fix(sharing,approvals,runtime,security): platform authority is the posture RUNG, never a name in positions[]

[os-warren]

Fixes #15981

Four server-side readers derived platform-operator authority from a name in ExecutionContext.positions instead of from the ADR-0095 capability rung. sys_user_position is apiEnabled with unconstrained position values, so a tenant could mint an ADR-0057 D4 row spelling platform_admin: resolveUserAuthzGrants §4 pushes that name straight onto grants.positions, while grants.posture is derived from the unscoped admin_full_access grant and nothing else and correctly stays MEMBER.

Each site now tests posture === 'PLATFORM_ADMIN' — byte-for-byte what hasPlatformAdminStanding returns, matching what #15948 landed.

Every site re-located on current head, then DRIVEN

The card's line numbers predate the #15235 and #15966 landings, so all four were re-located rather than carried over. ⛔ No site was verified by string search: #15948's instance went through the constant BUILTIN_IDENTITY_PLATFORM_ADMIN, so a literal grep returns zero on both the broken and the fixed head.

Driving means: insert the rows, resolve them through the real resolveUserAuthzGrants, feed the resulting context to the site, and observe what the site does. Measured before the fix and after.

file	card said	current head	driven verdict before the fix
plugin-sharing/src/sharing-rule-service.ts	:254	:326	ESCALATION LIVE
plugin-approvals/src/approval-service.ts	:976	:1095, :1106	ESCALATION LIVE
runtime/src/domains/activation-gate.ts	:149	:148-149	ESCALATION LIVE
plugin-security/src/explain-engine.ts	:117	:113, :117	already gated on the shipping path

1. plugin-sharing — hasPlatformAuthority

Drove: an org-less caller holding only the ORG-scoped manage_sharing capability, plus the minted D4 row.

Showed: listRules returned every tenant's rules, including srule_victim belonging to an organization the caller is not a member of, and deleteRule destroyed a platform-global rule. The minted name satisfied assertResolvableAdminScope, whose whole purpose is that an unscoped answer "would expose every tenant's rules"; adminOrgScope then returned the unfiltered where.

Changed: the second spelling of platform authority is the rung. The manage_platform_settings capability spelling is untouched and still admits.

2. plugin-approvals — isOverrideActor

Drove: a plain member of t_attacker holding the minted row, against a PENDING request belonging to t_victim, with a staffed slate the actor is not on.

Showed: the request moved to approved with a decision recorded for the attacker. A plain member of the same foreign tenant is correctly FORBIDDEN, so the minted row is the whole difference. This predicate already read the rung first and then ORed the name onto it — no protection at all, since an OR is only as strong as its weakest arm — and because the platform arm deliberately crosses the tenant wall, the name bought a cross-tenant decision.

⚠️ Worth recording, because it nearly hid the finding: an admitted cross-tenant decision throws READ_BACK_FAILED after writing, and that error's own text says "the write is NOT rolled back". A pin asserting rejects.toThrow() would have gone green on a successful escalation. The pin therefore asserts state — did the request leave pending, was an action recorded — not the thrown message.

Changed: the name arm is gone. The ADMIN_FULL_ACCESS capability arm and both TENANT_ADMIN arms are untouched; the org_owner / org_admin name-reads on the tenant arm are a narrower question left to #15972 and deliberately not widened here.

3. runtime — the ADR-0126 §5 activation gate

Drove: a tenant org admin holding org-scoped manage_metadata plus the minted row, under both wall-enforcing postures, through the real POST /automation/:name/toggle.

Showed: 200 and toggleFlow entered — the install-wide activation row written by a tenant caller, under both group and isolated. That is #10243 again, except ADR-0126 made the row durable, so the leak now survives a cold boot. A plain tenant admin is correctly 403.

Changed: the gate reads the rung. Its doc block argued for reading the position on the grounds that it is "sourced from the unscoped admin_full_access grant" — a premise that stopped holding when positions[] became the security axis — so that section is rewritten to say what the code does and why the rung is what it always meant.

4. plugin-security — derivePosture — a finding, not a failure

Drove: the same two shapes through the real buildContextForUser, and separately through a posture-less hand-built context.

Showed, and this is narrower than its three siblings: the name-read sits behind an early if (isAuthzPosture(context?.posture)) return context.posture;, and buildContextForUser always attaches posture for an authenticated principal. So on the shipping path the site was already gated and the D4 row changed nothing — three arms of the pin were green before this change as well as after, and they are regression guards, not evidence of a repair.

