[objectstack-fleet]

Refs #24579
Clause-②: no

Round 19 of the 18.0 sweep's wave anchor (claim 6305778491, PM loop round 34). It applies round 18's two carried checklist-text findings, PR #25018's out-of-scope findings as its ACCEPT 6305381435 and landing record 6305762608 carry them.

Only checklist text changes, in two files: RUNNER.md (two spellings) and areas/automation.json (automation.setup-packaged-automation-board acceptance[1], one revision bump and one history row naming PR #25018). There is no product code, test, pin or changeset text, no new item, and every item id is kept.

• Base 73432299c0 (origin/main when the branch was cut, and still origin/main when this body was written).
• objectui sources were read at the console pin cf153eb2e535 (.objectui-sha on main) with git show: packagedFlows.ts blob a85c96d28e5a and PackagedAutomationPage.tsx blob f4aa90e11d32, the same blobs round 18 cited. The server side was read at the base.
• The live reading at the pin is NOT MEASURED. The sources were read, not run.

1. RUNNER.md: the connector environment-facts entry

The entry named the dogfood §0 own-port boot "isolated" twice, the phrasing a runner reads as the isolated tenancy posture. Both are respelled in the voice rounds 17 and 18 used in the area files (round 18: "a dogfood-§0 isolated boot on a non-3000 port" → "a dogfood-§0 boot on its own non-3000 port", and "an isolated boot without it dials 3000" → "a boot on its own port without it dials 3000"). This is a plain textual edit, two lines, and no line is re-wrapped. In the quotes below, PORT stands for the angle-bracket port placeholder the file spells.

line	old	new
:260	- **An isolated boot on a non-3000 port breaks the showcase's self-pinging connectors	- **A boot on its own non-3000 port breaks the showcase's self-pinging connectors
:269	back, so the dogfood §0 isolated boot — `objectstack dev … -p PORT` with the env	back, so the dogfood §0 boot on its own port — `objectstack dev … -p PORT` with the env

git diff --stat: RUNNER.md | 4 ++--.

Every isolated in RUNNER.md at the base, each read in its context:

line	text	sense	verdict
:141	rule 8's probe list: "group beside isolated"	posture (the opposite posture a probe tries)	kept
:260	"An isolated boot on a non-3000 port breaks the showcase's self-pinging connectors"	the own-port boot	respelled
:269	"the dogfood §0 isolated boot — objectstack dev … -p PORT with the env untouched"	the own-port boot	respelled
:519	the walled-boot entry: "os serve boots group and isolated"	posture (walled mode)	kept
:527	"OS_TENANCY_POSTURE=group or isolated"	posture	kept
:528	"resolveTenancyPosture() … reads as isolated"	posture	kept
:591	the walled-boot measurement: "under isolated with the other two set"	posture (walled mode)	kept

That is 7 at the base and 5 at the head, all 5 posture texts. Two other forms of the word are not the boot's name and are left: :9, "environment isolation (§0)", names the dogfood skill's section, and :319, "do NOT isolate a package install", is a verb.

2. automation.setup-packaged-automation-board acceptance[1] (revision 7 → 8)

The clause said "default all On, an obsolete-status flow excepted". That holds for the row's switch, the activation flag. It does not hold for the Activation badge beside the switch, which steps[3] (revision 7) reads as "Not running here", switch still checked, for the two policy-unbound schedule flows on a default boot.

clause, old:

inventory: the flows table lists exactly the packaged flows (default all On, an obsolete-status flow excepted: the engine holds it disabled, so its switch reads Off) and the packaged-actions section renders beside it; tenant/org-authored flows are ABSENT

clause, new:

inventory: the flows table lists exactly the packaged flows (each row's switch, the activation flag, is checked by default, an obsolete-status flow excepted: the engine holds it disabled, so its switch is unchecked) and the packaged-actions section renders beside it; tenant/org-authored flows are ABSENT. This clause judges the switch, not the badge beside it: on a default boot the two policy-unbound schedule flows keep a checked switch while their badge reads 'Not running here' (steps[3]), and that reading does not fail this clause

verify: the old text is kept whole, and this is appended:

Score each row's switch against the enabled field of its row in the same GET /api/v1/automation/_status read steps[3] takes: the page checks the switch exactly where that field is not false (joinPackagedFlows in packagedFlows.ts; the Switch's checked prop in PackagedAutomationPage.tsx), and the engine sets it false only for an obsolete or invalid status or a ledger toggle (isFlowEnabled, service-automation engine.ts). OS_AUTOMATION_SCHEDULED_WORK_ENABLED moves the badge, never the flag: on a fresh boot the only unchecked switch is the obsolete-status flow's (showcase_approver_bindings), whether that variable is exported or not. The badge (data-testid packaged-flow-activation) is steps[3]'s reading, reconciled there against the row's unboundCause: ⛔ do not score a 'Not running here' badge as a switch reading Off, nor read a checked switch as a flow that runs

oracle (dom) and evidence ("row list vs the two API reads, side by side") are unchanged. They match steps[3], which compares the rendered rows against GET /api/v1/meta/flow and GET /api/v1/automation/_status. The clause still judges what the page renders, against those two reads.

