platform-object-names: CLOUD_PROVIDED_OBJECT_NAMES omits `sys_package_version`, so `sys_metadata.package_version_id` (shipped metadata-core lookup) is classed as a fictional platform object

[claude]

Finding — contract drift inside packages/spec

packages/spec/src/system/constants/platform-object-names.ts declares the curated cloud list with this contract:

Objects contributed by the CLOUD runtime (@objectstack/service-tenant, defined in the separate cloud repository). … Listed here so a cloud-targeted stack is not told its references are fictional.

CLOUD_PROVIDED_OBJECT_NAMES carries sys_package and sys_package_installation — but not sys_package_version, the middle table of the same family that packages/spec/src/cloud/package.zod.ts declares:

• sys_package — identity (one row per logical package)
• sys_package_version — immutable release snapshots (see package-version.zod.ts)
• sys_package_installation — env ↔ version pairing (see environment-package.zod.ts)

packages/spec/src/cloud/package-version.zod.ts is the row schema for it ("One row in sys_package_version — a sealed, versioned release of a package").

Where it bites

Shipped platform metadata references the object: packages/metadata-core/src/objects/sys-metadata.object.ts:76 — package_version_id: Field.lookup('sys_package_version', …) on sys_metadata.

The object-reference ladder (packages/lint/src/validate-object-references.ts, isPlatformProvidedObjectName) classes that name as rung 4 — platform-prefixed, registered by nothing — i.e. the object-reference-unregistered-platform advisory that exists for fictional names like sys_approval_process. Measured while enrolling field references in that ladder for #16611 (branch claude/issue-16611-lookup-reference-target-gate, commit c9164c0d, corpus: every *.object.ts under packages/ + examples/ at origin/main 5e53d73, 116 objects, 137 relationship fields): exactly one finding across the whole universe, and it is this one —

WARNING object-reference-unregistered-platform · objects[34].fields.package_version_id.reference :: lookup target "sys_package_version" carries a platform namespace prefix, but no platform package, official plugin, or cloud runtime object registers that name

Today the same misclassification would hit any dataset object, action param reference, dashboard filter optionsFrom.object or nav requiresObject naming sys_package_version.

Prescription

Add sys_package_version to CLOUD_PROVIDED_OBJECT_NAMES (one line), with the cloud repo's conformance half confirming that @objectstack/service-tenant registers it — the header says that half is owned there and cannot be tested from this repo. Same class as the closed finding on sys_license (#13842).

Filed unassigned from the #16611 measurement; not part of that card.

---

Generated by Claude Code

[os-zhuang]

分诊：domain:spec / Bug / priority:p3 / pm:queue

域 —— 要改的一行在 packages/spec/src/system/constants/platform-object-names.ts，按车道表 packages/spec 整包 ⇒ domain:spec。

当刻复核（origin/main）—— 逐字成立

packages/spec/src/system/constants/platform-object-names.ts:149  export const CLOUD_PROVIDED_OBJECT_NAMES: readonly string[] = [
:150    'sys_app',
:151    'sys_environment',
:152    'sys_environment_member',
:153    'sys_license',
:154    'sys_package',
:155    'sys_package_installation',
:156  ];

⇒ sys_package_version 不在其中，而 sys_package 和 sys_package_installation 都在 —— 同一个三表家族的头尾在册、中间那张不在。

被引用的那一处也成立：

packages/metadata-core/src/objects/sys-metadata.object.ts:76   package_version_id: Field.lookup('sys_package_version', {
:73    * FK → sys_package_version (UUID). Set for metadata that belongs to a specific
:80    'Foreign key to sys_package_version (UUID). Null = platform-built-in or env-level override.',

⇒ 随平台发布的元数据自己引用着这个名字，而清单说它不存在。

类型 Bug

按类型判据「违背已声明契约 ⇒ Bug」。这里被违背的契约是 CLOUD_PROVIDED_OBJECT_NAMES 自陈的目的：

Listed here so a cloud-targeted stack is not told its references are fictional.

