docs(plugin-hono-server): re-anchor the dead tracker citations in packages/plugins/plugin-hono-server/src to the commits that decided them

[objectstack-fleet]

Part of #20594
Clause-②: no

What changed

This is stage 10 of the domain:cli lane of the dead-citation sweep: packages/plugins/plugin-hono-server/src. Every comment site there that cited a tracker number answering 404 now cites, in ruling C+D's form C (comment 5749154545 on #19123), the commit in this repository's history that decided what the line describes, and keeps saying in its own words what that commit decided. PR #20533 is the method, and stages 1 to 9 of this card (PR #20624, PR #20632, PR #20656, PR #20673, PR #20689, PR #20703, PR #20713, PR #20723, PR #20735) are the precedents. The card stays open for the lane's remaining packages, so this PR says Part of.

That is 24 sites on 24 lines in 5 files, covering 5 numbers, rewritten to 5 distinct commits:

• the census's 5 sites: src/adapter.ts 4, src/current-user-endpoints.ts 1 (4 numbers);
• 19 test-file comment sites in 3 test files (the census defers *.test.ts; stages 1 to 9 took test comments too): ui-plugin-auto-discovery.pin.test.ts 16, handler-throw-declared-envelope.test.ts 2, current-user-endpoints-localization.test.ts 1.

Only comments changed: 24 lines out, 24 in, every one of them a site (no companion line), and every touched file keeps its line count (1,660 / 1,020 / 335 / 403 / 697), so no line citation into these files moves. No citation number is added: over the 24 line pairs, the added numbers are a subset of the removed ones (#16599 x2, #9864, #16334, all answering 200, stay where they stood), and no PR number stands on an added line. No ADR or ruling-record file in docs/adr/ or scripts/adr-anchors/ records any of these 5 decisions (a grep for the 5 numbers there reads 0 hits; the control number #7329 reads 1 in the same tree), so every anchor is a commit.

A patch changeset for @objectstack/plugin-hono-server rides along, because one rewritten comment reaches dist (measured below). That is stage 6's and stage 9's case (PR #20703, PR #20735), not stages 5 and 7's.

Census: packages/plugins/plugin-hono-server, before and after

Instrument. The gate's own node scripts/check-issue-citations.mjs --census --json, read-only and unchanged, run under with-fleet.sh --read for the token. The count is its allocated-but-absent findings under packages/plugins/plugin-hono-server/. Both runs enumerated the whole board.

reading	tree	board	whole-repo allocated-but-absent	package sites	lines	numbers	files
before	base f927864ea0, run 2026-09-29T23:42:29Z to 23:46:56Z	enumerated, 186 pages, frontier #20735, 18,562 numbers	1,105	5	5	4	2
after	91ce7e5e8f, run 23:58:22Z to 2026-09-30T00:02:19Z	enumerated, 186 pages, frontier #20737, 18,564 numbers	1,100	0	0	0	0

The whole-repo drop of 5 is exactly these sites: a site-by-site diff of the two JSON outputs has 5 findings gone (adapter.ts:225, :227, :308, :349; current-user-endpoints.ts:448) and none added. The other three tallies (resolves 33,003, resolves-as-pull-request 1,984, cross-repo-unjudged 995) are equal in both runs. packages/plugins/plugin-hono-server is byte-identical at 91ce7e5e8f and at the head.

Supplementary scan (test files, strings and files outside src/ included). The gate's exported extractCitations and classifyCitation over all 41 tracked files of the package (CHANGELOG.md excluded), comment-prose and whole-file projections, with the board from the gate's own probeBoard: 347 citations and 32 dead before, 323 and 8 after. Under src/: comments 5 dead to 0, test comments 19 to 0, strings 0 and test strings 2 unchanged. Its before list of src/ comment sites equals the census's. The 8 left are 2 test strings and 6 sites outside src/ (see Acceptance notes).

