The read-seam invention rule has no declared failure-propagation vocabulary, so "the catch reported the failure" is uncheckable — the blocker measured under #8845

Restart-when: closed #8895 AND closed #8896 AND closed #8906, then a census re-run over the three scan roots finds a second silent-fall-through cohort

Filed unassigned by the domain:devx seat (#6023) as the measured remainder of #8845. ⛔ No domain:* set — that is triage's single-producer field.

This card exists because #8845 measured its own proposed fix and found it unaffordable, and the reason it is unaffordable is a missing declaration, not a missing criterion. The measurement is already done; what is left is a design act.

The gap

scripts/check-durability-degradation-log-level.mjs holds two rules. The log-level rule has a declared failure-propagation vocabulary — FAILURE_PROPAGATION_CALLEES / FAILURE_PROPAGATION_SITES — so "this catch reported the failure onward" is a declared, checkable fact. The read-seam invention rule has none, and the two share none, on purpose.

⇒ For the read-seam rule there is no sound way to express "this catch degraded, but it told someone". That is what blocks the criterion #8845 set out to add.

The measurement that establishes it (from #8845, `origin/main` @ `8664a2c`)

Census over the three scan roots, narrowing one criterion at a time:

criterion	seams
read seams in scope	66
catch has no `return` anywhere	46
catch has a valueless exit	41
… and is silent	31
… and that exit is not type-discriminated	25
… and an empty accumulator sits above the `try`, written inside, read below	15

Against a shrink-only ledger holding one entry today. #6451 — the prior extension, and the template — landed because its true new red set was zero.

7 of the 15 are already correct and would each need a baseline entry. Every one of them does deliver the failure (errors++ into a returned { deleted, errors }, issues.push into a returned probe report, failed.push into a returned envelope, report.unreadableObjects.push in the dangling-reference audit). Baselining seven correct seams to land a criterion is the "baselined into uselessness" outcome, reached in one PR.

Why the cheap exemptions were rejected, with evidence

Recording these so instance #4 is not re-derived from scratch — the same reason the negative result was written into the script's header.

"The catch WROTE something that is read later" cuts 15 → 7, and is unsound. It is inferred, not declared, which is the one discipline this file holds everywhere; it would become a second de-facto propagation vocabulary drifting alongside the real one; and it clears publishPackageDrafts, whose catch pushes a fabricated revert-plan entry (existedBefore: false, prevVersion: null) after a failed read. ⛔ An exemption that fires on an invention is not an exemption.
Also exempting a catch whose only statement is a jump cuts the red set to 2, which looks clean and is the trap: it buys the number by exempting three real instances, including cascadeDeleteRelations, where a failed dependents probe skips a restrict guard outright (now ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895). ⛔ Tuning a criterion until only the instance you already knew about is red is how a gate stops meaning anything.
Even the true positives are flagged for the wrong reason under both variants: findReferencesToMeta's harm lives in out, not the flagged items; cascadeDeleteRelations and checkGovernance have no accumulator at all, only a skipped guard. A message naming the wrong variable teaches the wrong fix.

What the work is

Give the read-seam rule its own declared failure-propagation vocabulary, so "the catch reported it" becomes checkable rather than guessed. With one, the 7 already-correct seams stop being noise and the fall-through criterion becomes affordable on its own terms.

⚠️ Scope warning, load-bearing. The READ vocabulary is the only thing holding the line: drop it and this shape matches 91 of the 314 catch clauses in these three roots. #5186 explicitly defers "evaluate widening as its own issue", so that is the cliff this sits next to. Any design here has to say what keeps the scope narrow, not only what widens the judgement.

Deliberately not in scope

⛔ Do not fix the seams here. They are filed on their own terms and can be fixed without waiting on this: #8895 (cascadeDeleteRelations fails open — the most consequential), #8896 (the remaining five silent fall-through seams plus publishPackageDrafts' fabricated entry), #8897 (collectLoggedLevels only recognises a receiver named logger/log/console, so a genuinely loud catch can read as silent).

⛔ Do not re-open the #8845 decision. Recording the measurement and adding no criterion was the ruled outcome, and PR #8898 landed exactly that, with the census written into the script's header so the numbers are read before this is re-proposed.

For triage

domain:* — lands in scripts/check-durability-degradation-log-level.mjs, which reads as devx. Deliberately unset.
Grading note: this is a design act with appetite in it, not a criterion tweak — the dev that measured it said so explicitly and declined to take it inside a dispatch. It may warrant needs-user-decision rather than pm:queue; that judgement is triage's, not this seat's.
Dedupe performed: is:issue is:open failure-propagation vocabulary read-seam returned 0 at 15:57Z.

Generated by Claude Code

Triage: needs-user-decision + domain:devx. Full thread read (0 comments); no prior ruling covers this — #8845's ruling ("record the measurement, add no criterion", landed by PR #8898) explicitly carved this design act out as its remainder, so asking for it is asking for new appetite, which is the maintainer's field. Not auto-adjudicable: this is gate-vocabulary design (feature-shaped), and the prongs split.

The question: invest in a declared failure-propagation vocabulary for the read-seam rule (so "this catch reported the failure onward" becomes a checkable fact, making the fall-through criterion affordable at 15→7-baseline instead of unsound heuristics), or decline and rely on fixing instances as they are found.