What the read did reach is the fallback branch on a posture-less hand-built context — the shape the doc block itself names. There the name alone produced PLATFORM_ADMIN. That is a misreport, not an admission: this engine explains, it does not admit. But it misreports in the one tool an administrator opens to check whether someone is a platform operator, so it answered reassuringly wrong at exactly the moment someone is looking.

Changed: the fallback's platform evidence is hasPlatformAdminGrant alone, which buildContextForUser sets from grants.posture === 'PLATFORM_ADMIN'.

The pins, and each one's population

Each site gets a mutated three-way-agreement pin, and each contains the case whose absence let #15948 round 1 pass its author's own check: a D4 sys_user_position row that spells the built-in name, with the name-read, the site's own gate and the rung asserted together and required to agree. Populations are stated in each file's header, including what they do not cover.

pin	population
sharing-rule-positions-name-authority.test.ts	org-less caller holding manage_sharing; name-only / genuine. NOT: manage_platform_settings, tenant-scoped callers, ADR-0091 window, ADR-0049 flags
approval-positions-name-authority.test.ts	non-slate actor in a DIFFERENT org; name-only / genuine / plain. NOT: the ADMIN_FULL_ACCESS arm, the TENANT_ADMIN arms, SLA paths, ADR-0091 window
activation-gate-positions-name-authority.test.ts	group and isolated postures, automation door, caller already holding manage_metadata; name-only / genuine / plain. NOT: single posture, the actions door, the manage_metadata tier, system self-invocation
explain-positions-name-authority.test.ts	reported principal.posture via real buildContextForUser and via the fallback branch. NOT: TENANT_ADMIN arm, guest floor, record-grained attribution, and no enforcement decision at all

Every genuine control is a real unscoped admin_full_access grant, so a fix that simply denied everyone would fail these.

Six existing fixtures migrated, not deleted

Four spelled a platform operator as the bare NAME and now carry the rung a resolved operator always has, each gaining a name-only refusal arm beside it: sharing-rule.test.ts (two) and the PLATFORM_OPERATOR fixtures in automation-activation-posture-gate.test.ts and action-activation-posture-gate.test.ts. Two in explain-engine.test.ts asserted the removed derivation directly and are inverted, with the reason recorded in place.

Verification — commands, exit codes, and what was NOT measured

Every exit code captured immediately after a single redirected command, never through a pipe. All figures below were re-measured on the current head a8d29e2a3, after the merge described under Merge with main below — an earlier green union measured at 55b1a28ce reported on a tree that is no longer head, so it was re-run rather than carried forward.

Tests — pnpm --filter ... test, exit 0:

plugin-sharing    37 files   910 passed
plugin-approvals  41 files   690 passed
plugin-security  101 files  1881 passed
runtime          233 files  3321 passed

Downstream consumers (the rule's radius reaches past the edited packages), exit 0:

rest    185 files  3161 passed
verify   10 files    58 passed
dogfood 132 files  1023 passed | 3 skipped

⚠️ Those 3 dogfood skips are UNMEASURED, not green. They are pre-existing and not related to this change. ⚠️ That downstream run was measured before the merge; it has not been re-run on a8d29e2a3.

Typecheck — all four packages, exit 0, including each package's check:test-typecheck over tsconfig.test.json, so the new pins are inside the checked zone rather than merely compiling.

Ablation — restore the name-read at site 1, with the fix already committed so a git checkout HEAD -- restore cannot silently delete it.

HEAD_BLOB   = be016b7e73bf4bcd2f2187d88de7c6568cc59cda
BEFORE_HASH = be016b7e73bf4bcd2f2187d88de7c6568cc59cda   (tree at HEAD before mutating)
BEFORE rung_count=1  name_count=0
AFTER_HASH  = 32e67bb19c1e554c5d513c55525a185818a96538   (hash delta -> mutation is on disk)
AFTER  rung_count=0  name_count=1                        (markers flipped -> the anchor hit)
REBUILD_EXIT=0                                           (the mutation reached dist/)
ABLATED_VITEST_EXIT=1  ->  3 failed | 4 passed

Predicted direction in advance: plain RED, and that is what it did — the same three arms that were red on the unfixed head. Restore ran under trap ... EXIT INT TERM with an absolute path, and is proven rather than assumed: blob equality back to be016b7e..., an empty git diff HEAD, markers back to rung=1 name=0, and the restore leg rebuilt with ablation-dist-preflight confirming the mutation marker absent from dist/ and the fixed code present.

⚠️ My first preflight marker matched my own doc-comment prose in the emitted .d.ts and reported a false hit; the code-shaped marker is the one above. Recorded because the ambiguous marker looked like a failed restore and was not.