Per-site table

git blame at the base ties each line to the commit that wrote it, and each anchor was read in its message, changeset or diff, not only its subject.

number	sites (base line)	anchor: what it decided
#13279	adapter.ts:225, :227; handler-throw-declared-envelope.test.ts:84; current-user-endpoints-localization.test.ts:90	6a180e42d: tryFind in resolveAuthzContext raises AuthzStoreUnavailableError (503 SERVICE_UNAVAILABLE) when a permission-store read is issued and throws, instead of answering it as an empty read, and each fail-closed transport catch (requireDatasourceAdmin in service-datasource among them) re-raises it: an unreadable store licenses no verdict, the maintainer's 2026-08-30 ruling recorded in its message. The first three lines blame to cefe068702 (the declared-envelope rendering, PR #17412) and the fourth to 5f7fa1de0; both wrote them citing this ruling. PR #13475 (200) names #13279. Stages 1, 2, 4 and 9 gave the number this anchor.
#9934	adapter.ts:308; handler-throw-declared-envelope.test.ts:152	79c46da90: the producer-side user-facing marking for hook refusals, the userMessage channel, a text field a producer sets at throw time and every classified envelope carries. Both lines blame to cefe068702. The PR that landed it (PR #9992) answers 404 too. Stages 1, 2, 4 and 6 gave the number this anchor.
#6307	adapter.ts:349	293476148: refuse a repeated ?version= on GET/DELETE /packages/:id rather than pick one value, through readSingleQueryValue, which it introduces. The line blames to 7cdbcbb306 (surface repeated query parameters as arrays, PR #7396), which says it follows that direction. Stages 2 and 8 gave the number this anchor.
#6216	current-user-endpoints.ts:448	f586f1a89: one ExecutionContext assembler with two named anonymous entries, assembleExecutionContext the default, fail-closed one and assembleExecutionContextOrGuest the explicit guest one, the maintainer's 2026-08-08 Option A recorded in its docblock. The line blames to 6615a024c3 (the current-user faces adopt the shared assembler). Stages 1, 2 and 7 gave the number this anchor.
#16721	ui-plugin-auto-discovery.pin.test.ts:27, :37, :42, :180, :211, :217, :360, :363, :495, :498, :594, :596, :604, :608, :631, :646	51ae73123: LiteKernel.use() runs the same assertPluginContract as ObjectKernel.use() and refuses the same plugin objects with the same envelope, the maintainer's 2026-09-08 option A (the kernels converge) recorded in its changeset. 15 lines blame to it; :180 blames to 3c48234b3, which re-wrapped that sentence and keeps its fact. Its lite-kernel.ts docblock records the measurement taken before converging, which :604 describes ("before commit 51ae731"). :363, :498 and :631 said the hono-plugin.ts question was "noted on" the dead number; that note is the text this commit wrote into this file, so they now say "raised with" / "recorded with" it. New anchor; no other package has re-anchored this number yet.

Anchor checks. Every cited sha matches exactly one object (git rev-parse --disambiguate, count 1 for each of the 5), is a commit, has one parent, and is an ancestor of main (merge-base --is-ancestor against f927864ea0, exit 0 for all 5). The checkout is not shallow. The control leg 2672f855fa (2026-08-09, the parent of the oldest anchor 293476148) exits 0 against origin/main, and the negative control, this branch's own head, exits 1. Four anchors reuse the landed stages' (6a180e42d, 79c46da90, 293476148, f586f1a89), so each number carries one anchor across the tree; one is new (51ae73123).

Numbers. All 5 dropped numbers answer 404 by REST (probed 2026-09-30T00:14:17Z). The numbers kept on or beside the changed lines answer 200: #16599, #9864, #16334, #16363, #16049, #6878, #3867, #8086, #16545, #15999, #5090. packages/plugins/plugin-hono-server/src has no slash-joined #A/#B without spaces; the spaced pairs (#3867 / #8086, #2408 / #3361) are read by the grammar and every half answers 200.

Mechanical guard: no code token moves

H2 holds on the parser-token reading; the emitted dist is NOT byte-identical, because one rewritten // comment sits inside a returned object literal and the bundler keeps it.