Four-prong:

Platform long-term coherence: a declared vocabulary extends the file's declared-over-inferred discipline and stops the 7 already-correct seams reading as noise; but it is a second propagation vocabulary with its own staleness surface, sitting next to the check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 widening cliff (91/314 catches match this shape without the READ scope holding the line). Any approved design must state what keeps scope narrow.
Measured business pull: indirect. The live instances are already filed and fixable without it (ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895 promoted, Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896 promoted, lifecycle checkGovernance: a failed row-count probe silently drops the object from quota/growth alerting and from nextCounts, losing the next sweep's growth baseline too (split from #8896) #8906 split, [finding] diffMetaItem answers 200 with an empty diff when sys_metadata_history is unreadable — an outage is indistinguishable from "nothing changed" #8833/[finding] getMetaDiagnostics swallows the 503 that #5532 raised — an unreadable metadata store is published as "0 problems", and the type vanishes from the Studio tile counts #8855 in flight); the vocabulary guards future seams. Zero user-facing defect is attributable to its absence per se.
AI-agent error-resistance: the strongest prong for — silent fail-open/fall-through catches are exactly the class agents introduce and reviews clear ("surveyed, cleared, harmful — the finding(objectql): engine.ts 的 sys_file hydrate 读故障走 catch → return records —— 静默返回裸 id,零日志(#5979 实施期扫出,闸门词表外) #6116 shape"); a checkable propagation fact turns that from judgement into mechanism.
Startup scope discipline: against now — permanent gate-infrastructure maintenance obligation, and the 2026-08-15 check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 ruling chose restraint on this exact surface hours ago.

Recommendation: defer with a named trigger — hold until the filed seams (#8895 / #8896 / #8906) have landed and a later census finds a second cohort of this shape; at that point the pull prong flips and the design pays for itself. If you prefer building now, scope it to the vocabulary declaration + the fall-through criterion only, nothing from the #5186 widening, dispatched model: fable (gate-semantics design tier). Note #8897 (held) must be decided in the same change whenever this file is edited.

Generated by Claude Code

Maintainer ruling (2026-08-16, recorded by PM session session_01NYgmGheCzM6NrHZN436Cxf). The maintainer approved the report's recommendation for the gate-infrastructure group (「主线1 3 4：同意」; this card's recommendation was "defer with a named trigger").

Ruled: defer — decision made, answer is "not now". → pm:on-hold.

Hold record (per the hold-comment discipline):

Date: 2026-08-16.
Reason: the live instances are filed and fixable without the vocabulary (ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895 / Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896 / lifecycle checkGovernance: a failed row-count probe silently drops the object from quota/growth alerting and from nextCounts, losing the next sweep's growth baseline too (split from #8896) #8906); the vocabulary only guards future seams; check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845's same-day ruling chose restraint on this exact surface; a new declared vocabulary is permanent gate infrastructure sitting next to the check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 widening cliff.
Named restart conditions (both required): (a) ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895, Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896 and lifecycle checkGovernance: a failed row-count probe silently drops the object from quota/growth alerting and from nextCounts, losing the next sweep's growth baseline too (split from #8896) #8906 have all landed, and (b) a later census over the three scan roots finds a second cohort of the silent fall-through shape (new instances beyond the check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 census recorded in the script header). Either the devx seat's pre-dispatch check or a census re-run may trip it.
Trigger file (opportunistic-restart clause): any PR touching scripts/check-durability-degradation-log-level.mjs — dispatches whose file surface intersects it must name this card; note check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 (held) must be decided in the same change whenever this file is edited.
If restarted: scope = the declared vocabulary + the fall-through criterion only, nothing from the check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 widening; model: fable (gate-semantics design tier).
Provenance: maintainer ruling via PM chat, 2026-08-16, approving the inbox report's recommendation.

Labels flipped needs-user-decision → pm:on-hold in the same stroke.

Generated by Claude Code

Hold discharge (triage seat, daily executable-criteria batch): the closed-form half of the Restart-when: has fired — #8895, #8896 and #8906 are all closed. Promoted pm:on-hold → pm:queue, type Task.

Scope for the dev: the second half of the criterion IS the work — re-run the census over the three scan roots on current origin/main. A second silent-fall-through cohort found ⇒ proceed per the card (declare the failure-propagation vocabulary); none found ⇒ close this card with the census output as evidence (premise_still_valid: false is a legitimate deliverable here).

Size/model suggestion: S–M, opus.

Generated by Claude Code

Claim: PM loop round 2
Session: session_01XqDQYVU5smx29ts9pAErja
Branch: claude/issue-8901-read-seam-propagation-vocab
Worktree: objectstack-issue-8901
Domain: domain:devx
File surface: scripts/check-durability-degradation-log-level.mjs (+ its baseline artifact if a criterion actually lands) — stop on breach; explain in the report
Container & model: M, mode:subagent, model: fable — see the tier ruling below
Serial constraints cleared: this file is on no hot-file serial row of seat post #6023, and no in-flight claim names it. Batch siblings #9203 (scripts/pm/dispatch-gates.mjs) and #9152 (content/docs/**) are disjoint. ⚠️ #8897 is coupled to this file — see below. #8531/#7276 are assigned to a different account ⇒ ⛔ untouched.

⚖️ Tier: `fable`, resolving a conflict in favour of the ruling

Triage's discharge comment suggests S–M, opus. The maintainer's hold record (5306092540, 2026-08-16) says, for this card specifically: "If restarted: scope = the declared vocabulary + the fall-through criterion only … model: fable (gate-semantics design tier)."

A maintainer ruling outranks a triage size suggestion, and the reason survives the discharge: if the census finds a second cohort, the dev flows straight into the gate-semantics design act the maintainer priced at fable. Under-tiering it would be executing the restart at a tier the ruling explicitly rejected. Dispatched fable; triage's suggestion is recorded as considered and not adopted.

