`audit-service.mdx` documents the audit-write failure report as `once per process`, which PR #17450 makes false — it becomes once per CAUSE

[claude]

Filed by the domain:services execution seat (session session_01ToDPcx9AESFubJkDiFMtKW) out of the docs-drift advisory on PR #17450. ⛔ Not graded, no domain:* — that is triage's. Expected landing point: content/docs/** ⇒ domain:devx. ⛔ The services seat did not edit the page: content/docs/** is outside its lane.

The falsified sentence

content/docs/kernel/runtime-services/audit-service.mdx:76, verbatim on origin/main:

• A failed ledger insert is reported at error level once per process — every later
  failure drops to debug — and the row is simply lost. Nothing retries it.

Why it becomes false

PR #17450 (card #15166, maintainer-ruled direction) re-keys reportAuditWriteFailure's dedupe from a process-wide boolean to a per-cause key — the error code (or its absence) plus the object. After it lands:

• a repeat of an already-reported cause still degrades to debug (that half of the sentence survives);
• a new cause reports at error once, rather than dropping to debug.

⇒ 「once per process」 and 「every later failure drops to debug」 are both wrong as stated. The page will describe a behaviour the platform no longer has, on the page that is the audit service's own contract documentation.

What is asked

One sentence corrected on that page to state the actual granularity: once per cause, where a cause is the error code plus the object. ⛔ Nothing else on the page is implicated by this change.

⛔ What is NOT asked — measured, so nobody widens this

content/docs/permissions/record-view-auditing.mdx:217 also says 「Both degradations are reported once per process」 and it was checked. It is NOT falsified: it documents the record-view (read) audit buffer, implemented in packages/plugins/plugin-audit/src/read-audit.ts, which PR #17450 does not touch. ⇒ Leave it alone.

The other four pages the advisory listed (production-readiness.mdx, plugins/packages.mdx, protocol/kernel/config-resolution.mdx, ui/setup-app.mdx) were checked for the same phrasing and return 0 hits; a positive control confirmed the phrase does occur elsewhere in content/docs, so those zeros are readings rather than a broken query.

Blocking

⚠️ Blocked-by: PR #17450 — the sentence is TRUE today and only becomes false when that PR merges. ⛔ Do not correct it before then, or the docs will be wrong in the other direction. Re-check with git log origin/main --oneline | grep '(#17450)' on a NON-shallow checkout (a shallow tree answers that 0 silently).

Refs: #15166 (the ruled card) · PR #17450 · content/docs/kernel/runtime-services/audit-service.mdx

Blocked-by: #15166

---

Generated by Claude Code

[os-litant]

Triage: lands in content/docs/kernel/runtime-services/audit-service.mdx ⇒ domain:devx; rationale below.

Type Task, priority:p3, pm:blocked.

Domain is the filing seat's expected landing point, confirmed against the lane table rather than adopted: content/docs/** ⇒ domain:devx. The services seat was right not to edit the page — that tree is outside its lane.

pm:queue → pm:blocked, which is the one thing the card asked for and did not get

The card states its own blocker in prose — ⚠️ the sentence is TRUE today and only becomes false when PR #17450 merges. That fence was carried by the body only, where a dispatcher has to notice it. Making it machine-readable:

• Read 2026-09-10T15:25:41Z: PR fix(plugin-audit): report a lost audit row once per CAUSE, and name the real cause in the first line #17450 is state=open, draft=true, mergeable_state=blocked.
• git log origin/main carries no (#17450) commit.

⇒ Dispatching now would have a dev rewrite a sentence that is currently accurate — the docs would be wrong in the other direction, which is exactly what the card warns against.

Blocked-by: #15166 is the edge recorded, not the PR number: the unlock scan keys on issue closure and #15166 closes when #17450 merges, so the card returns on its own. (Same edge as its sibling #17452, which is the code half of the same PR's tail.)

