fix(objectql,runtime): a hook whose handler names a function gets ctx.title in-process

[objectstack-fleet]

Part of #24289

Clause-②: yes (widening)

Item 1 of the card's release 6252025560: a hook whose handler NAMES a function now gets the same ctx.title(field?) in-process that an inline handler and a sandboxed body get. Item 2 (declaring title on HookContext) is not built here. P3 below found two doors that run hooks in-process and still do not deliver ctx.title, so the declaration would run ahead of the runtime. That half goes back to the PM as needs_decision, and #24289 stays open for it. This PR carries no closing keyword for that reason.

What changed

• packages/objectql/src/hook-binder.ts: BindHooksOptions gains wrapHandler(handler, hook). resolveHandler applies it once per hook, at bind, to every handler the hook runs in-process, after a string handler resolves: an inline function, a name from the bind's functions, or a name the same package registered on the engine (the new resolveInProcessHandler is the old resolution, moved unchanged). It is never applied to the handler bodyRunner builds from a body. The engine awaits a handler and discards its return value, and so does the adapter around the wrapped function. With no wrapHandler, every handler binds exactly as resolved.
• packages/spec/src/contracts/objectql-engine.ts: IObjectQLEngine.bindHooks opts gain wrapHandler?: (handler: (context: HookContext) => unknown, hook: Hook) => (context: HookContext) => unknown, typed with the spec's own Hook and HookContext (no any, no bare unknown for a known signature; unknown is only the discarded return).
• packages/objectql/src/engine.ts: ObjectQL.bindHooks opts carry the same member (BindHooksOptions['wrapHandler']). No engine default is installed.
• packages/runtime/src/app-artifact-handlers.ts: bindAppArtifactHandlers passes wrapHandler: (handler, hook) => withInProcessHookTitle(handler, ql, String(hook.name)). The pre-bind copy of inline-handler hooks (hookWithInProcessTitle, PR fix(runtime): an in-process hook handler is handed the same ctx.title a hook body gets #24356) is removed. withInProcessHookTitle and buildTitleSurface (body-runner.ts) are unchanged.

Why the wrap is a binder option (G1)

The alternative was to resolve names in the runtime before the bind. That would copy the binder's resolution rules (the bind's functions, then a function the same package registered on the engine, never another package's, with INVALID_REFERENCE for a miss) into a second resolver. The binder is documented as the one resolver ("Inline function handlers and string-named handlers share one resolver"). With the option, the binder resolves both kinds and applies the one wrap after resolution, so the inline handler and the named handler take the same wrap at the same point. That is also why the runtime's earlier inline-only pre-wrap is removed rather than kept beside it: keeping it would wrap an inline handler twice.

Premises, each measured

P1 (true): a named handler ran in-process without ctx.title, on both doors. The new pin packages/verify/src/harness.named-hook-title-door.test.ts was run against origin/main ee882b845 (built through turbo) before any fix:

× the artifact door: a string handler resolved from the runtime module
× the source door: a string handler resolved from the stack's functions
TypeError: ctx.title is not a function   (both)
Tests  2 failed | 2 passed (4)            (the 2 passing: PR #24356's inline-handler pins)

After the fix (head 043baeb3f), same command: Tests 4 passed (4).

P2 (true): on ee882b845, withInProcessHookTitle wrapped only an inline handler in bindAppArtifactHandlers (hookWithInProcessTitle, typeof hook.handler !== 'function' returns the hook unchanged), before ql.bindHooks. A string handler reached the binder unwrapped. The P1 run above shows it: inline pins green, named pins red.

P3 (false): not every in-process door delivers ctx.title after item 1. Doors enumerated and measured at head 043baeb3f:

Door	Runs in-process?	ctx.title after this PR	Reading
sandboxed body (artifact door, objectstack dev)	no (QuickJS)	yes	pinned, harness.hook-title-door.test.ts artifact case
inline handler via bindAppArtifactHandlers (source boot, os serve over a config)	yes	yes	pinned, harness.hook-title-door.test.ts source case and app-artifact-handlers.hook-title.test.ts
named handler, source door (functions)	yes	yes	pinned, new verify pin
named handler, artifact door (runtimeModule)	yes	yes	pinned, new verify pin
ObjectQLPlugin's metadata-service bind (ql.bindHooks(bindable, { packageId: 'metadata-service' }))	bodies no; a handler only by a name owned by metadata-service	bodies yes (engine default body runner); no wrap passed	read from code: stored rows are JSON, and no caller registers functions under metadata-service
ql.registerHook(event, fn), documented as the plugin escape hatch (data-hooks.md, method 2)	yes	no	measured: typeof ctx.title === 'undefined'
an ObjectQL used directly, ql.bindHooks([...]) with no runtime (a host or a test harness)	yes	no (by design: no wrapHandler)	measured: typeof ctx.title === 'undefined' for an inline and a named handler

The two measured undefined rows came from one scratch vitest run in packages/objectql against a bare new ObjectQL(): {"registerHook":"undefined","bindInline":"undefined","bindNamed":"undefined"}. The scratch file was deleted right after; it was never committed. So HookContext gains no title here. Declaring it, whether required or optional, would declare a member that the documented registerHook door does not deliver. The options go to the PM.