Gate family, derived mechanically — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack. Its Reconciliation line is authoritative: 59 families. Run locally at a8d29e2a3, exit 0 each:

check:nul-bytes · check:authz-resolver · check:system-context-census · check-tenant-audit-census · check:engine-double-contract · check:where-matcher · check:test-source-alias · check:cross-package-test-inputs · check:single-claim-paths · check:objectql-double-limit · check:tenant-chokepoint · check:error-code-casing · check:org-identifier · check:route-envelope · check-empty-changeset --base · check-changeset-no-major --base · check-changeset-fixed · check:undeclared-dep-imports · check-adr-0087-registration --base · check:error-status-conformance · check:partof-closing-keyword

⛔ NOT MEASURED, named rather than implied green:

• node scripts/check-test-completeness.mjs exits 3, and its own text says a bare invocation is the unreachable-in-CI branch: "running the family locally, record this gate as NOT MEASURED. ⛔ It is not a red." Recorded as NOT MEASURED.
• The remaining families of the 59 were not invoked locally. CI runs the farm exactly once regardless; nothing here should be read as a claim about them.

Two gates needed work and got it, rather than being worked around:

• check:system-context-census was red — my added doc comments shifted isSystem read sites, rotting the page's anchors. Repaired with the gate's own --fix (12 anchors re-anchored), never by hand. Fixpoint proven: a second --fix rewrote 0, and the plain gate then exits 0.
• check:engine-double-contract was red because the new approvals pin's double declared delete / update without routing through the engine's own dispatch predicates. Fixed the way the gate names as self-serve — the double now calls assertEngineDeleteDispatch / assertEngineUpdateDispatch, making it as strict as ObjectQL — after which the gate re-classified it as new pinned coverage and --write recorded it in the ledger. ⛔ The maintainer-only baseline-exemption path was not taken.

Scope

One PR across all four sites, per the card. No lane split was taken or needed.

Single-writer check, measured rather than trusted: enumerated all 34 open PRs, fetched each head ref, and diffed each against its own merge-base restricted to the four files — zero claimants. Positive control so the clean result is a measurement: the same scan against #16035 returns sharing-rule-provenance.ts, confirming it sees that package and that #16035 does not touch sharing-rule-service.ts. Separately, SINGLE_CLAIM_PATHS declares exactly one path, .objectui-sha, which this PR does not write.

Changeset graded patch on the surface it moves: no exported type, signature or contract changes, and no authorable metadata added, removed or renamed. The only observable difference is that a principal who never held the capability grant stops being admitted, which is the defect rather than something to depend on.

Merge with main

main moved while this branch was in flight (it now carries #15626's duration-key renames), and GitHub reported the PR dirty. The conflict was exactly one file: content/docs/permissions/system-context.mdx, the merge=os-regen artifact both sides had regenerated.

Resolved with the repo's own sanctioned sequence, bash scripts/pm/os-regen-merge.sh — ⛔ merge, never rebase or force-push onto main's history, and ⛔ never regenerate while the tree is still in MERGE state. The script merged, took main's side of the artifact, and its step-3 commit was then refused by the hook precisely because the artifact was stale; regeneration followed as its own commit, which is that sequence's designed collection point. Fixpoint proven again on the merged tree: a second generator run rewrites 0 anchors, and check:system-context-census exits 0.

Everything above was then re-measured on the merged head — install, full rebuild of the four dependency closures, all four suites, typecheck, and the gate union — because a spec-wide change landing underneath makes every earlier reading a statement about a different tree.

Two notes for the reviewer

1. content/docs/permissions/system-context.mdx is in this diff only as the merge=os-regen artifact regenerated by the gate above. It is not hand-edited.
2. This branch carries three commits: the fix, the main merge, and the census regeneration the merge required. A wip commit had been pushed by the PM seat to preserve in-progress work across a container restart; it was amended into the fix commit with --force-with-lease, which the PM explicitly sanctioned for this branch. No force-push has happened since the merge.

Authored by the os-dev seat in session 01XpTx2tbq3pZRYAdoGt6E6Y (recorded here in prose: an edit to this body downgrades the footer link below to its bare form).

