[objectstack-fleet]

security#1 · os-bob · session_012dn2AdqWnb3ndnEacKvJvF

Clause-②: no
Metadata-protocol: none
Skills-docs: none — what a metadata author writes is unchanged; only the refusal entry one class of write receives changes

维护者速读

• 改了什么:岗位分配(sys_user_position)与权限集授予(sys_user_permission_set)的写入,若点名一个调用者自己读不到的用户,被拒时改为得到与"该用户不存在"完全相同的回答,由引擎自己的引用检查给出。
• 为什么改:安全加固——调用者从一次被拒的授予里,不应得知任何关于自己无权查看的用户的信息。
• 风险与回滚:哪些写入被拒、状态码与错误码都不变,只换掉一类拒绝条目的文案与约束字段;出厂权限下组织管理员看不到组织外的用户,所以对组织外用户的拒绝文案会从"不是该组织成员"变为"不存在该用户记录"。回滚即还原一个文件。
• 先看:packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts(holderLeftToReferenceCheck 与 referenceCheckAsksCaller 两段,风险在后者的放行条件)、同名测试文件末尾新增的 describe 块、packages/core/src/security/second-object-read-exposure.pin.test.ts 里新增的一条普查登记、.changeset/sec-grant-holder-unreadable-answer.md。
• 两分钟验证:pnpm --filter @objectstack/plugin-security exec vitest run src/grant-holder-membership-refusal.test.ts,预期 31 个测试全部通过。
• 需要你做的:无,席位落地。

What changes

The rule: a refused grant holder the caller cannot read is answered as a holder that does not exist — on sys_user_position and sys_user_permission_set, for every non-system insert, and for every update that names a different holder than the row stores.

• The grant-holder membership refusal now asks the caller's own read door about a holder the write names, the same read the engine's reference check asks of a user_id value. A holder that door does not return is left to the engine's reference check, which answers it with its own reference_not_found entry in the engine's own message context — the answer every other user reference that caller names receives. The plugin keeps no second spelling of that sentence.
• A holder the caller CAN read is judged on organization membership exactly as before, and a non-member keeps the membership refusal and its remedy.
• The hand-off happens only where the engine's check is certain to ask: the live object's user_id is a non-readonly lookup / user reference to sys_user, and sys_user is registered. Anywhere else the membership predicate is judged in the plugin as before.
• The second-object read census (packages/core/src/security/second-object-read-exposure.pin.test.ts) classifies the plugin as a caller of the reference-target arbiter that serves nothing of the target: its one read of a holder is the caller's own read door, projected to id, and its answer only decides whether the write-path reference check answers the holder.
• Unchanged: which writes are refused, 400, VALIDATION_FAILED, fields[].field: user_id, fields[].code: reference_not_found, the system-write stand-down, global grants, and an update that leaves the holder as stored (judged on membership, as before). No new error code.

Route choice: the engine's own reference check answers the holder, rather than the plugin rebuilding the engine's sentence. @objectstack/plugin-security carries no runtime dependency on @objectstack/objectql, where the sentence builder and its message context (negotiated locale, translated field label) live, and handing the holder to the engine's own door keeps every stage after the membership hook identical for any holder the caller cannot read. No engine file is touched.

Tests

packages/plugins/plugin-security/src/grant-holder-membership-refusal.test.ts, one new top-level describe in the existing harness (a real ObjectQL engine over a real SQL driver with the real SecurityPlugin), 10 cases:

• CONTROL — the caller's own sys_user read returns its own row and never the named holder, which exists where the case needs it.
• sys_user_position and sys_user_permission_set, insert and update-by-id — the whole answer an HTTP door serves (resolveThrownHttpError, serialized) is byte-identical across three stores of the same holder id, refused at user_id with reference_not_found; nothing is stored, the updated row is untouched (4 cases).
• A holder the caller cannot read is read only through the caller's own door, projected to its id, and no membership is read for it (every read naming the holder is spied: non-system, the caller's userId, fields: ['id']) — the behaviour pin the census row above names.
• A holder the caller can read keeps the membership refusal (constraint.target: sys_member), and a readable member is admitted.
• The refusal set is unchanged on the path the engine's check does not judge: an update that moves only the organization is still refused for a non-member and lands once the holder is a member there.
• Under the shipped organization administrator's sys_user read, a member is admitted, and a user outside the organization gets the same answer a missing user gets.
• A composition with no sys_user object: membership is judged in the plugin.