Token guard. It compares the TypeScript parser's leaf tokens (TypeScript 6.0.3, getChildren walk, JSDoc nodes excluded) of the 5 touched files at base f927864ea0 and at the head. Controls mutate the head text in memory only.

• Real run: 15,054 base tokens (4,831 / 2,134 / 3,559 / 2,363 / 2,167), 0 differing, exit 0.
• Comment-insertion control: 0 differing, exit 0.
• Code-insertion control: all 5 files differ, exit 1.
• String control (the first character of the first import specifier flipped in each file): exactly 1 differing StringLiteral per file, exit 1.

All 48 changed lines (24 out, 24 in) are // or * comment lines.

Emitted dist. pnpm --filter @objectstack/plugin-hono-server build at the head, then at base (the base blobs of the 5 touched files restored in place under a trap-armed restore; an on-disk probe read #9934 1 and commit 79c46da90 0 in adapter.ts before that build; afterwards every touched blob equals its HEAD blob, git diff HEAD is empty and the status is clean), with the same dependency builds:

• index.js and index.mjs differ, in one line each: the adapter.ts:308 comment, refusal text (#9934) at base and refusal text (commit 79c46da90) at head. index.d.ts, index.d.mts and both .map files are equal. No docblock of this diff reaches the declaration files.
• The same parser comparison over the two differing files reads identical tokens (10,818 in index.js, 10,521 in index.mjs), so the whole dist delta is comment text. Its code control (a code line appended) reads COUNT/TOKENS DIFFER in each.
• Code-mutation control (scripts/ablation-replace.mjs, wrap mode, anchor message: 'No response from handler' } hit 1 to 0, planted marker 0 to 1, blob 6a0c10f76282 to d5223196afeb; scripts/ablation-dist-preflight.mjs found the marker in index.js and index.mjs): index.js, index.mjs and both .map files differ from the head build. The blob was restored to HEAD 6a0c10f76282 with git diff HEAD empty, dist was rebuilt, its six sha256 values equal the first head build, and the preflight in --absent mode reads the marker absent from all 6 files with a clean tree.

A raw scan of the 6 changed files for ASCII control bytes finds none, and check:nul-bytes exits 0.

Changeset

patch for @objectstack/plugin-hono-server (.changeset/plugin-hono-server-provenance-anchors.md), in PR #20632's form. The package's files[] is dist, README.md and CHANGELOG.md, and the build above emits different index.js / index.mjs at base and head, so this diff publishes. check-changeset-no-major, check-empty-changeset, check-adr-0087-registration and check-changeset-fixed all exit 0.

Gates (head 03e5f4c0fd)

This host has no flock, so os-verify-lock.sh ran in its declared unlocked mode. Its official wording, verbatim (printed by every run; the command line differs per run and is listed in the verdicts below):

Declared narrowing — verification ran UNLOCKED. scripts/pm/os-verify-lock.sh
could not take the shared verify lock on this host: no usable flock. The shared
verify lock is declared Linux-only (flock is util-linux, and a stock macOS does
not ship it), so the command below was run directly, without the lock —
a declared narrowing, not a silent one. No serialization guarantee held for this
run, nor for any sibling agent in this container while it ran.

Its verdict line from each run (the closure build and the three dist builds at feaf0c9b73, whose packages/plugins/plugin-hono-server is byte-identical to this head; the first whole-workspace build, tests and typecheck at 91ce7e5e8f; the second whole-workspace build, tests and typecheck at this head after the merge; the scratch-script paths shortened to SCRATCH):

os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 27s · declare it in the PR body · pnpm --workspace-concurrency=2 --filter '@objectstack/plugin-hono-server...' build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 3s · declare it in the PR body · bash SCRATCH/base-build.sh SCRATCH
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 3s · declare it in the PR body · node scripts/ablation-replace.mjs --file packages/plugins/plugin-hono-server/src/adapter.ts --anchor "message: 'No response from handler' }" --replacement "message: 'No response from handler ABLMARK20594S10' }" -- bash SCRATCH/mut-inner.sh SCRATCH
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 3s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 12s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server exec vitest run --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 17s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server typecheck
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 118s (1m58s) · declare it in the PR body · pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 118s (1m58s) · declare it in the PR body · pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 11s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server exec vitest run --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 16s · declare it in the PR body · pnpm --filter @objectstack/plugin-hono-server typecheck

