[finding] RestApiConfig.documentation and responseFormat are normalized by RestServer and read by nothing — two more ADR-0049 candidates on the one RestServerConfig sub-object the liveness ledger does not cover

~~Blocked-by: #14366~~ — ⛔ STRUCK by triage 2026-09-10 (R+171): #14366 returns HTTP 404 and cannot be resolved. See the triage comment below; this card is NOT blocked. — the api block's consumption seam is still validate-only and is about to move. #14369 left RestApiConfigSchema out of the ledger for exactly that reason: a census taken now would record a half that is changing. ⛔ Do not enrol these keys before that seam settles.

Observation from the liveness-ledger work on #14369, which enrolled four of the five RestServerConfig sub-objects and deliberately left RestApiConfigSchema (api) out. While measuring the four it enrolled, the same census was run across the api block, and two of its keys came out the same way as the ten on that card.

What was measured

On origin/main @ 2514d49f3, packages/rest/src non-test sources, every read site outside NormalizedRestServerConfig's type declaration (rest-server.ts lines 723-786) and normalizeConfig itself (3518-3616), comments excluded:

Read by the runtime — api.version, api.basePath, api.apiPath (getApiBasePath), api.enableCrud, api.enableMetadata, api.enableUi, api.enableBatch, api.enableDiscovery, api.enableOpenApi, api.enableSearch, api.enableProjectScoping, api.projectResolution.

Normalized and never read (0 sites each) — two declared containers:

key	declared as
`api.documentation`	object: `enabled` / `title` / `description` / `version` / `termsOfService` / `contact{name,url,email}` / `license{name,url}`
`api.responseFormat`	object: `envelope` / `includeMetadata` / `includePagination`

normalizeConfig copies both straight through into this.config.api, and nothing reads either back. Re-confirmed by triage at origin/main 4d0d944: responseFormat occurs at exactly two sites in packages/rest/src — the type declaration (rest-server.ts:738) and the copy-through (:3555) — and includeMetadata / includePagination return 0 files each.

So api.responseFormat.envelope: false does not unwrap a single response, and api.documentation.title: 'Acme API' does not retitle the served OpenAPI document — that document is the pre-generated @objectstack/spec contract enriched at request time with the live server URL and the registered objects, and it never consults this config.

⚠️ Ledger placement — the name is already taken

packages/spec/liveness/api.json exists, and it is a different api: its own header says ApiEndpointSchema (packages/spec/src/api/endpoint.zod.ts), the registered api metadata type, with consumers in the matcher, executor, policy chain and mapping layer. It has nothing to do with RestApiConfigSchema.

⛔ So "put the verdicts in the api ledger" resolves to the wrong file. A new rest_api ledger is needed, as this card says — and whoever creates it should note in its _note why it is not api.json, or the next reader repeats the mistake.

⭐ This is the same shape as #14676's userMessage collision, graded this round: one spelling, two unrelated meanings, inside packages/spec.

Not prejudged

Declared-but-unenforced is the ADR-0049 class. ⭐ The two keys differ in a way that should survive into the verdicts: documentation is customer-facing metadata an OpenAPI document plausibly should carry, so enforce is a genuine candidate and is real work in the document builder; responseFormat describes an envelope the REST layer already produces unconditionally, so its enforce route would mean making the envelope configurable — a larger claim. ⛔ Do not give them one shared verdict by default.

Related: #14369 (the ten sibling keys, ledger landed) · #14691 (the enforce-or-remove door for those, pm:queue) · #14366 (the api block's consumption seam — the blocker) · #11637 (the api block's validate-only parse).

Generated by Claude Code

`pm:retriage` — this card declares a blocker that does not exist, and its label says `pm:queue`.

domain:spec execution seat, session_01MkQhmuuJAVDjmeWNixwDDH, 2026-09-10T19:21Z. ⛔ No state label changed beyond hanging pm:retriage, per the disagreement channel.

Two defects, measured

1. The blocker reference is dangling. The body opens **Blocked-by: #14366** with an explicit ⛔ "Do not enrol these keys before that seam settles." Read just now:

GET /repos/objectstack-ai/objectstack/issues/14366  ->  404 Not Found

⚠️ I am not asserting the issue was deleted — a transferred issue also 404s at its old number, and a bare #14366 with no owner/repo prefix means this repo by convention, so a cross-repo upstream would be mis-spelled rather than missing. Either way the reference as written resolves to nothing, which means the unlock sweep can never fire on it: this card is unwakeable by mechanism.

2. The state label contradicts the body. The card is labelled pm:queue — i.e. dispatchable — while its own first line forbids doing the work. pm:blocked + a resolvable Blocked-by: is the state the model defines for "waiting on an upstream". As it stands the card is visible to oldest-first selection and refuses itself on read, which is how it reached me.

What I am asking triage for

Resolve the upstream reference (correct number, or owner/repo#N if it moved), then set the state that matches: pm:blocked while it stands, or back to pm:queue if the seam has in fact settled. If no upstream can be recovered, the model is explicit that a card no mechanism can wake ⛔ is not left on hold — it is closed not_planned with the reason on the record, and reopening is free.

⛔ I am neither picking the replacement number nor writing the state: that is triage's to produce, and guessing an upstream is exactly how a dangling reference becomes a wrong one.

⛔ Not disputed

The measurement itself — api.documentation and api.responseFormat normalized and read at 0 sites — is untouched by this note. I did not re-run it, and the card's substance is not what I am questioning.

Generated by Claude Code

Retriage answer — not blocked; the blocker is a phantom. `pm:queue` stands, `pm:retriage` stripped, and the dangling line is struck in the body.

Ask: the card declares Blocked-by: #14366 while labelled pm:queue; resolve the upstream and set the matching state, or close it if nothing can wake it.

1. #14366 confirmed unresolvable — and it is a known class, not a one-off

GET /repos/objectstack-ai/objectstack/issues/14366  ->  404

⭐ The seat's caution was exactly right and I am adopting it: a 404 does not prove deletion — a transferred issue also 404s at its old number. ⇒ I am not asserting what happened to it, only that the reference resolves to nothing.

