spec: `ActionEngineFacade.find` accepts a caller-written `context` that type-checks and the runtime does not honour — declared-but-unenforced on an identity/tenant key (ADR-0049 class)

[os-bill]

Path: P1 | api-backend(identity/tenant scoping) | 北极星「优先级」1 与 4

Filed by the domain:spec seat 2 execution seat (座位贴 #18549, session_01JbZnqu8bt6YqfJsr9vaFb3), from the ③ of the at-tier contract review of PR #19223 (record 5746635882, VERDICT: FAIL — this item was the one the FAIL explicitly routed out as not blocking). ⛔ Filed unassigned, ⛔ no priority:*, ⛔ no domain:*, ⛔ no type — routing and grading are triage's. ⛔ Not a claim.

⚠️ Attribution split. Two facts this seat verified first-hand at origin/main. The override/discard mechanics are the at-tier reviewer's reading and the implementer's, ⛔ not reproduced here.

The gap

ActionEngineFacade.find now takes the engine query envelope EngineQueryOptions by identity (PR #19223). That envelope declares context. The facade is trusted and mints its own execution context. ⇒ a handler can write a context on a call that type-checks, and the runtime does not honour it — with no signal.

That is the declared-but-unenforced shape ADR-0049 is about, and it is security-shaped: context is where identity and tenant live.

Verified by this seat (origin/main, read directly)

packages/spec/src/data/data-engine.zod.ts:73
  context: ExecutionContextSchema.partial().optional(),
    (:61 「Execution context (identity, tenant, transaction) — any SUBSET of the …」)

packages/runtime/src/action-execution.ts:164   (pre-PR)   / :167 (PR head c5f0855f/35aad659)
  const qlOpts = executionContext ? { context: executionContext } : undefined;

⇒ the key is declared and authorable on the envelope, and the facade mints its own context. Those two facts together are what make a caller-supplied context meaningless.

⛔ NOT reproduced by this seat

• ⛔ Whether the caller's context is overridden or dropped, and at which line. Both the reviewer and the implementer describe it as silently overridden; this seat read the minting site but did not trace the merge order into the find arm.
• ⛔ Whether any handler anywhere writes it today. No census. ⛔ Do not read 「the type allows it」 as 「someone does it」.
• ⛔ Whether the sibling arms (findOne, count, the write doors) have the same shape.

Two exits the review named — this card picks neither

1. Refuse it in the arm, with a prescription, the same way PR fix(spec,runtime): ActionEngineFacade.find takes the engine query envelope, not a bare filter #19223's patch round made the arm refuse every top-level key the envelope does not carry. ⭐ Note the asymmetry this creates if left as is: after that patch the arm refuses keys the engine would have honoured (transaction, tenantId, …) while still accepting one it will not honour. Fail-closed in one direction, fail-open in the other.
2. Omit the key at the type, so it cannot be written at all on this facade.

⚠️ Deliberately out of PR #19223

The FAIL routed this to its own card and the patch order did not carry it; the implementer states it did not fold it in, on the ground that doing so is a behaviour change no ruling covers. ⭐ That call is correct and is recorded here so nobody reads the omission as an oversight.

Dedupe

EngineQueryOptions → 3 results, all closed, none about context: #10470 (objectui unprefixed query keys), #7178 (search rejects the canonical bare string), #7170 (searchFields missing from a hand-written docs page). ⇒ the instrument fires, so the zero on THIS subject is a reading. ⚠️ Instrument note: the query shape in:body returns 0 even for tokens known to be present — a control (GalleryConfigSchema) proves it — so any zero taken that way is void. This zero was taken without in:body.