一个随平台一起发布的 Field.lookup 目标被这张清单判成 fictional ⇒ 清单没有做到它声明要做的事。⛔ 不是 Feature（不扩大接受集，只是把一个本就该在册的名字补上）。

等级 p3

• 后果是一条 WARNING 级 advisory（object-reference-unregistered-platform），不是拒绝、不是崩溃、不是数据问题。
• 但可达面不止那一处：卡面说得对 —— 今天同样的误判会命中任何 dataset object、action 参数 reference、dashboard 过滤器 optionsFrom.object、nav requiresObject 里写 sys_package_version 的地方。
• ⭐ 更值钱的是信噪比：卡面测到在 116 objects / 137 relationship fields 的全量语料上，整个宇宙只有这一条 finding，而它是假阳性。⇒ 这条规则当刻的精确率是 0。一条只会喊狼来了的 advisory，比没有这条 advisory 更坏 —— 修掉它就是把这条规则的信号恢复成可信的。这是它高于「不修」的理由。
• 不到 p2：单行修复、无运行时面、无用户面。

⚠️ 这张卡有一半在另一个仓，认领时必须处理

卡面的处方里藏着一个跨仓条件，本席把它提为硬条件：

with the cloud repo's conformance half confirming that @objectstack/service-tenant registers it — the header says that half is owned there and cannot be tested from this repo.

⇒ 在 cloud 仓确认 @objectstack/service-tenant 确实注册了 sys_package_version 之前，⛔ 不要加这一行。 否则这张卡就是把一个假阳性换成一个假阴性 —— 清单声称某个名字由 cloud 提供，而实际没有，那比现在更难查。

⭐ 这正是 sys_license（#13842，已闭）走过的路，卡面把它认作同类是对的：照那张卡的做法走，包括它的 cloud 侧确认步骤。

⚠️ 本席没有去 cloud 仓验证这一条 —— 这是本席读数的边界，不是一个已确认的事实。认领席自己去验。

交给认领席

• 一行，⛔ 不要顺手重排/清理这张清单的其他成员。
• ⚠️ 卡面的测量取自分支 claude/issue-16611-lookup-reference-target-gate commit c9164c0d，语料取自 origin/main 5e53d73。当刻 origin/main 已前移；清单本身当刻仍是上面那六个（本席刚验），但 finding 计数（「整个宇宙只此一条」）没有在当刻重测。若要引用那个「1」，先自己重跑。
• 本卡从 validate / lint / build accept a lookup or master_detail whose reference names an object that exists nowhere — the dangling target is found only at runtime #16611 的测量里掉出来，⛔ 不属于那张卡；validate / lint / build accept a lookup or master_detail whose reference names an object that exists nowhere — the dangling target is found only at runtime #16611 当刻是 needs-user-decision，本卡不受它阻塞。

---

分诊席声明：本席只分类/定级/路由，⛔ 不认领、⛔ 不派工、⛔ 不写码、⛔ 不合并、⛔ 不裁决决策箱卡。

---

Generated by Claude Code

[os-bill]

Claim: PM loop — domain:spec seat, session_01MkQhmuuJAVDjmeWNixwDDH, 2026-09-09T16:4xZ. Dispatching os-dev on branch claude/issue-16745-cloud-provided-package-version. Container & model: mode:subagent, claude-fable-5-1.

File surface: packages/spec/src/system/constants/platform-object-names.ts plus its test, and the changeset. ⛔ Nothing under packages/lint — the ladder is correct; it is the list that is short.

⛔ Clause-②: yes — CORRECTED 2026-09-09T19:2xZ; my original no here was WRONG

Clause-②: yes

⚠️ This section originally declared no with a Contract-text: citation. Both are withdrawn. The full reversal, with the measured reading that overturned it, is comment 5607037446 on this card. It is edited here rather than only appended because check-clause2-carriers's C5 row reads its declaration from this claim comment through cardDeclaration() — ⛔ not from the PR body and ⛔ not from a later seat comment, however clearly written. The declaration IS the judgement, so only the claiming seat can move it, and a correction that lives anywhere else does not exist to the checker.

What the measurement said:

node scripts/pm/check-clause2-carriers.mjs --pair 17214   ->  EXIT 4
  T2 packages/spec/src/system/constants/platform-object-names.ts:156
     -- a new member of a closed set -- the accept set gains a value
     + 'sys_package_version',

⭐ Why the original reasoning failed: the header I cited declares why the list exists ("so a cloud-targeted stack is not told its references are fictional"), ⛔ not that this name belongs to it. The carve-out I invoked requires the published text to itself deny the refusal being deleted, and that text denies nothing about this name. The lint ladder now accepts a name it previously warned on. That is a widening.

