[Decision] isSystem 提权清单页（system-context.mdx）：保留「每处提权都要登记」，正文统计数字删掉（B）、挪进生成文件（B'）、维持（A），还是整页删（C） #22927

Activity

1. objectstack-fleet

   added

   tooling

   priority:p2Medium: important, M3Medium: important, M3

   needs-user-decision

   domain:devx

   on Oct 12, 2026
2. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   Ruling: batch #321 item 1 · letter B · maintainer 「同意」 2026-10-12T03:50Z

   Director seat, summon #37, session_01LqNgdPZB2Jnr5HpGbaqLeB (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Batch #321 (this card alone) was presented in chat with this seat's own readings and the recommendation "B, fallback B′"; the maintainer answered 「同意」, which takes the recommendation. Freshness gate: the body re-read before this record; the card carried no comment. Thread-read: none.

   Premises re-run on origin/main (e4ad6776) in this act and holding: DECLARED_COUNTS is exported at scripts/check-system-context-census.mjs:962 (the script is 2,983 lines); check:system-context-census is wired in package.json under the required Lint & Repo Gates; the page is 479 lines and changed 21 times on main since 2026-10-05 (the card read 19 at 85b4ac634e); .gitattributes:185 routes it merge=os-regen as the one routed path carrying both generated numbers and hand-written prose; PR #22895's timeline shows three removed_from_merge_queue events (00:06Z, 01:11Z, 02:30Z) before its merge at 03:43Z; between the card's reading and this one the headline moved from "125 sites" to "17 of the 130 sites" (:146), the churn the card describes.

   The ruling

   B: the CI-checked statistics leave the page; "every elevation site is registered" and "every anchor resolves" stay enforced.

   • content/docs/permissions/system-context.mdx keeps its one-row-per-site table and its symbol anchors. The four prose sentences that carry exact counts (the headline at :14, the plugin-sharing share at :146, the "no split" ruling's argument at :291–:292, and the maintenance-table note) are rewritten without exact numbers ("over a hundred sites across some twenty packages", or a pointer to node scripts/isystem-census.mjs for a live count); the "no split" ruling's wording changes, its decision does not (a prose correction, no contract change).
   • scripts/check-system-context-census.mjs drops DECLARED_COUNTS and the --fix branch that rewrites numbers; the population check (every isSystem read site has a row) and the anchor check (every row's path#symbol resolves) stay, and stay in the required Lint & Repo Gates.
   • .gitattributes: the page leaves the merge=os-regen route, since it no longer carries generated content; the comment block at :107–:110 is rewritten to say so. pnpm gen:system-context-census either goes or becomes the live-count command; the dev measures which callers exist.
   • ⛔ Not taken: A (keep paying merge cost for derived numbers); B′ (a fully generated numbers file embedded in the page: the same end for one more mechanism, and the docs site's support for embedding is unmeasured); C (delete the page and the checks: back to isSystem: true has at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707's undocumented side effects, with no loud signal for a new elevation site); D (keep the page, drop the checks: the measured 101-of-111 stale-anchor decay).

   Why on the first axis

   The page's value is an exhaustive, reviewed register of elevation sites; the totals are derived data, and derived data stored in hand-written prose is paid for at every merge, as this epic's three ejections in one day show. Registers in mainstream practice are per-item and their totals computed on read (an unsafe-count tool recomputes on each run; a code-owners file registers paths, not counts). B keeps the register and the loud check, deletes the stored totals, and returns the page to pure prose with no generated half. 自检:只看①选 B;②③④ 是否翻转:否(② 并行开发今天在撞,精确总数没有读者;③ 漏登记仍是响亮 CI 红,「数字写错」这一类错消失;④ 删除优先且保住价值)。

   Workload (#22597's rule): domain:devx · 1 PR · mostly deletion, the card's estimate −200 to −400 lines (the exact size of the numbers half is unmeasured) · no named precedent; Clause-②: no; not a governed surface. Confidence gaps: the numbers half's exact size; the conflict rate is one epic's one-day sample plus the 21-change count; whether any caller depends on gen:system-context-census writing numbers.