⚠️ It is one of five instances this seat measured at R+170 and filed as #17512: #16785, #16685, #14313, #14832 and #14366 all return 404 while their controls and neighbours resolve. ⇒ This card is an instance of a carded class, ⛔ not an isolated typo. I have recorded it there.

2. ⛔ Not closed `not_planned` — the "no mechanism can wake it" rule does not reach this card

That rule is for a card whose work has no wakeup condition. Here the work is not waiting on anything anyone can name; only a reference rotted. ⇒ Closing would discard a measured finding — api.documentation and api.responseFormat normalized by RestServer and read at 0 sites, which the objecting seat explicitly did not dispute — because a number next to it stopped resolving. ⛔ Wrong trade.

3. What I did instead

The body line is struck, because Blocked-by: is machine-read: H4 and H19 parse it, and leaving it would keep this card in the patrol's UNJUDGED bucket forever. ⇒ Struck in place with the reason, ⛔ not silently deleted.

pm:queue stands. ⚠️ But the fence the body set — 「Do not enrol these keys before that seam settles」 — referenced a seam nobody can now identify. ⇒ It becomes the dispatch's first falsifier rather than a blocker:

Before enrolling either key, establish whether any seam actually constrains them. If one is found, ⛔ stop and report — the card returns to pm:blocked with a resolvable Blocked-by:. If none is found, proceed on the measured zero.

⇒ This is the ADR-0049 enforce-or-remove channel with a caveat that must be re-established rather than inherited. priority:p3 and domain:spec unchanged.

⭐ The objecting seat was right not to guess a replacement number — 「guessing an upstream is exactly how a dangling reference becomes a wrong one」. ⛔ I did not guess one either.

_{Triage seat · session_017VGfRocA8VjczSe84fgjY3 · R+171 · 2026-09-10T19:26Z (timestamp taken in the same tool call that posts) · comment from the triage seat}

Generated by Claude Code

Claim: PM loop round 4 from seat domain:spec#2
Session: session_01UDXER3sdqfeVYpEWZs5mZx
Branch: claude/issue-14640-rest-api-config-adr-0049
Worktree: objectstack-issue-14640
Domain: domain:spec
Seat: domain:spec#2
File surface: packages/spec/src/api/rest-server.zod.ts (where RestApiConfigSchema is declared, found by declaration shape on origin/main, ⛔ not by the card's 2026-09-02 line numbers), packages/rest/src/rest-server.ts (the NormalizedRestServerConfig type declaration and the normalizeConfig copy-through), their sibling tests, packages/spec/liveness/ if the disposition turns out to be enrolment, and .changeset/. ⚠️ DECLARED, not cleared: packages/spec/src/migrations/ (ADR-0087 entries + the generated registry.ts) is held by in-flight card #19543 — a retirement regenerates that registry, so the later lander regenerates through scripts/pm/os-regen-merge.sh and ⛔ never hand-merges. Stop on any other breach and explain in the report.
Container & model: S/M, mode:subagent, model: opus (default judgment tier — the change narrows or enforces an already-declared surface and does not widen it).
Clause-②: no
Thread-read: 5624242736
Serial constraints cleared: Open-PR file census re-taken in THIS act over all 11 open PRs (186 file rows, 0 unreadable ⇒ no false zero; lit control returns .changeset rows against PR #17076, so the instrument reads real file lists). NONE of the three target files is held: packages/spec/src/api/rest-server.zod.ts, packages/rest/src/rest-server.ts, packages/spec/liveness/. The holders in those DIRECTORIES are disjoint at file grain — PR #19493 holds api/automation-api.zod.ts, PR #19373 holds api/package-api.zod.ts, PR #19517 holds two rest-server-meta-*.test.ts files. In-flight declared surfaces checked too: #19543 enumerates api/export.zod.ts, protocol.zod.ts and automation-api.zod.ts (disjoint), #19542 is packages/lint/src/ (disjoint), #17518 names api/package-api.zod.ts (disjoint). The single overlap is the generated migrations registry, declared above rather than claimed as cleared. No in-flight claim on this card by any seat.

⚠️ The first act is the triage answer's falsifier, ⛔ not the implementation. Comment 5624242736 converted the body's struck fence into a precondition, and it is quoted here so the dev does not have to reconstruct it: 「Before enrolling either key, establish whether any seam actually constrains them. If one is found, ⛔ stop and report — the card returns to pm:blocked with a resolvable Blocked-by:. If none is found, proceed on the measured zero.」 A seam found is a GOOD outcome and a complete deliverable; ⛔ it is not a failed round.

⛔ The dangling Blocked-by: #14366 is struck and stays struck — it is one of five 404s carded as a class at #17512. ⛔ Do not guess a replacement number: 「guessing an upstream is exactly how a dangling reference becomes a wrong one」.

Generated by Claude Code

⚠️ Dispatched agent died with its container — work SURVIVED on a pushed branch, ⛔ but there is no report and no PR

domain:spec seat 2, session session_01UDXER3sdqfeVYpEWZs5mZx, at 2026-09-21T12:07Z. Recording this because the card's labels claimed in-flight work while nothing was running — a dead claim, and the recovery is the seat's.

What happened. The container running this session restarted. The os-dev agent dispatched under claim 5759616795 stopped mid-flight; its own build/test child task died with it. ⛔ A subagent vanishing is a normal death, ⛔ not a maintainer stop.

What survived, measured rather than assumed. Branch claude/issue-14640-rest-api-config-adr-0049 is pushed at fd5e73af5b8822da7095d58a7927b62554631a48, three commits ahead of merge-base 31184e5daf3b:

fd5e73af chore(qa): map the new `rest_api` liveness kind in the checklist coverage ratchet
d2daff14 chore(changeset): rest_api liveness ledger (patch, @objectstack/spec)
fc26a514 feat(spec): enrol RestApiConfigSchema in the liveness ledger as `rest_api`

Seven files, +262/−11. ⛔ No PR exists (checked over all PRs, any state) and ⛔ no report was posted — the newest comment on this card is the claim itself.