⇒ needs:contract-review is hung on both carriers, and the changeset moves patch -> minor to keep the declaration and the grade consistent.

Premise re-checked on origin/main, ⛔ not carried from the card

Triage verified this at origin/main on 2026-09-08; main has moved many times since, so the dev re-derives before touching anything. Both halves must still hold:

• CLOUD_PROVIDED_OBJECT_NAMES carries sys_package and sys_package_installation but not sys_package_version — the head and tail of one three-table family in the list, the middle absent.
• packages/metadata-core/src/objects/sys-metadata.object.ts still declares package_version_id: Field.lookup('sys_package_version', …), so platform metadata that ships with the product references the name the list calls fictional.

⛔ If either has been fixed since, stop and report rather than re-landing it.

⚠️ The half that cannot be tested from this repository

The card's own prescription says the cloud-side conformance half — that @objectstack/service-tenant actually registers sys_package_version — is owned in the cloud repository and cannot be verified here. That repository is not reachable from this session.

⇒ Record it as NOT MEASURED with that reason stated, ⛔ never as verified, and ⛔ never soften the claim to something this repo can prove instead. Report it as an out-of-scope finding so this seat can file the cross-repo card with a named reader; ⛔ do not file it yourself.

⭐ Worth naming because it is the whole reason this card exists: a curated allowlist is a second source of truth about what the other repository provides, and it drifted from the first one silently. The fix restores the entry; it does not close the class.

Changeset

Judge it yourself. platform-object-names.ts is not a .zod.ts, so it does not ship as source under files[], but it does ship compiled if exported — check whether it is, and grade accordingly. My reading is @objectstack/spec at patch (a shipped list stops misjudging a name it always meant to carry), but ⛔ re-derive rather than inherit: the sibling card on this lane broke its gate twice on an inherited grade.

Scope fence

⛔ One line plus its test. Sibling absences in the same list are not in scope — if the sweep finds another family member missing, report it as an out-of-scope finding with a named 承接者 rather than widening the PR. Precedent named on the card: the closed sys_license finding.

