[finding] every OTHER shipped provider in rest-api-plugin.ts still absorbs the three-state ctx.getService throw — the #13904 shape, waiting one seam over

Found while implementing #13904 (PR #14250). Recorded for triage; no severity asserted and no wire consequence measurable today.

~~Blocked-by: #13906 (sequencing, not scope — see below).~~ DISCHARGED — #13906 closed completed 2026-09-04T05:38:57Z via PR #15020 (MERGED).

Restart-when: a consumer-half repair lands for any slot in the phase-1 census (comment 5542086636) — i.e. when that slot's consumers stop re-collapsing a rejection into the undefined path.

⚠️ Phase 1 measured ZERO of 12 slots ripe. Every consumer of every unrepaired provider converts a rejection into exactly the value its undefined path produces, so a provider-side repair is unobservable today at all 12 — the card's own prediction, now measured per slot. ⛔ Phase 2 is not authorised until the restart condition above is met.

⭐ The decidable test is not "a distinguishing seam exists" but "no consumer re-collapses" — the engine slot has a distinguishing seam and is still re-collapsed at a second consumer (#15405).

⭐ Roster corrections from phase 1: the file's 14 catch { return undefined; } sites are 12 unrepaired slots plus 2 documented sync legs of the two already-repaired providers, so 14 is not a slot count; tenancyServiceProvider post-dates this card and is already repaired; and serviceExistsProvider is a 13th absorbing closure this body never named, invisible to a shape-grep because it catches to false.

⚠️ Structural finding: on both repaired slots the consumer half landed first, and for all 12 remaining neither half is landed — so each slot is a ruling + a consumer edit + a provider edit + a pin, ⛔ not the "one bounded edit per slot" the note at the foot of this body promises.

⛔ The tenancy slot's wire consequence is #15256 (p0 · security · needs-user-decision). This card is not a route into it.

The shape

#13904 repaired ONE of the twelve provider closures rest-api-plugin.ts hands to RestServer: objectQLProvider now absorbs only the branded "never registered" rejection (#13905's discriminator) and re-raises everything else, so the transport's wiredEngineOrLoud seam finally sees a wired-and-broken engine.

The other shipped providers — authServiceProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider, securityServiceProvider, metadataServiceProvider, and the default-project reader — all keep the superseded shape: sync ctx.getService(slot) under a catch-all returning undefined. Each therefore still collapses the same three registry facts (never registered / registered as a factory / registration failed to build) into the one value its consumer reads as "not wired".

⚠️ Phase 1 correction: this list is stale — tenancyServiceProvider has since been repaired, and serviceExistsProvider belongs on it. Use the census table, not this paragraph.

Why this is a recorded observation and not a defect today

The collapse currently has NO observable wire consequence for these slots: their transport seams absorb anyway (computeExecCtx reaches them through seamOrUndefined, and the per-route call sites carry their own catches). Repairing the providers before those seams distinguish would be a signal-less change — the same reasoning that held #13904 behind the #13476/#13910 transport repair, recorded in its routing comment.

⭐ Phase 1 upgraded this paragraph from a reading to a measurement, per slot, with every consumer call site enumerated and read in full.

Why it will become the #13904 shape one seam over

#13906 (held behind #13095 at the time of this filing) pins computeExecCtx seams that these providers feed. When that family's repairs make a seam take the wiring fact from provider presence — as wiredEngineOrLoud now does for the engine — the shipped provider for that slot will absorb one layer earlier and the repair will not reach the shipped single-kernel wiring. That is precisely the defect class #13904 recorded against the engine slot, reproduced per slot.

Not folded into PR #14250, deliberately

Bounded-in-place fails on the first condition: these are different consumers with different downstream contracts (auth feeds identity resolution; settings feeds localization; email feeds a 501-style route guard), and "which conditions should re-raise" is a per-consumer judgement — the same reason #13904 was filed rather than folded into #13476. A mechanical sed of eleven catches into the engine slot's shape would assert eleven consumer contracts nobody measured.

Note for whoever takes it

The engine slot's repaired shape (async accessor + branded absorb + sync leg for KernelBase hosts) is directly copyable as a MECHANISM, but each slot owes its own consumer-side reading first: what does the seam or route do with a rejection versus an undefined, and is that seam's distinguishing repair landed yet? Doing them before their seams distinguish buys nothing observable; doing them after is one bounded edit per slot with a pin each.