• Build: @objectstack/plugin-hono-server with its closure (7 of 81 workspace projects), then the whole workspace, turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2, 71 of 71 tasks, before and again after the merge. The tree was clean after each, and the package's six dist files after each whole build equal the first head build by sha256.
• Tests: vitest run --maxWorkers=2: 27 files, 324 tests passed (every *.test.ts under src/), at this head and at 91ce7e5e8f.
• Typecheck: pnpm --filter @objectstack/plugin-hono-server typecheck exits 0 at this head and at 91ce7e5e8f (tsc --noEmit, tsc --noEmit -p tsconfig.typecheck.json, and check:test-typecheck OK with 0 files / 0 errors / 0 pinned signatures). --listFiles: tsconfig.json and tsconfig.test.json each compile 33 src/ files including all 27 tests and all 5 touched files.
• Spec artifacts: origin/main brought a packages/spec change, so pnpm --filter @objectstack/spec check:generated ran after the rebuild: "All 15 generated artifacts are up to date" (exit 0).
• Lint: the repo-wide pnpm lint (eslint . --no-inline-config) exits 0 at this head (2026-09-30T00:25:09Z to 00:25:36Z), and at 91ce7e5e8f.
• Citation judging: after merging origin/main (fbec216e2d), node scripts/check-issue-citations.mjs --base origin/main reports "no issue citations added against fbec216 (2 file(s) read)" (exit 0).
• Derived gates: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 63 families, the same list at 91ce7e5e8f and at this head. All 63 exit 0 at this head in one pass, and --ran with the exit-coded record reads "63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN" (a derived zero). Among them: check:issue-citations, check:doc-authoring, check:nul-bytes, check:published-files, check:dts-closure, check:dual-build-cjs-loads, check:type-check-debt, check-adr-0087-registration, check-empty-changeset.
• Artifact rosters: 36 of the 39 non-self-test roster rows exit 0 at this head, including the four the derivation marks as keeping their roster under one of this diff's paths (check-changeset-fixed, check:authz-resolver, check:error-code-casing, check:filter-alias-parity). The other three need a pull request's context; they are run against this PR once it exists and reported on the card. The 18 self-test-only rows grade their checkers' fixtures and cannot judge this diff.

Hypotheses (measured first)

• H0 holds. At base f927864ea0 the filtered census answers 5 sites on 5 lines, 4 numbers, 2 files, as on the seat's 0be898499f. The whole-repo count is 1,105.
• H1 holds. After the rewrite, the filtered census answers 0 for packages/plugins/plugin-hono-server. No site was left for an open PR (the file lists of all open PRs were read at 2026-09-29T23:48:36Z, 6 PRs, and again at 2026-09-30T00:15:14Z, 9 PRs: only the Version Packages PR chore: version packages #20639 touches the package, in CHANGELOG.md and package.json) or for an unfound anchor.
• H2 holds on the token reading, not on the dist reading. The parser leaf-token diff of all 5 touched files is empty with its controls firing. The emitted dist differs in one comment line of index.js and of index.mjs, token-identical with a code control. That is why the changeset ships.