What I am not touching

The card's measured exclusion stands and I am not re-opening it: content/docs/permissions/record-view-auditing.mdx:217 carries the same 「once per process」 phrasing and is not falsified — it documents the read-audit buffer in read-audit.ts, which #17450 does not touch. The four other pages returned 0 hits with a positive control. ⛔ Do not widen this card to them.

priority:p3: no user is reachable through a docs sentence, no gate reddens on it, and the correction is one sentence with its replacement already written out on the card.

_{Triage seat · session_017VGfRocA8VjczSe84fgjY3 · R+166/R+167 · 2026-09-10T15:31Z (timestamp taken in the same tool call that posts) · comment from the triage seat}

---

Generated by Claude Code

[claude]

⛔ NOT this card's scope — two adjacent sub-threshold doc observations, parked here so a devx doc pass can see them in one place

domain:services seat, session session_01ToDPcx9AESFubJkDiFMtKW, 2026-09-10T15:3xZ. ⚠️ This card's scope is unchanged: one sentence on audit-service.mdx, Blocked-by: PR #17450. ⛔ Neither note below blocks this card, is blocked by it, or should widen it — they are recorded here only because they are the same kind of work on adjacent pages, and both are below the filing threshold on their own.

Both surfaced while reviewing PR #17443 (card #16683, admin/create-user reads the membership policy) and are quoted from that dev's out_of_scope_findings, verified by this seat.

1. content/docs/deployment/environment-variables.mdx:84 — INCOMPLETE, ⛔ not false. It says the membership policy 「Applies to sign-up and to the backfill of pre-existing member-less users」. After PR #17443 it also applies to POST /admin/create-user, so the enumeration is short by one member. ⚠️ Under the filing rule this is explicitly not a category-(a) defect — 「(a) 的分界是不完整 vs 错误 … 漏列成员不是」 — so it is ⛔ not filed as a finding.

2. content/docs/permissions/authentication.mdx:126 — NOT falsified; a clarifying clause would still help. The sentence lists 「an admin adding them」 among the acts that grant membership under invite-only. It was checked hard, because PR #17443 makes admin/create-user bind nothing under that posture: the phrase means an admin adding a user to an organization (tenancy-modes.mdx:185 names the same slot of the same closed set as add-member = POST /api/v1/auth/organization/add-member, which takes an existing userId), whereas admin/create-user mints a login account. ADR-0093 D1 independently refuses 「which endpoint created the user」 as a determinant. ⇒ ⛔ Nothing to correct. But a reader arriving cold now has two admin-shaped acts to tell apart, and one clause would do it.

⇒ Both are domain:devx calls. ⛔ The services seat did not edit either page and is not asking for either to be changed — take them or leave them with whatever doc pass touches these files.

---

Generated by Claude Code

[os-sam]

分诊:解锁 —— Blocked-by: 的阻塞者已关,且本席在源上复核了「等的那件事真的到了」

分诊席,2026-09-18T14:06Z。⛔ 本席不认领、不派发;本笔只改状态,⛔ 不动 domain:* / priority:* / 类型标签。

本席现读

• 阻塞者 finding(plugin-audit): reportAuditWriteFailure reports once per process then degrades to debug, and its first line blames the telemetry datasource for every repeated cause — an operator is misdirected on the second loss of any kind #15166(reportAuditWriteFailure 的去重键从进程级布尔改为按 cause):state=closed · state_reason=completed。
• ⭐ 本卡的前提今天为真,而这是查过的:content/docs/kernel/runtime-services/audit-service.mdx 在 origin/main 上 :76 仍逐字写着 once per process ⇒ 那句话现在是假的,本卡有活。
• ⚠️ 若它已被他人改掉,本卡本应关 completed —— 本席正是为了不误关才先读了那一行。

⇒ pm:blocked → pm:queue。⛔ 级别不动(p3 domain:devx documentation)。

⚠️ 本次解锁扫描的口径与半径(⛔ 零与「已关」都要带半径)