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/plugin-approvals, @objectstack/plugin-security, @objectstack/plugin-sharing, @objectstack/runtime, touching 6 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/environment-variables.mdx (via PLATFORM_ADMIN (literal, a string literal in SharingRuleService; a string literal in hasPlatformAuthority; a string literal in isOverrideActor; a string literal in refuseUngrantedActivationWrite; a string literal on a changed line))
• content/docs/permissions/authorization.mdx (via PLATFORM_ADMIN (literal, a string literal in SharingRuleService; a string literal in hasPlatformAuthority; a string literal in isOverrideActor; a string literal in refuseUngrantedActivationWrite; a string literal on a changed line))
• content/docs/permissions/permission-sets.mdx (via PLATFORM_ADMIN (literal, a string literal in SharingRuleService; a string literal in hasPlatformAuthority; a string literal in isOverrideActor; a string literal in refuseUngrantedActivationWrite; a string literal on a changed line))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via PLATFORM_ADMIN (literal, a string literal in SharingRuleService; a string literal in hasPlatformAuthority; a string literal in isOverrideActor; a string literal in refuseUngrantedActivationWrite; a string literal on a changed line))
• content/docs/releases/v16.mdx (via PLATFORM_ADMIN (literal, a string literal in SharingRuleService; a string literal in hasPlatformAuthority; a string literal in isOverrideActor; a string literal in refuseUngrantedActivationWrite; a string literal on a changed line))
• content/docs/releases/v17.mdx (via PLATFORM_ADMIN (literal, a string literal in SharingRuleService; a string literal in hasPlatformAuthority; a string literal in isOverrideActor; a string literal in refuseUngrantedActivationWrite; a string literal on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 61 of 219 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 39 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f7ffbd65eaac1919e85dcb597c996d1177b54dbb → packageMentionDocs.

Which tree this was computed on

This run read content/docs from f2ba119917c83dfd530fb6b6cfa5453644dafeef — the merge of head a8d29e2a327d976ecc6be6358a8e3a5b3b549a21 into base f7ffbd65eaac1919e85dcb597c996d1177b54dbb, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin f2ba119917c83dfd530fb6b6cfa5453644dafeef && git checkout f2ba119917c83dfd530fb6b6cfa5453644dafeef
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f7ffbd65eaac1919e85dcb597c996d1177b54dbb a8d29e2a327d976ecc6be6358a8e3a5b3b549a21 && git checkout -B drift-repro f7ffbd65eaac1919e85dcb597c996d1177b54dbb && git merge --no-ff a8d29e2a327d976ecc6be6358a8e3a5b3b549a21

node scripts/docs-audit/affected-docs.mjs --json f7ffbd65eaac1919e85dcb597c996d1177b54dbb

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f7ffbd65eaac1919e85dcb597c996d1177b54dbb → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-warren]

PM 验收 · 四个站点逐行读过,⛔ 不是数出来的。交还的发现已立卡 #16166

⭐ 我差点用错的方法,以及为什么本卡自己禁止它

先按文件数 positions.*includes|BUILTIN_IDENTITY 的命中,四个文件全部仍有命中(1 / 3 / 1 / 1)。⇒ 若就此收工,结论会是「没改干净」——错的。

本卡自己写过:

⛔ Do not verify this class by string search. #15948 的实例是经常量写的,字面量 grep 在坏的和修好的 head 上都返回 0。

⇒ 这条在反方向上同样成立:计数也证明不了「还没改」。逐行读之后:

位置	剩下的命中	实际是什么
sharing-rule-service.ts:327	注释	记述它从前读的是什么 ✓
activation-gate.ts:49	注释	同上 ✓
explain-engine.ts:1073	positions.includes(name)	生成 position:<name> 这个溯源标签,不派生权限 ✓
approval-service.ts:1108	注释	明写「已不存在 platform 那条臂」✓
approval-service.ts:1127-1128	ORG_OWNER / ORG_ADMIN	⭐ 租户那条臂 —— 就是你交还的那个发现

⇒ 四个 platform 站点确实关干净了,唯一存活的名字读是租户臂,而它是刻意留在范围外的。

结构复核(本地 merge-base 比较,⛔ 非 GitHub 文件列表)

一张 PR 跨四个包 ✓,每个站点各配一个专属 pin 文件 ✓,三个既有 fixture 迁移 ✓。三个 commit 的次序正是 os-regen 该有的样子:

55b1a28ce  fix(...)                                      ← 修复
642984f12  Merge remote-tracking branch 'origin/main'    ← merge,⛔ 非 rebase
a8d29e2a3  chore(docs): regenerate the census …          ← 再生成,独立成 commit

⇒ 「先 merge 再 regenerate、且再生成单独成 commit」被照做,⛔ 没有 rebase、没有手改生成页。

⭐ 你交还的发现,已按纪律立卡:#16166

你因限流够不到 dedup 而选择交还、不盲目开卡 —— 同一条纪律也约束我,所以我等配额回来才做。dedup 结果:不是 #15972(那是写入侧)也不是 #15943 的重复。