Acceptance notes

• Strings, the form-D stage. One dead number remains in a string literal in packages/plugins/plugin-hono-server/src: #16721 at the end of the group-F describe title of ui-plugin-auto-discovery.pin.test.ts (:635, a test title, no assertion text). It stays on the card for its form-D stage; no string moved here. The supplementary scan's second test-string hit, :111 ('.os-pin{color:#123456}'), is a CSS hex colour in a fixture, not a citation: the whole-file projection reads it as a six-digit number, while the census blanks strings and defers test files.
• Outside src/**, a later stage of the card: objectstack.config.ts:19 (#11332) and :26 (#10724), tsconfig.test.json:3 and :61 (#13176), tsconfig.typecheck.json:12 (#11332 and #10724; #4914 in the same group answers 200). The other citations in the package outside src/** (CHANGELOG.md excluded) answer 200: tsconfig.test.json (#14062, #5286, #5449, #12542), tsconfig.typecheck.json (#13284, #5475, #10756), vitest.config.ts (#10374, #9457, #7378; #8129 resolves as a pull request). README.md carries none.
• An open question now lives only in this file. hono-plugin.ts:521 and :523 still carry the && plugin.staticPath conjunct and the plugin.slug || plugin.name.split('/').pop() derivation that, since 51ae73123, neither published kernel's use() lets an input reach. The pin file says so and leaves the call to hono-plugin.ts; the tracker note it pointed at is gone, so this file's text (and commit 3c48234b3's message) are the record. Unreachable defensive code, not a defect: noted, not filed.
• Card-word residue, cited nowhere. handler-throw-declared-envelope.test.ts still says "before this card" (:85) and "the card" (:19, :32) around its rewritten lines. They cite no dead number, so they were left, as the landed stages left theirs.
• The moving origin/main. The branch merged origin/main once (03e5f4c0fd, merging fbec216e2d: the ADR-0087 migration chain moves to @objectstack/spec/migrations). packages/spec is in this package's dependency closure, so the workspace was rebuilt and the package's tests, typecheck and every gate above were rerun at the merge head; nothing in packages/plugins/plugin-hono-server changed.

Deviations

• Three derived gates first read NOT MEASURED. check:dual-build-cjs-loads, check:lean-entry-closure and check:type-check-debt exited 3 (PREREQUISITE NOT MET: built output absent) in the first pass, before the whole-workspace build. Rerun after it, each exits 0, and all 63 exit 0 in the single pass at this head.
• The first check:generated run was void. This host's global pnpm is a v11 front end that rejects the -s each sub-gate passes, so all 15 rows read "unexpected argument '-s'" (exit 1, nothing measured). Rerun with the real pnpm 10.31 binary first on PATH, it reads all 15 up to date (exit 0).
• Commit trailers are AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), and the pre-push trailer check passed on every push. The harness's attribution reminder asked for a model-named trailer and a different PR footer, and AGENTS.md overrides it. The merge commit carries git's default message.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 7 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fbec216e2d184afc03b456b0bd8013ad5d47bc6f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 8ab123c0ed42b3678cc2c88bb80fef381674019d — the merge of head 03e5f4c0fd6f8bb63ce037d6d39141240bdccf51 into base fbec216e2d184afc03b456b0bd8013ad5d47bc6f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8ab123c0ed42b3678cc2c88bb80fef381674019d && git checkout 8ab123c0ed42b3678cc2c88bb80fef381674019d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fbec216e2d184afc03b456b0bd8013ad5d47bc6f 03e5f4c0fd6f8bb63ce037d6d39141240bdccf51 && git checkout -B drift-repro fbec216e2d184afc03b456b0bd8013ad5d47bc6f && git merge --no-ff 03e5f4c0fd6f8bb63ce037d6d39141240bdccf51

node scripts/docs-audit/affected-docs.mjs --json fbec216e2d184afc03b456b0bd8013ad5d47bc6f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 03e5f4c0fd6f8bb63ce037d6d39141240bdccf51
Local-runs: none

① Derived judgments

Inputs read. Card #20594's body and all 39 comments (the stage-1 to stage-10 claims, os-dev-reports, ACCEPT and Landed records; the stage-5 ruling 5895600995 that a changeset follows from a dist measurement; the domain:services pointer 5888293145 and its answer 5890033713). PR #20741's body; its file list (pulls/20741/files?per_page=100: page 1 holds 6 entries, page 2 is empty); its full diff (Accept: application/vnd.github.diff, 222 lines, 6 diff --git blocks; compare/main...03e5f4c0fd reads the same 6 files at merge base fbec216e2d). The check-runs on the head.