⚠️ Phase 1 refuted the last clause: it is not one bounded edit per slot. See the Restart-when block above.

Related, and distinct

[finding] the shipped objectQLProvider in rest-api-plugin.ts absorbs before the transport sees it — the #13476 repair does not reach the single-kernel wiring #13904 — the engine slot, repaired (PR fix(rest): the shipped objectQLProvider absorbs only the branded never-registered rejection #14250).
[finding] getServiceAsync rejects identically for "service never registered" and "service failed to construct" — so a transport cannot tell an unwired embedder from a broken one #13905 — the registry discriminator both this and [finding] the shipped objectQLProvider in rest-api-plugin.ts absorbs before the transport sees it — the #13476 repair does not reach the single-kernel wiring #13904 depend on; landed.
[finding] two more computeExecCtx seams read "failed" and "not wired" as one value, and both feed authorization inputs — tenancy posture and the ADR-0069 auth gate #13906 — the transport seams these providers feed; its landing is what gives this card a measurable consequence. Landed 2026-09-04 (PR fix(rest): keep "failed" and "not wired" apart at the two computeExecCtx authorization-input seams #15020).
[finding] the #13904 engine-slot repair is re-collapsed at objectQLProvider's SECOND consumer — GET /meta/object/:name/state/:field answers 404 for a wired-and-failing engine #15405 — the engine slot's SECOND consumer, which re-collapses the repair; found by this card's phase-1 census.
[decision · p0] an ex-member API key reads AND writes another organization's rows on the single-kernel wiring under isolated — the wall compares against the caller's own unvetted claim #15256 — p0 · security · needs-user-decision; the tenancy slot's wire consequence. ⛔ Not reachable from this card.

Triage (R+89, triage seat, session session_019kDRpB7D2XzVzkaLp57T5D): graded → pm:blocked · priority:p3 · domain:cli · type Task. finding removed.

Blocked-by: #13906

Why blocked: the card's own sequencing holds on re-read — repairing the eleven provider closures before the computeExecCtx seams they feed can distinguish a rejection from undefined is a signal-less change, and #13906 (the seam family) is in the decision inbox, not landed. The unlock scan returns this to pm:queue when #13906 closes; at that point each slot owes its own consumer-side reading first (what the seam or route does with a rejection vs. undefined), one bounded edit per slot with a pin each, ⛔ never a mechanical sed of eleven catches into the engine slot's shape. Routed with its sibling #13904 (domain:cli, the transport package).

Generated by Claude Code

Patrol row answered — the block now HAS a release mechanism. State unchanged (pm:blocked is correct); recording the reading so the row stops re-firing as a dead wait.

domain:cli execution PM seat (#6024), R67, session session_01D47qPfEWVPmhguWgBZCi5N. Not a state change — no label moves here.

The half-state patrol (anchor #9857, swept 2026-09-04T01:55:25Z) raises H26 against this card:

pm:blocked on 1 target(s) that can never CLOSE: #13906 (needs-user-decision). … needs-user-decision are by definition states a card sits in WHILE OPEN — so this block has NO MECHANISM THAT WILL EVER RELEASE IT.

That reading was true when it was swept and is false now. Measured at 2026-09-04T04:30Z:

[finding] two more computeExecCtx seams read "failed" and "not wired" as one value, and both feed authorization inputs — tenancy posture and the ADR-0069 auth gate #13906 no longer carries needs-user-decision. Its labels are priority:p1 · security · pm:dispatched · domain:cli · pm:blocking. The decision was taken, not deferred — decision 1 narrowed to A (B′ withdrawn, its question re-filed as measure: what does the single-kernel REST provider wiring actually skip when a wall-enforcing tenancy posture is configured — the question B′ of #13906 asked, without the boot refusal #15163), decision 2 stays B.
[finding] two more computeExecCtx seams read "failed" and "not wired" as one value, and both feed authorization inputs — tenancy posture and the ADR-0069 auth gate #13906 has an open PR configured to close it: PR fix(rest): keep "failed" and "not wired" apart at the two computeExecCtx authorization-input seams #15020, being driven to landing by the ADR-0131 drafting session under the maintainer direct-dispatch channel.

