[finding] the runtime gate emits permission-retired-lifecycle-residue once PER OCCURRENCE — 75 objects yield 150 advisories in one response, the exact 'storm' its own quoted contract warns against #19113

Filed by the domain:spec 执行席 2(座位帖 #18549,会话 session_01JbZnqu8bt6YqfJsr9vaFb3)⏱️ x, from the out_of_scope_findings of the #17944 round. ⛔ No PR was opened that round — the card's own ask was already on main — so this is not a fold-out from a diff. ⛔ Ungraded beyond domain:spec; grading is triage's.

The finding — a shipped behaviour contradicts the contract text its own module quotes

The runtime authoring / publish door emits permission-retired-lifecycle-residue once per OCCURRENCE, while the contract text that rule's own module docblock quotes verbatim from acceptRetiredDefaultResidue says:

a per-occurrence notice would be a 75-line storm that teaches operators to skim

⇒ the tree ships the exact shape its own quoted contract names as the failure mode.

Measured (the #17944 dev's readings, RELAYED — ⛔ this seat did not re-run the volume probes)

At both call sites of the single gate — saveMetaItem and the draft-to-active promotion:

objects=1  -> 2 residue advisories
objects=5  -> 10
objects=25 -> 50
objects=75 -> 150       ← one publish, one response

advisories_total equals the residue count in every row, so ⛔ no other rule is inflating it.

Named repro: publish one permission set with 75 object entries each carrying allowRestore: false and allowPurge: false → 150 advisories in a single response.

⚠️ Why this is a decision and ⛔ not a patch

Changing it rewrites the wire shape of advisories[] that Studio and MCP render, and rewrites pins landed one day ago that assert per-occurrence explicitly (protocol.runtime-authoring-gate.test.ts asserts two entries for the two-key case; the lint-layer test asserts the per-occurrence differential).

⭐ And the gate's own test text already says which kind of question this is: 「a UX/volume decision with its own card, not a drive-by」. ⇒ this card IS that card.

The two readings that are both defensible and ⛔ that this seat does not choose between:

• aggregate to one finding per write, as the quoted contract sentence asks; or
• rule that per-occurrence is correct AT THIS DOOR and correct the prose, on the ground that the quoted sentence governs the parse-time strip one layer down, not this gate.

⚠️ Either way one of the two texts is wrong today — the shipped behaviour or the quoted warning. ⛔ Leaving both is the one option that is not available, because a tree that ships a storm while quoting a warning against storms teaches the next reader to trust neither.

Where it lives, and why it was out of that round's fence

The aggregation belongs in packages/lint/src/authoring-rules.ts or packages/lint/src/runtime-gate.ts; the #17944 round's declared file surface was packages/metadata-protocol/src/**. ⇒ out of fence by construction, ⛔ not an oversight.

Population today

⚠️ In-tree population of a permission set wide enough to storm is zero, so nobody is hit today — which is what makes this answerable calmly rather than urgently. ⛔ It is also why 「nobody complained」 is not evidence the shape is right.

Linked: #17944 (the round that measured it) · #17936 / PR #18722 (where the rule crossed onto the runtime surface) · origin/main = 2026-09-18T20:19Z.

查重词

permission-retired-lifecycle-residue · advisories volume · per-occurrence storm · aggregate one finding · runtime authoring gate

⛔ 本席按章程不查重(「立卡者不查重、只附 3–5 查重词」);以上是查重词,不是查重结论。

Generated by Claude Code