Sampled. The whole population: all 24 rewritten sites in all 5 code files (adapter.ts 4; current-user-endpoints.ts 1; current-user-endpoints-localization.test.ts 1; handler-throw-declared-envelope.test.ts 2; ui-plugin-auto-discovery.pin.test.ts 16), each read against its anchor's message and patch via commits/SHA. The brief's floor of 12 sites in 6 files exceeds the population's file count: the sixth file is the changeset, which carries no site. Every hunk of the diff was read, adapter.ts's four hunks in full.

(1) Comment-only: RIGHT. An awk pass over the diff (changeset excluded) finds 24 removed and 24 added lines and 0 changed lines whose first non-blank characters are not * or //. No code token, string literal, error message, identifier or test assertion moved. adapter.ts's four pairs are docblock lines :225 and :227, the // line :308 inside declaredEnvelopeForThrow's returned object literal (the code beside it — code, message, the details and userMessage spreads — is unchanged context, read on the head blob), and docblock line :349. The describe('UI plugin auto-discovery (#16050)' titles in the pin file's hunk headers are context, not changes. Every hunk header has equal old and new spans.

(2) Anchors: RIGHT, none wrong or unsupported. All 5 shas exist (commits/SHA answers each with one parent) and all 5 read ahead, behind_by 0 against main (ahead_by 3307 / 4838 / 6228 / 6053 / 1914).

• 6a180e42d (2026-08-30, "fail loud when a permission-store read fails (fix(core,rest,services): fail loud when a permission-store read fails #13475)") — adapter.ts:225, :227; handler-throw-declared-envelope.test.ts:84; current-user-endpoints-localization.test.ts:90. Its patch makes tryFind in resolve-authz-context.ts throw new AuthzStoreUnavailableError(object, err) on a thrown read, and its service-datasource/admin-routes.ts hunk adds if (isAuthzStoreUnavailableError(err)) throw err; in the catch of requireDatasourceAdmin with the words "an unreadable store licenses no verdict at all"; the message records the 2026-08-30 maintainer ruling. "the ruling commit 6a180e4 landed", "commit 6a180e4's discipline (an unreadable authz store licenses no verdict)", "requireDatasourceAdmin re-raises it (commit 6a180e4)" and "fail-LOUD tryFind (commit 6a180e4)" are all supported.
• 79c46da90 (2026-08-19, "producer-side user-facing marking for hook refusal messages — userMessage channel (contract: a hook refusal has no way to mark its message user-facing — the console's 403 substitution (ruled in #3821) needs a producer-side opt-in channel #9934) (feat(contract): a hook refusal can mark its message user-facing — the userMessage producer-side opt-in channel #9992)") — adapter.ts:308; handler-throw-declared-envelope.test.ts:152. Adds userMessage to ApiErrorSchema, ThrownHttpError, rest/error-response.ts and the client. "END-USER-addressed refusal text (commit 79c46da)" supported.
• 293476148 (2026-08-09, "refuse a repeated ?version= on GET/DELETE /packages/:id (GET/DELETE /packages/:id 把重复的 ?version= 查询参数(string[])原样交给 PackageService #6307) (fix(rest): refuse a repeated ?version= on GET/DELETE /packages/:id instead of handing the array to PackageService (#6307) #6895)") — adapter.ts:349. Its package-routes.ts patch introduces function readSingleQueryValue and the "supplied N times. Supply it at most once" refusal. "the readSingleQueryValue direction commit 2934761 landed" supported.
• f586f1a89 (2026-08-10, "one ExecutionContext assembler, two named anonymous entries (finding: ExecutionContext 在 dispatcher / REST / share-link 三处独立组装 —— 收敛为单一共享装配函数前,先裁决匿名面分歧 #6216) (refactor(core,runtime,rest): one ExecutionContext assembler, two named anonymous entries (#6216) #7259)") — current-user-endpoints.ts:448. Adds assembleExecutionContext ("the DEFAULT, fail-closed entry (finding: ExecutionContext 在 dispatcher / REST / share-link 三处独立组装 —— 收敛为单一共享装配函数前,先裁决匿名面分歧 #6216 Option A)") and assembleExecutionContextOrGuest; its changeset records "maintainer ruling 2026-08-08 on finding: ExecutionContext 在 dispatcher / REST / share-link 三处独立组装 —— 收敛为单一共享装配函数前,先裁决匿名面分歧 #6216, Option A". "commit f586f1a, the ruled Option A" supported.
• 51ae73123 (2026-09-08, "LiteKernel.use() enforces the declared plugin contract, converged with ObjectKernel ([Decision] The declared plugin contract does not govern what the runtime accepts: LiteKernel never runs PluginSchema, and isDefault survives the kernel that does #16721 step 2) (feat(core): LiteKernel.use() enforces the declared plugin contract, converged with ObjectKernel (#16721 step 2) #16827)") — the 16 pin-file sites. Its lite-kernel.ts patch inserts assertPluginContract(plugin) between validateIdle() and registerPluginByName; its docblock records "maintainer ruling 2026-09-08, option A under core(finding): duplicate plugin registration throws on LiteKernel and silently overwrites on ObjectKernel — a fourth instance of the two-kernel semantic split #9864's precedent that the kernels converge" and the step-1 measurement (813 calls, 807 unchanged, six refusals from three test-local fixtures); its changeset says LiteKernel.use() used to write the object straight into the registry while PluginSchema ran only in PluginLoader. The three "raised with / recorded with commit 51ae731" lines (:363, :498, :631) hold in a strict sense: the "noted on [Decision] The declared plugin contract does not govern what the runtime accepts: LiteKernel never runs PluginSchema, and isDefault survives the kernel that does #16721" sentences they replace were written INTO this file by that commit (its pin-test hunk, +142/−120, carries them). ":604 (before commit 51ae731)" matches the commit's own "measured before converging ([Decision] The declared plugin contract does not govern what the runtime accepts: LiteKernel never runs PluginSchema, and isDefault survives the kernel that does #16721 step 1)". Supported.