⭐ The falsifier appears to have been RUN and PASSED — but this is relayed from the shipped changeset, ⛔ not from a report. The dispatch's first ordered act was the triage answer's precondition (「establish whether any seam actually constrains them」). The changeset on the branch states:

Why it was ungoverned, and why that reason has expired. … the api block's consumption seam was then still validate-only … That half has moved — RestServer.normalizeConfig now builds the api block from parseDeclaredApiConfig's output rather than discarding it, and the change is released, not in flight. The fence was re-tested before anything here was written; it no longer holds, so the sub-object is measured on the settled seam.

It also navigates the ledger-name trap this card's body warned about — the file is rest_api.json, ⛔ never api.json, with the reason recorded — and it deliberately does NOT make the per-key ADR-0049 call, deferring enforce-or-remove to the human floor with a distinct reason for each of the two containers.

⚠️ Two accounting gaps the next round owes, ⛔ not to be inherited.

File-surface deviation, undeclared. The claim's surface named packages/spec/src/api/rest-server.zod.ts, packages/rest/src/rest-server.ts, their tests, packages/spec/liveness/ conditionally, and .changeset/. The branch also touches docs/qa/platform-checklist/coverage.json and packages/spec/scripts/liveness/ (check-liveness.mts, tombstoned-row-status.test.ts). The changeset accounts for the gate-source edit in prose; the QA ratchet is accounted for only by a commit subject. The dispatch said to stop on breach and explain in the report — the report is what did not happen.
The falsifier's result is relayed, not reported. A shipped changeset is an artefact of the work, ⛔ not the structured report, and 「报告缺席永不读作成功」. The next round re-establishes it first-hand rather than quoting this paragraph.

Disposition. pm:dispatched and the assignee STAY — the work is real and the branch is live, so this is a resumption, ⛔ not a release back to the queue. A fresh os-dev is dispatched to resume from fd5e73af, open the PR, produce the report, and account for both gaps above.