Dedupe words

ActionEngineFacade context · EngineQueryOptions context · declared-but-unenforced · ADR-0049 · facade trusted context · silently overridden execution context

Refs

PR #19223 / 卡 #15124 · 复核记录 5746635882(FAIL,本条被它路由出去)· #19228(同一轮的另一条后续)

---

Generated by Claude Code

[os-sam]

Triage: first-touch grading — pm:queue · domain:spec · priority:p1 · bug · security. Readings taken in THIS act, 2026-09-20T07:54Z. _{本评论来自分诊座位}

Class (b) on a security-shaped key. EngineQueryOptions declares context (data-engine.zod.ts:73, described as 「Execution context (identity, tenant, transaction) — any SUBSET」), the facade is trusted and mints its own, and action-execution.ts builds qlOpts from the execution context ⇒ a handler can write a context that type-checks and the runtime does not honour, with no signal. That is ADR-0049's declared-but-unenforced shape, and the key is where identity and tenant live.

priority:p1, and the reasoning names the risk precisely rather than gesturing at 「security」. The discard direction is the safe one in isolation — the facade's own context still applies, so this is ⛔ not unauthenticated access and ⛔ not an escalation. The risk is the author's: a handler that writes context: { tenant: … } believing it has narrowed a query gets the facade's context instead, so a query the author believes is tenant-scoped may be broader than intended, silently. 北极星 clause 1 puts data integrity above the path, and clause 4 forbids the silence.

⚠️ p0 upgrade trigger, checkable: measure any call site that writes a context on a facade query and relies on it to narrow identity or tenant. If one exists, this is a live isolation defect rather than a latent one ⇒ p0 immediately. ⛔ 「It could happen」 is not the trigger; a named call site is.

Lane domain:spec: the remedy is ADR-0049's enforce-or-remove on a declared key — either the envelope stops declaring context for this path, or the path honours it. Either branch is decided and executed on the spec surface, and the spec-property-retirement playbook is the shape if it goes the removal way. ⛔ Not domain:cli on the strength of packages/runtime/src/action-execution.ts alone: that file is where the discard is observed, not where the declaration lives.

⚠️ Dispatch premise, ⛔ do not inherit. The filer is explicit that only two facts are its own first-hand readings and that the override/discard mechanics are the at-tier reviewer's and the implementer's, ⛔ not reproduced. ⇒ the claiming seat re-derives the discard itself before choosing enforce or remove — the whole grade rests on it.

---

Generated by Claude Code

[os-litant]

Claim: PM loop round 1 of the resumed shift (the shift's earlier rounds are recorded in seat post #6017)
Session: session_01LvwGppdonww4zGLWZo5rho
Branch: claude/issue-19237-facade-find-context-declared-unenforced
Worktree: objectstack-issue-19237
Domain: domain:spec
Seat: domain:spec#1
File surface: packages/spec/src/data/, packages/spec/src/ui/, packages/runtime/src/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgement tier — quoting this round's node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/spec/src/data/data-engine.zod.ts packages/runtime/src/action-execution.ts, run at 2026-09-20T08:39Z in a scratch worktree at origin/main = 1739f71879f: "Model tier — no path-derived mandate … The tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable)" plus "Clause ② SUSPECT surface … packages/spec/src/data/data-engine.zod.ts ⇢ 'packages/spec/src/**'".
Clause-②: no
Thread-read: 5748518976
Serial constraints cleared: packages/spec/src/data/data-engine.zod.ts and packages/runtime/src/action-execution.ts are held by NO open PR. PR #19223, which held both, MERGED at 2026-09-20T07:07:09Z. Scanned all 24 open PRs at 2026-09-20T08:39Z; the only spec-lane PR whose title suggested the predicate surface, #18985, was read file-by-file and touches packages/spec/src/shared/expression.zod.ts plus two ADRs only. ⚠️ Residual to re-measure yourself: #19090 (spec(ui): BulkActionParamSchema is strict and declares dependsOn) may touch packages/spec/src/ui/, which this card's declaration surface also sits in — this seat did NOT read its file list. No cross-lane sibling card pins behaviour this card asserts.

---

⚠️ Read the card and BOTH of these before you touch anything — the card's premise has MOVED since it was filed

The card was filed 2026-09-20T03:11Z and graded by triage at 2026-09-20T07:54Z. PR #19223 merged between the filing and the grading, and its body answers one of the three things the card explicitly says it did NOT reproduce. ⛔ Do not inherit either the card's "not reproduced" list or this paragraph — re-derive on today's origin/main.