Why the new text holds:

• At the pin, joinPackagedFlows sets enabled: state.enabled !== false, and the row's Switch renders checked={row.enabled}. The badge is a separate element (data-testid="packaged-flow-activation", data-reading from activationReading), which reads off when the flag is off, not-running when the flag is on and the row carries an unboundCause, and on otherwise.
• At the base, getFlowRuntimeStates() takes enabled from isFlowEnabled(name), which is false only for flowStatusDisabled (status obsolete or invalid) or flowLedgerDisabled (the activation ledger). describeUnboundReason returns its deployment_policy cause only for an enabled flow, so the scheduled-work switch moves the badge and never the flag.
• At the base, allFlows still declares 32 flows: one obsolete (showcase_approver_bindings) and two type: 'schedule' (showcase_scheduled_digest, showcase_task_due_reminder), as round 18 derived at 93e6c1a5f8. examples/app-showcase/src/automation/ has no change between the two commits.

How the edits were made and checked

• RUNNER.md: a plain textual edit of the two lines, shown above.
• automation.json: the scripted span editor of rounds 17 and 18, unchanged (sha256 b0fa4606c135…, identical). It never re-serialises the file. Dry run, then --write, both printing: OK … A1 doc == old + declared ops; A2 21 unedited items + 5 top-level keys value-equal; A3 per item below; A4 text outside the 1 edited item spans byte-identical, with automation.setup-packaged-automation-board: revision 7 -> 8; 7 leaf paths changed, all within [acceptance.1.clause, acceptance.1.verify, revision, history.7].
• A separate whole-branch check against the base agrees. Exactly the two files changed. One item changed, with revision +1 and exactly one appended row (revision, date, change, ref). Nothing changed outside acceptance[1].clause and acceptance[1].verify, and that clause's oracle and evidence are unchanged.
• The new history row carries the placeholder ref #PENDING-24579R19, because a row's ref names this PR and the PR had no number yet (the rounds 6–18 precedent). The next commit on this branch swaps in this PR's number and changes nothing else. The gates are re-run on that head, and the report comment on qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 records them.
• A control-byte scan of both files finds none.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derives 13 commands on the 2 paths, against merge base 73432299c of origin/main. At head a6a963a5f9 each was run with its exit code captured before any pipe, and each exited 0:

node scripts/check-ci-filter-parity.mjs · node scripts/check-closing-keyword-parity.mjs · node scripts/check-closing-keyword-parity.mjs --self-test · node scripts/check-comment-mask-corpus.mjs · pnpm --filter @objectstack/lint run check:doc-formula-expressions · pnpm check:cross-package-test-inputs · pnpm check:doc-authoring · pnpm check:driver-memory-census · pnpm check:gitlink-declared · pnpm check:nul-bytes · pnpm check:platform-checklist · pnpm check:refd-timer-probe · pnpm check:watch-hint-literal

The first run of check:doc-formula-expressions refused with exit 3, a prerequisite: @objectstack/formula and @objectstack/lint were not built in this worktree. Both were built under the shared verify lock (VERDICT command-exit 0, held 2 s, waited 0 s), and the rerun exited 0. --ran, with an exit code on every line, reads "13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN", a derived zero.

No per-PR CI job runs pnpm check:platform-checklist, so this local reading is its evidence. The base column was taken in this worktree with both files restored to the base's blobs, then restored to HEAD and proven equal by blob hash, with git diff HEAD empty:

reading	base 73432299c0	head a6a963a5f9
exit	0	0
items	16 areas, 328 items (323 active, 1 planned)	16 areas, 328 items (323 active, 1 planned)
line citations	0 survive across 21 swept documents	0 survive across 21 swept documents
symbol anchors	979/989 against 434 cited sources, 10 on the named residual (#16898), 18 file floors held	979/989 against 434 cited sources, 10 on the named residual (#16898), 18 file floors held

No anchor and no line citation is added. The new verify text names joinPackagedFlows, isFlowEnabled and the two files in prose, as the item already cites objectui.

git merge-tree --write-tree exited 0 against each of:

• origin/main 73432299c0;
• PR fix(objectql): a unique refusal's user-facing sentence names the object and field by label #25021's head 2e76ecfc31 (it changes areas/records-forms.json);
• PR feat(service-messaging,spec,cli)!: retire sys_notification_subscription — no reader ever expanded a subscription (ADR-0030 L3, amended) #25024's head 356172a1f9 (it changes FOLLOW-UPS.md).