No ADR or ruling record holds these decisions: a grep for the 5 numbers in docs/adr and scripts/adr-anchors of the worktree (at f11b5f20a2) reads 0, control #7329 reads 2. Commit anchors are the right form C.

(3) Numbers: RIGHT. Multiset over removed lines: #13279 x4, #9934 x2, #6307 x1, #6216 x1, #16721 x16 (the 24 dropped) plus #16599 x2, #9864 x1, #16334 x1; over added lines: #16599 x2, #9864 x1, #16334 x1. The kept numbers stand on the same lines they stood on, and no number is added. REST probe at my read: the 5 dropped answer 404; #16599, #9864, #16334 and the context-line #6878, #16363, #16049, #16050 answer 200 (#16363 is a pull request, kept as it stood). No 200 number was removed or rewritten. Shas on added lines: 6a180e4 x4, 79c46da x2, 2934761 x1, f586f1a x1, 51ae731 x16 (one sentence-initial "Commit" at :608); shas on removed lines: none.

(4) Line counts: RIGHT. Additions equal deletions in every modified file (4/4, 1/1, 1/1, 2/2, 16/16), every hunk's old and new spans are equal, and the head blobs read 1,660 / 335 / 1,020 / 403 / 697 lines, the dev's figures. The changeset is a new 11-line file.

(5) Judged in ②.

(6) Part of #20594: RIGHT. The card stays open for create-objectstack 3, plugin-dev 3, observability 1, verify 1, the form-D string stage and each package's files outside src/** (landing record 5900344766, claim 5901153104). The body's first line is Part of #20594 with no closing keyword; Part-of PR must not also close its card is success. Nothing left behind: I fetched all 33 src/*.ts blobs of the package at the head tree (truncated: false), extracted every #NNN token (304 tokens, 82 distinct numbers) and probed each by REST: 80 answer 200, 2 answer 404 — #16721 in the group-F describe title string at ui-plugin-auto-discovery.pin.test.ts:635 (a string literal, the form-D stage, as the dev declares) and #123456 at :111, a CSS hex colour in a fixture, not a citation. Zero comment sites remain. The brief's "52 to 0" is not this stage's figure: the dev reports the census 5 to 0 (24 sites including 19 test-comment sites), and both readings hold on the head.