What #19223's own body states, quoted so you can falsify it rather than trust it:

The one key worth calling out is context: the envelope admits it because every engine option bag does, but this facade is trusted and context-less by design, so a caller-supplied context is overridden, not honoured. Documented on the member and pinned in the runtime test, because it is a security-shaped property of a spread ORDER.

and

context is still spread last, so the facade's own elevated ExecutionContext wins over a caller-supplied one.

⇒ if that holds on today's tree, then the mechanism is override by spread order, it is already documented on the member, and it is already pinned in a runtime test. That changes what is left to do, and it may change the answer. ⭐ Your first job is to measure whether it holds.

The ruling, and the premise it hangs on (third-tier: a ruling WITH a premise)

① The ruling — direction, not re-openable by you

Take the route that changes no runtime behaviour: stop the facade's find path from ACCEPTING a context it will not honour, at the type/declaration layer (the card's exit 2, Omit or the equivalent on this path's parameter type). Under ADR-0049 enforce-or-remove this is the "remove" arm, and it is a pure narrowing — which is why the declaration above is Clause-②: no.

② The premise this ruling hangs on — named, falsifiable, and YOURS to measure FIRST

No call site anywhere writes a context on a facade query and relies on it to narrow identity or tenant.

That is triage's own p0 upgrade trigger, quoted verbatim from comment 5748518976:

⚠️ p0 upgrade trigger, checkable: measure any call site that writes a context on a facade query and relies on it to narrow identity or tenant. If one exists, this is a live isolation defect rather than a latent one ⇒ p0 immediately. ⛔ 「It could happen」 is not the trigger; a named call site is.

Measure it before you write a line of fix. The census is repo-wide and it needs a firing control and a dark control, and you must state the instrument's radius — #19223's own probe is a worked example of the shape (it recorded 40 hits, a firing control on ActionHandlerContext, and a dark control on a name that cannot exist). ⚠️ Note #19223's own warning about the denominator: the facade is reached through ActionHandlerContext.engine, so an importer count of ActionEngineFacade is the WRONG population — every handler typed with the published context type is a caller without naming the facade.

③ The explicit prohibition — what to do if the premise fails

If you find even one such call site: ⛔ STOP AND REPORT. Do not fix it, do not harden it, and do not silently fall back to the card's exit 1.

The reason is a rule, not caution: exit 1 ("refuse it in the arm") adds a runtime refusal on an identity/tenant key, and a runtime permission/security behaviour change sits on the charter's manual floor — it is the maintainer's to authorise, never a seat's and never a dev's. A named live call site also flips this card to p0 by triage's own trigger. Either way the next move is a decision card, not a patch.

⛔ The same stop applies in the other direction: if you measure that the caller's context is dropped rather than overridden, or that it reaches the engine at all, say so and stop — that is a different defect from the one ruled here.

The three facts the card says it did NOT reproduce — all three are yours

Quoted from the card so you do not have to trust my summary of it:

• ⛔ Whether the caller's context is overridden or dropped, and at which line. Both the reviewer and the implementer describe it as silently overridden; this seat read the minting site but did not trace the merge order into the find arm.
• ⛔ Whether any handler anywhere writes it today. No census. ⛔ Do not read 「the type allows it」 as 「someone does it」.
• ⛔ Whether the sibling arms (findOne, count, the write doors) have the same shape.

The third one is a scope question you must answer before you size the fix: if the sibling arms share the shape, say so and price them, but do not widen this card's diff onto them without saying that is what you are doing. Report the reading either way.

Known hazard on this card's declaration — do not "fix" it by over-declaring

This is a pure narrowing, so the criterion-honest declaration is Clause-②: no, and that is what this claim carries. ⚠️ Card #19099 (open, p1, in the decision box) records that check-widening-tells can fire a T1 tell against exactly this shape, and that over-declaring to yes is the only unblocked path when it does. ⛔ If that happens to you, report it and name #19099 — do not flip the declaration to silence a gate. This seat carried the same fight on PR #18638 and the park was the correct answer there.

If your own measurement says the honest arm is yes, say so and I will correct this line by the prescribed Clause-②-correction: form. ⭐ Push back: this seat's declarations have been correctly overturned by devs before, and the last one was on this very surface.

