeset failures predate the skip-changeset label. The run after the label skips the job, which is right: a test-only change in the private @objectstack/dogfood package publishes nothing.
• Main overlap: none; the file is unchanged on main since the base.
• K = 1 card.

Marking ready and enabling auto-merge.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 43645197239 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Dogfood Regression Gate (3/3) — 失败步骤: Boot example apps and exercise real user flows

  @objectstack/dogfood:test:  FAIL   isolated  test/bare-name-one-holder-flow-family.dogfood.test.ts > one package holder per flow, webhook, connector and email template name, on a booted showcase > the
    ↳ 失败原因: @objectstack/dogfood:test: AssertionError: one warning line: expected [] to have a length of 1 but got +0
  @objectstack/dogfood:test:  FAIL   isolated  test/bare-name-one-holder-flow-family.dogfood.test.ts > one package holder per flow, webhook, connector and email template name, on a booted showcase > ins
    ↳ 失败原因: @objectstack/dogfood:test: AssertionError: {"success":true,"data":{"manifestId":"com.qa.bare.delta","version":"1.0.0","versionId":"1.0.0","installedAt":"2026-11-14T21:57:56.730Z","hotLoaded":true,"upg
  @objectstack/dogfood:test:  FAIL   isolated  test/bare-name-one-holder-flow-family.dogfood.test.ts > one package holder per flow, webhook, connector and email template name, on a booted showcase > the
    ↳ 失败原因: @objectstack/dogfood:test: AssertionError: expected [ Array(3) ] to deeply equal [ Array(2) ]
  @objectstack/dogfood:test:  FAIL   isolated  test/bare-name-one-holder-flow-family.dogfood.test.ts > one package holder per flow, webhook, connector and email template name, on a booted showcase > the
    ↳ 失败原因: @objectstack/dogfood:test: AssertionError: expected [ Array(3) ] to deeply equal [ Array(2) ]
  @objectstack/dogfood:test:  FAIL   isolated  test/bare-name-one-holder-flow-family.dogfood.test.ts > one package holder per flow, webhook, connector and email template name, on a booted showcase > the
    ↳ 失败原因: @objectstack/dogfood:test: AssertionError: expected [ [ 'com.qa.bare.alpha', true ], …(2) ] to deeply equal [ [ 'com.qa.bare.alpha', true ], …(1) ]
  @objectstack/dogfood:test:  FAIL   isolated  test/bare-name-one-holder-flow-family.dogfood.test.ts > one package holder per flow, webhook, connector and email template name, on a booted showcase > the
    ↳ 失败原因: @objectstack/dogfood:test: AssertionError: expected [ 'com.qa.bare.alpha', …(3) ] to deeply equal [ 'com.qa.bare.alpha', …(2) ]
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/bare-name-one-holder-flow-family.dogfood.test.ts — 24h 窗口内只有本 PR 撞到过，暂不汇总（再有一个不同 PR 撞到就会自动开汇总 issue）。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 11 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

domain:server#5 · os-elon-musk · session_016WV4cz2MxDkQYCC4U8indM

Triage of queue build 43645197239: not this PR's failure, so it is re-queued.

• The build's tree is gh-readonly-queue/main/pr-33449-063d2e0d75. Its base 063d2e0d75 is feat(service-automation)!: two packages of two namespaces may each declare a connector of the same name (ADR-0150 child B, the narrowing) #33431 (feat(service-automation)!: two packages of two namespaces may each declare a connector of the same name), which was queued ahead and is 2 commits ahead of main. So this group was stacked.
• The only failing file is test/bare-name-one-holder-flow-family.dogfood.test.ts, which fails on package-holder counts for flow, webhook, connector and email-template names. That is the surface feat(service-automation)!: two packages of two namespaces may each declare a connector of the same name (ADR-0150 child B, the narrowing) #33431 changes.
• This PR changes one line set in test/audit-log-admin-search.dogfood.test.ts and nothing a flow-family holder reads.

Auto-merge is re-enabled. If the same file fails again with #33431 out of the group, I will re-triage.