fix(spec): stop verbatim-quoting a rotted proof-registry reason in the sharing_rule ledger note - #18994

Fixes #18801

Clause-②: no

What was wrong

The _note of packages/spec/liveness/sharing_rule.json quoted the declarative-rbac-seeding proof-registry entry's blockedReason verbatim, and named the file to find it in. PR #18797 (ac720a9865) rewrote that reason, so the quoted sentence stopped existing in the very file the note sends a reader to.

The judgement was never wrong. The seeding does falsify the entry's original premise — the rewritten reason on the entry now records exactly that, as a real ADR-0054 §3 binding candidate held back by the adoption act alone. Only the quotation rotted, which is why this is p3 and why the fix replaces the quote rather than the verdict.

Shape chosen: A-2 — stop quoting verbatim

The card preferred A-2 and left the choice to the dev, because the real question is whether a reader can still locate the entry once the quote is gone. Measured, not assumed:

So the id is a unique key within the registry and grepping it lands a reader on the entry. A-1 would have bought a pointer with the same expiry date as the last one: the entry's reason is prose owned by another card's author, and this note has now been broken by a rewrite of it once already.

Three things worth stating about the shape:

• The old premise is paraphrased, deliberately not re-quoted. A paraphrase of a premise that has already been retired cannot rot — the text it describes is frozen in history and nothing will rewrite it again. Re-quoting it would also have re-introduced the exact string this card exists to remove.
• It is the house pattern in the same directory. liveness/api.json and liveness/qa.json both cite proof-registry.mts by name and claim, and quote none of its prose. This file was the outlier.
• ⚠️ Nothing mechanically asserts those ids unique — there is no uniqueness assertion in proof-registry.test.ts or anywhere in packages/spec/scripts/liveness/. The id's durability as an anchor is a measured fact about today's tree, not an enforced invariant. See the acceptance note below.

Acceptance readings

All taken at dc1202c21b with a fold-proof predicate: whitespace folds and TypeScript ' + ' concatenation seams are dissolved before matching, because the registry splits every reason across source literals mid-phrase and a line-oriented grep reads a false zero there. The predicate carries a self-test — three synthetic samples that must each read 1 through a fold or a seam, plus a negative control that must read 0 — and all four behaved as declared on every run, so the zeros below are measurements rather than a broken regex. Needles are written in full; corpus is all 8,912 tracked text files via git ls-files.

Firing control, same run — a zero alone is not a reading:

Uniqueness, re-taken — the card's claim was the filing dev's reading and had not been re-run. All three old spellings, before and after:

The claim holds, with the shape made precise: the three spellings do not all hit this one site. Spelling 3 was the only one on the _note; spelling 1's single hit is on an unrelated file — KnowledgeSource is documented as not being a governed metadata type, nothing to do with sharing rules — and it is deliberately untouched; spelling 2 was already absent.

Substance preserved. The rewritten _note still asserts, in its own words, that the seeding falsifies the entry's original premise, and now says what that premise was and that #18587 supplied the per-type coordinate it claimed was missing. The sentence was replaced, not deleted.

DARK. check:liveness exits 0 on both legs and its output is byte-identical before and after, reporting sharing_rule 17 classified (live 16, planned 1) either way. The BEFORE leg is a real measurement, not a no-op: the old quotation was confirmed back on disk (1 occurrence) before that run, and the restore was proven by blob hash matching HEAD, an empty git diff HEAD, and 0 occurrences afterwards.

Verdicts untouched. The read-only fence was drawn by kind, not by path: every status, verifiedAt, evidence, producer and per-row note in the file is byte-identical to main. Asserted structurally, not by eyeball — the edit script parses both versions and requires every field except _note to compare equal.

Changeset: a patch, measured rather than defaulted

packages/spec's files[] ships liveness, so this file is published content. npm pack --dry-run --json, with controls in both directions:

• 275 published entries, and liveness/sharing_rule.json is among them.
• Positive control: 39 liveness/*.json ledgers ship — the measurement can see a spec-owned data file when one ships.
• Negative control: 0 entries under scripts/, and scripts/liveness/proof-registry.mts is not published — which is why fix(spec): re-read four sharing proof-registry reasons now that sharing_rule is governed #18797 correctly took skip-changeset, and why this card cannot.

Published bytes move, and what moves is precisely the pointer a consumer follows, so skip-changeset does not apply by its own criterion. A patch changeset is written. Precedent for the shape: .changeset/13272-liveness-cloud-citations-verifiedat-anchors.md, a patch for a liveness-ledger evidence/prose change with no verdict moving.

⛔ No skip-changeset label is applied, deliberately — it is an opt-out that would exempt this PR from the very check the changeset satisfies.

Verification

Run in a dedicated worktree at dc1202c21b, after merging origin/main (which moved packages/spec) and rebuilding.

• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 55 commands. All 55 run with exit codes landed to disk first, then reconciled with --ran: 54 run green, 1 NOT MEASURED, 0 unrun.
  • The one NOT MEASURED is pnpm check:dual-build-cjs-loads — recorded exit 3, PREREQUISITE NOT MET, its own words: "this gate reads built output, and some package has no dist" across 87 packages. It needs a whole-repo build and is owned by CI's Build Core. Exit 3 is neither a pass nor a failure by that gate's design.
  • pnpm check:lean-entry-closure first read the same exit 3; its prerequisite named exactly one package, so @objectstack/objectql was built and it was re-run to a real verdict — 2 published conditions measured from a real load, admitted set held exactly.
• Tests: pnpm --filter @objectstack/spec test — 489 files, 14209 passed. The five liveness-ledger test files were also run on their own: 146 passed.
• Typecheck: pnpm --filter @objectstack/spec typecheck — OK.
• Generated artifacts: pnpm --filter @objectstack/spec check:generated — all 16 up to date after the merge.
• Control characters: check:nul-bytes green, plus a direct scan of the edited file for the wider control-byte class — no hits.
• Lint, narrowed and the narrowing proven — the three readings, not an assertion:
  1. Population, read from eslint's own config: every files: selector in eslint.config.mjs is {ts,tsx,mts,cts,js,jsx,mjs,cjs}. Neither .json nor .md is selected by any of them.
  2. Count, read from --format json: eslint over exactly the 2 changed paths reports on 2 files, 0 errors, each with its own message "File ignored because no matching configuration was supplied."
  3. Invariance for untouched files: type-aware linting is not enabled anywhere — eslint.config.mjs states it carries no parserOptions.project and no typed rules for ANY file — so this diff cannot move the verdict on a file it does not contain. The repo-wide eslint . sweep is CI's run and is unaffected by these two paths.

Acceptance notes

Out of scope for this card, filed nowhere and recorded here instead:

• noted, not filed: the HIGH_RISK_CLASSES ids in packages/spec/scripts/liveness/proof-registry.mts are not asserted unique anywhere — no check in proof-registry.test.ts or its siblings. This is an observation, not a reproducible defect, a contract violation or an authoring trap, so it is not one of the three filing classes. It is worth writing down only because this PR's argument for A-2 rests on the id being a durable anchor, and that rests on a convention rather than on a gate. Who will meet it: the next seat to add or rename a HIGH_RISK_CLASSES entry — the same file this card was forbidden to edit. Not acted on here.
• noted, not filed: the same id string is declared a second time in the tree, at packages/qa/dogfood/test/authz-conformance.matrix.ts:322. That is deliberate — the conformance matrix names the same proof — and it makes the id a cross-file join key rather than a collision. Recorded so a later reader who greps the id repo-wide and finds two declarations does not read it as drift. Who will meet it: anyone following the new _note pointer with a repo-wide grep instead of a registry-scoped one.

Pushback on the brief

Reported rather than quietly worked around, per the round convention:

1. The A-2 wording in the brief mis-attributes the rewrite. It prescribes saying the entry's reason "was updated (by feat(spec): govern sharing_rule — seed its liveness ledger and pay the first of #18582's three debts #18587)". Measured: feat(spec): govern sharing_rule — seed its liveness ledger and pay the first of #18582's three debts #18587 (e0d05538c0) seeded the ledger and put sharing_rule in GOVERNED, which supplied the coordinate; the blockedReason text itself was rewritten by fix(spec): re-read four sharing proof-registry reasons now that sharing_rule is governed #18797 (ac720a9865, Fixes #18589). Writing feat(spec): govern sharing_rule — seed its liveness ledger and pay the first of #18582's three debts #18587 as the rewriter would have planted a second wrong pointer in the sentence that exists to stop wrong pointers. The note names fix(spec): re-read four sharing proof-registry reasons now that sharing_rule is governed #18797 as the rewriter and feat(spec): govern sharing_rule — seed its liveness ledger and pay the first of #18582's three debts #18587 as what supplied the coordinate. This is a one-token correction inside the shape the brief chose, so it was implemented rather than handed back.
2. The PM's "5 hits" and this PR's "6" are the same reading. declarative-rbac-seeding occurs 6 times across 5 lines of the registry — line 519 carries it twice. A line count and an occurrence count, not a disagreement.
3. The base moved twice during the round. The brief's readings were at 2265bb0a5e; the worktree was cut at a484966407, and origin/main reached d8b12fca97 before the gate list could be derived. Every reading in this PR was re-taken, and origin/main was merged in because dispatch-gates refused to answer from the stale tree — correctly, since all five of its gate-defining files had moved across that range.
4. declarative-rbac-seeding 是真实的 ADR-0054 §3 绑定候选,而 #18797 刻意没绑 —— 绑定要同时动登记表、账本与测试三处,且 condition 同时被 showcase-d3-d4-capabilities 演练,谁拥有它是一次要裁的判断 #18800 was re-taken at the start of work, as instructed: state=open, assignees [], labels pm:queue / domain:spec / priority:p3, 0 comments — nobody holds it, so this round does not collide.

🤖 Generated with Claude Code

Generated by Claude Code

Generated by Claude Code