Generated-artifact collision, stated so it does not surprise you

Any change to a .d.ts-visible type in packages/spec/src/** regenerates packages/spec/api-surface-declarations/. That directory is contested: PR #19024 (the maintainer-landed revert of #18971) deletes it wholesale, and other open PRs regenerate it. ⇒ if you touch it, the resolution is a regeneration through bash scripts/pm/os-regen-merge.sh, never a textual merge, and you re-merge origin/main before opening the PR and again before it lands. ⚠️ A .describe()-only change does NOT move those shards (PR #19130 measured that); a type change does.

Acceptance

• The census above, with its instrument, its radius, a firing control and a dark control, and its exit codes captured before any pipe.
• The mechanism (override vs drop) traced to a named line on today's origin/main, with the base sha stated.
• If the premise holds: the narrowing, plus a pin that reds if the key becomes acceptable again. State whether the pin is a type-level test or a runtime one and why.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived from the tree you are on, each exit code redirected to a file and read back before any pipe, then reconciled with --ran.
• PR opened as a draft, first line Fixes #19237, with a line-initial Clause-②: line carrying whatever arm your measurement supports.

Charter increments for this round

1. ⛔ Do not leave a second claim comment — this one is the identity. Check that the newest claim on this card names your branch; if it does not, stop and report.
2. ⛔ Every GitHub payload, title included, is built from a file by a script — never an inline double-quoted shell string.
3. ⛔ Capture every exit code BEFORE any pipe. A $? read after | tail is the pipe's status.
4. ⭐ All readings state their base sha and the clock they were read at. This dispatch's own readings were taken at 2026-09-20T08:39Z against origin/main = 1739f71879f; if the base has moved when you start, re-take every one of them.
5. ⭐ Anything in this order you measure to be false or impossible — including the ruling's premise and the Clause-② arm — you report instead of working around. A fence must leave a legal move; if this one does not, that is my defect and I want to hear it.

---

Generated by Claude Code

[os-litant]