The pre-existing 21 cases of the file pass unchanged.

packages/core/src/security/second-object-read-exposure.pin.test.ts: one CALLERS row, kind: 'not-a-served-read', naming the pin above.

Acceptance notes

• Under the shipped organization_admin set, a user outside the caller's organization is unreadable to that caller, so a grant naming one now reads the engine's reference_not_found sentence instead of the membership sentence. The refusal itself and its codes are unchanged; this is the platform's answer for every user reference that caller cannot read.
• The refused entry's constraint follows the entry: { target: sys_user } from the reference check for a holder the caller cannot read, { target: sys_member, targetField, organization } from the membership refusal otherwise.
• Clause-②: no without an arm: no write accepted before is refused now, and none refused before is accepted.

Verification

Every reading below except the first three ablations was taken at head 367379988 (after the last merge of main, at 7c523aa10).

Package: build, typecheck, full suite

Under the verify lock, after rebuilding the dependency closure (--filter '@objectstack/plugin-security^...'): pnpm --filter @objectstack/plugin-security build, pnpm --filter @objectstack/spec check:generated (14 artifacts up to date), pnpm --filter @objectstack/plugin-security typecheck (incl. check:test-typecheck: 0 errors), the core repo project (Test Files 7 passed (7), Tests 96 passed (96)), then the plugin-security suite: Test Files 248 passed (248), Tests 5834 passed | 45 skipped (5879), lock VERDICT command-exit 0.

Ablations: 5 legs, each red then restored

Taken at ee912fb9 (the fix commit; the test file has since lost one type cast and nothing else). Each leg mutated through scripts/ablation-replace.mjs, which proves the mutation landed (anchor count, blob hash) and that the restore matched HEAD with git diff HEAD empty. The tests import the hook from src/, so no dist/ is involved.

1. The insert-path hand-off removed: 2 of 30 red, exactly the two insert cases.
2. The update-path hand-off removed: 2 of 30 red, exactly the two update cases.
3. The sys_user-registered condition removed from the hand-off guard: 1 of 30 red, the no-sys_user composition case (the write is no longer refused).
4. At 367379988, the census row's key renamed: 2 of 4 red in the core pin (the unclassified-caller case, which names this file, and the vacuity control).
5. At 367379988, the insert-path hand-off removed: 3 of 31 red, the two insert cases and the read-shape pin.

Gates

node scripts/pm/dispatch-gates.mjs --commands derives 69 families at 367379988 (the core census file adds six). All 69 exit 0 at 367379988, check:type-check-debt included (run under the verify lock). check:dts-closure and check:dual-build-cjs-loads first read exit 1 while this worktree's own closure build was rewriting packages/spec/dist beside them; re-run after it, both exit 0. --ran reconciliation: 69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN. Repo-wide scans and every other family are CI's.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 9 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/frontend/plugins/plugin-view.mdx (via onUpdate (symbol, a top-level function))
• content/docs/permissions/system-context.mdx (via onInsert (symbol, a top-level function), onUpdate (symbol, a top-level function))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: sys_user (literal, 49 pages)
• the SDK route bridge reached 63 of 226 client-bound route-ledger rows — the other 163 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 163: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 104 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7c523aa108650e48d19419ae9b76924c64707741 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12cbfaf3a96464554a5cbad10461dafb17bf2c19 — the merge of head 367379988e6328b95977490715653b995f8ef644 into base 7c523aa108650e48d19419ae9b76924c64707741, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12cbfaf3a96464554a5cbad10461dafb17bf2c19 && git checkout 12cbfaf3a96464554a5cbad10461dafb17bf2c19
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7c523aa108650e48d19419ae9b76924c64707741 367379988e6328b95977490715653b995f8ef644 && git checkout -B drift-repro 7c523aa108650e48d19419ae9b76924c64707741 && git merge --no-ff 367379988e6328b95977490715653b995f8ef644

node scripts/docs-audit/affected-docs.mjs --json 7c523aa108650e48d19419ae9b76924c64707741