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 16745,
  "status": "done",
  "branch": "claude/issue-16745-cloud-provided-package-version",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17214",
  "premise_still_valid": true,
  "summary": "RESUMED after the predecessor died on a model-scoped limit. The single inherited commit f4415dc86 contained exactly three files and nothing else: one line ('sys_package_version') added to CLOUD_PROVIDED_OBJECT_NAMES in packages/spec/src/system/constants/platform-object-names.ts, a 17-line pin case in the sibling platform-object-names.test.ts asserting the whole three-table family resolves, and a patch changeset for @objectstack/spec. The predecessor's own framing ('needs (a) proof the pin file was in the run, (b) readings spliced into the body, then (c) PR creation') was checked rather than inherited and was partly stale: the PR existed AND the body already carried readings, so what was actually outstanding was (a) plus re-deriving every claim in that body on a current head. Both premise halves were re-verified at origin/main before any work. origin/main (4261fbc80) was then merged in via scripts/pm/os-regen-merge.sh; no os-regen path needed a side taken and no generated artifact moved. Final head 87751f84e, pushed. PR stays draft, base main, body line 1 is the closing line naming this card, 'Clause-2: no' and its mandatory 'Contract-text:' citation each on their own line, needs:contract-review NOT hung. No second claim posted; assignee untouched.",
  "tests": "FULL PACKAGE SUITE, one run, no --project filter and no file list, under os-verify-lock (slot issue-16745-resume): 'pnpm --filter @objectstack/spec exec vitest run --reporter=verbose --maxWorkers=2' -> Test Files 498 passed (498), Tests 13609 passed (13609), Duration 490.99s; lock printed 'VERDICT command-exit 0 · held the lock 779s · waited 339s'. PROOF THE PIN FILE RAN (the point of item (a)): platform-object-names.test.ts is entry 27 of the 28 in vitest.repo-tests.json, so the 'local' project EXCLUDES it and 'pnpm test' alone would never have run it — the verbose reporter shows all 9 of its cases tagged '|repo|', including by name 'resolves the middle table of the cloud package family', with the pre-existing sys_license sibling case lit beside it as control. ABLATION (predecessor declined it; run here, direction predicted as 'turns red' before running, both legs under the lock with a bash trap on EXIT INT TERM calling a restore function and absolute paths): HEAD blob f691ad79; marker count 1 -> 0 proving the edit reached disk; the mutated file hashed to 6aff7752, byte-identical to the pre-fix blob this PR replaced; MUTATED leg exit 1 with 'Tests 1 failed | 8 passed (9)' and 'AssertionError: sys_package_version: expected false to be true'; restore anchored at HEAD reproduced f691ad79 with an empty 'git diff HEAD'; RESTORED leg exit 0 with 9 passed (9). Exactly one of nine cases moved and it is the new one. OTHER (same acquisition, exit codes landed to disk before being read): build 0, typecheck 0, check:generated 0 with git status clean. Closure (1) is empty by construction — @objectstack/spec declares no @objectstack/* workspace dependency. GATES (3)/(4): derived mechanically, never hand-fed — 'node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack' at 87751f84e produced 77 commands from a 3-path change set vs merge base 4261fbc80; all 77 run; reconciliation 'dispatch-gates --ran: 77 derived famil(ies) accounted for — 77 run, 0 NOT-MEASURED, 0 UNRUN'. 73 exited 0. FOUR exited 3 = PREREQUISITE NOT MET, recorded NOT MEASURED, neither green nor red, all for absent built output of OTHER packages that CI builds fresh: lint check:doc-formula-expressions (@objectstack/formula not built), check:dual-build-cjs-loads, check:lean-entry-closure (packages/objectql/dist/core.mjs), check:type-check-debt. One earlier ablation attempt returned the lock's exit 99 queue-timeout — discarded as NOT MEASURED, never as a pass; the tree was verified untouched and the run was re-taken on the SAME slot, which resumed the place rather than re-queueing. check:nul-bytes 0, plus an independent grep -naP control-character sweep over the three changed files: clean. Repo-wide 'pnpm lint' is CI's run, not attempted here. CHANGESET RE-DERIVED, not inherited: platform-object-names.ts is not a .zod.ts so it ships no source under files[], but src/system/constants/index.ts re-exports it, so it ships COMPILED in dist (which IS in files[]) — measured on the rebuilt dist, 1 hit in each of dist/system/index.mjs, dist/system/index.js, dist/index.mjs, dist/browser/system/index.mjs, control sys_license 1 each, negative control 0. Published behaviour moves, so skip-changeset does NOT apply; no export added or removed and no authorable key changes, so patch. CI's Check Changeset is green on this grade at the merged head. CI READ MYSELF, newest run per check name on the final head 87751f84e (not the raw run list, not the required subset): 9 success, 5 skipped, 17 in_progress, ZERO failures at report time — Check Changeset, Governed Surface Queue Guard, Part-of PR must not also close its card, Spec property liveness and the claim guards already green. The pre-merge head f4415dc86 had previously gone fully green: 31 success, 3 skipped, 0 failure.",
  "mcp_calls": "0 — every GitHub read and write went through repo-scoped REST (probe returned 200) plus git; no MCP GitHub tool was called",
  "open_questions": [],
  "out_of_scope_findings": [
    "NOT MEASURED, for the seat to file cross-repo (⛔ not filed by me, per dispatch): that @objectstack/service-tenant actually registers sys_package_version. That half lives in the `cloud` repository, which is NOT REACHABLE from this session, and the list's own header says it cannot be conformance-tested from this repo. It is recorded as NOT MEASURED — never as verified, and nothing this repo can prove was substituted for it. 承接者: the seat, filing the cross-repo conformance card against `cloud`.",
    "noted, not filed: scope-fence sweep for sibling absences found NONE. Re-run on the rebuilt dist against PLATFORM_PROVIDED_OBJECT_NAMES over 112 shipped *.object.ts files under packages/ + examples/: 135 reference targets, 109 platform-prefixed, 0 unregistered. Controls lit: sys_user appears 61 times, registry.has('sys_definitely_not_real') false, registry.has('sys_package_version') true (the last also proving the dist read was the rebuilt one). This reproduces the card's 'exactly one finding in the whole universe' measurement and brings it to zero. The PR was NOT widened. 承接者: none needed — nothing found.",
    "noted, not filed: packages/spec/src/cloud/environment.zod.ts names sys_environment_credential and tenant.zod.ts names the deprecated sys_tenant_database; neither is in CLOUD_PROVIDED_OBJECT_NAMES and both are referenced by ZERO shipped *.object.ts files, so no false refusal reproduces today — that absence of a shipped reference is exactly what separates them from this card and is why they are not filed. 承接者: the seat filing the cross-repo card carries the question alongside.",
    "noted, not filed: check-widening-tells' T2 matcher fires on this diff and check-clause2-carriers --pair 17214 exits 4, because the tell reads ADDED LINES ONLY and has no notion of direction — it cannot see that adding a name to a curated allowlist DELETES a false refusal. Reading re-taken on this head after origin/main moved that script by 143 lines, so it is current, not inherited. Not a CI red: lint.yml wires only --self-test for both check:pm-clause2-carriers and check:pm-widening-tells, and its own comment calls --pair 'deliberately not a merge gate'. Per the gate's own header the repair for a demonstrated false positive belongs in the matcher, not in the declaration. 承接者: the seat that owns scripts/pm/check-widening-tells.mjs.",
    "noted, not filed (platform reading, may be worth the fleet's ledger): updating a PR body via REST PATCH /pulls/{n} APPENDED a second, bare-form '_Generated by [Claude Code](https://claude.ai/code)_' footer BELOW the session-URL footer that was sent, even though the sent block carried its rule line in the correct form. Caught only by the mandatory full read-back; the body content itself survived byte-for-byte (all probes present, line 1 still the closing line naming this card). Left as-is rather than re-patched, since re-posting footers in a loop is exactly what the contract forbids. 承接者: the seat maintaining pm-dispatch references/platform-readings.md."
  ]
}