Pins

• packages/verify/src/harness.named-hook-title-door.test.ts (new, G2): on both bootStack doors, a named handler answers ctx.title() = L1 · Widget (this record's formula title, one hop through a lookup), ctx.title('product') = Widget (W-1), and ctx.title('spare') = null. These are the same answers PR fix(runtime): an in-process hook handler is handed the same ctx.title a hook body gets #24356's pin gets from a body.
• packages/objectql/src/hook-binder-wrap-handler.test.ts (new):
  • the inline handler, the name from the bind's functions and the engine-registered name of the same package all take the wrap, once each, at bind;
  • a body's handler never takes it;
  • control: with no wrapHandler, a named handler and an inline handler are called with the engine's own context object (identity), as before.

Ablation (G2)

One run under trap restore, after the fix was committed (39cf701a1):

• Mutation. The wrapHandler: line was deleted from packages/runtime/src/app-artifact-handlers.ts through scripts/ablation-replace.mjs: anchor 1 → 0, blob 1b658c88ace0 → 376387b42a8a.
• Rebuild. Runtime was rebuilt. The build exited 1 in its declaration pass, because noUnusedLocals flags the now-unused withInProcessHookTitle import. That happens after the JS emit, so the marker count in dist/index.js went 1 → 0, and ablation-dist-preflight.mjs runtime 'wrapHandler: (handler, hook)' --absent exited 0.
• Ablated run. The verify pins went 3 failed | 1 passed: both named-handler doors and the inline source door failed with TypeError: ctx.title is not a function, and the artifact body door stayed green. The inline door going red is expected: inline handlers now take the same one wrap.
• Restore. git checkout HEAD -- ABS_PATH gave blob 1b658c88ace0, equal to the HEAD blob, and git diff HEAD was empty. Runtime was rebuilt (exit 0, marker count back to 1) and the pins were 4 passed (4).

Local verification (head 043baeb3f)

• Build closure: turbo run build --filter=@objectstack/verify... (49 tasks), then the 4 touched packages, then --filter='!@objectstack/docs' for check:dual-build-cjs-loads.
• Derived gates (dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no paths): 92 families.
  • 89 passed with exit 0 on the first pass.
  • 3 first refused on prerequisites and then passed, exit 0:
    • check-engine-split-ratio --days 90 (exit 2) and check-plugin-teardown-shape --self-test (exit 3) on the shallow clone; both passed after git fetch --unshallow origin main.
    • check:dual-build-cjs-loads (exit 3, no dist); passed after the full build: "111 published require entry point(s) across 69 package(s) load".
• Typecheck (each pnpm --filter PKG typecheck, test layer included): spec, runtime and verify passed with exit 0. objectql first exited 1: the new pin's context literal lacked ql, which gave TS2352 under tsconfig.test.json. That is fixed in a2263206e, and objectql then exited 0 ("test layer compiles").
• Tests:
  • objectql: vitest run 446 files, 8362 passed.
  • runtime: vitest run --project local 421 files, 6626 passed, 19 skipped.
  • verify: vitest run 43 files, 371 passed.
• eslint --no-inline-config over the 6 changed .ts files: exit 0.
• Final head a2263206e changes only that test literal. --commands derives the same 92 families there. The test-facing gates (check:cross-package-test-inputs, check:test-source-alias, check:nul-bytes, check:tier-file-adoption) were re-run there with exit 0, and --ran reconciles 92 derived, 92 run, 0 NOT-MEASURED, 0 UNRUN.

Acceptance notes

• Item 2 (HookContext.title) is held for a decision; the reading and the options are in the os-dev-report on Hook ctx.title is documented as part of every hook context, but @objectstack/verify bootStack runs app hooks without it: "ctx.title is not a function" under the test harness, while objectstack dev serves it #24289.
• @objectstack/verify changes only a test file (its files[] ships dist only), so it takes no changeset entry.