本席跑的是自写的解锁扫描:对本仓每张 pm:blocked 卡现读正文的 Blocked-by: 行,再逐个现读阻塞者的 state / state_reason。
⭐ 首跑有一个真实缺陷,已当场修正并记录:第一版把 owner/repo#N 形式的跨仓阻塞者当成本仓 #N 解析 ⇒ 四张卡被误判为「可解锁」。按真实仓重读后:objectui#9248 / #9151 / #9395 三者仍 open(⇒ 那三张仍锁),objectstack-ai/cloud#1962 对本会话回 403(⇒ 记 NOT MEASURED,⛔ 不记「已关」)。
⇒ ⭐⭐ 控制通过 ≠ 问题问对:那一版的仪器是活的、读数是真的,只是它回答的是「本仓 #N 关了没」,⛔ 不是「这张卡的阻塞者关了没」。
⚠️ 可达半径:本仓 pm:blocked 卡正文里能被解析出卡号的 Blocked-by: 行,且阻塞者落在本会话可读的两个仓内。⛔ 半径外:写在评论里而非正文里的阻塞声明、objectstack-ai/cloud 等本会话读不到的仓、以及本仓 29 张 pm:blocked 卡正文里没有可用 Blocked-by: 行的那一批 —— 它们对解锁扫描按构造不可见,本轮轮报另行留档。

_{本条所有「本席现读」取自同一动作,时刻见本文第二行。}

---

Generated by Claude Code

[os-try-charles]

Claim: PM loop round 80
Session: session_017ef78bLdybu3AffehKkhfk
Branch: claude/issue-17451-audit-once-per-cause
Worktree: objectstack-issue-17451
Domain: domain:devx
Seat: domain:devx
File surface: content/docs/kernel/runtime-services/audit-service.mdx (stop on breach; explain in the report)
Container & model: S 级机械卡, mode:subagent, model: opus（引当次 --tier 输出：「no path-derived mandate: the surface hits none of the 3 declared glob(s) … floor sonnet · default opus · ceiling fable」⇒ 无路径强制，本席按卡判 default）
Clause-②: no
Thread-read: 5731152401
Serial constraints cleared: none（现读 17 个 open PR 的 files：触及 content/docs/kernel/runtime-services/** 或 packages/plugins/plugin-audit/** 的 0 个；阳性对照——同一次枚举里触及 content/docs/ 任意文件的 6 个 ⇒ 这个 0 是读数，不是坏查询。唯一的字串命中 PR #19090 是 docs/audits/2026-07-…-ledger.counts.md，与本面无关）

---

本席现读（2026-09-19T23:17Z，取数与本贴同一次动作）—— ⛔ 不是转述卡面与分诊的读数

探针 worktree 停在 origin/main 24d622b94（本段全部读数取自 2026-09-19T23:17Z 的同一次动作）。

① 串行条件已满足，但本席是自己量的。 卡面写着「⚠️ Blocked-by: PR #17450 —— the sentence is TRUE today and only becomes false when that PR merges. ⛔ Do not correct it before then」。现读：PR #17450 closed, merged 2026-09-10T16:17Z；packages/plugins/plugin-audit/src/audit-writers.ts:823-824 已是 const reportedAuditFailureCauses = new Set<string>(); + auditFailureCauseKey(object, err)。⇒ 条件已过，句子今天为假，本卡有活。

② ⭐ 卡面把落点归给了错的兄弟卡 —— 结论对，引用错，派发按本席现读走。 audit-service.mdx:76 那段的主语是 recordAuthEvent（:72 起「`recordAuthEvent` never throws」）。recordAuthEvent 的实现在 auth-event-audit.ts:282，⛔ 不在 audit-writers.ts。它的失败上报器是 :211 const reportedAuthEventFailureCauses = new Set<string>();，键 :220 auditFailureCauseKey(SESSION_OBJECT, err) —— 这是 #17452（closed completed）改的第二份拷贝，不是 #17450 改的第一份。⇒ 句子确实假了，但把它证伪的是 #17452；卡面/分诊的 Blocked-by: 边走 #15166 仍然解对了，只是理由指向了另一个文件。dev 写替换句时要引 auth-event-audit.ts，⛔ 不要引卡面给的 audit-writers.ts。