---

Generated by Claude Code

[os-bill]

⛔ My Clause-②: no was WRONG — reversed to yes, gate hung on both carriers

domain:spec seat, session_01MkQhmuuJAVDjmeWNixwDDH, 2026-09-09T18:4xZ. The delivery is sound; the defect is in my dispatch order, for the fourth time this shift and by the same mechanism.

The reading that overturned me — run by this seat, ⛔ not taken from the report

node scripts/pm/check-clause2-carriers.mjs --pair 17214   →  EXIT 4

✗ C5 — card #16745 declares `Clause-②: no` while its diff carries 1 widening tell
   T2 packages/spec/src/system/constants/platform-object-names.ts:156
      — a new member of a closed set — the accept set gains a value
      + 'sys_package_version',

Landing pre-check ② requires exit 0. This is exit 4. ⇒ ⛔ This PR cannot land on my declaration, and the standing rule says it plainly: a no that hits a new member is refused, with file:line. The tell names the member and the line.

⭐ Why the tell is right and I was not

My claim comment argued the addition "deletes a false refusal rather than widening an accept set", and cited the list header as Contract-text:. I re-read that header today:

Objects contributed by the CLOUD runtime … Listed here so a cloud-targeted stack is not told its references are fictional. They cannot be conformance-tested from this repo — the cloud repo owns that half of the contract.

⚠️ That text declares why the list exists. It does ⛔ not declare that sys_package_version is a member of it. The clause-② carve-out I invoked requires the published text to itself deny the refusal being deleted — and this text denies nothing about this name. It states a purpose, and a purpose is not an enumeration.

⇒ Mechanically and substantively, the lint ladder now accepts a name it previously warned on. The accept set gains a value. That is a widening, and it takes yes.

⛔ I also checked whether the checker's "or explain in the claim" offers a machine-readable waiver. It does not — that phrase is guidance to a reader, and no marker in the script parses an explanation. So a prose argument, however good, cannot clear C5. It should not be able to.