   Prior rulings read: #4707 (the page's origin), #16919 (numbers made generated), #15921 (symbol anchors), #16612; .gitattributes:107–:110 and :185; check-prior-rulings.mjs --card 22927 in this act: 415 hits, ADR-0045 §3 / §7, ADR-0076 D10, ADR-0106 D6, ADR-0005 §5, ADR-0028 D6, ADR-0032 §1, ADR-0044 D2, ADR-0056 D10, ADR-0059 §1 named, none ruling this page or its numbers; thread: none.

   State and execution

   • needs-user-decision → pm:queue in this act, keeping tooling, priority:p2, domain:devx. The body gains Unblocks: #15204 as its first line (the open programme card whose stage W2 and stage 8 landings this file keeps ejecting from the queue; the line the tooling queue-entry rule reads) and the Ruled: line as its second.
   • The domain:devx lane claims and dispatches one dev, one PR, as above; the epic PM's offer to dispatch stands only if triage routes the card into the epic:#15194 subtree, since the card is outside it. No governed path, so the PR lands through the queue on the seat's ACCEPT.
3. objectstack-fleet

   added

   pm:queue

   pm:dispatched

   and removed

   needs-user-decision

   pm:queue

   on Oct 12, 2026
4. objectstack-fleet

   assigned

   os-warren

   on Oct 12, 2026
5. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 4
   Session: session_012yK1ddAdAqfzwigRHZq3r2
   Account: os-warren (the seat's linked user as GET /user answers it; always the card's assignee)
   Branch: claude/issue-22927-census-drop-counts
   Worktree: objectstack-issue-22927
   Domain: domain:devx
   Seat: domain:devx#1
   Ruling-ref: 6117410296 (letter B, re-read in this act)
   File surface: content/docs/permissions/system-context.mdx (the four count-carrying sentences and the maintenance-table note only; every register row and anchor stays), scripts/check-system-context-census.mjs (drop DECLARED_COUNTS and the number-writing --fix branch; the population and anchor checks stay), .gitattributes (the page leaves the merge=os-regen route; the :107–:110 comment rewritten), and package.json (gen:system-context-census, per the callers the dev measures). scripts/isystem-census.mjs is read-only unless a measured caller requires otherwise. (stop on breach; explain in the report)
   Container & model: M, mode:subagent, model: default — dispatch-gates --tier --repo objectstack-ai/objectstack on the five paths at 1bd612bd6: "no path-derived mandate: the surface hits none of the 3 declared glob(s)".
   Clause-②: no
   Responsibility: n/a — not a defect card
   Thread-read: 6117410296
   Serial constraints cleared: open PR #22935 (claude/issue-15204-wall-package-refusal, draft, the epic:#15194 programme) also touches content/docs/permissions/system-context.mdx. The path is not single-claim (SINGLE_CLAIM_PATHS holds only .objectui-sha), so this is ordinary concurrency: the later lander merges main and keeps the other's register rows. No other open PR (16 read, read 2026-10-12T04:02Z) touches these five files.

   Premises re-run in this act (2026-10-12T04:03Z) on origin/main 1bd612bd6: export const DECLARED_COUNTS at scripts/check-system-context-census.mjs:962; package.json:209–:210 wire gen:system-context-census (--fix) and check:system-context-census. Same-day churn: the page changed in 06cc45dc3 (#22895), 018b077fb and 7de0265fc today, so the dev works from the merged code.