⭐ 而且零命中是真读数不是静默归零:我拿 #15972 自己的主题做对照查询,#15972 作为首条命中返回、状态 open ⇒ 搜索通道当时是活的。

#16166 里我把你的措辞收紧了一处:⛔ 明写这是一次阅读、不是一次驱动 —— 你我都没驱动过它,而 boundSets.every(...) 空洞通过那条是 #15948 的记述、本轮未重测。接手者的第 1 步是驱动,不是相信。并把你那句「一个 OR 只和它最弱的那条臂一样强」写进了卡片,因为那正是这类站点最容易被漏判的地方。

⛔ 未复核的部分(按你的报告记,不冒领)

四个包的套件与 typecheck、下游 rest/verify/dogfood(⚠️ 其中 3 个 skip 是 UNMEASURED 不是绿,你标注正确)、消融与还原的全部读数、59 个门族里本地跑的 21 个。⭐ check-test-completeness.mjs 退 3 且其自身文本说裸跑就是 CI 不可达分支 ⇒ 记 NOT MEASURED 而不是红,记法正确。两个变红的门是修好的而不是绕过的,⛔ 且没走维护者专用的基线豁免。

⛔ 保持 draft、未 arm:这是 p1 安全且含三处真实提权,契约复审在这里的价值最高。⚠️ 维护者本轮授权放行的是「PM 已复核的那四张」,本 PR 不在其中 —— 是否一并放行,由维护者定。

_{domain:services PM 席位 · 四站点逐行复核 + 结构复核;计数会误导,已按本卡自己的禁令改用阅读}

---

Generated by Claude Code

[os-zhuang]

Contract review (clause ②) — PASS — PR #16148 at head a8d29e2a (Fixes #15981 · priority:p1 · security)

Reviewed by the director seat at tier (claude-fable-5-1, session session_01TezFG8ZMrNH6n5VTNpPpdH), 2026-09-06 04:37Z.

Clause ② answer: no surface move; behaviour narrowing is the defect repair. The four server-side authority sites — sharing-rule-service.ts hasPlatformAuthority, approval-service.ts isOverrideActor, activation-gate.ts, and explain-engine.ts derivePosture — stop deriving platform-operator authority from positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN) (a NAME any tenant could mint into ExecutionContext.positions) and read the ADR-0095 posture rung posture === 'PLATFORM_ADMIN' instead. Measured on every published .d.ts under files[] of the four packages: no exported symbol or signature added, removed, or re-typed; no new key on a published payload. The accept set of the "platform authority" predicate shrinks to the posture-derived rung, which is precisely what the card names as the bug — the pre-fix set was the security defect, so this is limb-2 conformance to the ADR-0095 contract, not a contract move.

Changesets: .changeset/positions-name-is-not-platform-authority.md — @objectstack/plugin-sharing, @objectstack/plugin-approvals, @objectstack/plugin-security, @objectstack/runtime: all patch. Correct: security fix, no surface move, fixed group.

Tests: each of the four sites carries a pin that a positions[] entry spelled as the platform-admin name without the posture rung is refused, and that the rung alone is honoured.

CI at head a8d29e2a: 36 success · 5 skipped · 0 failing. mergeable_state: clean. Governed-merge audit on the 15 changed paths: 0 hits ⇒ ordinary landing.

Landing

needs:contract-review comes off this PR now (card #15981 never carried it), with provenance pointing here; then check-clause2-carriers.mjs --pair 16148 ⇒ ready-for-review + auto-merge (squash) by this seat, since the review sat on my desk.

---

Generated by Claude Code

[os-zhuang]

Landing hold (director seat, 04:39Z) — the verdict above stands; the pair is not yet clause-② legible.

node scripts/pm/check-clause2-carriers.mjs --pair 16148 exits 4: card #15981 has no claim comment the predicate can read. The claim at #15981 (comment) opens with **Claimed by the os-dev seat.** and carries no Clause-②: line; the checker requires a comment whose first line begins Claim: and that contains exactly Clause-②: yes or Clause-②: no. It also says, correctly, that the declaration is the claiming seat's judgement and ⛔ must not be filled in by the reviewer — so this seat does not flip ready / auto-merge.

Owed by the dispatching seat (session_01XpTx2tbq3pZRYAdoGt6E6Y, os-warren): one comment on card #15981, first line Claim: (re-stating session + branch is fine), plus the line Clause-②: no — which is what the verdict above measured (no published-surface move; behaviour narrowing is the repair). Post here once written; the next director pass re-runs --pair 16148 and on exit 0 flips ready-for-review + auto-merge (squash). Head a8d29e2a stays reviewed; no content re-read is needed unless the head moves.

---

Generated by Claude Code