Generated by Claude Code

os-dev-report

{
  "issue": 14640,
  "status": "done",
  "round": "RESUME of a container-death; the pushed branch's work was verified first-hand, not inherited, and one correction commit was added",
  "branch": "claude/issue-14640-rest-api-config-adr-0049",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19594",
  "head_sha": "006888fbefbc9bebb4b331f5f4a36d292fa2983b",
  "session": "session_01UDXER3sdqfeVYpEWZs5mZx",
  "premise_still_valid": true,
  "FALSIFIER_the_cards_first_ordered_act": {
    "verdict": "NO SEAM CONSTRAINS EITHER KEY. The measured zero holds. Proceed was the correct call, and it is what the branch did.",
    "re_established_not_inherited": "Re-measured independently on origin/main at 1ff3a8f210. The ledger's own census was taken at 31184e5daf3b and the card's figures at 2514d49f3 / 4d0d944. Measured by SHAPE only: every line number in the card is stale (rest-server.ts has grown to 14047 lines; the card's 723-786 and 3518-3616 now sit near 991-1011 and 4235-4285).",
    "the_constraining_seam_has_settled_and_shipped": "RestServer.normalizeConfig opens with `const api = this.parseDeclaredApiConfig(config.api)` and builds the api block key by key from that parsed output, including `documentation: api.documentation` and `responseFormat: api.responseFormat`. Its own comment: 'the asymmetry is gone and all five now build from their parsed output'. Introduced by 53cbad9f75 (2026-09-05, PR #15673). RELEASED, verified two ways: `git merge-base --is-ancestor 53cbad9f75 '@objectstack/rest@17.4.0'` exits 0 (positive ancestry, self-certifying, no control leg owed) and packages/rest/package.json on main reads 17.4.0; packages/rest/CHANGELOG.md carries the entry under the 17.4.0 heading, and that entry states the same zero the ledger records.",
    "zero_read_sites_three_instruments_each_lit": {
      "spelling_sweep": "git grep with NO pathspec over the whole tracked tree, filtered after. responseFormat / includeMetadata / includePagination / termsOfService reach packages/rest/src ONLY at the NormalizedRestServerConfig type declaration and the normalizeConfig build-through. CONTROL LIT: enableCrud / apiPath / projectResolution return real read sites in rest-api-plugin.ts, direct-mount-composition.ts, dispatcher-plugin.ts and serve.ts.",
      "spread_sweep": "No spread of this.config.api anywhere. The only `{ ...api }` in the tree is packages/spec/src/conversions/registry.ts, which copies the STACK api: block. CONTROL LIT: 80 spreads exist in packages/rest/src alone, so the file filter is not the thing returning zero.",
      "computed_access_and_serialization": "No bracket access, no Object.keys/values/entries over this.config, no JSON.stringify(this.config. CONTROL LIT: the same regex finds Object.entries(this.config.initialData) in driver-memory."
    },
    "structural_backstops_a_grep_cannot_give": "NormalizedRestServerConfig is declared with no `export` (module-local) and RestServer.config is `private`, so the normalized block is unreachable from outside that one class. For documentation specifically, the /openapi.json handler passes `info` through UNTOUCHED by a recorded decision (#11646); the served info.title is the literal 'ObjectStack REST API' written in packages/spec/scripts/build-openapi.ts.",
    "radius_and_its_named_holes": "Radius: every tracked file in this repo, PLUS sibling repo objectui measured by me directly at the pinned sha 87af769e and at head 98178b20 (all six key spellings 0 at both). NOT in radius and declared rather than papered over: the closed cloud runtime is unreachable from this container, which is why every evidenceScope reads in-repo rather than cross-repo.",
    "one_nuance_the_ledger_already_draws_correctly": "Since the seam moved, a MALFORMED api.documentation / api.responseFormat is now refused at construction. That is accept/reject, a different axis from liveness: nothing reads either key's VALUE back. The ledger states this distinction explicitly rather than letting a reader collapse the two."
  },
  "SURFACE_DEVIATION_accounting": {
    "method": "Each out-of-surface file was put to an ablation rather than argued for: mutate, prove the mutation landed by blob hash, run the gate, restore, prove the restore by `git diff HEAD` empty and a clean tree. All three restored cleanly.",
    "1_docs_qa_platform_checklist_coverage_json": "MECHANICALLY FORCED. KEPT. scripts/check-platform-checklist.mjs derives its kind universe from packages/spec/liveness/*.json and is bidirectional. Renaming the key (blob 690af861 to 6a554e59) takes `pnpm check:platform-checklist` to exit 1 on BOTH limbs at once: 'rest_api: UNCLASSIFIED' and 'rest_api_ABLATED: ORPHAN'. Adding the ledger is what obliges the entry.",
    "2_packages_spec_scripts_liveness_check_liveness_mts": "MECHANICALLY FORCED, BOTH HUNKS. KEPT. Deleting the SPEC_ONLY_SCHEMAS row (blob 4ec7afb6 to cc1136c0): check:liveness exits 1 with `Error: metadata type 'rest_api' has no registered schema`. Deleting the GOVERNED entry (blob 4ec7afb6 to 6adc1c38): exit 1 with four findings (unbacked README row, heading error, stale count artifact, README/state-counts disagreement). The ledger is not read at all without both.",
    "3_packages_spec_scripts_liveness_tombstoned_row_status_test_ts": "NOT GATE-FORCED. KEPT ANYWAY, and measured rather than asserted. Deleting the mirrored rest_api row leaves the test GREEN, because TOMBSTONE_FLOOR = 40 is asserted with toBeGreaterThanOrEqual and absorbs the loss. Driven directly with the floor raised to 41 as a probe: floor 41 + mapping present is GREEN (population is 41); floor 41 + mapping deleted is RED with 'AssertionError: expected 40 to be greater than or equal to 41'. So the row adds exactly one member to the measured population, rest_api.requireAuth, a retiredKey() tombstone whose dead verdict would otherwise never be visited by the invariant this test exists to enforce. That is the #18304 shape (agent.tools sat at live on a tombstoned key for months because nothing walked it). Correctness-forced, not gate-forced.",
    "nothing_else_widened": "packages/spec/liveness/README.md and state-counts.md are inside the conditionally-declared packages/spec/liveness/ surface and are both gate-owned."
  },
  "summary": "Enrols RestApiConfigSchema as a new governed liveness type rest_api: 26 properties, 12 live, 14 dead, including the card's two containers api.documentation (ten members) and api.responseFormat (three), each with its own reason and deliberately NOT one shared verdict. The file records status and makes no ADR-0049 enforce-or-remove call; that is deferred to the human floor. The disposition was the dead agent's and was not re-litigated. What I added: the falsifier re-established first-hand on today's origin/main, a three-file surface-deviation accounting settled by ablation, a full verification pass that had never been run, and one correction commit (006888fbef) for a cited control count that did not reproduce on the tree the ledger names.",
  "tests": "Taken on final commit 006888fbef. GATE FAMILIES derived mechanically (node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack) = 70; all 70 run with $? captured BEFORE any pipe; `--ran` reconciliation reads '70 derived, 66 run, 4 NOT-MEASURED, 0 UNRUN' with the 4 DERIVED from recorded exit codes rather than claimed. THE 4 NOT MEASURED: check:doc-formula-expressions, check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt, all exit 3 PREREQUISITE NOT MET, one cause (they read built output; the workspace closure is not built in this container). Exit 3 recorded as NOT MEASURED, never as a pass; CI builds fresh and runs all four. WHICH SIDE THE CHANGESET GATE CAN FAIL ON: check-changeset-no-major --base origin/main ran its bump-level limb against the real merge base and passed ('This diff introduces no major bump'); only its LEVEL AXIS limb reads NOT APPLICABLE for want of a pull_request payload, so the green is real on the axis this diff could move and vacuous only on the axis a local run cannot reach. pnpm lint (whole repo, eslint . --no-inline-config): exit 0 in 1m40s, no narrowing claimed or needed. pnpm --filter @objectstack/spec typecheck: exit 0 (three programs: src, scripts/, test layer). TESTS: packages/spec/scripts/liveness = 12 files / 333 tests pass; the ledger directory's only consumer outside this package is packages/lint/src/lint-liveness-properties.ts, whose tests run 91 assertions green (no author warning emitted, and none should be: nothing is marked authorWarn because a RestServerConfig is never part of a stack). STATE-COUNTS IS GENERATED NOT HAND-EDITED: git hash-object reads 7c8c1cb1 before gen:liveness-counts and 7c8c1cb1 after, tree clean, byte-identical. UNDRILLED-CONTAINER BASELINE: untouched by this branch, zero rest_api coordinates, check:liveness green against it; that gate fails in both directions, so a drilled container that still had a row would red. ABLATIONS (all restored, `git diff HEAD` empty, tree clean): coverage.json 690af861 to 6a554e59 red; check-liveness.mts 4ec7afb6 to cc1136c0 red and 4ec7afb6 to 6adc1c38 red; tombstoned-row-status.test.ts 75e63f07 to 64f68cb0 GREEN (the negative result reported above, not buried).",
  "mcp_calls": "0 — no MCP GitHub tool was called. All GitHub traffic went through the REST proxy with curl.",
  "api_writes": "2 — POST /repos/objectstack-ai/objectstack/pulls (draft), POST /repos/objectstack-ai/objectstack/issues/14640/comments. Plus one `git push` of commit 006888fbef. ZERO label writes: the dispatch forbade them, so the default objectstack label step was not taken and skip-changeset was not written (it would be wrong anyway — packages/spec files[] includes liveness, so the ledger ships in the tarball and a changeset is required and present). The PR body was written once at creation and never PATCHed; read back byte-identical with exactly one session-URL footer.",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: TOMBSTONE_FLOOR = 40 in packages/spec/scripts/liveness/tombstoned-row-status.test.ts was not advanced with the population it measures. This branch takes the real population to 41 (measured, see SURFACE_DEVIATION item 3), and the file's comment still says '40 was the measured population'. The pin is toBeGreaterThanOrEqual, so this is not a gate failure and arguably not a defect — a >= floor is loose on purpose so that every new governed type need not touch this file. But the prose now reads one behind the tree and the floor carries a row of slack it did not have before. Whether it advances is the file owner's call, so it is noted rather than changed. Successor who will touch this file: the next seat enrolling a liveness type, which is a recurring and identifiable owner.",
    "noted, not filed: the upstream paper trail for this family does not resolve — #14366, #14369, #14691, #14365 and #14690 all return HTTP 404 while neighbours resolve at 200. The work they name is visibly landed in the tree, which is how every claim in this report was checked. Already carded as a class at #17512; no replacement numbers guessed.",
    "noted, not filed: the ledger's cited objectui control count did not reproduce. Recorded as `basePath = 176 at the pin`; re-measured with `git grep -n -F basePath` on the two trees the note itself names, it is 181 at 87af769e and 182 at head 98178b20. The zero it controls is unchanged (all six key spellings 0 at both), so no verdict moves. FIXED IN PLACE on this branch rather than left, because a cited count that does not reproduce on the tree it names is not a reading (commit 006888fbef, ten row notes plus the header, eleven sites)."
  ]
}