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7c523aa108650e48d19419ae9b76924c64707741 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

security#1 · os-bob · session_012dn2AdqWnb3ndnEacKvJvF
os-dev-report

{
  "issue": null,
  "status": "done",
  "branch": "claude/sec-grant-holder-sentence",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31244",
  "session": "session_012dn2AdqWnb3ndnEacKvJvF",
  "premise_still_valid": true,
  "summary": "Rule implemented in packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts: a refused grant holder the caller cannot read is answered as a holder that does not exist. For a holder the write names (every non-system insert; an update naming a different holder than the row stores) the hook first asks the caller's own read door the same sys_user read the engine's reference check asks (through ctx.api, memoized per write); a holder that door does not return is left to the engine's reference check, which answers it with its own reference_not_found entry in its own message context. A readable holder is judged on membership as before and keeps the membership sentence (Zone 2 item 2 measured: kept). The hand-off happens only where that check is certain to ask (live user_id is a non-readonly lookup/user reference to sys_user, sys_user registered); otherwise membership is judged in the plugin as before. Route: Zone 3 alternative in effect (the engine's door answers ahead of the hook), implemented inside the hook file; no engine file touched, nothing in delegated-admin-gate.ts or the other serial files. Preferred route not taken because plugin-security has no runtime dependency on objectql, where the sentence builder and its message context (negotiated locale, translated label) live, and handing the holder to the engine's own door keeps every stage after the hook identical for any holder the caller cannot read. Premise measured on a real engine before the fix (readings in the private field). Refusal set, 400, VALIDATION_FAILED, field and field code unchanged; the refused entry's constraint follows the entry (reference check's for an unreadable holder). Under the shipped organization_admin sys_user read, users outside the organization are unreadable, so their refusal now carries the reference check's sentence (stated in PR and changeset). Declarations: Clause-② written as `no` with NO arm, not the dispatch's `(narrowing)` hypothesis: no write accepted before is refused now and none refused before is accepted, so the arm is not true and full dogfood is not owed; flagged here rather than chosen silently. Metadata-protocol: none; Skills-docs: none with reason. Standard-text conflict: os-dev rule 2 says pr_create carries the claim Account as assignee, AGENTS.md says pr_create carries none and the seat assigns at hand-over; AGENTS.md wins, PR opened with no assignee. main merged twice (last at c9fed93ed, incoming plugin-security and objectql changes) and every reading retaken there. One mis-typed background command (a dependents filter) was killed before it acquired the lock. Worktree removed after the report comment.",
  "tests": "At c9fed93ed under the verify lock: closure rebuilt (--filter '@objectstack/plugin-security^...'), plugin-security build, spec check:generated (14 artifacts up to date), plugin-security typecheck incl. check:test-typecheck (0 errors), full suite: Test Files 248 passed (248), Tests 5833 passed | 45 skipped (5878), VERDICT command-exit 0. Earlier heads: 9c5f2651-era suite 248/248, 5805 passed; target file 30/30 at 1e980018. New: one top-level describe in grant-holder-membership-refusal.test.ts, 9 cases (control read; insert and update-by-id on both tables with the served answer byte-identical across three stores of one holder id; readable holder keeps the membership refusal and a readable member is admitted; organization-only move still judged on membership, then lands once a member; shipped user read; no sys_user composition); 21 prior cases unchanged. Ablations at ee912fb9 via scripts/ablation-replace.mjs (mutation landed by anchor count and blob hash, restore blob == HEAD, git diff HEAD empty each time; tests import the hook from src, no dist involved): insert hand-off removed 2/30 red (the two insert cases); update hand-off removed 2/30 red (the two update cases); sys_user-registered guard condition removed 1/30 red (no-sys_user case: write no longer refused).",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack derived 63 families, identical at 9c5f2651 and c9fed93ed. At c9fed93ed: 62 exit 0 (exit codes captured before any pipe, recorded as COMMAND :: exit N); check:type-check-debt exit 3 NOT MEASURED (closure build never got a lock turn: two 540s queue-timeouts behind a dogfood holder, pid 27631, held 27+ min); it was exit 0 at 9c5f2651. --ran reconciliation at c9fed93ed: 63 derived, 62 run, 1 NOT-MEASURED, 0 UNRUN. At 9c5f2651 check:dual-build-cjs-loads and check:i18n were exit 3 (prerequisite), both exit 0 at c9fed93ed; check-plugin-teardown-shape --self-test needed its pinned commit fetched (owned ref, deleted after), then exit 0. PR #31244 check-runs at report time: Check Changeset, Check PR Size, Governed Surface Queue Guard, Lint (CI release & engine gates, ESLint, PM dispatch-gates, docs & code guards, repo & tooling gates, scoped query-options erasure, scoped slot lookup & corpus, scoped tooling self-tests), PR-body guards, Type Check (consumer gates, debt ledger, source gates, workspace), filter: all in_progress; 18.x upgrade harness, Packed-tarball smoke, Schedule gate: skipped. Test Core / Build Core not yet listed. Not waited on, per contract.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-② measured `no` without an arm; see summary)",
  "mcp_calls": "0 — no MCP GitHub calls",
  "api_writes": "2 — POST /repos/objectstack-ai/objectstack/dispatches (relay pr_create: POST /repos/objectstack-ai/objectstack/pulls, draft, no labels, no assignees; read-back 7527 bytes sent = stored), POST /repos/objectstack-ai/objectstack/dispatches (relay comment via post-stamped: POST /repos/objectstack-ai/objectstack/issues/31244/comments). git push not counted.",
  "open_questions": [],
  "security_findings": "withheld",
  "out_of_scope_findings": []
}