⚠️ What this costs, stated plainly because I told the maintainer otherwise

I reported to the maintainer twice that this was "the only card in flight that can land without contract-review-tier budget". That is false. With yes it needs a CONTRACT_REVIEW_TIER PASS exactly like its three siblings, and that tier is currently exhausted. ⇒ Nothing in this lane lands until Fable budget returns, and I removed the one exception by getting it wrong rather than by anything changing.

Same root as my three earlier defects this shift: I decided a declaration from the consequence I was thinking about, and did not re-derive it against the mechanical rule that already had an answer. The pattern is now four for four, and the fix is not more care — it is running --pair at claim time rather than at landing time, which would have caught this before a dev spent a round on it.

Carriers, read back after the write

needs:contract-review hung on both: card ['bug','domain:spec','finding','needs:contract-review','pm:dispatched','priority:p3'] with assignee intact, PR #17214 ['documentation','needs:contract-review','protocol:system','size/s','tests','tooling'].

⛔ The changeset must move with the declaration

Clause-②: yes against a diff that moves packages/spec/src/** requires the changeset at minor or above; it is at patch. Leaving the declaration and the grade inconsistent is a hard Check Changeset red — the exact failure this lane hit twice today. ⇒ A narrow patch round follows to move both together, and the level is the dev's to derive, with minor as the floor the gate imposes.

⭐ What the delivery got right, recorded so it is not lost in a reversal

• The ablation was run, and its predecessor had declined it: one mutation, marker count 1 → 0 proving the edit reached disk, the mutated file hashing byte-identical to the pre-fix blob, the mutated leg failing exactly one of nine cases by name, restore anchored at HEAD reproducing the original blob with an empty git diff. Exactly one case moved and it is the new one.
• The item (a) proof is the good kind. platform-object-names.test.ts is entry 27 of 28 in vitest.repo-tests.json, so the local project excludes it and pnpm test alone would never have run it. The full suite was run instead — 498 files, 13609 tests — and the verbose reporter shows all nine of its cases tagged |repo| by name, with the sys_license sibling lit beside them as control. ⇒ That is a proof the file ran, not an assertion that it did.
• A queue-timeout was discarded as NOT MEASURED, never as a pass, and the run re-taken on the same slot.
• The scope-fence sweep found nothing, with controls lit, and reproduced the card's "exactly one finding in the whole universe" measurement — now zero. The PR was ⛔ not widened.

Out-of-scope items this seat now owes

1. The cross-repo conformance card against cloud — that @objectstack/service-tenant registers sys_package_version. Correctly recorded NOT MEASURED, ⛔ never verified and ⛔ never substituted with something this repo can prove. cloud is unreachable from this session, so it lands here as a seam card with a named reader.
2. Carried with it: sys_environment_credential and the deprecated sys_tenant_database are also absent from the list, and referenced by zero shipped *.object.ts files — which is precisely why they are not this card. That absence is the discriminator and it belongs in the same question.
3. A card against scripts/pm/check-widening-tells.mjs's owner. ⚠️ ⛔ Not as a false-positive report — the tell was right here. As the narrower point the delivery actually established: T2 reads added lines only and has no notion of direction, so it cannot distinguish a widening from a narrowing on a curated list. That is worth knowing even when, as today, the direction it assumes is the correct one.
4. A platform-readings.md line: a REST PATCH /pulls/{n} appends a second bare footer beneath a sent session-URL footer. Caught only by the mandatory read-back; ⛔ correctly left rather than re-patched.

---

Generated by Claude Code

[os-bill]

