spec: replace the slice(0, 6) always-on pin with the derived rule, and retire the comment that invites the next author to grow the slate after the sixth entry

Carved out of #10250, whose fix (PR #11044) could not land here: packages/spec/src/kernel/platform-capabilities.test.ts is spec surface, and the services lane has zero packages/spec ownership. Same shape as #10999.

Filed unassigned and ungraded — domain:* and type are triage's to mint. The services seat carved it because it hit the boundary; it does not claim it.

What is there today

packages/spec/src/kernel/platform-capabilities.test.ts:140:

expect(PLATFORM_ALWAYS_ON_CAPABILITIES.slice(0, 6)).toEqual([ … ]);

A literal prefix assertion, with a comment telling the next author to "grow the slate AFTER these six."

Why the comment is the part that matters

That instruction is what produced the defect #10250 fixes. sms sits at index 6 — exactly one past the pinned prefix — and it reads settings. It was added after the six, exactly as the comment says to, and landed outside the thing that keeps the ordering true. Nothing objected.

⛔ So this is not "bump the 6 to a 7". A literal boundary re-run is the same bug moved one position, and the comment would still be inviting the eighth entry to repeat it.

The rule to state instead

PR #11044 derives the boundary rather than counting it: every always-on entry that is not one of the services others bind into at kernel:ready must be mounted after all of them. That covers sms, sharing, messaging, analytics and anything added tomorrow, without a number to keep in sync.

The derived pin already ships in @objectstack/cli (that was the only home available to the services lane). It is strictly stronger than the spec assertion — it reddens on everything the literal one does, plus everything it missed.

The work

Replace the literal slice(0, 6) assertion with the same derivation.
Retire the "grow the slate AFTER these six" comment and state the rule in its place.

⚠️ The spec assertion passes today and is still true — this is not a red gate and there is no urgency beyond the comment continuing to give the wrong instruction. Nothing is blocked on it.

Two homes for one invariant, deliberately, until this lands

Once this lands, decide whether the @objectstack/cli pin stays as defence-in-depth or is removed as a duplicate. That is a judgement for whoever takes this; PR #11044 has no opinion, and it declared the split rather than leaving it to be discovered.

Refs

#10250 (the defect and the ruling: A + C + the pin expansion) · PR #11044 (the derived pin, in @objectstack/cli) · #10999 (the previous spec slice carved out of this lane, same reason) · #11045 (adjacent: nothing requires the settings ordering declaration — check:init-service-contract walks init() only)

Triage: pm:queue, domain:spec, type Task. Test-only pin replacement inside packages/spec (literal slice(0, 6) → the derived rule PR #11044 already ships in @objectstack/cli), plus retiring the "grow the slate AFTER these six" comment. No contract acceptance change ⇒ Clause-② expected no. The "two homes" question (keep the cli pin as defence-in-depth vs remove) is the implementer's call to state in the PR body — either is acceptable, silence is not.

Generated by Claude Code

Claim: PM loop round R2 wave 2
Session: session_01T9cDbY2NBiVJWYx3BpWfH2
Branch: claude/issue-11046-derived-always-on-pin
Worktree: objectstack-issue-11046
Domain: domain:spec
File surface: packages/spec/src/kernel/platform-capabilities.test.ts only (replace the literal slice(0, 6) pin with the derived rule; retire the "grow the slate AFTER these six" comment) + changeset/skip-changeset per gate (stop on breach; explain in the report)
Container & model: S (test-only, the derivation template already ships in @objectstack/cli via PR #11044), mode:subagent, model: opus — dispatch-gates --tier: no path-derived mandate; opus because restating the boundary rule in the spec test is a semantic derivation, not a transcription
Clause-②: no
Serial constraints cleared: premise re-verified on origin/main — literal pin at platform-capabilities.test.ts:140, the inviting comment at :137 (test name). PM ruling within seat discretion: the @objectstack/cli derived pin STAYS as defence-in-depth — do not touch packages/cli (removing the duplicate, if ever, is a cli-lane card). No in-flight claim declares this file; disjoint from the wave-1 in-flight #9689 (field.zod.ts / engine.ts / migrations).