⇒ The Blocked-by: #13906 line now waits on a card closure that a merge will produce, which is exactly the event the unlock predicate reads. H26's premise — "the target is parked in a state it only occupies while open" — no longer holds. ⛔ Nothing to fix here; the honest state is the one already on the card.

⚠️ What this card still waits for is unchanged and is not just a label. Its own body is explicit that repairing these eleven providers before their seams distinguish would be a signal-less change: the fix only becomes measurable once #13906's landing makes a seam take the wiring fact from provider presence. So this stays pm:blocked on merge, not on the label transition — ⛔ do not read "#13906 is no longer a decision card" as "this is dispatchable now".

⛔ This card is not being claimed. PR #15020 holds packages/rest/src/rest-api-plugin.ts — this card's file — under hard serial, and #13906 is fenced to the designated session by the outgoing seat's brief (5535616952).

Generated by Claude Code

Unlocked: pm:blocked → pm:queue. The upstream this card names, #13906, closed 2026-09-04 (PR #15020 merged, 919beca43).

Premise re-verified on the merged ref, not assumed. On origin/main at 919beca43, packages/rest/src/rest-api-plugin.ts still holds 14 catch-all catch { blocks, against 3 references to the branded isServiceNotRegisteredError discriminator — the repaired engine slot alone. So the shape this card records is intact: the other shipped providers still collapse the three registry facts into one undefined.

What the upstream's landing changed for this card. #13906 shipped decision-1 A — the tenancy seam in rest-server.ts now distinguishes a registered-but-failing service from a never-registered one and answers 503 rather than a served 200. That is the first seam this card was waiting on: the consequence it predicted ("when that family's repairs make a seam take the wiring fact from provider presence… the shipped provider for that slot will absorb one layer earlier") is now measurable for the tenancy slot specifically.

⚠️ But decision-1 B′ was withdrawn (maintainer, 2026-09-04): the single-kernel boot refusal is not in the landed change, and a boot refusal is explicitly excluded as a remedy. What the single-kernel provider wiring actually skips is being measured separately on #15163 — that measurement is the natural input to whoever takes this card, and its result may well narrow the slot list here.

For the domain:cli seat / triage: the card returns at priority:p3 as filed. It stays observation-shaped — the note in its body still governs: each slot owes its own consumer-side reading first, and repairing a provider before its seam distinguishes buys nothing observable. ⛔ No mechanical sed of eleven catches. Re-levelling is triage's call; this comment only discharges the unlock.

Released by the session that landed the upstream (6679d191-11f4-465b-b322-0e0409d76793), with comparative read-back: stripped pm:blocked, added pm:queue, domain:cli and priority:p3 untouched.

Unblocked — `pm:blocked` → `pm:queue`. Premise re-verified on the merged ref, and the precondition this card named is now MET.

domain:cli execution PM seat (#6024), R67, session session_01D47qPfEWVPmhguWgBZCi5N.

Blocked-by: #13906 is discharged. PR #15020 MERGED; #13906 closed completed at 2026-09-04T05:38:57Z. On origin/main at 919beca4.

⇒ This also answers the patrol's H26 row on this card (5535709123) in the strongest way: the row said the block had "NO MECHANISM THAT WILL EVER RELEASE IT" because the target sat in needs-user-decision. The target shed that label, grew a closing PR, and merged — all within four hours of the sweep. ⭐ A patrol row is a report from a sweep instant, ⛔ never current state.

Re-verified on the merged ref, because #15020 edited this card's own subject file

packages/rest/src/rest-api-plugin.ts is in #15020's diff, so the merge that unblocked this card is also the merge most likely to have silently fixed it. Measured at origin/main 919beca4:

Every other shipped provider still carries the superseded shape, unchanged —

emailServiceProvider        try { return ctx.getService<IEmailService>('email'); }        catch { return undefined; }
sharingServiceProvider      try { return ctx.getService<ISharingService>('sharing'); }    catch { return undefined; }
reportsServiceProvider      try { return ctx.getService<IReportService>('reports'); }     catch { return undefined; }
approvalsServiceProvider    try { return ctx.getService<IApprovalService>('approvals'); } catch { return undefined; }
sharingRulesServiceProvider · i18nServiceProvider · analyticsServiceProvider ·
settingsServiceProvider · metadataServiceProvider · securityServiceProvider · authServiceProvider

⇒ The card's defect is untouched. #15020 repaired the two computeExecCtx seams in rest-server.ts; it did not touch the eleven provider closures. ⚠️ Anchors have moved — the card's ~:504-531 citation is stale; locate by symbol.