Dev session: session_01UxK7vXeLCgYoxSXaHuQA1Y (mode:cloud), dispatched by the domain:spec seat 2 (session_019oFY6Hi35J7atvgVFnmoaK) for claim 6257131238.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UxK7vXeLCgYoxSXaHuQA1Y

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/objectql, @objectstack/runtime, @objectstack/spec, touching 8 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v17/17-7.mdx (via bindAppArtifactHandlers (symbol, a top-level function))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 148 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e22defb13c171900e2c1c54d1d15c24ed85fe91b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 7d816eab584237726d2e342fbf2b17a24c00c12e — the merge of head 5753938245d5000bbacd6287e086b4a5e2c01604 into base e22defb13c171900e2c1c54d1d15c24ed85fe91b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7d816eab584237726d2e342fbf2b17a24c00c12e && git checkout 7d816eab584237726d2e342fbf2b17a24c00c12e
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e22defb13c171900e2c1c54d1d15c24ed85fe91b 5753938245d5000bbacd6287e086b4a5e2c01604 && git checkout -B drift-repro e22defb13c171900e2c1c54d1d15c24ed85fe91b && git merge --no-ff 5753938245d5000bbacd6287e086b4a5e2c01604

node scripts/docs-audit/affected-docs.mjs --json e22defb13c171900e2c1c54d1d15c24ed85fe91b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e22defb13c171900e2c1c54d1d15c24ed85fe91b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 (seat check) · PR #24423 · domain:spec seat 2 · zhuangjianguo · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-19T02:22Z

ACCEPT at head a2263206e7e1fa58553a4fb936eca4488d4ff11b (claim 6257131238, mode:cloud session session_01UxK7vXeLCgYoxSXaHuQA1Y, report 6257914461 on #24289) for item 1 only. A contract review at CONTRACT_REVIEW_TIER is owed: the published contract type IObjectQLEngine.bindHooks opts, Clause-②: yes (widening). It runs on this head, isolated from the seat. needs:contract-review is on the PR until its record is adopted.

item	reading
Shape	Draft, base main, assignee zhuangjianguo. Line 1 is Part of #24289, with no closing keyword (the brief's own route once P3 failed), and Clause-②: yes (widening) starts a line. 7 files, +297/−24. Not governed. The changeset is minor on @objectstack/spec and patch on @objectstack/objectql and @objectstack/runtime.
The option	BindHooksOptions.wrapHandler(handler, hook) is applied once per hook at bind, after a string handler resolves (resolveInProcessHandler), and never to a body's handler. ObjectQL.bindHooks and the spec contract carry it, typed with spec Hook / HookContext, with no any. bindAppArtifactHandlers passes withInProcessHookTitle through it. The inline-only pre-wrap is removed, so both handler kinds take one wrap, and a caller that passes no option binds as before.
Premises	P1 true: the new verify pin was red on ee882b845 on both doors (TypeError: ctx.title is not a function) and is green after. P2 true. P3 false: ql.registerHook(...) (documented in skills/objectstack-data/references/data-hooks.md) and a bare ObjectQL bindHooks without the runtime still run hooks with no ctx.title. So per the brief's prohibition, item 2 (HookContext.title) is not built, and the card stays open for the decision.
CI	On this head: 41 runs, 35 success, 6 skipped.
Accepted deviations	No @objectstack/verify changeset: only a test file changed there. body-runner.ts is untouched. Its withInProcessHookTitle "Why" docblock still speaks of the inline handler only; that is polish, carried by whichever PR next edits the file.
Item 2	The seat puts the decision to the maintainer on #24289 (options A–D and the four-axis analysis there). The card moves to needs-user-decision when this PR lands.
Landing	After a contract-review PASS and a green head: pr_ready then automerge_enable. Part of, so #24289 stays open.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a2263206e7e1fa58553a4fb936eca4488d4ff11b
Local-runs: none
Scope: packages/spec/src/contracts/objectql-engine.ts + packages/objectql/src/hook-binder.ts, packages/objectql/src/engine.ts, packages/objectql/src/hook-wrappers.ts (read, unchanged), packages/objectql/src/plugin.ts (the two other bindHooks callers; read, unchanged), packages/runtime/src/app-artifact-handlers.ts, packages/runtime/src/sandbox/body-runner.ts (withInProcessHookTitle, buildTitleSurface; read, unchanged), packages/objectql/src/hook-binder-wrap-handler.test.ts, packages/verify/src/harness.named-hook-title-door.test.ts, .changeset/24289-named-hook-handler-ctx-title.md

PR #24423 (Part of #24289, item 1 of the release 6252025560), net diff against the merge base ee882b845 with origin/main: 7 files, +297 / -24. Inputs: the card and its 14 comments, the PR body and file list, the net diff, and the 45 check-runs on this head (36 success, 9 skipped, 0 failure; the five required contexts all success). No worktree, build, test or gate run.