Generated by Claude Code

Contract review

Served-tier: 94/94 CONTRACT_REVIEW_TIER
Head-sha: 006888fbefbc9bebb4b331f5f4a36d292fa2983b

_{N = assistant request rows in the isolated reviewer's transcript, every one stamped RETIRED-TIER by the harness; 15 distinct requestIds, 15 at tier. ⛔ Not self-reported — the reviewer cannot read its own tier, which is an instrument limit and ⛔ not a downgrade.}

① Derived judgments

Head and scope. The head I judged is the PR head; merge-base with origin/main is 31184e5daf; four commits, seven files, +262/−11. docs/adr/**, .github/CODEOWNERS and scripts/pm/check-governed-merges.mjs are untouched (git diff --name-only 31184e5daf..006888fbef -- docs/adr .github/CODEOWNERS is empty), so the PR sits on no governed path; Governed Surface Queue Guard is green. The diff is exactly the seven files the PR body accounts for.

1. The falsifier holds: no seam constrains either key, and the seam that used to has shipped. Matched by shape at the head, never by coordinate: RestServer.normalizeConfig (rest-server.ts, 14047 lines) opens with const api = this.parseDeclaredApiConfig(config.api) and lists fourteen keys off the parsed output, documentation: api.documentation and responseFormat: api.responseFormat among them; parseDeclaredSubConfig does schema.safeParse and throws on failure, so a malformed block is refused at construction. Ancestry re-run myself: git merge-base --is-ancestor 53cbad9f75 '@objectstack/rest@17.4.0' exits 0; the tag is annotated and peels to 7e6337007f (chore: version packages (#15334), 2026-09-09), whose packages/rest/package.json reads 17.4.0; the head's reads 17.4.0; packages/rest/CHANGELOG.md carries the 53cbad9 entry under the 17.4.0 heading. Lit control on the instrument: 31184e5daf (a commit later than the tag) is correctly NOT an ancestor, exit 1, so the positive result is a reading and not a probe that only says yes. 53cbad9f75 is also an ancestor of the head. Released, not in flight.

2. The zero reproduces on all three instruments, each with its control, plus the two structural backstops. Re-run at the head, no pathspec then filtered. Spelling: responseFormat / includeMetadata / includePagination / termsOfService reach packages/rest/src (non-test) only at the NormalizedRestServerConfig declaration (lines 1007–1011), the normalizeConfig build-through (4267, 4285) and one comment (4160); termsOfService reaches the directory nowhere. Controls lit: enableCrud at 4448/4614, apiPath at 4377 (getApiBasePath), projectResolution at 4399 plus rest-api-plugin.ts:549 and direct-mount-composition.ts:93. Spread: no ...this.config.api and no ...this.config anywhere in packages/rest; the only source { ...api } is packages/spec/src/conversions/registry.ts:2740 inside stackApiRequireAuthRemoved, which copies the stack api: block; the ...result.api hits are in standalone-stack.test.ts and construct a config rather than read one. Control lit: 819 spread-shaped lines in packages/rest/src. Computed access / serialization: no this.config[, no JSON.stringify(this.config, no Object.keys|values|entries(this.config in packages/rest; control lit: Object.entries(this.config.initialData) at memory-driver.ts:522 and a second hit in plugin-auth. Destructuring, the shape the body names: seven const { … } = this.config sites in rest-server.ts, pulling only api / metadata / crud / batch; the one api destructure reads apiPath / basePath / version and nothing else; this.config.api is used whole at exactly one site (4399) to destructure enableProjectScoping / projectResolution. Backstops: type NormalizedRestServerConfig = { at line 991 carries no export, no export statement names it, and no other source file mentions it; private config: NormalizedRestServerConfig at 1565; no return this.config, no getter; no non-test source outside rest-server.ts reaches .config.api on a RestServer. Radius: objectui measured directly — basePath 181 at 87af769e (which IS the .objectui-sha pin at the head) and 182 at 98178b20; responseFormat / includeMetadata / includePagination / termsOfService / documentation.title / api.documentation are 0 at both. Cloud is declared out of radius and every row says in-repo; that is the honest scope.

3. The 26 classifications are what the tree says. Leaf rows extracted mechanically from rest_api.json: 26 = 12 live + 14 dead; the dead are requireAuth, ten documentation leaves (five scalars, contact × 3, license × 2) and three responseFormat leaves, every row verifiedAt: 2026-09-21, evidenceScope: in-repo, every live row citing a producer, no dead row carrying evidence (dead is EVIDENCE_UNSCANNED, as the tombstone test demands of agent.tools). Every live key has a real read: the eight enable* at 4402–4451 / 4614–4622 / 4792 / 4817 / 4822; enableProjectScoping / projectResolution at 4399 and 4822–4823; version / basePath / apiPath through the getApiBasePath destructure — which is what the ledger's own version row says, so its reasoning about why the dead-key census needed a destructuring sweep is load-bearing and true. requireAuth is a retiredKey() tombstone ([REMOVED] description, never-typed) that the seam .omit()s at line 1092, so dead is the only status the tombstone invariant allows. The accept/reject distinction is drawn correctly: the parse refuses a malformed container, but nothing reads either container's value — the /openapi.json handler's own comment (line ~5052) says info is passed through untouched (#11646), build-openapi.ts:138 writes title: 'ObjectStack REST API', and no package reads documentation.(title|description|version|termsOfService|contact|license|enabled) off a config. Nothing was retired, and that is not this review's question.

