[objectstack-fleet]

Requested by Elon · project thread

Refs #32826 (item 4, the changeset half; the docs half and items 1, 2, 3, 5, 6 land in #33491)

Area-lease pilot #33059 · area E2b · seat domain:server#5 · os-elon-musk · session_016WV4cz4f7zEQZ2C9GTG382

What changes

The released 18.4.0 entry 2fc3fce in packages/rest/CHANGELOG.md (the dataset query door judges which refused holders the caller is admitted to), under "Moved for every caller":

1. "… one admitted to every holder included, so the row above applies to it" reached across a list boundary: it opens the "Moved for every caller" list, so "the row above" is the last row of the previous list, which a reader of this list does not see as above it. It now names the row it means: the holder "counts as a holder whose admission cannot be judged (the 503 row of the list above)".
2. A missing moved answer is added: where only some holders' own reads refuse, a caller admitted to every holder: 409 naming every holder → 409 naming only the holders that could be judged.

Docs-only. No code, no test, no changeset.

Why

#32826 item 4 (contract review r2 N6 on PR #32804, 6836320789): the partial-judgement row was missing from the moved answers and the pointer was wrong. PR #32804's changeset has been consumed by the 18.4.0 release, so per AGENTS.md (RELEASE-OWNED, packages/*/CHANGELOG.md) the released entry is amended in a dedicated docs-only PR.

Verification

• git diff origin/main — packages/rest/CHANGELOG.md only, +2 / −1.

Clause-②: no
Metadata-protocol: none

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (n/a)
• 2. Every name I added uses the casing for its kind. (n/a)
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset — n/a, docs-only amendment of a released entry (skip-changeset).
• 6. packages/spec touched: n/a.
• 7. No hand edits to packages/*/CHANGELOG.md — deliberate exception: AGENTS.md's dedicated docs-only amendment of a released entry.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4cz4f7zEQZ2C9GTG382

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/rest/CHANGELOG.md), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/rest/CHANGELOG.md) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8fdf25a43707b03f2120941acd6acefbdd0b034a → packageMentionDocs.

[objectstack-fleet]

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head ec0cdb8 · 2026-11-14T22:38:52Z

review#3.

[objectstack-fleet]

Review — changes needed

Head-sha: ec0cdb8c7e1c0286cdd3e5fe87814f86d03fb3c4

The PR touches one file, packages/rest/CHANGELOG.md: one line rewritten and one line added in the released 2fc3fce entry. A dedicated docs-only PR is the allowed form for amending a released entry (AGENTS.md, packages/*/CHANGELOG.md row), and skip-changeset fits.

• Edit (1) is right. "and counts as a holder whose admission cannot be judged (the 503 row of the list above)" names the row it means. The old "the row above" reached across a list boundary.
• must-fix M1: edit (2) is wrong in one case. The new line reads: "where only some holders' own reads refuse, a caller admitted to every holder: 409 naming every holder → 409 naming only the holders that could be judged". For an ambiguity reason, that holds only when two or more holders could be judged. At 2fc3fce the arm answered undetermined whenever a holder was unjudged and admitted.length === 0 || (ambiguity && admitted.length === 1). So with three holders where two own reads refuse, a caller admitted to the one holder that could be judged got 503, not a 409 naming one holder. That is the 503 row, which edit (1) already points to. For a non-ambiguity reason (outside-closure), one judged holder does give the 409 naming it. Qualify the line, for example: "where only some holders' own reads refuse and the rest can be judged, a caller admitted to every holder that can be judged: 409 naming every holder → 409 naming only those holders, when two or more of them remain or the refusal is not an ambiguity (otherwise the 503 row)". A released entry is what an upgrading reader greps, so the line has to be exact.

A delta that changes only that text converts this to PASS.

Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6 (review#3)

[objectstack-fleet]

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head fc8a59a · 2026-11-14T22:39:54Z

review#3 (delta).

[objectstack-fleet]

Review — PASS (delta)

Head-sha: fc8a59a9427c01925e494c30c148960fcb450119

This reviews the delta ec0cdb8c...fc8a59a9, which changes one line in packages/rest/CHANGELOG.md and is text only. The added row now limits the 409 to "when two or more of them remain or the refusal is not an ambiguity; otherwise the 503 row applies". That matches the arm at 2fc3fce (undetermined when a holder is unjudged and admitted.length === 0 || (ambiguity && admitted.length === 1)), so M1 is closed. Edit (1) stands as reviewed.

The ACCEPT re-reads every check at the landing head.

Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6 (review#3)

[objectstack-fleet]

domain:server#5 · os-elon-musk · session_016WV4cz4f7zEQZ2C9GTG382
ACCEPT · area E2b (area-lease pilot #33059) · 2026-11-14T23:30Z

• Refs: rest: loose ends of PR #32804 — real-arrangement pins for the refusal forms, the 503's cause and log line, one shared refusal recogniser, prose (follow-up of #32292) #32826 item 4 (changeset half; the rest lands in fix(rest): the dataset door judges a holder whose own address a row no one module owns contends, so the name refuses 409, not 503 (ADR-0150 D4) #33491).
• Review: review#3 changes needed 6885315003 (M1: the partial-judgement row holds only while two or more judged holders remain) → delta PASS on head fc8a59a9 (comment 6885328428).
• Changeset: skip-changeset (docs-only amendment of a released entry).
• Governed: check-governed-merges --pr 33495 ⇒ NOT governed; +2 / −1.
• Checks on fc8a59a9: 34 success, 17 skipped, 0 failing; mergeable clean.
• Landing: ready + auto-merge by the area thread (Elon 15:21Z in the E2b thread).

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 43661768268 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (8/8) — 失败步骤: Run this shard's tests

  @objectstack/plugin-approvals:test:  FAIL  src/action-page-member.integration.test.ts > [#22578] handleActionPage — the ADR-0043 action page from a Request > GET renders the confirm page for a live to
    ↳ 失败原因: @objectstack/plugin-approvals:test: Error: Test timed out in 5000ms.
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/action-page-member.integration.test.ts — 24h 内已弹出 7 个 PR（feat(auth)!: a managed environment adds pending, SSO-only people, and ban works without the admin plugin #33227、fix(objectql, runtime)!: a function's bare-name read is refused naming both when the platform and a package hold the name, and answers nothing for a name only a disabled package holds (ADR-0150 D4) #33439、feat(plugin-security): a host can keep a platform baseline contribution at read, or decline it #33444、docs(plugin-hono-server, hono): say which 304 answers carry Vary, and that the hosted door leaves compression to the platform #33452、fix(objectql): the security-catalog name-conflict refusals say a permission set holds one name per namespace #33463、docs(ui): a contributed navigation entry's order sorts it among the target app's own entries #33472、docs(rest): name the 503 row and add the partial-judgement row in the released 2fc3fce CHANGELOG entry #33495），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: src/action-page-member.integration.test.ts #33508（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 23 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)