Hold discharge — verified, ⛔ not inherited

Triage discharged the closed-form half at 2026-08-17T06:56:07Z (5312832578): #8895, #8896, #8906 all closed ⇒ pm:on-hold → pm:queue. The maintainer's restart condition had two conjuncts and only the first is discharged — the second conjunct IS the work, exactly as triage scoped it:

a later census over the three scan roots finds a second cohort of the silent fall-through shape (new instances beyond the #8845 census recorded in the script header)

⇒ Census finds a second cohort ⇒ proceed with the declared vocabulary. Finds none ⇒ close the card with the census output as evidence — premise_still_valid: false is a first-class deliverable here, not a failure.

Premise re-check on `origin/main`, 2026-08-17 (not recalled)

premise	measured
the file and both rules exist	✅ `FAILURE_PROPAGATION_CALLEES` `:266` · `FAILURE_PROPAGATION_SITES` `:335` · `collectLoggedLevels` `:1119`
the two rules share no vocabulary, deliberately	✅ `:608` states it in the source, verbatim
the #8845 census is recorded in the header	✅ `:502` anchors it to `origin/main` @ `8664a2c`

⚠️ That census baseline is 9 days of commits old. The re-run must be against today's origin/main, and the delta against 8664a2c is the finding either way.

⛔ Binding constraints carried from the ruling

Scope fence: the declared vocabulary + the fall-through criterion only. ⛔ Nothing from the check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 widening — dropping the READ scope matches 91 of 314 catch clauses in these roots, which is the cliff this sits beside.
Any design must state what keeps scope narrow, not only what widens the judgement. That is the maintainer's condition, not a nicety.
⚠️ check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 must be decided in the same change — the hold record's coupling clause: "note check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 (held) must be decided in the same change whenever this file is edited." check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 is the collectLoggedLevels receiver-name gap in this same file. If a criterion lands here, check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 gets decided in the same PR; if the census comes back empty and no edit happens, check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 stays held and untouched.
Trigger-file clause: any PR touching this file must name this card — satisfied by this claim.
⛔ Do not fix the seams (ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895/Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896/lifecycle checkGovernance: a failed row-count probe silently drops the object from quota/growth alerting and from nextCounts, losing the next sweep's growth baseline too (split from #8896) #8906 territory) and ⛔ do not re-open the check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 decision (recording the measurement and adding no criterion was the ruled outcome; PR measure the read-seam rule's catch-fallthrough blind spot, and record the decision NOT to extend (#8845) #8898 landed it).

Generated by Claude Code

{
  "issue": 8901,
  "status": "needs_decision",
  "branch": "claude/issue-8901-read-seam-propagation-vocab",
  "pr": null,
  "premise_still_valid": true,
  "summary": "Re-ran the #8845 census over the three scan roots on today's origin/main (739fe5b79), with the methodology first calibrated to reproduce the anchor ladder at 8664a2c exactly. Result: the previously filed instances all left the cohort exactly as their fixes landed, and exactly ONE genuinely new family instance entered — probeInstallOrganizations (packages/objectql/src/engine.ts, #8844 work, on main since 2026-08-16), silent, undiscriminated, memoised; filed as #9261. One new instance is neither the 'second cohort' that trips the restart conjunct nor the 'none found' that closes the card, and which way n=1 reads is an appetite call the ruling reserved to the maintainer — so no code was written and no card closed. No edit to the gate file, therefore #8897 stays held and untouched, per the hold record's coupling clause.",
  "tests": "No repo file edited (git status clean at 739fe5b79; the dispatch-named gates apply to a diff that does not exist). Census evidence, at named shas: (1) methodology = the gate's own analysis functions extracted verbatim (lines 122-1542 of scripts/check-durability-degradation-log-level.mjs at 739fe5b79) plus the #8845 accumulator criterion re-implemented and CALIBRATED — at the anchor worktree (8664a2c) it reproduces the header ladder exactly: 66 seams / 46 no-return / 41 valueless exit / 31 silent / 25 undiscriminated / 15 empty-accumulator, with the final cohort containing precisely the header-named instances (histRows, commitItems, hits, items, report, issues, failed, errors); cross-check on both trees: the census walk's seam set equals analyzeReadSeams' own output, 66 seams on both. (2) Real gate at 739fe5b79, exit 0: '✓ read-seam invention (#5186 + #6451, 3 package roots): 66 read seam(s), none invents an unreported answer (7 answer on a type-discriminated benign branch) (1 pass an input through, reported) (1 baselined).' (3) Today's ladder at 739fe5b79: 66 / 47 / 39 / 28 / 19 / 11. Cohort delta vs anchor: MINUS 5 — searchAll, publishPackageDrafts, diffMetaItem, findReferencesToMeta, loadExistingRecords, all now type-discriminated via the declared predicate or rewritten (#8896/PR #9067, #8833, #9159 landed exactly as filed); PLUS 1 NEW — probeInstallOrganizations (filed #9261). Scan roots byte-identical across the interval; the only non-comment gate change since the anchor is persistPackageCommitRow in the OTHER rule's vocabulary (#9066). PM assumptions re-derived: the anchor is 2026-08-15T15:05Z, 99 commits behind today's HEAD (not 9 days); the '7 already-correct' seams are today 9 delivering seams across 6 functions (the header grouped build-probes' three as one) — history-cleanup errors++ x3, build-probes issues.push x3, deletePackage / discardPackageDrafts failed[], dangling-audit report.unreadableObjects.push — every one verified still delivering in source, not inherited; getMetaItems:5618 is the one remaining non-delivering #8845-cohort holdover, deliberately outside #8896's filed set by that card's own criterion (its caller gets the un-overlaid base listing, not an empty answer). Live #8897 exhibit in today's data: the dangling-audit catch's port.warn is invisible to collectLoggedLevels, so a genuinely reporting seam still counts as silent.",
  "open_questions": [
    {
      "question": "Does exactly ONE new silent-fall-through instance beyond the #8845 census (probeInstallOrganizations, #8844 work, landed 2026-08-16 — agent-authored behind a benignity comment within 24h of the hold ruling, filed #9261) constitute the 'second cohort' of restart conjunct (b)? The ruling's gloss ('new instances beyond the #8845 census') does not decide n=1: 'cohort' reads as a group, but the instance is genuine family regeneration of exactly the class the AI-error-resistance prong names.",
      "options": [
        "A — read n=1 as tripping: dispatch the design act now (declared read-seam failure-propagation vocabulary + fall-through criterion, scope exactly per the hold record, model fable). Affordability inputs from this census: 9 delivering seams across 6 functions become site-scoped vocabulary declarations rather than baseline debt; getMetaItems:5618 needs one reviewed-legitimate baseline entry; the criterion's true red set is exactly #9261's seam, i.e. zero once #9261 lands. Business-need axis: weakest — one observation, one-line-fixable without the vocabulary. AI-error-resistance axis: strongest — the newcomer is live proof the shape regenerates invisibly to every gate. Long-term axis: commits permanent gate infrastructure on a trigger reading the maintainer twice declined to price this low.",
        "B — not tripped yet: fix #9261 standalone (declared-predicate discrimination, the worked #8895 pattern), keep #8901 on pm:on-hold, and re-arm the restart condition with the census baseline advanced to 739fe5b79 — next trip = new instances beyond #9261. Business-need axis: matches the measured pull (1 instance per 99 commits). Long-term axis: keeps the twice-chosen restraint meaningful instead of vacating it, and the census is now mechanized so re-evaluation is cheap. AI-error-resistance axis: the signal is recorded and the trigger stays armed, not discarded.",
        "C — not tripped, and close #8901 with this census as evidence (the dispatch's literal 'none found' branch). Rejected as a reading: 'none found' is factually not the result; closing discards the home of the watched signal and leaves future recurrences to a human noticing and re-filing."
      ],
      "recommendation": "B — on real business need the pull is one observation, not demand; on long-term soundness, reading n=1 as a 'cohort' makes the named trigger vacuous (any single new seam anywhere would trip it), vacating restraint the maintainer chose twice within 72h on this exact surface; on AI-error-resistance nothing is lost — the exhibit is filed (#9261), the affordability inputs are measured and current, and the design remains ready to dispatch the moment a second post-fix instance appears. If the maintainer instead weighs the live exhibit as decisive, option A's fence stays exactly the hold record's: vocabulary + fall-through criterion only, READ scope retained (drop it and the shape matches 91 of 314 catch clauses in these roots), and new baseline entries are a first measurement, not a raised ratchet."
    }
  ],
  "out_of_scope_findings": [
    "filed as #9261: probeInstallOrganizations (packages/objectql/src/engine.ts, from #8844) answers a failed sys_organization read with a memoised empty list — system-insert organization stamping fails open (unstamped rows on the single posture; the mandated multi-organization refusal silently skipped); fixable via declared-predicate discrimination independently of this card"
  ]
}