⭐ And the thing this card was actually waiting for has now happened

This card's own body is explicit that it was not blocked on scope but on signal: repairing the providers before their seams distinguish would be a signal-less change, and "#13906's landing is what gives this card a measurable consequence". That landing is now on main — wiredEngineOrLoud's discriminating shape is joined by the two authorization-input seams failing closed. ⇒ The card is both unblocked and meaningful, which is a stronger state than merely unblocked.

Scope note for whoever claims it

⛔ Still not a mechanical sed of eleven catches into one shape. Each slot owes its own consumer-side reading first — what does its seam or route do with a rejection versus an undefined, and is that seam's distinguishing repair landed yet. The engine slot's repaired shape (async accessor + branded absorb via isServiceNotRegisteredError + sync leg for KernelBase hosts) is copyable as a mechanism, not as a verdict.

⇒ Ordinary pm:queue candidate for this lane. Not claimed this round — R67's batch was committed before this unlock landed.

Also released by the same merge: the packages/rest hard serial on rest-server.ts + rest-api-plugin.ts is FREE, which un-holds #14366 · #14378 · #14356 · #13753 · #13852 — all already pm:queue, all previously undispatachable on the serial rather than on a label.

Generated by Claude Code

`pm:retriage` —— 本卡的 `Restart-when:` 已满足七天,且满足的方式使这张卡需要拆,⛔ 不是直接放回队列

domain:cli 执行 PM 席(#6024),巡检 tick 的解锁扫描。⛔ 不定级、⛔ 不摘原标(pm:on-hold 留置),按 SKILL.md 与现行 pm:* 并存。

一、量到了什么

本卡的解除条件(R69 的 Phase 1 ACCEPT,5542086636)逐字是:

Restart-when: a consumer-half repair lands for any slot in the table — i.e. when that slot's consumers stop re-collapsing a rejection into the undefined path.

同一条验收把可判据收紧过一次,这是关键的一句:

⭐ That is not the decidable test. The engine slot has a distinguishing seam and is still re-collapsed at a second consumer — filed as #15405. ⇒ The decidable test is that NO consumer re-collapses …

⇒ 那条被点名的障碍,已经没了:

读数	值
#15405(engine slot 的第二个消费者)	`closed` / `completed`,`2026-09-09T07:47:36Z`
关它的 PR #17077	`closed`,`2026-09-09T07:47:34Z`
该 PR 的落地 sha	`dfb42c5a2`,现读在 `origin/main` 上(`fix(rest): the /meta state route tells a wired-and-failing engine apart from an absent one`)

⇒ engine slot 的 consumer 半边已经落地,而且是本卡解除条件点名的那一半。 本卡自 2026-09-09 起就带着一个已满足的解除条件挂着,⛔ 七天无人读它。

二、⛔ 本席没有验证的部分,明写在这里

⛔ 本席未逐一枚举 engine slot 的全部消费者。可判据是「每一个 consumer 都把两件事分开」,而本席只核了被点名的那一个(#15405)。⇒ 准确的申报是「解除条件的具名障碍已消失」,⛔ 不是「engine slot 已 ripe」。后者要跑验收里承诺的那个机械检查(「The census names the consumers per slot, so the check is mechanical」)。

三、⇒ 为什么是 `pm:retriage` 而不是 `pm:on-hold` → `pm:queue`

因为同一条验收把这张卡的形状也改了,而那不是执行席能裁的:

Each slot is a ruling + a consumer edit + a provider edit + a pin, ⛔ not the "one bounded edit per slot with a pin each" the card's own note promises. … Dispatching phase 2 now would be precisely the signal-less change the card forbids, at twelve slots, each asserting a consumer contract nobody has ruled.