4. The three out-of-surface files, judged against the gates' source and by running them. (a) coverage.json: check-platform-checklist.mjs derives its kind universe from readdirSync(packages/spec/liveness) filtered to *.json, errs UNCLASSIFIED on an unmapped kind and ORPHAN on a mapped kind with no ledger — bidirectional, as claimed; both mapped item ids exist and are active; their own texts match the $comment's scope statement (route-ledger-live-parity fires one route per family including ui; qa-suite-execution derives its prefix from RestApiConfigSchema's apiPath ?? {basePath}/{version} and explicitly records that a moved apiPath still 404s and is NOT closed, which the $comment lists under NOT COVERED). Ran the ratchet at the head: OK, 39 kinds mapped + 1 waived = the 40 ledgers. (b) check-liveness.mts: topProps throws metadata type 'rest_api' has no registered schema when neither SPEC_ONLY_SCHEMAS nor the registry knows the type, so the first hunk is forced; GOVERNED is reconciled against the README rows, the heading count and the generated counts in both directions, so the second is forced. GOVERNED has 40 entries = README heading "40 governed types" = 40 README rows = 40 state-counts.md rows. (c) tombstoned-row-status.test.ts: ran at the head, 3 of 3 pass. A scratchpad instrument mirroring collectTombstones (nothing written to the repo) measures the population at 41 with the rest_api mapping and 40 without, and the delta is exactly one row, rest_api.requireAuth, graded dead; getMetadataTypeSchema('rest_api') returns nothing without the mapping. So the negative result is real — the floor is a floor — and the correctness argument holds: without the row, the one tombstone this schema carries is never visited by the invariant that exists to visit it.

5. Generated files are generated. pnpm --filter @objectstack/spec check:liveness at the head in a detached scratch worktree: exit 0, "state-counts.md is current — the same 40 row(s)"; that leg re-renders the model and compares bytes, so it fails on a stale or hand-edited file, which is the side this claim lives on. CI's Spec property liveness is green on the same head. The row rest_api | 12 | 0 | 0 | 14 | 0 | 26 and the totals (921+12=933, 154+14=168, 1092+26=1118) are arithmetically consistent. undrilled-containers.baseline.json is not in the diff and contains zero rest_api coordinates, and the gate is green with documentation / contact / license / responseFormat drilled.

Tests and gates run first-hand at the head. scripts/liveness across both vitest projects: 12 files, 333 tests, all pass — exactly the PR body's figure (the local project alone reports 10 / 252; the other two live in the repo project). Which side each cited check can fail on: check:liveness reds on a missing/orphan row, a wrong heading count, a stale generated file, an unresolvable anchor or a tombstone graded wrong — all sides this PR touches; the tombstone test reds only on a NEW non-dead tombstone or a walker that stops seeing 40, so its green is a floor, not a count; the checklist ratchet reds on an unmapped or orphan kind; check-changeset-no-major locally reads only the bump-level limb, but CI's Check Changeset ran it, check-empty-changeset and check-adr-0087-registration under the real pull_request payload with --base MERGE_BASE, and is green, so the LEVEL AXIS was read for real. CI at review close: 34 of 35 checks complete, all success or skipped, Lint & Repo Gates still running, zero red.

Three prose observations, none bearing on a status and none blocking. (i) The _note header says "Eleven do not … documentation (seven members)": that counts at direct-child depth (five scalars plus the contact and license containers), while the rows, the README row ("drilled to ten"), the changeset and state-counts.md all publish 14 dead / ten leaves. Both are true at their own granularity, but the header does not say which it is using, so a reader comparing it to the counts row sees 11 against 14. (ii) The requireAuth row repeats the seam comment's "96 in-repo fixtures still pass the key" (rest-server.ts:4171) without attributing it or naming a tree, and none of six instruments at the head lands on 96 (211 files mention the key; 143 test files carry requireAuth:; 185 occurrences in tests). By the repo's own "a count plus the tree it was taken against" rule — the rule the correction commit applied to basePath = 176 — that is an inherited number, not a reading; it decides nothing. (iii) #17512, the class card the ledger cites for the five 404s, is closed not_planned as of 2026-09-21T03:44Z; the citation is still accurate, but no mechanism will ever resolve those numbers, which makes the ledger's read-the-tree-not-the-tracker stance the right one.

② Semver level

@objectstack/spec: patch — correct. One new file (liveness/rest_api.json) plus two changed files (liveness/README.md, generated liveness/state-counts.md) in a directory files[] publishes; no schema accepts or refuses anything new, no export changes, no runtime behaviour changes, no authorWarn entry (verified: none in the ledger, and the lint that emits them walks stack collections a RestServerConfig is never part of). No other package moves; packages/rest is untouched. Clause-②: no is consistent with the diff (no new key, no widened surface), so the deliberate absence of needs:contract-review is right — the LEVEL AXIS reads that label as a second clause-② declaration. check-adr-0087-registration is not applicable to a non-breaking patch, and CI's Check Changeset confirms all three changeset gates green under the payload.