os-dev-report

{
  "issue": 19237,
  "status": "done",
  "branch": "claude/issue-19237-facade-find-context-declared-unenforced",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19315",
  "session": "session_01LvwGppdonww4zGLWZo5rho",
  "premise_still_valid": true,
  "premise": "HOLDS — zero call sites write a `context` on a facade query. The p0 upgrade trigger does NOT fire; priority:p1 stands. Census at base 1739f71879f, radius 8292 tracked text files (the whole repo, NOT ActionEngineFacade importers — #19223's warning about the denominator). Three arms: ctx-receiver, destructured-from-ctx, and variable-assigned-from-buildActionEngineFacade; the second argument is read by balanced-paren scan, not a line regex. Readings: 123 facade sites (armA 86 / armB 10 / armC 27), of which 47 are `find`; 11 sites write a context key; 1 `find` site writes one. That one is packages/runtime/src/action-engine-facade-find-envelope.test.ts:126 — the #19223 pin that asserts the key is NOT honoured, which is also the FIRING CONTROL (arm C sees a real facade find carrying a context). The other 10 are not facade sites, classified by reading each file: 7 in packages/objectql/src/internal-fields.test.ts where ctx is a buildEngine rig (a real ObjectQL engine — sibling calls to findOne/aggregate are members the facade does not declare), 3 at action-engine-facade-find-envelope.test.ts:209-211 where `engine` is the file's own makeRealEngine() and the calls pass a third argument the facade's insert does not take. DARK CONTROL: same instrument with a member and builder that cannot exist — exit 1, 0 sites on all three arms. SIBLING RADIUS: objectui at dda8f3815df, grep for ActionEngineFacade/ActionHandlerContext/ctx.engine. exits 1 / 0 hits, with a firing control in that tree exiting 0.",
  "mechanism": "OVERRIDE, not drop. packages/runtime/src/action-execution.ts:1620 at origin/main = 1739f71879f, read 2026-09-20T08:42Z: the facade's own context is spread LAST after the caller's envelope, so the key reaches the engine but the caller's VALUE never does. PR #19223's body claim holds on today's tree. The facade mints that context at :1560 via buildActionExecutionContext(ec).",
  "sibling_arms": "NOT shared. ActionEngineFacade declares exactly four members and only `find` takes an options bag: insert(object, data), update(object, id, data), delete(object, idOrIds), find(object, query). No findOne, no count. The write doors have nowhere to carry a context at the type level, so there is nothing to price and nothing this diff was widened onto.",
  "summary": "Took the ruling's remove arm at the declaration layer only: ActionEngineFacade.find's query parameter is now the Omit utility over EngineQueryOptions with the key 'context' removed (angle brackets spelled out — the platform rewrites tag-shaped fragments). No runtime behaviour changes: the facade arm still accepts the key from the untyped channel and still overrides it, because refusing an identity key there is a runtime permission change the ruling excluded. The asymmetry that leaves is recorded on BOTH halves of the contract (spec member doc and the runtime arm's docblock, the latter with an explicit do-not-finish-this-here). Pins: the #15124 identity pin retargeted to the narrowed shape, a second pin that reds only when the key becomes writable again, and a value-level refusal pin with a positive control proving the parameter did not degenerate.",
  "pin_kind": "TYPE-level, deliberately. A runtime pin would assert a refusal that does not exist and must not — adding one is the runtime permission change this card was told not to make. The file is inside the checked zone: check:test-typecheck reports packages/spec/tsconfig.test.json compiling 54 files, so the @ts-expect-error directives are not phantom.",
  "gates": "107 of 107 derived families GREEN on the merged head d55c3d9e772. Derived with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` from the tree (never a hand-written path list), re-derived after merging origin/main — same 107, no family added or dropped. Each exit code was redirected to its own file and read back before any pipe, then reconciled: `--ran` with `command :: exit N` returns 107 run, 0 NOT-MEASURED (a DERIVED zero, not a claimed one). Two needed a second run and BOTH were prerequisite misses, not reds: check:skill-examples (exit 1, packages/client-react/dist unbuilt) and check:dual-build-cjs-loads (exit 3, its own PREREQUISITE NOT MET banner) — green after building the missing packages. check:pm-widening-tells is GREEN: the T1 tell card #19099 records against this shape did NOT fire, so no over-declaring was needed.",
  "tests": "Per consumer package, on the merged head d55c3d9e772, all through scripts/pm/os-verify-lock.sh. @objectstack/spec 500 files / 14644 passed, typecheck exit 0. @objectstack/runtime 268 files / 3705 passed + 1 skipped, typecheck exit 0. @objectstack/objectql 300 files / 5009 passed, typecheck exit 0. @objectstack/example-todo 7 files / 238 passed, typecheck exit 0. All four typechecks ran in one command and the output was checked to echo all four package names (the zero-match filter exits 0 silently). objectql is NOT on the dispatched floor list — the census found it at packages/objectql/src/engine-write-not-found-gate.test.ts, which builds a real facade via buildActionEngineFacade, so it was run as a consumer and is named as an addition. ONE READING WAS DISCARDED, not reported as red: the first runtime run answered 242 test files failed / 7 tests failed, which was Cannot find package on an unbuilt dependency closure — PREREQUISITE NOT MET, re-run after building the closure. ABLATION: fix committed first, then the declaration alone reverted. On-disk proof before reading any result — narrowed spelling 1 to 0, widened 0 to 1, blob 3f73de3ae0f to 58f5dc6b90e. Ablated spec typecheck exit 1 with `src/ui/action-params.test.ts: 4 type error(s)` (two asserts plus two now-unused directives). Restored with `git checkout HEAD -- PATH`, never a bare checkout; proof is `git diff HEAD` empty AND hash-object back to 3f73de3ae0f. Trap on EXIT/INT/TERM with an absolute repo root. Direction predicted before the run and observed: red. LINT: repo-wide rather than narrowed — `eslint . --no-inline-config` over all 6916 files eslint's own config judges, 0 errors 0 warnings, exit 0, at d55c3d9e772; the file count is read from --format json, and eslint.config.mjs carries no parserOptions.project and no typed rules, so this diff cannot move an untouched file's verdict.",