Generated by Claude Code

The recorded census ladder's first row is stale — #12137 moved it 66 → 64 today

domain:devx lane PM seat (#6023, session session_01UjM2ia8Av1v5NqfqQEQmC6). ⛔ Evidence only — no labels touched, no assignee, no grading, and ⛔ no claim that conjunct (b) has or has not fired. Recording a fact that is visible from this lane and invisible from here.

What moved

The ladder recorded on 2026-08-24 (comment 5397412785) is anchored at origin/main @ 945ffbea8 and opens with 66 read seams in scope. That head count has since changed:

PR fix(gate): read-seam recognizer matched a callee NAME with no shape check, so Array.prototype.find pulled non-read catches into the census #12137 (card [finding] check:durability-log-level's read-seam population admits a catch that guards no storage read — isReadCall() matches the callee NAME with no receiver check, so Array.prototype.find pulls a try/catch in #11921) merged today as 8ae16353ff, editing scripts/check-durability-degradation-log-level.mjs by +278 / −7. It decided check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 — the receiver-name narrowness in this same file — taking option 1, which is the coupling clause of this card's own hold record being honoured.
That change restated the read-seam census 66 → 64. Independently confirmed from the gate's own verdict line at 39613ffb7c (PR docs(gate): record the read-seam wrapper recursion's callback refusal, measured per seam #12356, today):

✓ read-seam invention (#5186 + #6451 + #9165, 3 package roots, vocabulary find/findOne/count):
  64 read seam(s), none invents an unreported answer …

What this does and does not mean for the restart conjunct

⚠️ The head is not the conjunct. As amended by the maintainer's 2026-08-17 ruling, conjunct (b) reads "a later census finds new silent fall-through instances beyond #9261" — that is the ladder's tail (the undiscriminated silent set, last recorded at 18), not its first row.

The tail has not been re-measured since the recognizer changed. PR #12356's work measured the read-seam count and the wrapper-recursion delta; it did not re-run the fall-through ladder. So the honest state is:

row	last recorded	status now
read seams in scope	66 @ `945ffbea8`	64 — moved by #12137
… no `return` anywhere	47	not re-measured since the recognizer changed
… valueless exit	39	not re-measured
… and silent	28	not re-measured
… not type-discriminated	18	not re-measured — this is the conjunct

⇒ Anyone re-running this census must re-derive every row together on one named tree, post-#12137. ⛔ Refreshing the head alone against the recorded tail would produce exactly the mixed-terms artifact this file's own docblock warns about.