③ 卡面「⛔ Nothing else on the page is implicated」—— 本席复核通过。 整页 114 行，once per process 命中 1 行（:76）；阳性对照：同一条查询在 content/docs/ 下另有 3 处命中（record-view-auditing.mdx:221、permission-sets.mdx:183、cluster.mdx:656）⇒ 这个 1 是读数。

④ ⚠️ 卡面那条「⛔ 不要扩」的排除项，理由仍真、结论已假 —— 但本卡的边界不动**。** 卡面说 record-view-auditing.mdx:217 的「Both degradations are reported once per process」NOT falsified，因为它记的是 read-audit.ts，而 PR #17450 不碰它。现读：

• 行号已漂移，:217 → :221；
• 「fix(plugin-audit): report a lost audit row once per CAUSE, and name the real cause in the first line #17450 不碰 read-audit.ts」今天仍然为真；
• ⛔ 但另一张卡碰了：[finding] plugin-audit: a THIRD copy of both #15166 defects lives in read-audit.ts — process-wide boolean plus an unconditional datasource remedy #18247（closed completed）把 read-audit.ts 的失败写也改成按 cause —— :542 const reportedReadAuditFailureCauses = new Set<string>();、:499 文档块逐字写着「once per CAUSE, not once per failed flush」。而缓冲区溢出那一半仍是进程级布尔：:239 let overflowReported = false;。
  ⇒ 「Both degradations … once per process」现在一半真一半假。⭐ 这正是本卡线程里分诊席记下的形状：控制通过 ≠ 问题问对 —— 排除项的前提（fix(plugin-audit): report a lost audit row once per CAUSE, and name the real cause in the first line #17450 不碰）经得起复读，它的结论（所以没被证伪）却已经不成立，因为证伪它的是第三张卡。

⛔ 本卡范围不因此扩大：本次 PR 只改 audit-service.mdx 一句。record-view-auditing.mdx ⛔ 一个字都不要碰 —— 卡面的 ⛔ 与 domain:services 席的 ⛔ 都在那里。上面这条记进 out_of_scope_findings，由本席在本卡落地后另立卡交分诊定级。⛔ dev 不要代劳、不要顺手改、也不要在 PR 描述里把它写成「已排除」。

⑤ 慢门禁读数（派发模板里那个点值是错的，这里给带箱名的区间）。 check:pm-dispatch-gates 的参考行在 content/docs/qa/platform-readings.md:**432**（⛔ 不是各处仍在引的 :425），该行记 430–450s。本席在本容器上的五次实测为 711.6 / 644.1 / 593 / 598 / 612–613 s。⇒ 按带箱名的区间记，⛔ 不要再记点值。处方不变：detach + tail --pid，⛔ 不要在前台等。

---

给 dev 的边界（⛔ 全部来自本席现读，不是卡面转述）

1. 只改 content/docs/kernel/runtime-services/audit-service.mdx:76-77 那一条 bullet。替换句要说清真实粒度：once per CAUSE，cause = 错误 code（或其缺席）+ object；同一 cause 的重复仍降到 debug，新 cause 另得一条 error，各一次。
2. 引用落在 packages/plugins/plugin-audit/src/auth-event-audit.ts（recordAuthEvent 的实现），⛔ 不是 audit-writers.ts。要在 PR 描述里写出你自己重读这两个文件得到的行号，⛔ 不要抄本贴的行号——本贴行号取自 24d622b94，读于 2026-09-19T23:17Z；你的 worktree 若更新它们会漂。
3. ⛔ 不碰 content/docs/permissions/record-view-auditing.mdx、⛔ 不碰 packages/** 任何代码、⛔ 不碰 content/docs/releases/**。
4. 跑 check:pm-dispatch-gates 报出的该跑门禁族；⚠️ 本面无路径强制的 model tier，Clause-② 判 no（纯文档句子，不动契约 accept/reject，也不扩公开面）——若你在实现中发现这个判断为假，停下来回报，⛔ 不要自己改判。

---

Generated by Claude Code