① Derived judgments

1. The contract member — right. IObjectQLEngine.bindHooks opts gain an optional wrapHandler: a function of (handler, hook: Hook) that returns a handler, where handler and the returned function are both functions of (context: HookContext) returning unknown; typed by import type { Hook, HookContext } from '../data/hook.zod'. Both types are spec-owned (packages/spec/src/data/hook.zod.ts, the z.input types of HookSchema and HookContextSchema), so the import satisfies the file header's own predicate ("a type that MOVES into spec loses the excuse" for unknown). The evidence bar holds: it is an option on an existing member whose cross-package consumer through the slot is already in the tree (bindAppArtifactHandlers, packages/runtime). Narrowness: the binder hands a HookHandler ((context: HookContext) returning a Promise of void or void), assignable to the declared parameter; the unknown return is exactly what the binder does with it (an async adapter that awaits wrapped(context) and returns nothing, result discarded), and anything narrower would force a retype or a cast of the one wrap passed (withInProcessHookTitle returns a Promise of unknown). hook: Hook whole rather than a pick of name: the runtime reads only hook.name, but a wrap that reads runAs or object is a legitimate use of the same option. Judged right, not a widening past need.
2. Implementers — right. git grep "implements IObjectQLEngine" on the head: ObjectQL only (packages/objectql/src/engine.ts:4437). Its bindHooks opts carry wrapHandler?: BindHooksOptions['wrapHandler'], the same signature, spread into the binder's opts. The structural fakes typed against bindHooks (packages/cloud-connection/src/marketplace-install-local-*.test.ts, packages/objectql/src/plugin-authored-hooks.test.ts's vi.fn()) take fewer optional opts and stay assignable; Type Check · workspace, Type Check · consumer gates and TypeScript Type Check are success.
3. TSDoc on the member — true of the code, with one loose phrase. "Called once per hook, at bind": resolveHandler runs once per hook in bindHooksToEngine's loop; the events-times-objects registration reuses the one wrapped; the binder pin asserts wrappedFor stays at 3 after two triggerHooks rounds. "Never applied to the handler bodyRunner builds from a body": the body branch of resolveHandler returns before resolveInProcessHandler is reached, so a hook carrying both body and handler binds its body and the wrap is never consulted (the same outcome the removed pre-wrap produced). "The engine awaits a handler and discards its return value": triggerHooks (await entry.handler(context)), dispatchUnscopedMultiWriteHooks (await entry.handler(wholeOpCtx)) and wrapDeclarativeHook's runWithTimeout (await handler(ctx), or a Promise.resolve().then(...) around handler(ctx) raced against the timer under timeoutMs) read no return. "What it returns is what the engine calls" is loose — the engine calls wrapDeclarativeHook(hook, adapter) — but the next sentence states the discard, and the returned function is the hook's handler in the position any resolved handler takes. Not misleading; no edit owed.
4. Behaviour for existing callers — right; with no option the bind is byte-for-byte as before. resolveInProcessHandler is the old tail of resolveHandler moved verbatim (the hunk is pure insertion above const h = hook.handler;). Without wrapHandler, resolveHandler returns that function unchanged (if (!fn || typeof opts.wrapHandler !== 'function') return fn;). The two other callers in the tree, ObjectQLPlugin's binds at packages/objectql/src/plugin.ts:3121 and :3723 ({ packageId: 'metadata-service' }), pass no option. The control pin asserts a named and an inline handler are called with the engine's own context object (identity). With the option, the adapter is always async and resolves undefined: every call site awaits and discards, so a synchronous throw becomes a rejection at the same await and nothing observable moves. The wrap sits inside wrapDeclarativeHook, where the removed pre-wrap sat, so the runAs swap of ctx.api and the fire-and-forget detached view are read by the title view at call time as before. The meta registered with the engine is now the app's own declaration rather than the pre-wrap's copy; nothing in packages/objectql/src or packages/runtime/src reads meta.handler, and wrapDeclarativeHook reads only async, runAs, name, condition, timeoutMs and onError.
5. The removed inline pre-wrap — every door it served is still served. The base hookWithInProcessTitle wrapped a hook whose handler is a function; the head wraps that function and the function a string handler names (the bind's functions, then the same package's engine-registered function through the unchanged ownPackageFunction). Copy semantics hold more simply than before: the binder never writes the hook object, and PR fix(runtime): an in-process hook handler is handed the same ctx.title a hook body gets #24356's runtime pin "the app's own declaration is not rewritten" (expect(hook.handler).toBe(handler)) is unchanged at head (blob a45861e6a7, equal to the merge base's) and green under Test Core (6 of 6 shards success). PR fix(runtime): an in-process hook handler is handed the same ctx.title a hook body gets #24356's verify pin (harness.hook-title-door.test.ts, blob 9d9503a70e) is likewise unchanged and green. withInProcessHookTitle and buildTitleSurface are untouched (body-runner.ts is not in the file list).
6. The pins — they pin the changeset's claims, with a control. harness.named-hook-title-door.test.ts: on both bootStack doors (artifact runtimeModule plus string handler; source functions plus a name) ctx.title() is L1 · Widget, ctx.title('product') is Widget (W-1), ctx.title('spare') is 'null' — the same EXPECTED PR fix(runtime): an in-process hook handler is handed the same ctx.title a hook body gets #24356's pin holds for an inline handler and a body, which serves as the cross-file control. hook-binder-wrap-handler.test.ts: the three in-process kinds take the wrap once each at bind; a body's handler never does; the control without wrapHandler is by context identity. Both files are compiled by their package's tsconfig.test.json (src/**/*, no test exclusion) behind check:test-typecheck. Not pinned, judged from code only: a hook carrying both body and handler under wrapHandler (item 3). The PR's before-reading on ee882b845 (both named doors red with TypeError: ctx.title is not a function) is the dev's local measurement, taken as the PR's claim and consistent with the base code as read.
7. Scope — right. Seven files, +297 / -24, no governed path (Governed Surface Queue Guard success), head repo equal to base repo, no ADR governs bindHooks opts (the file's ADR anchor is on transaction, ADR-0067 and ADR-0119, untouched; Lint & Repo Gates success carries check:adr-anchors).