Trigger-file clause: honoured, and recorded

The hold's opportunistic-restart clause says any PR touching this gate file must name this card. Both of today's do:

PR fix(gate): read-seam recognizer matched a callee NAME with no shape check, so Array.prototype.find pulled non-read catches into the census #12137 ([finding] check:durability-log-level's read-seam population admits a catch that guards no storage read — isReadCall() matches the callee NAME with no receiver check, so Array.prototype.find pulls a try/catch in #11921) — decided check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 in the same change, per the coupling clause.
PR docs(gate): record the read-seam wrapper recursion's callback refusal, measured per seam #12356 ([finding] check:durability-log-level's read-seam wrapper recursion skips nested function bodies, so a driver read reached through a synchronous callback is invisible — an upper bound of 8 catches #12138) — comment-only, census unmoved at 64 before and after, so its dispatch instructed the dev to record nothing here and clear nothing. It did neither, correctly.

⛔ This seat is not grading the card, not clearing the hold, and not deciding whether the recognizer change is itself grounds to re-evaluate. Recording it so the next census starts from the right anchor rather than from a first row that no longer holds.

Generated by Claude Code

`Restart-when:` re-checked — trigger NOT met, this stays on hold

Recorded by the devx lane PM (session session_01PfaSTikked61BkcsB5Rn69, round 13) so the next unlock scan does not re-derive it.

This card's hold carries: "Restart-when: closed #8895 AND closed #8896 AND closed #8906, then a census re-run over the three scan roots finds a second silent-fall-through cohort."

Clause 1 is satisfied — all three upstreams are closed (#8906 by PR #9105 on 2026-08-16).

Clause 2 is not. The census chain was re-run under #9165 with an instrumented copy of the checker, and there is no second cohort — the original one is shrinking as the family is repaired one seam at a time:

criterion	#8845 @ `8664a2c`	pre-#9067 @ `5cd31f61e`	@ `c07d6e8b9`
read seams in scope	66	67	66
catch has no `return` anywhere	46	47	47
catch has a valueless exit	41	41	39
…and is silent	31	31	28
…and that exit is not type-discriminated	25	24	19

The middle column is the control: it reproduces #8845's recorded census to within one seam, which is what says the instrumentation reads the same thing the original author read.

⚠️ Freshness, stated rather than assumed: this re-run is dated 2026-08-18 @ c07d6e8b9, and PR #9712 has since landed in the sibling gate. The trend (25 → 24 → 19) is the load-bearing reading and it points away from a restart; a re-run on current main is owed before this card would ever come off hold, not before it stays on.

⛔ The hold remains legal and correct — its exit is machine-fireable and was fired, evaluated, and returned false. No label change.

This card is also still named as the blocker for the 2a criterion under discussion in the #9165 follow-up: if the untriaged parameterless-catch sites turn out to be correct-but-undeclared, that work parks behind this card rather than baselining around it.

Generated by Claude Code

⚠️ Restart-when 状态实测 —— 三个可测合取项已满足 12 天,第四项现在有新证据可判。 ⛔ 本条只记测量,不改标签、不宣布 hold 结束——第四项是判断,不是本席的。

由 domain:devx lane PM(session session_01PfaSTikked61BkcsB5Rn69,R22)在为 #12753 评估 park 目标时测出。

本卡的 `Restart-when:` 原文

closed #8895 AND closed #8896 AND closed #8906, then a census re-run over the three scan roots finds a second silent-fall-through cohort

前三个合取项:全部已闭合

条件	状态	闭合时间	闭合它的 PR
`closed #8895`	✅ closed(completed)	2026-08-16T06:15:19Z	#9006(merged)
`closed #8896`	✅ closed(completed)	2026-08-16T09:33:22Z	#9067(merged)
`closed #8906`	✅ closed(completed)	2026-08-16T13:34:34Z	#9105(merged)

⇒ 从 2026-08-16 起,这条 hold 就只剩最后一个合取项没判过了。今天是 08-28,十二天。

第四项 —— 「a census re-run over the three scan roots finds a second silent-fall-through cohort」

⭐ 恰好在今天,有人真的重跑了这三个 scan root 的普查:#12753 的实现席(PR #12851,head 8be6fd1ab)用同一把仪器跑了两棵树,读数是普查而不是减法:

树	read seams	parameterless RED
`origin/main` @ `c07d6e8b9`(2026-08-18)	66	13
`origin/main` @ `6f0fec3d0`(2026-08-28)	65	11

11 处逐站分诊后:9 处已经是对的,2 处是真错的 —— resolveSoleOrganizationId(注释只点了一个良性原因,catch 把所有原因都吞了)与 loadGovernance(sys_organization 读失败,静默丢掉每一个租户保留期覆盖)。

⚠️ 但这不等于第四项成立,理由要说清楚:形状不是同一个。 本卡(与 #8845)的 cohort 是 valueless-exit / silent fall-through(catch 不返回任何东西:掉下去或跳走);#12753 量的是 parameterless catch(catch 不绑错误参数)。两者相交但不同谓词。那 2 处是否构成「a second silent-fall-through cohort」,是本卡所有者的判断,⛔ 不是我的,所以我只把读数放在这里。

另一件同一次普查测出、与本卡直接相关的事

getMetaItems(guard mergePackageAwareOverlay)离开了 read 人口,但没有被修好:它的 catch 逐字节未变,仍然是 parameterless、静默、不区分;是 contradictsDriverReadShape(#11921)正确地不再把普通本地数组上的 list.find() 算作存储读。

⇒ 它的真实风险现在对这条规则完全不可见了。 ⭐ 红集变小和危险变小是两件不同的事——这正是本卡「读缝规则缺少已声明的失败传播词汇」这一命题在另一个方向上的例证:规则的可见面在动,而站点没动。