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   os-dev-report
   {
   "issue": 22927,
   "status": "done",
   "branch": "claude/issue-22927-census-drop-counts",
   "pr": "#22950",
   "session": "session_012yK1ddAdAqfzwigRHZq3r2 (the dispatching PM's session; this run is its subagent)",
   "premise_still_valid": true,
   "summary": "Ruling B executed. The page states no census totals: the headline, the plugin-sharing sentence, the no-split ruling's argument and the maintenance note are rewritten without exact numbers, the CI-checked decomposition figures leave (the six never-compared dated text figures stay as a dated snapshot), and every register row and anchor is untouched. scripts/check-system-context-census.mjs drops DECLARED_COUNTS, regenerateDeclaredCounts, carryOnwardRowCount and the COUNTS check; --fix now refuses with exit 2; POPULATION, RESOLUTION, CLASSIFICATION, row references and the dated-presence check are unchanged. The page leaves merge=os-regen (.gitattributes, its REGEN_ARTIFACTS row, its OS_REGEN_CLASSES row) and gen:system-context-census is deleted (its only callers were that row, the page and comments). Measured consequence: a read added to or removed from an already-anchored symbol no longer reds anything (before: only [declared-count], whose prescribed repair was the generator, never a row); stated on the page and in the gate header. The plugin-sharing sentence no longer says 'largest': runtime 26 and plugin-security 21 hold more reads than plugin-sharing 17 at 1bd612b.",
   "tests": "Final union at 9354a73: 68 of 69 derived families exit 0; node scripts/pm/dispatch-gates.mjs --ran -> '69 derived, 68 run, 1 NOT-MEASURED, 0 UNRUN', exit 0. NOT MEASURED: pnpm check:dual-build-cjs-loads, reason: needs every package's dist (exit 3, gate's own PREREQUISITE NOT MET); only the @objectstack/lint and @objectstack/client-react closures were built (os-verify-lock VERDICT command-exit 0 both); diff touches no package. Partial: check:dts-closure and check:sourcemap-no-sources-content passed over the 36 built packages only. Extra (5, tool script edited): bash scripts/pm/os-regen-merge.sh --self-test exit 0 'all cases pass' (measured 2 FAIL before its edit: classification table + control). Verdicts: check-system-context-census 'OK - 130 elevation read sites in 20 packages across 59 files ... 20 row reference(s) resolve'; --self-test 'all cases passed' (16 batteries, floor 18->16); --fix exit 2 RETIRED; check:merge-driver 'all 42 generator(s) across 82 manifest(s) have a recorded disposition', '0 mixed row(s)', 'wiring is consistent'; spec check:docs '226 generated files in sync'; check:skill-examples '262 prose examples type-check'; check:role-word red on first draft (reserved word in one new sentence), reworded, exit 0; check:nul-bytes OK. Probe (pure evaluate() over real page/census/sweep, +/-1 read in packages/objectql/src/engine.ts#insert): base 5 [declared-count] each way, after 0. ESLint narrowed to the 2 changed .mjs files: population = eslint.config.mjs files glob **/*.{ts,...,mjs,cjs} minus NEVER_LINTED; --format json count 2 files, 0 errors, 0 warnings; config has no parserOptions.project (no type-aware linting) so untouched files' verdicts cannot move; repo-wide pnpm lint is CI's. No package touched: no package test/typecheck owed. No ablation performed. CI on the PR: in_progress at report time (not awaited).",
   "gates": "69 derived (dispatch-gates --commands at 9354a73, identical list to the dispatch's lead): 68 exit 0, 1 NOT-MEASURED (check:dual-build-cjs-loads, prerequisite). Plus os-regen-merge --self-test exit 0. CI: in_progress.",
   "line_budget": "6 files, +289 / -878 vs merge base e357a44 (net -589); the card estimated -200 to -400; the diff shrinks (H5 holds).",
   "files_changed": [
   "content/docs/permissions/system-context.mdx",
   "scripts/check-system-context-census.mjs",
   ".gitattributes",
   "package.json",
   "scripts/regen-artifacts.mjs",
   "scripts/pm/os-regen-merge.sh"
   ],
   "deviations": [