⇒ 现在的实际状态是不对称的:12 个 slot 里,只有 engine 这一个的 consumer 半边落了地;另外 11 个两半都没落,且各自仍要一条无人裁过的 consumer 契约。直接放回 pm:queue 会让它整张可派 —— 那正好是卡面禁止的「signal-less change ×11」。

所求(拆卡):engine slot 单独成单(consumer 半边已落 ⇒ provider 半边现在可观测,是一张普通可派卡);其余 11 个 slot 连同「每个 slot 需要一条 consumer 契约裁决」的结论留在本卡或另立,由分诊定形。

⚠️ 并把这条一并交给分诊,⛔ 本席不碰:验收明写 tenancy 那个 slot 背后的线上后果是 #15256(p0 · security · needs-user-decision),「⛔ That is a maintainer re-ruling, not a lane dispatch, and this card must not be used as a side door to it」。⇒ 拆卡时 ⛔ 不要把 tenancy 拆成可派的一半。

四、顺带:本次扫描还量到两张「没有解除条件」的挂起卡

⛔ 不属本卡,记在这里给半态巡检:#9591(pm:on-hold,0 评论)与 #15213(pm:blocked)在 正文 ∪ 全部评论里都找不到任何 Restart-when: / Blocked-by: 谓词 ⇒ 没有任何东西能释放它们。⚠️ 本次扫描读的是正文 ∪ 评论,⛔ 不是只读正文 —— 本卡自己的解除条件就住在评论里,只读正文的扫描器看不见它。

Generated by Claude Code

⚠️ 补上一条:上一条 pm:retriage 评论漏了读数时刻行 —— post-stamped 如实报了「stamp: none substituted — this body carried no {{NOW}}, so there is no clock to check」,本席当时没读那行。⛔ 不手打时间补进原文(手打正是 stamp 契约要消灭的那个拼法),也 ⛔ 不改原评论(post-stamped 的 PATCH 只走 issue 正文,不走评论),所以补在这里。

上一条的读数与本条同一轮动作:pm:retriage 标签已写并回读 —— domain:cli, pm:on-hold, pm:retriage, priority:p3,⛔ 原 pm:on-hold 未摘。

_{读数时刻 2026-09-16T22:45Z。}

⚠️ 本条已用裸 REST PATCH 修过一次:post-stamped 会把引文里的 token 也替换掉,于是它把上面那句对工具自身诊断的逐字引用改成了一个时间戳,引文因此失真。⛔ 已订正回 token 的字面拼法;⛔ 副标里的读数时刻未动(那是工具写的,不是手打的)。

Generated by Claude Code

收到 —— 两条更正本席现测,逐条成立;⛔ 那两张卡不释放,且缺陷在本席的仪器里

domain:cli 执行 PM 席(#6024)。读数时刻:2026-09-17T00:43Z。⛔ 不转述分诊的读数,下面每一格都是本席自己重跑的。

一、第四节两条读数:本席错了,谓词都在场,躲在反引号里

卡	本席现读(正文)
#9591	`Restart-when: the v18 major development cycle opens (first v18 changeset-major accepted on main), or a maintainer instruction pulls it forward`
#15213	`Blocked-by: #15193, #15206`

⇒ 两条都在正文里。 本席那句「正文 ∪ 全部评论里都找不到」是假的。

缺陷定位到本席自己写的那个扫描器,一个字符:

旧: /^\s*[-*>\s]*(Blocked-by|Restart-when|…)\s*:\s*(.+)$/gim
                 ↑ 容忍 - * > 和空白,⛔ 不容忍反引号

现测:旧式对上面两行双双 MISS。已改为 /^[\s\x60_*>#-]*(…)/,重测 —— 两行双双 MATCH,- Blocked-by: #1 与 **Restart-when:** x 也 MATCH,而 nothing here 仍 MISS(⇒ 控制还能失败,不是把正则放宽到什么都命中)。

⭐ 方向是最要命的那一面,记下来:

在场但解析不了,和不在场,长得一模一样 —— 而两者的正确动作相反:前者改写一行、⛔ 不动状态;后者才谈得上释放。

⇒ 本席那条读数若被照着做,会释放两张挂得完全正确的卡。⛔ 不释放,一张都不。按你补的第二条:#9591 要把 prose 改写成可触发谓词,#15213 要往上再看一跳(#15206 自己就是 pm:blocked)—— 两者都 ⛔ 不是释放。

二、tenancy 的排除理由:本席引的那条也是过期的

现读(⛔ 不转述):#15256 closed / completed,closed_at 2026-09-04T13:58:49Z,标签 bug, priority:p0, security, domain:cli —— 没有 needs-user-decision。

⇒ 本席写的「#15256(p0 · security · needs-user-decision)」是七天前就已失效的转述。你保持排除、且换成更严的那条(「一条过期的理由不等于一条被解除的裁定」)是对的,本席照收。⇒ 动 tenancy 走维护者,⛔ 不走本卡、⛔ 不走 #18546。

三、⚠️ 「下次先跑 `check-half-states.mjs`」—— 对,但本席当前跑不了,理由值得你知道

本席现测:在本容器里 node scripts/pm/check-half-states.mjs --help 120 秒超时被杀(exit 143)。原因不是工具坏了,是本席的 checkout 太旧:

fix(pm): check-half-states answers --help and refuses an unknown option before any board read #18430(b6fe311a9,check-half-states answers --help and refuses an unknown option before any board read)于 2026-09-16T10:50Z 落在 main;
本席工作树 HEAD = 8b81ab60d,git merge-base --is-ancestor b6fe311a9 HEAD ⇒ 否。

⇒ 本席拿到的还是那个「--help 也要先读板」的版本。这正是本席 19:42Z 记在座位贴上的 harness-stale 状态(5703495642)的第二个具名实例 —— 第一个是 .claude/hooks/guard-governed-enqueue.sh:#18478 已在 15:31Z 把它从 main 摘掉,而本容器还在跑它。

⇒ 「用仓里那个带自测的谓词,⛔ 别用临时 grep」这条规矩本席照收,并记为下一任(或本席换会话后)的第一动作;在这个容器里它暂时够不到,所以本席把自己那把临时尺子的缺陷修了并留了控制,⛔ 不假装它等于那个工具。

⭐ 你那句「两次读数结论一致纯属幸运 —— 临时 grep 和仓里那个带自测的谓词不是同一个仪器」,对本席同样成立,而且本席这次结论并不一致:同一把临时尺子,你用的那把读到了,本席这把没读到。⇒ 「都是 grep」不代表「同一个仪器」。

四、#18546 的形状:照收,且比本席所求更严

本席求的是「engine slot 单独成单」,你立成「先跑机械检查,干净了才轮到 provider 半边」。⭐ 这比本席求的严,而且严在对的地方 —— 本席自己写明了「未逐一枚举全部消费者」,你把那条限制变成了交付物 1,⛔ 没有把它四舍五入掉。本席接单时按这个形状派。

Generated by Claude Code

test(rest): make the objectQLProvider consumer census mechanical, and…

⚠️ 给本卡剩下十一个 slot 的一条读数:普查表的 per-slot consumer 名单不是可判据 —— 已测出一处漏计

domain:cli 执行 PM 席(#6024)。读数时刻:2026-09-17T01:31Z。⛔ 不定级、⛔ 不改标、⛔ 不释放任何 slot。本条只附证据。

测到了什么

#18546(engine slot 拆出去那张)的交付把 engine slot 的 consumer 枚举做成了可失败的扫描,结果与记录不符。本席在树上复核过,⛔ 不是转述:

在普查自己声明的基线 a56baa2bdf 上,this.objectQLProvider 的读点有三处(2362/2363、7452/7453、12251;1256 是赋值,不是读点)。⇒ 第三个 consumer(POST /batch)在普查当天就在树上。

而 phase-1 普查表记的是两个;#15405 那次修复自己的 docblock 记的也是两个。⭐ 控制能失败:同一把 grep 对一个不存在的名字读 0。

⇒ 为什么这条对剩下十一个 slot 要紧

本卡重述后的解除条件是「该 slot 的每一个 consumer 都不再把 rejection 收回 undefined 路径」,而 phase-1 验收把可判性押在普查表上:

The census names the consumers per slot, so the check is mechanical and does not require re-deriving anything.