[objectstack-fleet]

security#1 · os-bob · session_012dn2AdqWnb3ndnEacKvJvF
os-dev-report

{
  "issue": null,
  "status": "done",
  "branch": "claude/sec-grant-holder-sentence",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31244",
  "session": "session_012dn2AdqWnb3ndnEacKvJvF",
  "premise_still_valid": true,
  "summary": "REWORK round, new head 367379988 (main merged at 7c523aa10; main has not moved since). (1) Test Core 6/8: the second-object read census in packages/core/src/security/second-object-read-exposure.pin.test.ts now classifies packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts as kind not-a-served-read: the refusal asks whether a grant's user_id is a reference the write-path reference check judges, its one read of the target is the caller's own read door projected to id, and its answer only decides whether that check answers the holder; it reads no field of the target and serves nothing of it. The row names its behaviour pin, added in plugin-security: 'a holder the caller cannot read is read only through the caller's own door, projected to its id, and no membership is read for it' (spies every find naming the holder in all three stores: non-system, the caller's userId, fields ['id'], no sys_member read). File surface widened by that one core test file (one CALLERS row), as authorized. Test Core 6/8 is green at 367379988. (2) Test Core 5/8 (examples/app-todo/test/loop-body-iteration.test.ts timeout): not this change. The file boots ObjectQLPlugin + AutomationServicePlugin + a messaging stub, no SecurityPlugin; plugin-security is only a devDependency of service-automation and its src imports nothing from it, so the hook is not registered there. In any composition the hook returns on isSystem before any new code, and its registration is filtered to the two grant objects, so seed and boot writes pay nothing. Measured under the verify lock, two runs each, separate worktrees: head 367379988 5/5 and 5/5, ESCALATION 327 ms and 328 ms, file 8.53 s and 8.75 s (import 7.24 s and 7.51 s); origin/main 7c523aa10 5/5 and 5/5, ESCALATION 357 ms and 326 ms, file 8.57 s and 8.32 s (import 7.30 s and 7.10 s). The source in that test's closure is byte-identical between the two trees (the only difference under core, objectql, service-automation, driver-sqlite-wasm and app-todo src is the core census test file). Consistent with runner load (CI shard import 134 s); one shard re-run is the seat's. (3) Docs drift: no change to either file. content/docs/permissions/system-context.mdx row 23d states the system stand-down, the refusal set and envelope (400 VALIDATION_FAILED / reference_not_found at user_id, for every caller, a platform administrator included), the membership read's scope and the organization-less and single-posture notes; it names neither the refusal's sentence nor the hook's order against the reference check, every statement in it stays true (a holder the caller cannot read is still refused with that envelope, by the reference check), and its anchors grant-holder-membership-refusal.ts#onInsert and #onUpdate still exist and still judge. content/docs/frontend/plugins/plugin-view.mdx line 224 says a UI component has no onCreate/onUpdate/onDelete callbacks: a name collision, unrelated. (4) PR body not edited by me: replacement body for the seat at /tmp/claude-0/-home-user/5f604739-a23e-5e86-98d1-1572ab046d3b/scratchpad/sec-grant-holder-sentence/pr-body-v2.md (8739 bytes, rule level; adds the census row and the read-shape pin, 31 cases, five ablation legs, readings at 367379988). Carried from round 1: Clause-② stays `no` without an arm (not the dispatch's (narrowing) hypothesis); AGENTS.md over os-dev rule 2 on PR assignees (none set). Comparison worktree and its node_modules removed; the task worktree is kept for this PR's next round.",
  "tests": "At 367379988 under the verify lock: plugin-security closure rebuilt, plugin-security build, spec check:generated (14 artifacts up to date; a first unlocked run crashed in tsc with no diagnostics at default heap, re-run under the lock with a 4 GB heap is green), plugin-security typecheck incl. check:test-typecheck (0 errors), core repo project Test Files 7 passed (7), Tests 96 passed (96) (the census pin 4/4), plugin-security suite Test Files 248 passed (248), Tests 5834 passed | 45 skipped (5879), VERDICT command-exit 0. Target file 31/31. New ablation legs at 367379988 via scripts/ablation-replace.mjs (landed by anchor count and blob hash, restore blob == HEAD, git diff HEAD empty): census row key renamed -> core pin 2/4 red (unclassified caller names this file; vacuity control); insert hand-off removed -> 3/31 red (two insert cases and the new read-shape pin). Round-1 legs at ee912fb9 stand (2/30, 2/30, 1/30). app-todo loop-body-iteration runs: see summary (2).",
  "gates": "dispatch-gates --commands at 367379988 derives 69 families (the core census file adds six: check-dev-prereqs --self-test, spec check:error-code-provenance, check:authz-resolver, check:kernel-hook-pairs, check:object-def-param-keys, check:optional-error-sink). All 69 exit 0 at 367379988, check:type-check-debt included (under the lock: re-measure OK, 0 errors). check:dts-closure and check:dual-build-cjs-loads first read exit 1 while my own app-todo closure build was rewriting packages/spec/dist beside them; re-run after it, both exit 0 (256/256 declarations; 122 entries / 72 packages). --ran reconciliation: 69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN. PR #31244 check-runs at 367379988: every required context green except Test Core (5/8) failure (the app-todo timeout above) and its Test Core rollup; Test Core (6/8) success, Lint & Repo Gates, TypeScript Type Check, Build Core, Governed Surface Queue Guard, Lint UI family, Type Check UI, Test UI (16/16), Build & E2E UI, Live E2E UI, Dogfood Regression Gate, Check Changeset: success.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-② measured `no` without an arm)",
  "mcp_calls": "0 — no MCP GitHub calls",
  "api_writes": "3 in total, 1 this round — round 1: POST /repos/objectstack-ai/objectstack/dispatches (relay pr_create -> POST /repos/objectstack-ai/objectstack/pulls) and POST /repos/objectstack-ai/objectstack/dispatches (relay comment -> POST /repos/objectstack-ai/objectstack/issues/31244/comments); this round: POST /repos/objectstack-ai/objectstack/dispatches (relay comment -> POST /repos/objectstack-ai/objectstack/issues/31244/comments, this report). No body PATCH. git push not counted.",
  "open_questions": [],
  "security_findings": "withheld",
  "out_of_scope_findings": []
}