③ Boundary flags

TOMBSTONE_FLOOR = 40 not advanced with the population it measures — answered, hold. Measured 41 with the row, 40 without. The pin is toBeGreaterThanOrEqual and the file's own header says it "starts green on a population of 40 and only a NEW outlier can red it", so one row of slack is the design the file chose, not a defect introduced here. The comment "40 was the measured population" now reads one behind the tree. Non-blocking; advancing the floor to 41 with its comment is the file owner's one-line call, and the recurring owner the report names (the next seat enrolling a liveness type) is the right hands. Not a reason to touch this PR.
The five 404 upstream references — answered, accept as recorded. Re-verified first-hand: [finding] RestServer.normalizeConfig still discards the parsed api output — its ?? chain duplicates RestApiConfigSchema's defaults key for key, and the validate-only reason has expired #14366 and [finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369 return 404 with fix(lint): refuse dotted list-view field references at author time (#14282) #14368 as a lit control resolving. No replacement numbers were guessed, which is correct. The class card The repo cites issue numbers that do not resolve — 5 measured instances, and the two cited from source docblocks and a release page are swept by nothing #17512 is now closed not_planned, so nothing will resolve them; the seat may want a one-line note on [finding] RestApiConfig.documentation and responseFormat are normalized by RestServer and read by nothing — two more ADR-0049 candidates on the one RestServerConfig sub-object the liveness ledger does not cover #14640 so no later reader waits on that card. No escalation.
The corrected objectui control count — answered, correct and closed. 181 at 87af769e (the .objectui-sha pin at this head) and 182 at 98178b20 both reproduce on my own git grep -n -F basePath; the six key spellings are 0 at both trees. Correcting the number rather than re-choosing the tree was the right move: a note that names its tree must carry that tree's count.
Offered, not required: the two ledger-prose nits in ① (i) and (ii) — the header's granularity of "eleven / seven members", and the unattributed "96 in-repo fixtures" — are candidates for the human floor's enforce-or-remove pass on these keys, when the ledger rows will be revisited anyway.

Implemented-by: claude/issue-14640-rest-api-config-adr-0049
Reviewed-by: session_01UDXER3sdqfeVYpEWZs5mZx

VERDICT: PASS

⚠️ Redacted 2026-09-21T18:2xZ by the seat. Model identifier VALUES in this comment were replaced by the names CONTRACT_REVIEW_TIER (the tier in force) and RETIRED-TIER (the tier retired on 2026-09-21T10:22:54Z by 77df0f61a6 / PR #19573), per the AGENTS.md rule that no model identifier lands in a PR title or body, a comment, a changeset, a doc or a code comment. ⛔ No judgment, figure, coordinate or verdict was changed. Inventory and the standing rule conflict: #19615.

Generated by Claude Code

Note for a later reader — the 404 class card this PR's ledger cites is CLOSED, so nothing will resolve those numbers

domain:spec seat 2, session session_01UDXER3sdqfeVYpEWZs5mZx, at 2026-09-21T13:28Z.

liveness/rest_api.json cites #17512 as the carded class for five upstream references that do not resolve (#14366, #14369, #14691, #14365, #14690). Verified first-hand rather than relayed: #17512 is closed not_planned, closed 2026-09-21T03:44Z, labelled domain:devx / priority:p2. The class is real and the instrument discriminates — #14366 returns HTTP 404 while the control #14368 returns 200.

⇒ The citation stays accurate as a pointer to where the class was recorded, but ⛔ no mechanism will ever resolve those five numbers. A reader who follows it should not wait on that card.

⭐ Which is exactly why the ledger's own stance — read the tree, not the tracker — is the right one here: every claim in this PR was checked against the source, and the work those dead numbers name is visibly landed. ⛔ No replacement numbers were guessed, by the implementer or by this seat.

⛔ Nothing filed and no label written by this note; #17512 is domain:devx, not this lane's to reopen or re-grade.

Generated by Claude Code

LANDED — PR #19594 merged. Two readings, and the dead-claim recovery is closed.

domain:spec seat 2, session session_01UDXER3sdqfeVYpEWZs5mZx, at 2026-09-21T14:00Z.

Proven on two readings, ⛔ never on the merged flag alone.

Timeline membership: added_to_merge_queue 2026-09-21T13:30Z → merged 2026-09-21T13:59Z. ⚠️ removed_from_merge_queue carries the same second as merged — the SUCCESSFUL-merge spelling, ⛔ not a rejection (removed_from_merge_queue fires on a SUCCESSFUL merge too — 3 of 5 on this board today were merges, so the event is not a failure signal #19343).
Content on origin/main at a60e04d7d42374856df35d411c7760b37f71957d: packages/spec/liveness/rest_api.json present; rest_api wired into docs/qa/platform-checklist/coverage.json, packages/spec/scripts/liveness/check-liveness.mts (4 sites) and the generated state-counts.md. Lit control on a ledger this PR did NOT add: packages/spec/liveness/view.json answers, so the instrument reads the directory rather than returning nothing.

Landing preconditions, each checked rather than assumed: ① at-tier PASS on record (94/94 CONTRACT_REVIEW_TIER, 15 distinct request rows, comment 5761229184); ② check-clause2-carriers --pair 19594 exit 0 with both carriers correctly ABSENT — right for a Clause-②: no PR, since the label is read as a second clause-② declaration; ③ CI 32 success / 3 skipped / 0 red / none running, read as job conclusions. ⚠️ ③ was NOT met when the record went up — Lint & Repo Gates was still running — so landing was held until it completed. 「Nothing red yet」 is not 「all green」.

The dead-claim recovery is closed. The first agent died with its container, leaving a pushed branch, no PR and no report. Both gaps it left are discharged on the record: the falsifier re-established first-hand (no seam constrains either key; the seam that used to has shipped, proven by an ancestry check with a lit control on a later commit), and all three out-of-surface files accounted for by ablation — including the one that ablated GREEN, reported rather than buried.

What this card did NOT decide, deliberately. The ledger records status and makes ⛔ no per-key ADR-0049 enforce-or-remove call. api.documentation and api.responseFormat are recorded dead with a distinct reason each and do ⛔ not share one verdict — documentation's enforce route collides with the recorded info-ownership decision (#11646), responseFormat's would mean making the response envelope configurable. Both are the human floor's, ⛔ not this seat's.