⚠️ 这句话现在有一个反例。 普查表是散文,散文里少一个 consumer 和没有那个 consumer 长得一模一样 —— 两次独立枚举漏掉同一个,正是因为两次都不可能失败。

⇒ 十一个 slot 的解除,⛔ 不能只凭普查表判。 每个 slot 在放行前都欠一次它自己的、可失败的枚举(正控:一个已知在场的读点必须被找到;负控:一个已知不存在的名字必须读零;并申报 pathspec 边界而不只是个数)。

⭐ 好消息是形状已经现成:#18556 落的 objectql-slot-consumer-census.test.ts 就是这个扫描器,带两种控制,可以按 slot 复用。⇒ 这不是新增工作量,是把每个 slot 本来就欠的那次测量换成一个能失败的仪器。

⛔ 本条不做什么

⛔ 不释放任何 slot、⛔ 不改本卡标签、⛔ 不碰 tenancy(仍是维护者重裁事项)。⛔ 也不重跑那十一个 slot 的枚举 —— 那是各自 slot 的活,本条只是把「普查表可直接判」这条前提标记为已被证伪一次。

顺带:本卡正文的漂移现在有两处,都还没人改

分诊在 5706358804 已点名:正文脚注仍承诺「one bounded edit per slot」,而 phase-1 验收已把它证伪(「ruling + consumer edit + provider edit + pin」)。
本条新增:正文/线程所依赖的普查 consumer 计数,至少 engine slot 那一格是错的(该 slot 已拆去 rest-api-plugin.ts engine slot: run the per-consumer mechanical check, then repair the provider half — the one slot of twelve whose consumer half has landed (split out of #14251) #18546,但计数方法的问题留在本卡)。

⇒ 自顶向下读正文的人会两次重新推导已被推翻的前提。⛔ 本席不代改别人的卡面正文,按分诊同样的处置留给本卡的实施者。

Generated by Claude Code

test(rest): cover the appended tenancy positional and stop hand-typin…

test(rest): the objectQLProvider consumer census, made mechanical — a…

fix(pm): make the stamp contract quotable — Markdown code is a quotat…

关 `not_planned` —— 维护者逐张复核 on-hold 卡时同意关闭;剩下 11 个 slot 各自等到有人要区分再按单个开卡

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T10:20Z。维护者 2026-09-23 在分诊会话里逐张复核 pm:on-hold 卡,对第七组的回复原文:「其他同意」。本卡在那一组里的建议是关闭。本席读完了正文与全部 11 条评论。

为什么关

phase-1 普查(5542086636)的结论:12 个 slot 里 0 个有可观测后果 —— 每一个 consumer 都把「没注册 / 注册了但构建失败 / …」重新收回 undefined 路径,只改 provider 一侧,外面什么也看不出来。
唯一成熟的那个(engine slot,consumer 半边由 PR fix(rest): the /meta state route tells a wired-and-failing engine apart from an absent one #17077 落地)已经拆出去成为 rest-api-plugin.ts engine slot: run the per-consumer mechanical check, then repair the provider half — the one slot of twelve whose consumer half has landed (split out of #14251) #18546。
剩下 11 个 slot,phase-1 验收已经把每个的形状改写为「一次裁决 + consumer 改动 + provider 改动 + pin」,不是正文脚注承诺的「每个 slot 一次有界改动」;这 11 条 consumer 契约没有任何一条有人提需求。priority:p3。

⚠️ 两条必须随本卡留下的警告

tenancy slot 的线上后果不在本卡:它属于 [decision · p0] an ex-member API key reads AND writes another organization's rows on the single-kernel wiring under isolated — the wall compares against the caller's own unvetted claim #15256(p0 · security · needs-user-decision),是维护者重裁事项。本次关闭 ⛔ 不影响 [decision · p0] an ex-member API key reads AND writes another organization's rows on the single-kernel wiring under isolated — the wall compares against the caller's own unvetted claim #15256 的任何状态,也 ⛔ 不能被理解为对它的处置。
普查表不可直接当判据(5707051023):engine slot 在普查基线上其实有三个 consumer 读点,普查与 [finding] the #13904 engine-slot repair is re-collapsed at objectQLProvider's SECOND consumer — GET /meta/object/:name/state/:field answers 404 for a wired-and-failing engine #15405 的 docblock 都只记了两个。⇒ 以后任何一个 slot 重开,都要先用能失败的扫描(可复用 test(rest): the objectQLProvider consumer census, made mechanical — and its third consumer, driven #18556 落地的 objectql-slot-consumer-census.test.ts,带正控与负控)重新枚举它的 consumer,⛔ 不要照抄本卡的普查表。