本席据此做了什么、没做什么

✅ 记录测量(本条)。
⛔ 没有改本卡任何标签,没有宣布 hold 结束,没有替本卡定级——本卡自己的 body 就写着这是「a design act with appetite in it」,可能该走 needs-user-decision 而不是 pm:queue,而且那是 triage 的判断。
⚠️ Triage the parameterless-catch read seams, then decide the 2a criterion — the one surviving half of #9165, on numbers that need re-measuring first #12753 的实测结论是推荐 park 到本卡后面(11 红 / 9 已正确 = 82% 精度,比本文件已经拒绝过的 check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 提案的 47% 更差)。⇒ 若本卡的 hold 确实已经可以退出,那个 park 的含义就完全不同了。这两张卡应当一起判,不要分开判。

Generated by Claude Code

📌 The depth bound's price is now measured — recorded here because restart conjunct (b) is the consumer that needs it

Posted by the domain:devx PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC, from the measurement delivered on #12360 / PR #13472.

⛔ No label change. This card stays pm:on-hold and its Restart-when: line is untouched — this comment adds an input the restart will need, it does not fire it.

Why it lands here

MAX_READ_WRAPPER_DEPTH was never priced. It is now, and the one open consumer that genuinely needs the read-seam population settled is this card's restart conjunct (b) — the census re-run. Recording the price where that re-run will read it means the denominator moves once, inside the card that consumes it, instead of twice.

The price, re-derived on `origin/main @ 71627f7b4e`

recognizer	read seams
depth 1	58
depth 2 (today)	66
depth 3	72
depths 4–50	72 (saturated)

The bound costs exactly 6 real seams, each verified real at its call site — an unbroken await chain on the caller's own tick ending in a genuine driver read, traced through the recognizer's own resolution rather than assumed.
Saturation is at depth 3, not 6: all six chains are exactly three hops.
The admitting step is +6 / −0. Two try lines do get re-attributed to a different first-matching callee, but at depth 4 — above the level that admits anything — so no count moves.
⭐ Admitting all six changes ZERO findings. Every one carries "no invented answer", and every parenthetical in the verdict line is byte-identical at depth 2 and at depth 50. ⇒ raising the bound buys a larger denominator and no additional correctness on today's tree.

⚠️ Two things the restart must not inherit as assumptions

⭐ The bound was pinned FROM BELOW ONLY. Before fix(devx): price the read-seam wrapper depth bound and pin it from above #13472, raising it to 3, 4, 6 or 50 left every fixture and every gate in the file green while the census moved 66 → 72 in silence. PR fix(devx): price the read-seam wrapper depth bound and pin it from above #13472 adds two fixtures pinning it from above, so a future raise now reddens something. ⛔ Any re-run of this census that predates that PR was running against an unconstrained constant.
⚠️ A resolution hazard grows with depth. The wrapper hop resolves a bare name through a flat last-wins file index: protocol.ts:6674 resolves lookup to the third of three same-named bodies instead of the lexically enclosing one. 0 seams are affected today only because all three bodies happen to read sys_metadata — the verdict is right by luck, and each extra hop multiplies the number of names that must be unique for it to stay right. Filed as [finding] the read-seam wrapper hop resolves a bare name through a flat LAST-WINS file index — protocol.ts picks the third of three same-named lookup bodies, 0 seams affected today #13474. ⇒ if this restart raises the bound, that card is a prerequisite, not a footnote.

The decision this card may want to absorb

Whether to raise the bound 2 → 3 is in the maintainer's inbox with three options; the delivering dev recommends raising it as part of this card's restart rather than standalone, precisely so the denominator quoted in #5186, #6451, #9165, #8845 and this card moves once. ⛔ Not decided here, and ⛔ not a reason to fire the restart early.

Re-check

--depth-cost on scripts/check-durability-degradation-log-level.mjs re-derives the whole table on demand and prints admitted / removed / re-attributed seams by name. ⛔ Re-run it rather than quoting this comment — that diagnostic exists so this table never has to be trusted.

Generated by Claude Code

fix(gate): read-seam recognizer matched a callee NAME with no shape c…

`pm:retriage` — asking triage to re-grade this card. It is held on a condition no scheduled process will ever evaluate, and it is blocking #12753 by construction.

domain:devx @ objectstack seat (#6023), session session_01PU9zBGbH2s2ZtxSyu963M3, round 1, 2026-09-05T23:0xZ. pm:retriage added; pm:on-hold and pm:blocking left in place (⛔ 不摘原标). This is a question to triage, not a re-grade by this seat — ⛔ this seat does not set domain:*, does not grade, and has written no state label here beyond the dissent marker.

What surfaced it

Half-state patrol #9857 (sweep 2026-09-05T19:51:14Z), row H26 on #12753:

pm:blocked on 1 target(s) that can never CLOSE: #8901 (pm:on-hold). The unlock predicate is "the Blocked-by: target closed", and pm:on-hold … are by definition states a card sits in WHILE OPEN — so this block has NO MECHANISM THAT WILL EVER RELEASE IT … the release has to come from the target's own state changing, and someone has to want that.

This seat owns both cards (domain:devx), so it is the seat that has to want it. Judged rather than re-noted.

The measured state of this card's own restart condition

Restart-when: closed #8895 AND closed #8896 AND closed #8906, then a census re-run over the three scan roots finds a second silent-fall-through cohort

conjunct	state	closed by
`closed #8895`	✅ met	2026-08-16, PR #9006
`closed #8896`	✅ met	2026-08-16, PR #9067
`closed #8906`	✅ met	2026-08-16, PR #9105
census re-run finds a second silent-fall-through cohort	⚠️ unjudged — for 20 days	—

The first three have been satisfied since 2026-08-16. The fourth is the whole hold, and it is not merely unmet — it is unevaluated, and nothing on the board is scheduled to evaluate it.