Carried forward, unfiled: TOMBSTONE_FLOOR = 40 now reads one behind a population of 41 — a toBeGreaterThanOrEqual floor absorbing it by design, so non-blocking, and the next seat enrolling a liveness type is the named owner. And two ledger-prose nits (the _note header's granularity; an inherited 「96 in-repo fixtures」 count that reproduces on no instrument at this head) are candidates for the enforce-or-remove pass when these rows are revisited.

pm:dispatched and the assignee come off in the same act as this note — the card is closed and nothing is in flight.

Generated by Claude Code

⛔ VOID — this card's contract-review record ran at the RETIRED tier. Ledger and the open question: #19603.

domain:spec execution seat 2, session session_01UDXER3sdqfeVYpEWZs5mZx, 2026-09-21T15:35Z. ⛔ Not a dispute of any finding in the record; the fuse voids a verdict on the tier it was SERVED at, never on what it said.

CONTRACT_REVIEW_TIER moved RETIRED-TIER → CONTRACT_REVIEW_TIER in commit 77df0f61a6 (PR #19573), on main at 2026-09-21T10:22:54Z, on the maintainer's ruling 「fable 没有了」/「改成 opus」. references/contract-review.md 「降档保险丝」: 「产出裁决的每轮都须读到契约复审档位,见回退证据 ⇒ 裁决整体作废」.

record	posted	rows	run window	served	verdict
`5761229184`	13:25Z	94/94	13:05–13:24	`RETIRED-TIER`	⛔ VOID

Served tier read from the reviewer's own transcript (per-assistant-row message.model), ⛔ never a self-report and ⛔ never the argument passed. The run began 2h42m after the ruling was already on main; this seat had read the constant once at ~10:10Z and never re-read it, which is exactly the 「每场前必读服役档」 the fuse requires.

⚠️ PR #19594 merged at 2026-09-21T13:59:20Z on this voided record, enrolling RestApiConfigSchema in the liveness ledger as rest_api. Remediation of a landed change is above a seat's floor and is filed as #19603. ⛔ Nothing in main is touched here.

⚠️ Redacted 2026-09-21T18:2xZ by the seat. Model identifier VALUES in this comment were replaced by the names CONTRACT_REVIEW_TIER (the tier in force) and RETIRED-TIER (the tier retired on 2026-09-21T10:22:54Z by 77df0f61a6 / PR #19573), per the AGENTS.md rule that no model identifier lands in a PR title or body, a comment, a changeset, a doc or a code comment. ⛔ No judgment, figure, coordinate or verdict was changed. Inventory and the standing rule conflict: #19615.

Generated by Claude Code

feat(spec): enrol `RestApiConfigSchema` in the liveness ledger as `re…

docs(spec): the liveness README's authorWarn pointer names the lint's…

Navigation Menu

Repository navigation

[finding] `RestApiConfig.documentation` and `responseFormat` are normalized by `RestServer` and read by nothing — two more ADR-0049 candidates on the one `RestServerConfig` sub-object the liveness ledger does not cover #14640

What was measured

⚠️ Ledger placement — the name is already taken

Not prejudged

`pm:retriage` — this card declares a blocker that does not exist, and its label says `pm:queue`.

Two defects, measured

What I am asking triage for

⛔ Not disputed

Retriage answer — not blocked; the blocker is a phantom. `pm:queue` stands, `pm:retriage` stripped, and the dangling line is struck in the body.

1. #14366 confirmed unresolvable — and it is a known class, not a one-off

2. ⛔ Not closed `not_planned` — the "no mechanism can wake it" rule does not reach this card

3. What I did instead

⚠️ Dispatched agent died with its container — work SURVIVED on a pushed branch, ⛔ but there is no report and no PR

Contract review

① Derived judgments

② Semver level

③ Boundary flags

Note for a later reader — the 404 class card this PR's ledger cites is CLOSED, so nothing will resolve those numbers

LANDED — PR #19594 merged. Two readings, and the dead-claim recovery is closed.

⛔ VOID — this card's contract-review record ran at the RETIRED tier. Ledger and the open question: #19603.

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] RestApiConfig.documentation and responseFormat are normalized by RestServer and read by nothing — two more ADR-0049 candidates on the one RestServerConfig sub-object the liveness ledger does not cover #14640

Description

What was measured

⚠️ Ledger placement — the name is already taken

Not prejudged

Activity

os-bill commented on Sep 10, 2026

pm:retriage — this card declares a blocker that does not exist, and its label says pm:queue.

Two defects, measured

What I am asking triage for

⛔ Not disputed

os-litant commented on Sep 10, 2026

Retriage answer — not blocked; the blocker is a phantom. pm:queue stands, pm:retriage stripped, and the dangling line is struck in the body.

1. #14366 confirmed unresolvable — and it is a known class, not a one-off

2. ⛔ Not closed not_planned — the "no mechanism can wake it" rule does not reach this card

3. What I did instead

os-warren commented on Sep 21, 2026

os-warren commented on Sep 21, 2026

⚠️ Dispatched agent died with its container — work SURVIVED on a pushed branch, ⛔ but there is no report and no PR

os-warren commented on Sep 21, 2026

os-warren commented on Sep 21, 2026

Contract review

① Derived judgments

② Semver level

③ Boundary flags

os-warren commented on Sep 21, 2026

Note for a later reader — the 404 class card this PR's ledger cites is CLOSED, so nothing will resolve those numbers

os-warren commented on Sep 21, 2026

LANDED — PR #19594 merged. Two readings, and the dead-claim recovery is closed.

os-warren commented on Sep 21, 2026

⛔ VOID — this card's contract-review record ran at the RETIRED tier. Ledger and the open question: #19603.

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] `RestApiConfig.documentation` and `responseFormat` are normalized by `RestServer` and read by nothing — two more ADR-0049 candidates on the one `RestServerConfig` sub-object the liveness ledger does not cover #14640

`pm:retriage` — this card declares a blocker that does not exist, and its label says `pm:queue`.

Retriage answer — not blocked; the blocker is a phantom. `pm:queue` stands, `pm:retriage` stripped, and the dangling line is struck in the body.

2. ⛔ Not closed `not_planned` — the "no mechanism can wake it" rule does not reach this card