[objectstack-fleet]

security#1 · os-bob · session_012dn2AdqWnb3ndnEacKvJvF

席位核对

ACCEPT · Head-sha: 367379988e6328b95977490715653b995f8ef644 · 2026-11-08T00:28Z

Contract-tier review (isolated reviewer, rule level): PASS-WITH-NITS at this head, no must-fix.

1. Shape: the grant-holder membership refusal in packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts, its test file, one row in the second-object read census (packages/core/src/security/second-object-read-exposure.pin.test.ts, widened on the seat's rework order after CI named the file), and one patch changeset. No governed path.
2. Ruling A intact: the refusal set, 400, VALIDATION_FAILED, fields[].code: reference_not_found and the system-write stand-down are unchanged; no new code. The hand-off to the engine's reference check happens only where that check is certain to ask, and through the same caller read door.
3. Premise measured: the served answer is byte-identical across the three holder stores on insert and update-by-id for both tables; the five ablation legs each red the expected cases; plugin-security suite 5834 passed; core census 4/4.
4. Gate check-runs on this head: 56 success, 11 skipped, 0 failed. Test Core (5/8) first failed on an examples/app-todo boot timeout that does not load plugin-security (head and main measured equal locally; the merge base is green on that shard); the seat re-ran it once and it passed.
5. Accepted deviations: Clause-②: no with no arm (no write accepted before is refused, none refused before is accepted; fields[].constraint is an untyped record, so no schema face moves). The shipped organization-administrator path is reasoned through the delegated-admin gate rather than tested end to end. Two review nits are carried as follow-ups on the seat, not in this PR.
6. Docs: content/docs/permissions/system-context.mdx row 23d re-read; every statement stays true. The plugin-view.mdx hit is a name collision.
7. Landing: no governed path, so ready and auto-merge through the merge queue.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 42430861831 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (2/8) — 失败步骤: Run this shard's tests