Neither of those PRs touches RUNNER.md or areas/automation.json. Their file lists were read over REST, 7 and 41 files.

There is no ablation, because no tested behaviour changed. skip-changeset was re-measured: no files[] entry of the 73 non-private manifests (86 tracked package.json files) reaches outside its own package or names docs/qa, and the repo root is private.

Acceptance notes

• The same respelling is still owed in the area-level fixture recipes, outside every item. Rounds 17 and 18 respelled item texts, and this round's surface is RUNNER.md and one clause. At the base, 11 strings in the area-level fixtures recipes of four area files still name the own-port boot or its DB "isolated", with no posture word beside them:

  • attachments-storage.json: qa-scratch-authz (requires[2], teardown) and qa-media-constraints (requires[1], teardown);
  • automation.json: qa-flow-status-doors (requires[1], requires[2], teardown);
  • records-forms.json: qa-feeds-disabled (requires[1], teardown);
  • search.json: qa-contributor-bound-member (requires[2], teardown).

  One of them, qa-flow-status-doors.requires[2], points at this entry as "RUNNER.md, the isolated-boot/OS_PORT standing fact". After this PR the entry's title no longer says "isolated", so that pointer names it by words it no longer carries. records-forms.json is in open PR fix(objectql): a unique refusal's user-facing sentence names the object and field by label #25021. This is noted for the wave anchor, and not filed.

---

Generated by Claude Code

[objectstack-fleet]

Seat review

ACCEPT · domain:devx seat 1 · os-warren · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-21T02:01Z · head 390d88e8d0 · card #24579, round 19 (claim 6305778491)

• Form. Draft, base main. The first line is Refs #24579, then Clause-②: no. Assignee os-warren, label skip-changeset. node scripts/pm/check-governed-merges.mjs --pr 25027 → NOT governed. Two files, both on the claim's surface. git merge-tree is clean against main 73432299c0, against PR fix(objectql): a unique refusal's user-facing sentence names the object and field by label #25021's head and against PR feat(service-messaging,spec,cli)!: retire sys_notification_subscription — no reader ever expanded a subscription (ADR-0030 L3, amended) #25024's head. Neither of those PRs touches RUNNER.md or automation.json.
• RUNNER.md, read in its diff. The two own-port-boot uses in the connector entry now read "A boot on its own non-3000 port" and "the dogfood §0 boot on its own port", in rounds 17–18's voice. The other five isolated in the file name the posture (:141, :519, :527, :528, :591) and are kept.
• automation.setup-packaged-automation-board acceptance[1] (revision 7 → 8, one history row naming PR docs(qa): 18.0 sweep anchor round 18 — approvals.record-page-decisions re-derived against the shipped record page, the packaged-automation board's Activation cell and 22 own-port boot respellings #25018). The clause now says the default it judges is each row's switch, the activation flag: checked by default, and unchecked for the obsolete-status flow. The badge's "Not running here" on the two policy-unbound schedule flows does not fail it; that is steps[3]'s. The oracle and evidence are unchanged.
• Ledger invariants. 1 item changed in automation.json, with revision +1 and exactly one appended history row with ref: "#25027". No other item and no top-level key moves.
• Gates.
  • The dev's dispatch-gates union: 13 derived, 13 run, all exit 0; --ran reconciles.
  • check:platform-checklist at base and head reads the same: line citations: 0, symbol anchors: 979/989, 18 file floors held.
  • Check-runs at 390d88e8d0: 40, 31 success, 9 skipped, 0 failing or pending. node scripts/pm/check-expected-skips.mjs --pr 25027 → OK (9 skipped, every one in the roster). No review, no comment.
• Carried (the dev's out-of-scope finding): the area-level fixture recipes still spell the own-port boot "isolated", in 11 strings across 4 area files. These are outside every item, which is why rounds 17–18 did not reach them. automation.json's qa-flow-status-doors.requires[2] names the connector entry as "the isolated-boot/OS_PORT standing fact", words its title no longer carries after this PR. One of the four files, records-forms.json, is in open PR fix(objectql): a unique refusal's user-facing sentence names the object and field by label #25021, so this waits for that PR to land.

This seat readies the PR and queues it with auto-merge.

---

Generated by Claude Code