② Semver level

Clause-②: yes (widening)

• @objectstack/spec: minor — right. IObjectQLEngine.bindHooks opts gain an optional member: an additive widening of a published contract type. It matches the PR body's and the changeset's Clause-②: yes (widening), the retriage 6255696396 and the regrade 6255762317.
• @objectstack/runtime: patch — right. bindAppArtifactHandlers changes behaviour and no published surface: its signature is unchanged and withInProcessHookTitle stays a module export off the package index.
• @objectstack/objectql: patch — wrong, under-graded; FAIL item. BindHooksOptions is published from the package index (packages/objectql/src/index.ts:391, export type { BindHooksOptions, BindHooksResult }) and gains the accepted key wrapHandler; ObjectQL.bindHooks, a method of the published class, accepts the same new key. That is "a purely additive widening of a published package's public surface (a new exported symbol on an index, a new accepted key or value)", which the level rule the Check Changeset gate prints (the maintainer's ruling on decision batch [WIP] Add query enhancements and advanced validation features #35) grades at least minor; the commit type fix( does not lower it. The gate's level axis stayed green because it requires only ONE moved package at minor or above (spec here), and its own text says it cannot read WHICH package received the widening. Remedy: '@objectstack/objectql': minor in .changeset/24289-named-hook-handler-ctx-title.md; no other line moves. Earlier option additions on BindHooksOptions in the objectql changelog predate the rule and are not precedent.
• No entry for @objectstack/verify — right. The package publishes files: ['dist', 'README.md', 'CHANGELOG.md'] and the PR adds one src/*.test.ts, so nothing it publishes moves. The gate counts the changeset files added against the merge base (1, non-empty) and does not judge per-package coverage; Check Changeset is success on both of its runs for this head.