  @objectstack/platform-objects:test:  FAIL  src/apps/translations/setup-nav-dead-key-tombstone.test.ts > conditionally-contributed Setup nav ids stay labelled (#6659) > fr carries a label for every con
    ↳ 失败原因: @objectstack/platform-objects:test: AssertionError: Setup nav ids with no label — no boot-time gate can see these; see this file header: expected [ 'nav_scim_credentials' ] to deeply equal []
  

• Test Core (5/8) — 失败步骤: Run this shard's tests

  @objectstack/example-todo:test:  FAIL  test/loop-body-iteration.test.ts > #19206 — the loop body runs and binds `currentTask` > ESCALATION: the run reaches `notify_owner` and the notice renders the re
    ↳ 失败原因: @objectstack/example-todo:test: Error: Test timed out in 5000ms.
  @objectstack/example-todo:test:  FAIL  test/loop-body-iteration.test.ts > #19206 — the loop body runs and binds `currentTask` > EVERY item is processed, and each one carries its own values
    ↳ 失败原因: @objectstack/example-todo:test: Error: Test timed out in 5000ms.
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/loop-body-iteration.test.ts — 24h 内已弹出 9 个 PR（feat(objectql): restore a recycle-bin entry under its original ids and emit data.record.restored (#30237 PR 3) #31220、i18n(platform-objects): ship the platform objects, Setup, Studio and Account in French #31233、feat(cloud-connection)!: refuse a managed upgrade that renames or retypes a stored field until it is declared or confirmed #31243、fix(plugin-security): a refused grant holder the caller cannot read is answered as a holder that does not exist #31244、fix(auth): record an MCP access token as used only after the MCP door admits the call #31247、feat(plugin-auth, plugin-audit): a sign-in the IP allow-list refuses writes one login_failed row, bounded per address #31249、feat(spec): declare the optional ISecurityService.describeEffectiveAccess and its EffectiveAccess answer types #31256、feat(plugin-auth)!: an organization administrator reads their judged client address; the console's retired MFA notices are gone #31258、fix(metadata-protocol): a revert or a publish writes a connector's live row without the keys a save drains #31293），分属 4 条投机栈 ⇒ 4 次独立命中。汇总 issue：Queue-flake anchor: test/loop-body-iteration.test.ts #31294（已刷新）
• src/apps/translations/setup-nav-dead-key-tombstone.test.ts — 24h 内已弹出 5 个 PR（i18n(platform-objects): ship the platform objects, Setup, Studio and Account in French #31233、feat(cloud-connection)!: refuse a managed upgrade that renames or retypes a stored field until it is declared or confirmed #31243、fix(plugin-security): a refused grant holder the caller cannot read is answered as a holder that does not exist #31244、feat(spec): declare the optional ISecurityService.describeEffectiveAccess and its EffectiveAccess answer types #31256、fix(lint)!: refuse a flow node no edge path from the start node reaches #31287），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: src/apps/translations/setup-nav-dead-key-tombstone.test.ts #31306（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 33 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 42432244107 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (2/8) — 失败步骤: Run this shard's tests

  @objectstack/platform-objects:test:  FAIL  src/apps/translations/setup-nav-dead-key-tombstone.test.ts > conditionally-contributed Setup nav ids stay labelled (#6659) > fr carries a label for every con
    ↳ 失败原因: @objectstack/platform-objects:test: AssertionError: Setup nav ids with no label — no boot-time gate can see these; see this file header: expected [ 'nav_scim_credentials' ] to deeply equal []
  @objectstack/spec:test:      ✓ inverts the card's measured control: the three bogus keys now FAIL parse instead of adding zero warnings  376ms
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/apps/translations/setup-nav-dead-key-tombstone.test.ts — 24h 内已弹出 5 个 PR（i18n(platform-objects): ship the platform objects, Setup, Studio and Account in French #31233、feat(cloud-connection)!: refuse a managed upgrade that renames or retypes a stored field until it is declared or confirmed #31243、fix(plugin-security): a refused grant holder the caller cannot read is answered as a holder that does not exist #31244、feat(spec): declare the optional ISecurityService.describeEffectiveAccess and its EffectiveAccess answer types #31256、fix(lint)!: refuse a flow node no edge path from the start node reaches #31287），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: src/apps/translations/setup-nav-dead-key-tombstone.test.ts #31306（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️ 本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 36 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)