Merge head. 03e5f4c0fd merges fbec216e2d (26 files, none under packages/plugins/plugin-hono-server/), so the package at the head is the package at 91ce7e5e8f, where the dev's census and dist readings were taken.

Accept-set and public-surface changes implied by the diff: none. No runtime symbol, route, error code, envelope key, type or export moves; nothing in a // or * line can reach a declaration file.

Check-runs on the head at my read (2026-09-30T00:41:30Z): 34 runs, newest per name — 31 completed/success, 3 completed/skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in): the expected skips), 0 in progress, 0 failed. Check Changeset, Lint & Repo Gates, the four Type Check runs, Test Core 1–6, Dogfood Regression Gate 1–3, Temporal Conformance and the four PR-shape guards are all success.

② Semver level

patch for @objectstack/plugin-hono-server: RIGHT. The package publishes (no private; files = dist, README.md, CHANGELOG.md; the build is the shared tsup.config.ts, esm and cjs, unminified). The dev's measurement — base and head builds with the same dependency builds; dist/index.js and dist/index.mjs differing in exactly the adapter.ts:308 comment line; index.d.ts, index.d.mts and both maps equal; parser tokens of the two differing files identical; and a code-mutation control (ablation-replace.mjs) that flips index.js, index.mjs and both maps — supports carrying a changeset under the lane's own rule (ACCEPT 5895600995: the changeset follows from the dist measurement; stages 6 and 9, PR #20703 and PR #20735, shipped patch on a comment-text-only dist delta, while stages 5 and 7 took skip-changeset on byte-identical dist). The one comment that ships is a // line inside a returned object literal, a position unminified esbuild output keeps while docblocks do not reach the bundle, so the measurement's shape is the expected one. A tarball whose bytes differ is a publish, and patch is its floor. The changeset prose ("Comments only: no route, error code, refusal text, type, export or runtime behaviour changes") is accurate to the diff, and Check Changeset is success.

Clause-②: Clause-②: no on the body's second line is RIGHT. No accept-set narrows or widens, no public surface moves, no metadata surface is touched, so no ADR-0087 disposition is owed.

③ Boundary flags

• open_questions: empty in the dev's report (5901683329). Nothing to answer.
• Dev deviations, each judged: three derived gates first NOT MEASURED before the whole-workspace build, then exit 0 — sequencing, and CI's Build Core and Type Check · debt ledger answer the same families green; the void first check:generated run under the pnpm v11 front end, rerun green — host noise, and CI answers; the os-verify-lock UNLOCKED disclosure copied into the body — declared as required; 18 self-test-only roster rows not run — they grade fixtures, not this diff; model-free trailers per AGENTS.md — the seat's concern, not a contract one. None changes the verdict.
• Out-of-scope findings, both rightly left on the card: the #16721 describe-title string at :635 (form-D stage), and the five 404 sites outside src/** (objectstack.config.ts:19, :26; tsconfig.test.json:3, :61; tsconfig.typecheck.json:12), which the census does not sweep and no stage claims.
• The dev's Acceptance notes: hono-plugin.ts:521/:523's unreachable defensive conjunct is now recorded only in the pin file's text — noted, not a defect of this change; the "before this card" / "the card" residue at handler-throw-declared-envelope.test.ts:19, :32, :85 cites no number and is left as the landed stages left theirs — right.
• No escalation.

Implemented-by: claude/issue-20594-hono-server-citations
Reviewed-by: local_1d2a197c-c20e-4e90-9be8-413d4d432289

VERDICT: PASS

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 36651967188 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Console Pin Gate — 失败步骤: Build the Console SPA at the pinned objectui SHA

  ✗ Neither spec appears in the built console — no @objectstack/spec
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 6 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)