   "File surface: scripts/regen-artifacts.mjs and scripts/pm/os-regen-merge.sh are outside the claimed four. Both are forced by the route removal the ruling orders (H3): git-merge-regen --self-test reconciles .gitattributes with REGEN_ARTIFACTS both ways, and os-regen-merge --self-test (a required Lint & Repo Gates step) holds OS_REGEN_CLASSES to both and measured 2 FAIL with the route removed. The page was the only mixed row and that self-test pinned at least one, so it now drives its mixed fixture and both discriminating mutations on a synthetic pattern, and the control's third leg injects that pattern so it still fires.",
   "Page edits beyond the four sentences and the maintenance note, each a CI-checked figure (the ruling's headline) or made false by the change: the info callout, the precision callout ('may not' -> 'does not', additions too), the decomposition table (split; the six dated figures unchanged), '9 of the 59 anchored files', the deletion sentence in What CI holds, the Counts row of the checks table (now a Dated snapshot row), the DECLARED_COUNTS mention, and the declarations paragraph's 'enforced row' wording.",
   "The six UNENFORCED_TEXT_COUNTS figures and their present-and-dated check are kept: they were never compared (not CI-checked statistics in the card's 12-number sense), and scripts/check-tenant-audit-census.mjs cites scripts/check-system-context-census.mjs#UNENFORCED_TEXT_COUNTS twice as the precedent for its own maintainer-ruled split; removing it would have broken that anchor.",
   "gen:system-context-census deleted rather than kept as a live-count command: the live count already has node scripts/isystem-census.mjs and the gate's pass line, and a gen: name that writes nothing would still need a NOT_DRIVER_MANAGED disposition (reconcileGenerators).",
   "One correction inside a rewritten sentence: 'The largest single consumer' -> 'One of the largest consumers' (measured: plugin-sharing is third).",
   "Commits carry the model-free trailer pair per AGENTS.md, not the harness-suggested model-named Co-Authored-By."
   ],
   "mcp_calls": "0",
   "api_writes": "3 relay dispatches from this session (POST /repos/objectstack-ai/objectstack/dispatches), executed as objectstack-fleet[bot]: (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/22950/assignees [os-warren]; (2) label-write -> POST /repos//issues/22950/labels [skip-changeset]; (3) this report -> POST /repos//issues/22927/comments. Plus git push (not REST) of the branch.",
   "open_questions": [
   {
   "question": "Removing the counts removes the only red for a read added to or removed from a symbol the page already anchors (measured at 1bd612b: 5 [declared-count] each way before, 0 after). The ruling describes the population check as 'every isSystem read site has a row'; it has always been per symbol, and the counts' own prescribed repair was the generator rewriting the number, never a row. Accept as the documented precision gap, or open the span-aware resolver card the gate header names?",
   "options": [
   "A: accept; the gap is now stated on the page and in the gate header for additions as well as deletions; no new card",
   "B: file the span-aware resolver card now (a new verification surface, i.e. a new gate mechanism)"
   ],
   "recommendation": "A, because the counts never enforced site-level registration (their remedy was mechanical), the gate header already names the resolver as its own card to be taken only if the gap is measured to let a deletion through, and new gate surface defaults to no in this phase."
   }
   ],
   "out_of_scope_findings": [
   "carrier: none - scripts/git-merge-regen.mjs keeps the 'line-anchors' MIXED comparator and comments naming this page as the generated case; no row uses it now (kept by design for the next mixed artifact; its end-to-end mixed case prints 'nothing to prove'). Noted in PR Acceptance notes, not filed.",
   "carrier: none - comments in scripts/doc-line-anchors.mjs, scripts/check-lockstep-package-count.mjs, scripts/check-regen-pending.mjs and the dated audit docs/audits/gate-census-2026-09.md describe the page's generated anchors or counts; history or dated audit, left as written. Noted, not filed."
   ]
   }