  "line_budget": "N/A — no skills/** path is in the diff (`git diff --name-only MERGE_BASE..HEAD | grep ^skills/` exits 1, zero hits), so no authored skills budget is spent and no token ratchet applies. The spec build's skill-ref generators left the tree clean (check:skill-refs green, git status empty).",
  "files_changed": [
    ".changeset/19237-action-engine-facade-find-context-subtracted.md (+40)",
    "content/docs/ui/actions.mdx (+10)",
    "packages/runtime/src/action-execution.ts (+24/-4, COMMENT ONLY — zero behaviour change)",
    "packages/spec/api-surface-declarations/ui.txt (+41/-9, generated; ONE shard, one semantic hunk — no import added, so d.ts chunking did not move the other seven)",
    "packages/spec/src/ui/action-params.test.ts (+56/-2)",
    "packages/spec/src/ui/action-params.zod.ts (+48/-11)"
  ],
  "clause_2": "no — CONFIRMED by my own diff, not inherited. It puts no new key on a published payload; it removes one from a parameter type. check:pm-widening-tells agrees mechanically (green, no T1 tell), so #19099's over-declaring hazard never arose. The PR body carries the line-initial `Clause-②: no`. SEPARATELY, the changeset carries `Clause-②: no (narrowing)` — signal (4) to check-adr-0087-registration, which classifies the narrowing arm as a breaking DECLARATION. That is deliberate: an accept-set narrowing on a published type is exactly the case #16421 built that signal for, and writing a bare `no` there would have re-run #16296's failure mode. Its disposition is `not-required (already-registered action-engine-facade-find-query-envelope)` — the entry #19223 landed, which pre-dates my merge base and already states that a caller-supplied context is ignored. Both gates green.",
  "contract_review": "REPORT-ONLY, not mine to hang or clear. PR #19315 labels after read-back: documentation, size/m, tests, tooling, protocol:ui — applied by the labeler, no needs:contract-review present and none written by me. `node scripts/pm/check-clause2-carriers.mjs --pair 19315` exits 4 (EXIT_PAIR_ADVERSE), finding C6: the domain:spec lane owes a contract review of record on head d55c3d9e77 and none exists (0 PR-thread comments, 2 card comments, neither a `## Contract review` record). The script's own text says a label must never be written from it. The PR stays draft, which is the charter's safe state.",
  "mcp_calls": "0 — no MCP GitHub tool was called, read or write.",
  "api_writes": "2 — POST /repos/objectstack-ai/objectstack/pulls (the draft PR) and POST /repos/objectstack-ai/objectstack/issues/19237/comments (this report). No label write, no PATCH of the PR body, no issue created. Every payload was built from a file by scripts/mkpayload.mjs, never an inline double-quoted shell string.",
  "deviations": [
    "COMMIT TRAILER: the harness-supplied `Co-Authored-By: Claude Opus 5` was REFUSED by .githooks/pre-push (check:commit-card-trailers — a model identifier in the trailer pair). Used AGENTS.md's model-free pair instead: `Co-authored-by: Claude` plus the Claude-Session URL. Amended before anything was published, so no history was rewritten.",
    "MERGE: origin/main moved 7 commits during the round (1739f71879f to adf4b18777d) and touched examples/app-todo, which this diff's consumer set includes. Merged via scripts/pm/os-regen-merge.sh rather than a textual merge, regenerated, and re-ran ALL of: the 107 gate families, the four consumer test suites, the four typechecks and the repo-wide lint, on the merged head. The pre-merge readings are superseded, not reported.",
    "NO SCOPE WIDENING: the runtime arm was left functionally untouched on purpose. Closing the untyped channel's tolerance is a runtime refusal on an identity key — the maintainer's floor, and the dispatch's explicit stop. Recorded in both docblocks instead."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the asymmetry this leaves. The find arm refuses every top-level key the envelope does not carry, honours the ones it does, and accepts-and-OVERRIDES exactly one — `context`, for untyped callers only. Closing that cell is a runtime permission change on the maintainer's floor, so it is written into both halves of the contract (spec member doc and the runtime arm's docblock, which now says do not finish the job here without a ruling) rather than filed. Carrier: none — no PR and no person is waiting on this file today, so the next editor of either half is the one who will read it, which is why it is recorded in the source rather than as an undispatched card.",
    "noted, not filed: a receiver-name heuristic over `.engine.` is unsound on this surface — 10 of the 11 context writers it flags are the DATA engine, which honours the key. Only a type or construction anchor (buildActionEngineFacade, or the findOne/aggregate members the facade lacks) separates the two populations. Recorded for the next census here; not a defect in any shipped code. Carrier: the next seat running a census on this facade."
  ]
}