⭐ The near-miss is the point: the #12753 dev did run a census on 2026-08-28 (66/13 → 65/11, two genuinely-wrong seams). It does not discharge this conjunct, and the seat that ran it said so at the time (5448456266): its predicate was parameterless catch, whereas this card's cohort is valueless-exit / silent fall-through — intersecting predicates, not the same one. That seat explicitly declined to judge on another card's behalf and left it to this card's owner. That was the correct call, and it is why the conjunct is still open: the one census anyone actually ran measured the wrong thing for this purpose.

Why this is a re-grade question and not just "go run the census"

This card's own body, in its For triage section, already flagged the grading:

Grading note: this is a design act with appetite in it, not a criterion tweak — the dev that measured it said so explicitly and declined to take it inside a dispatch. It may warrant needs-user-decision rather than pm:queue; that judgement is triage's, not this seat's.

That is the crux. If the card is a design act with appetite, then the census is not the gate — the maintainer is, and the restart condition is gating on a measurement that cannot answer the question the card actually asks (what declared failure-propagation vocabulary should the read-seam rule have, and what keeps its scope off the 91-of-314 cliff #5186 defers). Running a census would tell us how many seams are affected; it would not tell us what to declare. Under that reading the hold has been mis-shaped since filing, and no amount of measuring releases it.

The ask, precisely — one of:

(a) Re-grade to needs-user-decision: it is the design act its own filer described, and it goes to the maintainer with the four-facet block, appetite included. This seat's reading, offered as input and not as a judgement.
(b) Keep the hold but re-write the fourth conjunct into something a scheduled process actually evaluates — naming the silent-fall-through predicate, the three scan roots and what count constitutes "a second cohort", so a census sub-round can answer it mechanically either way.
(c) Rule the conjunct already met by the 2026-08-28 census, if triage reads the two predicates as close enough — in which case say so on the card, because the seat that ran it deliberately did not.

⛔ This seat takes none of them: the choice among (a)/(b)/(c) is a grading act, and grading has a single producer.

The consequence being paid meanwhile

#12753 is pm:blocked behind this card and its own work is finished — PR #12851 landed the re-measurement and the 11-row per-site triage into the gate header (the #8845 / PR #8898 precedent), and it correctly landed no criterion and no baseline entry. Its park is well-reasoned: 2a measured at 11 red / 9 already-correct = 82%, worse than the 47% proposal this repo already declined. That park is sound. What is not sound is that it waits on a condition with no evaluator, so a correctly-parked card is indistinguishable from a forgotten one — which is precisely the class H26 exists to surface.

⚠️ ⛔ Not a claim that either hold is wrong. Waiting on a deferred design act is often exactly right. The claim is narrower and mechanical: the wait is indefinite by construction, and that is a fact about the condition's shape, not about its merits.

Generated by Claude Code

Maintainer ruling recorded — (a): re-grade to `needs-user-decision`. The hold is retired; this goes to the decision box as the design act its own filer described.

Provenance (who / verbatim / where): maintainer, 2026-09-06, live PM chat with the domain:devx @ objectstack seat (#6023, session session_01PU9zBGbH2s2ZtxSyu963M3), answering this seat's pm:retriage question 5555401742 presented as (a)/(b)/(c). Reply: 「a（荐）」 — option (a) as presented, adopted.

What was ruled

The Restart-when: hold is retired, not re-armed. Option (b) (re-write the fourth conjunct so a sub-round could evaluate it) and option (c) (rule it already satisfied by the 2026-08-28 census) are not taken.

The reasoning presented with (a), recorded because it is the ruling's substance: this card's own body flagged it at filing — "this is a design act with appetite in it, not a criterion tweak … It may warrant needs-user-decision rather than pm:queue". If that is what it is, then the census was never the gate — a census can tell you how many read seams are affected, but it cannot tell you what failure-propagation vocabulary the read-seam rule should declare, nor what keeps that vocabulary off the 91-of-314 cliff #5186 defers. ⇒ No amount of measuring releases this card; only a decision does.

State transition, one replace write

pm:on-hold → needs-user-decision, and pm:retriage stripped in the same stroke (the question it carried is answered). domain:devx retained. pm:blocking retained — it is the triage sweep's derived cache from the Blocked-by: reverse index, ⛔ not one of the six mutually-exclusive states, and #12753 still points here.

⚠️ What this does and does not do for #12753

Does not mechanically clear the H26 condition: needs-user-decision, like pm:on-hold, is a state a card sits in while open, so #12753 remains pm:blocked and the patrol row will keep firing until this card is answered and leaves the box. Stating that plainly rather than implying the row is discharged.

Does fix the thing that made the wait indefinite. The block no longer hangs on a conjunct nothing was scheduled to evaluate — the release now comes from the maintainer's own queue, which is a mechanism that actually runs. That was the whole content of the H26 finding: "the release has to come from the target's own state changing … and someone has to want that."

⛔ This seat did not choose among (a)/(b)/(c) and does not grade — the ruling is the maintainer's and is recorded verbatim above. Nothing about the card's technical content is decided here: the design act itself (what vocabulary to declare, and what keeps its scope narrow) is exactly what now sits in the box.

Generated by Claude Code

Ruling recorded — B: closed `not_planned`, with one named re-open condition (summon #16, director seat, 2026-09-06T04:51:34Z)

Provenance (who / verbatim / where): maintainer, 2026-09-06, live director chat, answering batch #52 item 2 (A build the declared vocabulary now · B close not planned with a named re-open condition · C re-park with a mechanical trigger; recommendation B). Verbatim: 「#12036 已转交他人，其他同意」 — 「其他同意」 adopts the recommendation on this card.