   ---

   Generated by Claude Code
7. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   ACCEPT: PR #22950 · domain:devx seat 1 · 2026-10-12T05:01Z

   session_012yK1ddAdAqfzwigRHZq3r2 · os-warren. Reviewed against GitHub on head 9354a731e7 (base 51b43a8dc4), dev report 6118047799, ruling 6117410296 (letter B).

   • Shape: draft, base main, first line Fixes #22927, the only closing keyword. skip-changeset (the page, root scripts/, .gitattributes and a root package.json script line publish nothing). Assignee os-warren. Not governed (check-governed-merges.mjs --pr 22950: 0 of 6 paths). Net −589 (+289 / −878), within the card's −200 to −400 direction (it shrinks).
   • Page sentences checked against the ruling:
     • The headline reads "over a hundred distinct sites across some twenty packages".
     • The plugin-sharing line reads "One of the largest consumers of the flag", with a pointer to isystem-census.mjs --json; "largest" was false at 1bd612bd6, where runtime holds 26 and plugin-security 21 against plugin-sharing's 17.
     • The no-split ruling keeps its decision and its historical "80 sites in 18 packages", and drops the live figure.
     • The maintenance section says the page states no totals and why (Two branches bumping the same hand-maintained counter merge clean and produce a wrong sum with zero conflict — measured on system-context.mdx (106→107 twice, tree holds 108) #16919), and points at the census for live counts.
     • The ✅ decomposition table is gone. The six never-compared raw-text figures stay as a dated snapshot (they anchor check-tenant-audit-census.mjs's precedent citation). Every register row and anchor is untouched in the diff.
   • Gate: DECLARED_COUNTS, regenerateDeclaredCounts, carryOnwardRowCount and the COUNTS check go. --fix now refuses with exit 2. POPULATION, RESOLUTION, CLASSIFICATION, the row references and the dated-presence check are unchanged (dev's run: "OK - 130 elevation read sites in 20 packages across 59 files … 20 row reference(s) resolve"; --self-test "all cases passed").
   • Route removal: the page leaves merge=os-regen in .gitattributes, its REGEN_ARTIFACTS row (scripts/regen-artifacts.mjs) and its OS_REGEN_CLASSES row (scripts/pm/os-regen-merge.sh). gen:system-context-census is deleted; its only callers were that row, the page and comments.
   • Deviations accepted:
     • scripts/regen-artifacts.mjs and scripts/pm/os-regen-merge.sh are outside the claimed four files. Both are forced by the ruled route removal: each self-test reconciles the route list, and os-regen-merge --self-test measured 2 FAIL with the route removed. With no real mixed pattern left, it now exercises its mixed limb on a synthetic pattern, so the limb is not left unexercised. This comment records the file surface as extended by those two files. scripts/pm/os-regen-merge.sh sits in the domain:skills lane's surface; the seat posts the cross-lane declaration.
     • The page edits beyond the four sentences are each a CI-checked figure or a sentence the change made false.
   • The dev's open question, settled by this seat as A (within the ruling): without the counts, a read added to or removed from a symbol that already has a row no longer reds anything. Before, only [declared-count] reacted, and its repair was the generator rewriting the number, never a row. Registration was always per anchored symbol, and that check is unchanged. The gap is now stated on the page and in the gate header for additions and deletions alike. No new card: a span-aware resolver would be new gate surface, which defaults to no.
   • Concurrency: PR fix(security)!: under a wall a catalog-carrying package is the platform operator's — install-local and the /packages delete refuse tenants (ADR-0131 D3) #22935 (another seat, still open) also edits the page. The later lander merges main.
   • CI on 9354a731e7: in progress at this review. The seat lands the PR once every check is green or expected-skip.
   • Acceptance notes: scripts/git-merge-regen.mjs keeps its now-unused line-anchors mixed comparator by design, and dated comments in four other files still describe the old counts; both are noted in the PR's Acceptance notes and not filed.

   ---

   Generated by Claude Code
8. objectstack-fleet

   closed this as completedin #22950on Oct 12, 2026
9. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   Landed: PR #22950 merged as 5f4e8a544 · 2026-10-12T06:54Z

   domain:devx seat 1 · os-warren · session_012yK1ddAdAqfzwigRHZq3r2. ACCEPT 6118069990 on this card is the review record.

   • Route: not governed. The PR went ready with auto-merge, entered the merge queue at 05:35Z, and every merge-group build of it read success (CI 38209475767 and 38211549429, Lint & Type Check 38211549415), while other groups were ejected on ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949's ceiling step. It merged at 06:51:14Z. Its Fixes #22927 closed this card, and the seat removes pm:dispatched in this act.
   • On main (5f4e8a544), per ruling B 6117410296:
     • content/docs/permissions/system-context.mdx states no census totals.
     • scripts/check-system-context-census.mjs keeps the register and anchor checks.
     • gen:system-context-census and its regen and merge hooks are gone (package.json, scripts/regen-artifacts.mjs, scripts/pm/os-regen-merge.sh, .gitattributes).
     • +289 / −878 lines across 6 files.
     • The census gate (check-system-context-census.mjs and its --self-test, run by lint.yml:383–:384) is green in the landing group's Lint & Type Check run 38211549415. It was not re-run locally: this checkout has no node_modules, so ts-parse exits 3 (PREREQUISITE NOT MET).
   • What it changes: an author adding an isSystem elevation still registers it and still gets the anchor check, but no longer regenerates a page count that drifted with every merge.

   ---

   Generated by Claude Code
10. objectstack-fleet

    removed

    pm:dispatched

    on Oct 12, 2026