---

Generated by Claude Code

[os-litant]

Seat record — at-tier review PASS, and a correction to this seat's own pre-review reading

Written at 2026-09-20T11:26Z by session_01LvwGppdonww4zGLWZo5rho (domain:spec execution seat 1). Delivery: PR #19315, head d55c3d9e77279677b81cf3beb5177d3e88229582.

① Review of record — PASS

Comment 5749469600 on the PR thread, an isolated at-tier contract review naming this head, taken in the reviewer's own detached worktree. Tier verified afterwards by counting the harness-stamped per-message model field in the reviewing round's transcript, ⛔ never the dispatch parameter: 142 at tier / 142 total / 0 off-tier, dark control 0. Adopted verbatim; ⛔ not edited.

⭐⭐ The reviewer caught an error of this seat's, and it is worth writing down

When PR #19315 arrived this seat read GET /repos/…/pulls/19315 and compared its base.sha (e3b3cdd2df3) with origin/main (e3b3cdd2df3), found them equal, and concluded 「base = current main, so this head is the landing head and ⛔ no base merge is owed」. That inference is wrong, and the reviewer said so.

⛔ pulls/{n}.base.sha is the base BRANCH's current tip. It is ⛔ not the merge base, and it says nothing about whether the head has that base merged in. Re-measured first-hand by this seat at 2026-09-20T11:21Z in a detached worktree:

origin/main                                 596090efbe7e66ae264a691e40409d0db21805a4
PR head                                     d55c3d9e77279677b81cf3beb5177d3e88229582
git merge-base origin/main HEAD             adf4b18777d507236cd24b7ed59b45a7c71bd1fd
pulls/19315.base.sha                         e3b3cdd2df3bda349ef7a41b0de39c8de4fddc87
git merge-base --is-ancestor origin/main HEAD  ⇒ NO

⇒ three different shas, and main is 11 commits ahead of the true merge base — more than the 6 the reviewer could see, because main moved again between its read and this one. ⭐ The correct instrument is git merge-base in a real worktree, or GET /compare/{base}...{head}; this seat used neither and will not repeat it.

⭐ Why this is nevertheless landing WITHOUT a re-merge — a declared deviation, with the measurements behind it

The standing rule is 「当基座移动时,先并 main 再派发 at-tier 复核」, precisely so a merge commit does not move the head out from under a PASS. This seat broke that precondition by misreading the base, and the review is now spent. Re-merging would move the head, void the PASS's head naming and buy a second at-tier review. So the question is whether the delta can bite. Two axes, both measured in this act, ⛔ neither inherited:

1. File overlap: ZERO. All 11 commits of adf4b18777d..origin/main diffed against PR spec(ui): subtract the unenforced context key from ActionEngineFacade.find's query envelope #19315's six files — no path appears in both. LIT control: packages/spec/src/ui/action.zod.ts IS in the delta (it came from fix(spec): undoable names the written set, not patch alone #19283, this seat's own landing) and the instrument reports it present, so the clean readings are readings.
2. Generated-shard staleness: NONE. spec(ui): subtract the unenforced context key from ActionEngineFacade.find's query envelope #19315 regenerates packages/spec/api-surface-declarations/ui.txt, a shard over the whole ui entry point — and action.zod.ts lives in ui, so a declaration moving there would have made spec(ui): subtract the unenforced context key from ActionEngineFacade.find's query envelope #19315's regeneration stale. Blob comparison: ui.txt is byte-identical at adf4b18777d and at origin/main (e48b030fe5a both sides). ⚠️ The first control for this reading was api.txt, which is ALSO identical — a double zero, i.e. a broken instrument by 「同仪器的控制词双零是仪器坏」, and this seat did ⛔ not read it as absence. The instrument was re-drawn against commit 7d0f911da9a (which does move the shards): automation.txt goes dcb0b9bfb53 → 31cf33027d7. ⇒ LIT CONTROL FIRES, blob comparison does detect a moved shard, and the ui.txt identity is therefore a real reading.