③ Boundary flags

1. Item 2 not built (dev deviation 3, needs_decision) — accepted as the brief's own route. HookContextSchema declares no title at head (grep over packages/spec/src/data/hook.zod.ts), and the dispatch claim 6257131238 makes item 2 conditional on item 1 delivering at every in-process door. The PR's P3 reading is confirmed from code: ql.registerHook(event, fn) bypasses the binder; the two ObjectQLPlugin binds pass no wrapHandler; a bare ObjectQL.bindHooks with no option returns the handler unwrapped. The options go to the maintainer through the seat; not judged here.
2. Accuracy of the PR's own text — accurate. The changeset's "Unchanged" paragraph and the PR body's P3 table name the doors that do and do not deliver ctx.title; the "no wrap passed" row for the metadata-service bind is confirmed (plugin.ts:3121, :3723), and no function is registered under the metadata-service owner anywhere in packages/. No sentence in the diff — the two TSDoc blocks, the runtime comment, the two test headers, the changeset — claims ctx.title on every door; each is scoped to the binder's option, to bindAppArtifactHandlers, or to the two bootStack doors. The docs (skills/objectstack-data/references/data-hooks.md) stay untouched, as the claim's hold-off requires.
3. No @objectstack/verify changeset (dev deviation 1, G4) — answered in ②: right.
4. body-runner.ts untouched; its withInProcessHookTitle "Why" docblock still speaks of the inline handler only (dev finding, carrier none) — accepted as polish outside the claim's file surface (body-runner.ts only if the signature must change; it did not). Not a FAIL item; the next edit to that file owns the sentence.
5. The contract file's header still lists HookContext among the "packages/objectql-local" types the contract must spell as unknown, one screen above the import this PR adds. The header's own live predicate authorises the import; the stale example predates this PR. Polish, not blocking.
6. Test wall time — the verify pin boots two stacks under a 120 s per-test ceiling, the same shape as PR fix(runtime): an in-process hook handler is handed the same ctx.title a hook body gets #24356's landed pin; not measured here, and Test Core is success. Nothing owed in this record.
7. Dev deviations 2 and 5 (a detached primary checkout in the dev's own container; three prerequisite-refused gate families re-run to exit 0) — recorded, no contract bearing.

Implemented-by: claude/issue-24289-named-handler-ctx-title
Reviewed-by: session_019oFY6Hi35J7atvgVFnmoaK

VERDICT: FAIL

One item fails: ② @objectstack/objectql is graded patch for a published-surface widening (BindHooksOptions.wrapHandler, ObjectQL.bindHooks opts); minor is owed. Everything else on the contract face passes, so the review after that one-line changeset edit is a ② re-read on the new head.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 (seat check) · PR #24423 · domain:spec seat 2 · zhuangjianguo · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-19T02:39Z

REWORK (patch round 1, same claim 6257131238, same mode:cloud session session_01UxK7vXeLCgYoxSXaHuQA1Y) at head a2263206e7e1fa58553a4fb936eca4488d4ff11b, from contract review 6258477908 (FAIL, one item). Everything else in that record and in the seat check 6258301985 holds.

• The FAIL item: .changeset/24289-named-hook-handler-ctx-title.md grades @objectstack/objectql as patch. But BindHooksOptions is exported from the package index (packages/objectql/src/index.ts:391) and gains the accepted key wrapHandler, and ObjectQL.bindHooks accepts it too. That is an additive widening of a published surface, which the level rule grades at least minor. The fix( commit type does not lower it.
• The fix: '@objectstack/objectql': minor in that changeset. No other line moves. Re-read the changeset's prose so that it says nothing that contradicts a widening.
• Push once after check-changeset-no-major --base origin/main and check-empty-changeset --base origin/main exit 0 locally. CI is read on the new head.
• After the push: a short round-2 contract review on the new head, then landing (pr_ready, automerge_enable). Part of #24289: the card stays open for item 2, which is with the maintainer (6258330202, corrected by 6258456134).

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 5753938245d5000bbacd6287e086b4a5e2c01604
Local-runs: none
Scope: packages/spec/src/contracts/objectql-engine.ts + .changeset/24289-named-hook-handler-ctx-title.md (the delta), packages/objectql/src/index.ts, packages/objectql/src/engine.ts, packages/objectql/src/hook-binder.ts, packages/objectql/src/plugin.ts (read, unchanged), packages/runtime/src/index.ts (read, unchanged), packages/runtime/src/app-artifact-handlers.ts, packages/verify/package.json (read, unchanged)

Round 2 on PR #24423 (Part of #24289, item 1 of the release 6252025560). Round 1 is the record 6258477908 on head a2263206e, FAIL on one item (② @objectstack/objectql graded patch); the seat's REWORK is 6258486561; the dev's round-1 report on the card is 6258759632. The new head 5753938245 is one commit on top of a2263206e (chore(changeset): grade @objectstack/objectql minor for the BindHooksOptions.wrapHandler widening, carrying the model-free trailer pair). Inputs: the two records above, the PR object, body and file list, the card and its 17 comments, the delta diff between the two heads, the net diff against the merge base ee882b845, origin/main at 538f923cb, and the 41 check-runs on this head (35 success, 6 skipped, 0 failure). No worktree, build, test, gate or ablation run.