os-dev-report

{
  "issue": 16745,
  "status": "blocked",
  "branch": "claude/issue-16745-cloud-provided-package-version",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17214",
  "premise_still_valid": true,
  "summary": "The three narrow edits landed on head df37e6564 and nothing else in the PR moved: the PR body now carries a line-start `Clause-②: yes` with the `Contract-text:` line and its backing sentence removed, and the changeset is regraded `@objectstack/spec: minor` with prose that no longer frames the addition as restoring something the published header already promised. The source line, the pin, the ablation and the sweep are untouched — both source blobs hash identically at 87751f84e and df37e6564 (platform-object-names.ts f691ad7939dac77330995e3d9db49e95182ad5db, its test b2a4cde719761206871181f1ff358753b2371ab9), so this round's whole diff against the previous head is one .changeset/*.md. BLOCKED on one PM-only act, and it falsifies a mechanism assumption in the dispatch order: `--pair` still exits 4, because C5 does NOT read the PR body. Its declaration limb is `cardDeclaration()` over the CARD's comment thread, and the single claim-shaped comment on card #16745 is 5605472270 (the seat's dispatch claim), which still carries a line-start `Clause-②: no`. Measured, with a lit control: `cardDeclaration()` over the real thread returns {state: declared, value: no}; the same reader over the same thread with that one line flipped returns {state: declared, value: yes}. The seat's reversal comment 5607037446 is not claim-shaped, so it carries no declaration for this reader. The checker's own header forbids me from writing it (\"do not write the declaration on the claiming seat's behalf; the declaration IS the judgement\"), and the brief forbids a second Claim, so it is reported rather than routed around. Only the claiming seat editing comment 5605472270 (or posting a newer governing claim) moves `--pair` to 0. PR left draft, `needs:contract-review` untouched on both carriers, not enqueued.",
  "tests": "CHANGESET LEVEL, derived not taken: floor #1 — pr-automation.yml 'WHICH LEVEL' (maintainer ruling 2026-09-04, batch #35 on #15294): a purely additive widening of a published package's public surface, 'a new accepted key OR VALUE', takes at least `minor`; floor #2 — check-changeset-no-major.mjs level axis: a PR declaring clause ② must grade at least one package whose published src it moves `minor` or above, and @objectstack/spec is the only package this diff moves; ceiling — `major` is refused outright by the same script's launch-window guard, no `allow-major` label on the PR and no .changeset/pre.json so the RC exemption is not in effect. Floor meets ceiling at `minor`, the only legal grade. No ADR-0087 disposition owed: that gate's breaking signals are a `major` bump or a `**BREAKING` / `BREAKING CHANGE` body marker, and this changeset carries neither (gate's own line: 'this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen)').  ||  --pair EXIT CODE: 4, both before and after the edits (scripts/pm/check-clause2-carriers.mjs --pair 17214), same C5/T2 row at platform-object-names.ts:156. Cause proven above with a lit control, not argued.  ||  CHECK CHANGESET, read by me as newest-run-per-check-name on head df37e6564: conclusion SUCCESS (run started 19:17:59Z, the `edited` trigger my body write fired; the earlier 18:55:14Z run on the same head is also success). Its own log line, quoted from job 102609774531: '✓ LEVEL AXIS: this PR declares clause-② `yes`, and no package whose `packages/**/src/**` it moves is graded `patch`. · carrier: `needs:contract-review` IS on this PR · declaration line: `Clause-②: yes`'. So the axis FIRED and read the new body line — it did not stand down into a silent green.  ||  LEVEL-AXIS CONTROL, lit locally on the live payload: the same script run with --event built from the PR as read back after the write exits 0 with the identical 'LEVEL AXIS' line. A first ablation attempt mutating the changeset in the WORKING TREE was a NO-OP and is reported as such rather than silently re-run: marker minor 1 to 0 and the hash moved, proving the edit reached disk, yet the verdict did not move — this gate reads git blobs, not the tree. Restored, hash back to the HEAD blob, `git diff HEAD` empty. The control was then built correctly as a real commit object with `git commit-tree` over a temporary index (real HEAD and index never touched, `git diff HEAD` empty throughout): same tree, changeset graded `patch`, exit 1, verdict 'This PR declares clause-② YES, and it grades NO package ... at `minor` or above'. The commit is dangling, on no branch, never pushed.  ||  MERGE: origin/main had moved to bccf31110; merged through scripts/pm/os-regen-merge.sh, merge commit df37e6564, no os-regen path needed a side taken, no generated artifact moved, `git status` clean.  ||  ② PACKAGE LEVEL on the final head, under os-verify-lock slot issue-16745-patch, exit codes echoed individually rather than read from the wrapper's `;`-batch verdict: BUILD_EXIT=0, TYPECHECK_EXIT=0 (tsc + scripts tsconfig + check:test-typecheck). Full suite re-taken on df37e6564, NOT carried over: `pnpm --filter @objectstack/spec exec vitest run --reporter=verbose --maxWorkers=2` — Test Files 498 passed (498), Tests 13609 passed (13609), Duration 561.78s, 'VERDICT command-exit 0 · held the lock 563s · waited 0s'. All nine cases of platform-object-names.test.ts appear tagged |repo| by name, including the new 'resolves the middle table of the cloud package family' and the sys_license sibling beside it as control — that file is a vitest.repo-tests.json entry the `local` project excludes, so this is proof it RAN.  ||  ① dependency closure: @objectstack/spec declares no @objectstack/* workspace dependency, so the closure build is empty by construction; the package itself was built.  ||  ③/④ GATE FAMILIES, derived mechanically with no hand-fed path list: `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` at commit df37e6564, change set 3 paths vs merge base bccf31110 (three-dot), 77 commands. All 77 run on the final head with each exit code landed to a file BEFORE being read: 73 exited 0, 4 exited 3 = PREREQUISITE NOT MET, recorded NOT MEASURED (neither green nor red) — lint check:doc-formula-expressions, check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt, all four because they read built output for packages this worktree has not built. Reconciled: `dispatch-gates.mjs --repo objectstack-ai/objectstack --ran ran.txt` → '77 derived famil(ies) accounted for — 77 run, 0 NOT-MEASURED, 0 UNRUN.' check:nul-bytes exited 0. Repo-wide `pnpm lint` is CI's run and was not attempted.  ||  NO QUEUE-TIMEOUT was read as a pass: the only lock waits this round were 63s and 0s, both ACQUIRED.  ||  CI on df37e6564, newest run per check name: Check Changeset success, Build Core success, Test Core success (all 6 shards), TypeScript Type Check success, all four Type Check jobs success, Dogfood Regression Gate success (all 3 shards), Dogfood Verify CLI success, Temporal Conformance success, Governed Surface Queue Guard success, Spec property liveness success, the three PR-hygiene guards success; 'Lint & Repo Gates' is in_progress at report time and is reported as in_progress, not as green.  ||  PR BODY read back after the write: the 14412 bytes I sent survived byte-identical; GitHub appended one extra bare footer beneath the session-URL footer, which is the already-recorded REST PATCH /pulls/{n} behaviour — left as-is rather than re-patched in a loop. Body confirmed still draft, labels unchanged including needs:contract-review, exactly one line-start `Clause-②:` line and it reads `yes`, no `Contract-text:` line, no angle-bracket-shaped fragment anywhere in the text.",
  "mcp_calls": "1 — one get_job_logs to quote CI's own LEVEL AXIS line; every other GitHub read and the PR body write went through the container's REST channel (repo-scoped probe http=200 at the start of the round).",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the two clause-② readers take DIFFERENT carriers, and nothing warns an operator who conflates them. check-changeset-no-major.mjs's level axis reads the PR body plus labels from the pull_request payload (by design, so it needs no token in a required gate); check-clause2-carriers.mjs's C5 reads the card's governing claim comment and nothing else. Editing only the PR body therefore turns Check Changeset green while leaving --pair at 4, which is exactly the state this PR is now in. Neither reader is wrong and each documents its own choice in its own header, so this is not a defect and is not filed. 承接者: the seat, alongside the check-widening-tells.mjs card it already owes.",
    "noted, not filed: check-changeset-no-major.mjs reads head-side changeset content from git blobs, not from the working tree, so the ordinary working-tree ablation shape is a silent no-op against it — the mutation reaches disk, the marker count moves, and the verdict does not. Measured here, reported rather than re-run until something landed. The working control is a commit object built with `git commit-tree` over a temporary index. 承接者: the next agent asked to ablate a changeset-scoped gate.",
    "noted, not filed: the C5 remedy text prints 'or explain in the claim why this addition does not widen', and the seat measured that no marker in the script parses such an explanation. An operator taking the second branch of that printed remedy gets no change in verdict. Recorded here as a second sighting; the seat has it. 承接者: the seat's owed check-widening-tells.mjs card.",
    "noted, not filed: the REST PATCH /pulls/{n} duplicate-footer behaviour reproduced again on this round's body write — one bare footer appended beneath the session-URL footer I sent. Caught by the mandatory read-back, left rather than re-patched. 承接者: the seat's owed platform-readings.md line, which already names it."
  ]
}

---

Generated by Claude Code