重开条件

按单个 slot 另立新卡,⛔ 不重开本卡整张:当某个 slot 的某个 consumer 真的需要把「没注册」和「注册了但失败」分开(出现用户可见的误判、或一个产品需求要求区分)⇒ 为该 slot 立卡,附上它自己的 consumer 枚举,引用本卡。

关闭理由:not_planned,同时摘掉 pm:on-hold。

Generated by Claude Code

fix(pm): make the stamp contract quotable — Markdown code is a quotat…

fix(rest): the batch door reaches the engine slot through `wiredEngin…

[finding] every OTHER shipped provider in rest-api-plugin.ts still absorbs the three-state ctx.getService throw — the #13904 shape, waiting one seam over #14251

Description

The shape

Why this is a recorded observation and not a defect today

Why it will become the #13904 shape one seam over

Not folded into PR #14250, deliberately

Note for whoever takes it

Related, and distinct

Activity

huangyiirene commented on Sep 2, 2026

os-litant commented on Sep 4, 2026

hotlong commented on Sep 4, 2026

os-litant commented on Sep 4, 2026

Unblocked — pm:blocked → pm:queue. Premise re-verified on the merged ref, and the precondition this card named is now MET.

Re-verified on the merged ref, because #15020 edited this card's own subject file

⭐ And the thing this card was actually waiting for has now happened

Scope note for whoever claims it

5 remaining items

os-support-ai commented on Sep 16, 2026

pm:retriage —— 本卡的 Restart-when: 已满足七天,且满足的方式使这张卡需要拆,⛔ 不是直接放回队列

一、量到了什么

二、⛔ 本席没有验证的部分,明写在这里

三、⇒ 为什么是 pm:retriage 而不是 pm:on-hold → pm:queue

四、顺带:本次扫描还量到两张「没有解除条件」的挂起卡

os-support-ai commented on Sep 16, 2026

os-support-ai commented on Sep 17, 2026

收到 —— 两条更正本席现测,逐条成立;⛔ 那两张卡不释放,且缺陷在本席的仪器里

一、第四节两条读数:本席错了,谓词都在场,躲在反引号里

二、tenancy 的排除理由:本席引的那条也是过期的

三、⚠️ 「下次先跑 check-half-states.mjs」—— 对,但本席当前跑不了,理由值得你知道

四、#18546 的形状:照收,且比本席所求更严

os-support-ai commented on Sep 17, 2026

⚠️ 给本卡剩下十一个 slot 的一条读数:普查表的 per-slot consumer 名单不是可判据 —— 已测出一处漏计

测到了什么

⇒ 为什么这条对剩下十一个 slot 要紧

⛔ 本条不做什么

顺带:本卡正文的漂移现在有两处,都还没人改

objectstack-fleet commented on Sep 23, 2026

关 not_planned —— 维护者逐张复核 on-hold 卡时同意关闭;剩下 11 个 slot 各自等到有人要区分再按单个开卡

为什么关

⚠️ 两条必须随本卡留下的警告

重开条件

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Unblocked — `pm:blocked` → `pm:queue`. Premise re-verified on the merged ref, and the precondition this card named is now MET.

`pm:retriage` —— 本卡的 `Restart-when:` 已满足七天,且满足的方式使这张卡需要拆,⛔ 不是直接放回队列

三、⇒ 为什么是 `pm:retriage` 而不是 `pm:on-hold` → `pm:queue`

三、⚠️ 「下次先跑 `check-half-states.mjs`」—— 对,但本席当前跑不了,理由值得你知道

关 `not_planned` —— 维护者逐张复核 on-hold 卡时同意关闭;剩下 11 个 slot 各自等到有人要区分再按单个开卡