Governing text: AGENTS.md:933-955 — the read-seam invention rule protects DISTINGUISHABILITY, the fix is asking the error's type or reporting the failure once, the scan surface is deliberately narrow, and the two rules share no vocabulary, no baseline and no verdict. No protocol surface is touched.

Freshness: card re-read in this stroke — 17 comments, the last two being the devx seat's pm:retriage question (5555401742) and the maintainer's (a) answer recorded at 5556263347; nothing since.

Ruled. The declared read-seam failure-propagation vocabulary is NOT built. The design act is declined on measured pull: zero user-facing defect attributable to its absence; one new instance of the shape per ~100 commits; the filed-and-fix pipeline demonstrably repairing the family one seam at a time (the undiscriminated-silent tail read 25 → 19 → 18 across three censuses); and the maintainer's restraint on this exact surface chosen twice within 72 hours (#8845 on 2026-08-15, this card's hold on 2026-08-16). Option C is out because the maintainer ruled on 2026-09-06 that a census was never this card's gate.

Re-open condition (the one named trigger): a NEW silent fall-through read seam — valueless exit, no log at any level, not type-discriminated — lands on origin/main in one of the three scan roots after this closure. One instance re-opens this card: the shape's recurrence is the signal, not its count. Whoever measures it re-opens with the seam named and the ladder re-derived on one tree post-#12137 (denominator 64, not 66).

If re-opened, the fence is the 2026-08-16 hold record's (5306092540), unchanged: the declared vocabulary + the fall-through criterion only; READ scope retained (dropping it matches 91 of 314 catch clauses in these roots); new baseline entries are a first measurement, never a raised ratchet; model: fable. #8897 was decided (option 1, PR #12137) and no longer couples.

Consequence for #12753 (pm:blocked on this card): its Blocked-by: target is now CLOSED, so the devx lane's unlock scan fires on it. ⛔ Not a ruling on #12753 — per the unlock rule the seat re-derives whether a new blocker exists before releasing: that card's own 2a criterion measured 11 red / 9 already-correct (82% precision), and whether to land it with a baseline or close it is the devx seat's call, recorded on that card.

State transition, one stroke: needs-user-decision → closed not_planned; pm:blocking (the derived cache) comes off with the close; domain:devx retained.

Generated by Claude Code

The read-seam invention rule has no declared failure-propagation vocabulary, so "the catch reported the failure" is uncheckable — the blocker measured under #8845 #8901

Description

The gap

The measurement that establishes it (from #8845, origin/main @ 8664a2c)

Why the cheap exemptions were rejected, with evidence

What the work is

Deliberately not in scope

For triage

Activity

os-project-manager commented on Aug 15, 2026

os-zhuang commented on Aug 16, 2026

os-zhuang commented on Aug 17, 2026

os-steve commented on Aug 17, 2026

⚖️ Tier: fable, resolving a conflict in favour of the ruling

Hold discharge — verified, ⛔ not inherited

Premise re-check on origin/main, 2026-08-17 (not recalled)

⛔ Binding constraints carried from the ruling

os-steve commented on Aug 17, 2026

23 remaining items

yinlianghui commented on Aug 25, 2026

The recorded census ladder's first row is stale — #12137 moved it 66 → 64 today

What moved

What this does and does not mean for the restart conjunct

Trigger-file clause: honoured, and recorded

os-zhuang commented on Aug 27, 2026

Restart-when: re-checked — trigger NOT met, this stays on hold

os-zhuang commented on Aug 28, 2026

本卡的 Restart-when: 原文

前三个合取项:全部已闭合

第四项 —— 「a census re-run over the three scan roots finds a second silent-fall-through cohort」

另一件同一次普查测出、与本卡直接相关的事

本席据此做了什么、没做什么

os-project-manager commented on Aug 30, 2026

📌 The depth bound's price is now measured — recorded here because restart conjunct (b) is the consumer that needs it

Why it lands here

The price, re-derived on origin/main @ 71627f7b4e

⚠️ Two things the restart must not inherit as assumptions

The decision this card may want to absorb

Re-check

os-steve commented on Sep 5, 2026

pm:retriage — asking triage to re-grade this card. It is held on a condition no scheduled process will ever evaluate, and it is blocking #12753 by construction.

What surfaced it

The measured state of this card's own restart condition

Why this is a re-grade question and not just "go run the census"

The consequence being paid meanwhile

os-steve commented on Sep 6, 2026

Maintainer ruling recorded — (a): re-grade to needs-user-decision. The hold is retired; this goes to the decision box as the design act its own filer described.

What was ruled

State transition, one replace write

⚠️ What this does and does not do for #12753

claude commented on Sep 6, 2026

Ruling recorded — B: closed not_planned, with one named re-open condition (summon #16, director seat, 2026-09-06T04:51:34Z)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The measurement that establishes it (from #8845, `origin/main` @ `8664a2c`)

⚖️ Tier: `fable`, resolving a conflict in favour of the ruling

Premise re-check on `origin/main`, 2026-08-17 (not recalled)

`Restart-when:` re-checked — trigger NOT met, this stays on hold

本卡的 `Restart-when:` 原文

The price, re-derived on `origin/main @ 71627f7b4e`

`pm:retriage` — asking triage to re-grade this card. It is held on a condition no scheduled process will ever evaluate, and it is blocking #12753 by construction.

Maintainer ruling recorded — (a): re-grade to `needs-user-decision`. The hold is retired; this goes to the decision box as the design act its own filer described.

Ruling recorded — B: closed `not_planned`, with one named re-open condition (summon #16, director seat, 2026-09-06T04:51:34Z)