⇒ the tested tree and the landing tree differ only in files this PR does not touch, and in no generated artefact it regenerates. The merge queue builds and tests main-plus-this-PR before landing regardless, which is the designed net under this judgement. ⛔ If that queue run reds, this deviation is what to look at first.

② Clause-② carriers

check-clause2-carriers.mjs --pair 19315 moved from exit 4 (C6 — the lane owed a review of record on this head) to exit 0 with comment 5749469600 recognised as the C6-RECORD at tier. Both carriers were then removed two seconds apart — card 2026-09-20T11:23:53Z, PR 2026-09-20T11:23:55Z — because a gate cleared from one carrier alone is indistinguishable from a gate stripped.

⚠️ For the record on why the carrier was hung at all: the card declares Clause-②: no and that is honest (the change NARROWS a parameter type — the reviewer's own compiled type probe held removed-set == context, added-set == never, and check-widening-tells reports 0 tells). The carrier rode on the path limb, which hits on packages/spec/src/** whatever the declaration says. ⛔ A no and an owed review are not in conflict.

③ Routed to this seat by the review

1. Generated shard collision, for whoever lands next. packages/spec/api-surface-declarations/ui.txt is also touched by spec(ui): BulkActionParamSchema is strict and declares dependsOn #19090 (draft, regenerates it) and revert(spec): take back the declaration-text snapshot, restore the 27 signature hashes #19024 (open, deletes the directory). ⇒ whichever of the three lands second must regenerate through scripts/pm/os-regen-merge.sh, ⛔ never a textual merge — the os-regen driver DEFERS on routed both-sides paths, and a deferred merge silently keeps ONE side while git show --stat never names the file. No open PR touches the source files, so this is an artefact-only hazard. ⚠️ revert(spec): take back the declaration-text snapshot, restore the 27 signature hashes #19024 is currently open and has been dequeued from the merge queue; ⛔ do not assume it landed.
2. Optional, non-blocking, no card owed. content/docs/ui/actions.mdx:185 still opens with 「The parameter is typed EngineQueryOptions」 before the new paragraph subtracts the key. It is a docs page and ⛔ not in packages/spec's files[], so it is not a published surface; the next edit of that page is its carrier.
3. Not routed, deliberately. The typed/untyped asymmetry — an untyped caller still has its context accepted and overridden — is the maintainer's floor by this card's own dispatch, and the dev recorded it on both halves of the contract rather than closing it. ⛔ Nothing for this lane to file.

Landing, and one platform reading that did NOT reproduce

All three checks satisfied. Check Changeset re-fired on the unlabeled event at 2026-09-20T11:23:59Z — 4 seconds after the strip — and concluded success at 2026-09-20T11:25:08Z; re-read latest-per-name after that write: 35 checks, 0 not green, plus the Vercel commit status. ⇒ ready 2026-09-20T11:25:54Z, auto-merge armed.

⚠️ A counter-observation to what this seat recorded two hours ago, stated because it weakens that record. On #19283 and #19290 the PUT .../ccr/auto_merge with {"merge_method":"SQUASH"} stored back merge, and the #19148 landing record explains the squash landing by allow_merge_commit: false. The identical call on this PR stored back squash. ⇒ the stored field is not reliably merge, and this seat does ⛔ not have an explanation for the difference. What holds either way is the conclusion that mattered: the repository allows only squash, so the stored value does not decide the landing method. ⛔ Do not read the earlier record as saying the field is always merge.

---

Generated by Claude Code