① Derived judgments

1. The delta is exactly the one line the FAIL item asked for. git diff a2263206e 5753938245 --stat: 1 file, +1 / -1, .changeset/24289-named-hook-handler-ctx-title.md (blob deac6a466 to 7023b1234); the hunk is '@objectstack/objectql': patch to '@objectstack/objectql': minor. The other six files are blob-identical at the two heads: engine.ts 9883e569af, hook-binder.ts 39d0c63916, hook-binder-wrap-handler.test.ts 43109ed1c2, app-artifact-handlers.ts 1b658c88ac, objectql-engine.ts 78adfe03b5, harness.named-hook-title-door.test.ts 3b076a13ac. The changeset's prose was re-read as the REWORK asked: its "What changed" paragraph names the option on bindHooksToEngine, ObjectQL.bindHooks and the IObjectQLEngine.bindHooks contract, it keeps Clause-②: yes (widening), and no sentence in it reads as a patch-only claim; nothing in it contradicts a widening.
2. The net diff against the merge base is otherwise unchanged from round 1, so round 1's ① judgments 1 to 7 carry over. The merge base of both heads with origin/main is ee882b845, and git diff ee882b845 5753938245 --stat is 7 files, +297 / -24, the same seven paths and the same count round 1 read (the delta replaces one line for one). Round 1's readings of the contract member (wrapHandler, a function of handler and hook: Hook returning a function of context: HookContext returning unknown, typed by the spec's own Hook and HookContext), of the one implementer (ObjectQL, packages/objectql/src/engine.ts:4437, the only implements IObjectQLEngine in packages/*/src on this head), of the TSDoc, of the no-option bind being byte-for-byte as before, of the removed pre-wrap's doors, of the pins and of the scope were made on code that has not moved: the six blobs above are identical, and the adjacent files those readings cite (plugin.ts, hook-wrappers.ts, objectql's index.ts, hook.zod.ts, body-runner.ts, runtime's index.ts) are blob-identical between the merge base and origin/main. The two ObjectQLPlugin binds (plugin.ts:3121, :3723) still pass no wrapHandler. Nothing is re-derived here that the head did not change.
3. Runtime exported surface, re-checked for ②. packages/runtime/src/index.ts is blob a82a2c8b2d at the merge base and at this head; it re-exports bindAppArtifactHandlers and the other app-artifact-handlers.ts exports unchanged. That file's export declarations are the same seventeen at the merge base and at the head (line-shifted); the three hunks sit inside the body of bindAppArtifactHandlers (signature untouched, AppArtifactHandlerBindingOptions and AppArtifactHandlerBinding untouched) and remove hookWithInProcessTitle, a module-private function that was never exported. No runtime export widens or narrows.
4. The check-runs on this head. 41 check-runs: 35 success, 6 skipped (Build Docs, Console Pin Gate, Dogfood Regression Gate matrix shard, Dogfood Verify CLI, Packed-tarball smoke (opt-in), Temporal Conformance (live PG + MySQL)), 0 failure, 0 in progress. The five required contexts, read off the live ruleset on main (GET /rules/branches/main) and equal to the five rows of REQUIRED_CONTEXTS in scripts/check-required-contexts.mjs, are all success: Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard. Also success: Check Changeset, Type Check · workspace, Type Check · consumer gates, Type Check · source gates, Type Check · debt ledger, Test Core (1/6) to (6/6), Spec property liveness, the two closing-claim guards and Part-of PR must not also close its card.
5. The PR's own text is accurate on the new head. The body states no per-package level (so the dev's pr_body_edits: none is right), keeps Clause-②: yes (widening), and states the no-@objectstack/verify-entry reason; the changeset is the only place a level is written. The docs-drift bot (6257906036) names one release-owned page (content/docs/releases/v17/17-7.mdx, via bindAppArtifactHandlers) as read-only; the PR does not touch it, as the guardrail requires.

② Semver level

Clause-②: yes (widening)

• @objectstack/objectql: minor — right; this closes round 1's one FAIL item. BindHooksOptions is published from the package index (packages/objectql/src/index.ts:391, export type { BindHooksOptions, BindHooksResult }) and gains the accepted key wrapHandler; ObjectQL.bindHooks, a method of the published class, accepts the same key (engine.ts:4869 to :4870). An additive widening of a published surface is at least minor under the level rule the Check Changeset gate prints, and the commit type fix( does not lower it. minor is what the changeset now says.
• @objectstack/spec: minor — right, unchanged from round 1. IObjectQLEngine.bindHooks opts gain an optional member: an additive widening of a published contract type (packages/spec/src/contracts/objectql-engine.ts, blob unchanged since round 1).
• @objectstack/runtime: patch — right, unchanged from round 1 and re-checked in ① item 3. bindAppArtifactHandlers changes behaviour only; the package index and every export of app-artifact-handlers.ts are the same at the merge base and at the head.
• No entry for @objectstack/verify — right, unchanged from round 1. packages/verify/package.json publishes files: ['dist', 'README.md', 'CHANGELOG.md'] (blob unchanged at the merge base, at the head and on origin/main), and the PR adds one src/*.test.ts; nothing it publishes moves.
• Check Changeset is success on this head. The gate's level axis asks for one moved package at minor or above and cannot read which package received the widening; the three levels above are judged from the exported surfaces, not from the gate.

③ Boundary flags

1. Not merging origin/main (dev deviation 1) — accepted; the PR is mergeable and a queue rebuild onto current main changes nothing this review judged. The dev's basis is .claude/agents/os-dev.md (on origin/main) line 279, which allows a post-PR merge of main only on a conflict, a main-caused CI red or a dequeue, with line 188 giving that file precedence over the dispatch wording; none of the three holds. The PR object reads mergeable: true, mergeable_state: clean, auto_merge: null, draft: true, head repo equal to base repo. main has moved 6 commits past the merge base (97cb5c5a8 to 538f923cb; 56 files, +1539 / -78). git log ee882b845..origin/main -- PATHS over the PR's seven paths is empty, and the adjacent files the hunks read are blob-identical between the merge base and origin/main (① item 2). The packages/spec/src files main moved are stack.zod.ts, two semantic migration entries, registry.ts.template and stack-page-walk-panels.test.ts, none of them the contract file or hook.zod.ts; main's own governed-path edits (docs/adr/0090, docs/adr/0095) are not this PR's paths. A queue rebuild merges disjoint files and re-runs the same code this record read.
2. Item 2 (HookContext.title) not built — unchanged from round 1, the maintainer's. The card stays open for it (6258330202, corrected by 6258456134); the dev's report 6258759632 keeps needs_decision for that half. Not judged here.
3. Round 1's boundary flags 1 to 7 carry over. Flag 3 (no @objectstack/verify changeset) is answered in ②. Flag 4 (body-runner.ts's withInProcessHookTitle docblock still speaks of the inline handler only) and flag 5 (the contract file's header still lists HookContext among the types the contract spells as unknown, one screen above the import) stay polish; the dev records flag 5 as an out-of-scope finding with carrier none in 6258759632. Flag 6 (test wall time) and flag 7 (dev deviations 2 and 5, now joined by this round's deviation 2, a re-created worktree) have no contract bearing.
4. No governed path. The file list is the same seven paths; Governed Surface Queue Guard is success; the PR carries needs:contract-review, which this record answers.

Implemented-by: claude/issue-24289-named-handler-ctx-title
Reviewed-by: session_019oFY6Hi35J7atvgVFnmoaK

VERDICT: PASS

The one FAIL item of round 1 is closed by the one-line changeset edit; everything else on the contract face is the round-1 reading on unchanged blobs, and the five required contexts are green on this head. Landing (pr_ready, automerge_enable) is the owning seat's; item 2 stays with the maintainer.

---

Generated by Claude Code

[objectstack-fleet]

Contract review adopted · domain:spec seat 2 · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-19T03:32Z

• Adopted: contract review round 2, 6259051030.
  • Served-tier: CONTRACT_REVIEW_TIER. Head-sha 5753938245d5000bbacd6287e086b4a5e2c01604 is the current head. PASS, no FAIL item.
  • Round 1's one FAIL item (@objectstack/objectql graded patch) is closed by the one-line changeset edit, now minor.
  • The other six files are blob-identical to round 1's head, so round 1's judgments carry over.
  • needs:contract-review is removed in this act.
• Not merging origin/main: the dev's deviation, accepted by the review. The PR is mergeable_state: clean, and none of its files changed on main since the merge base. The queue rebuild changes nothing the review judged.
• Pre-landing on this head:
  • 41 check-runs: 35 success, 6 skipped. The five required contexts are green.
  • check-expected-skips: OK.
  • check-governed-merges: not governed, +297/−24.
• Landing: pr_ready then automerge_enable, in this act.
  • Part of #24289, so the card stays open.
  • At the merge, the card's claim is released, and it moves to needs-user-decision for item 2 (analysis 6258330202, corrected by 6258456134).
  • The mode:cloud session session_01UxK7vXeLCgYoxSXaHuQA1Y is archived at the merge.

---

Generated by Claude Code