Generated by Claude Code

test(spec): derive the always-on mount boundary instead of pinning sl…

{
  "issue": 11046,
  "status": "done",
  "branch": "claude/issue-11046-derived-always-on-pin",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/11416",
  "premise_still_valid": true,
  "summary": "Both moves landed. The literal `slice(0, 6)` prefix assertion is replaced by the derived rule — every always-on entry that is not a bind target (`queue`/`job`/`cache`/`settings`, the services others bind into at `kernel:ready`) is mounted after all of them — stated as one predicate shared by the pin and its positive control, plus a floor case asserting bind-target membership so the rule cannot constrain nothing. The inviting test name and comment are retired. TWO DEVIATIONS TO RATIFY. (1) SCOPE: the premise was correct but INCOMPLETE — the same inviting instruction has a twin in the SOURCE file at `platform-capabilities.ts:204` (`// The first six are the pinned foundational prefix — grow the slate AFTER them.`), directly above the array an author edits, i.e. the load-bearing copy of exactly what this card's title targets. I retired it under the bounded in-place exemption (same defect class; correct form pinned by PR #11044; no other claim holds the file — verified, no open issue or PR touches it; same gate family, no new verification surface) rather than leave the card's actual target in place at the spot most likely to be read. The edit is comment-only and proved so mechanically: the slate's token sequence is byte-identical before and after. One line of prose, trivially revertible — flagged rather than shipped quietly. `packages/cli` was NOT touched, per the ruling. (2) STRICTNESS: the dispatch's 'strictly stronger, reddens on everything the literal one does' holds on the invariant that matters but is NOT a naive superset, and I will not paper over it — the derived form deliberately stops asserting peer order among the bind targets themselves and between `email`/`storage`, neither of which is a `kernel:ready` binding constraint (nothing binds `queue` into `job`), so pinning them was the same literalism this card retires. Reader membership on the slate is no longer asserted here and is not lost: `serve-settings-ordering.pin.test.ts` case 7 asserts it from the real plugin classes. On the 'two homes' question: KEEP the `@objectstack/cli` pin, and not merely as tolerated duplication — the two derivations are complementary and neither subsumes the other. `packages/spec` sits below every plugin package, so this file cannot import plugin classes and therefore pins slate ORDER only; it cannot verify that `BIND_TARGETS` still names the right services. The CLI pin is what keeps that membership honest (real plugin classes, ADR-0116/ADR-0049 edge + its ablation). That divergence is now written into the spec file's docblock rather than left to be rediscovered: a future service others start binding into at `kernel:ready` must be added to `BIND_TARGETS` by hand, and nothing in `packages/spec` will notice if it is not. This matches the PM ruling, reached independently and for a stronger reason than defence-in-depth.",
  "tests": "All heavy runs via `scripts/pm/os-verify-lock.sh`; verdicts read from each gate's own printed line, exit codes captured BEFORE any pipe (`cmd > log 2>&1; EXIT=$?`), never through `| tail`. Union re-run on final commit `61be8f8dfd` (= branch head; nothing pushed after). SUITE: `pnpm --filter @objectstack/spec test` → `Test Files 419 passed (419)`, `Tests 11138 passed (11138)`, lock `VERDICT command-exit 0`. TYPECHECK: `pnpm --filter @objectstack/spec typecheck` → `VERDICT command-exit 0`; `tsc --noEmit` + `check:scripts-typecheck` + `check:test-typecheck` (`OK — @objectstack/spec's test layer compiles under packages/spec/tsconfig.test.json`). GATES (all EXIT=0, derived from the ACTUAL diff via `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack`, no path arguments, not from a recalled list; header confirmed the answer came from objectstack-ai/objectstack at 61be8f8dfd): check:nul-bytes; check:engine-double-contract (`368 (file, verb) row(s) held by the RETAINED ledger`); check:where-matcher (`0 silently-wrong and 0 unjudged matcher(s) in 0 grandfathered file(s); none new`); check:cross-package-test-inputs (`OK: 14 package(s) read outside themselves, all declared`); check:spec-parsed-alias; check:test-source-alias; check:query-options-erasure; check:empty-state; check:liveness; check:strictness-ledger; check:variant-docs. REVERSE VERIFICATION (strictness proof, run on the COMMITTED fix so restore had a recovery point; scratch only, nothing committed): the separating mutation models a NEW bind target arriving — `realtime` joins both the slate and `BIND_TARGETS`, the class the literal pin structurally could not see since it constrained indices 0-5 only. Mutation confirmed ON DISK by marker count, not by the editor's exit code: `OS-ABLATION-11046` counted `src:0 tst:0` before and `src:1 tst:1` after (an earlier attempt used an ambiguous `^  'realtime',` anchor that already matched a line in the token vocabulary — replaced with a unique injected marker). NO REBUILD LIMB IS NEEDED OR CLAIMED, and this is a property of the resolution path, not of the suite's name: the test imports `./platform-capabilities` RELATIVELY, so vitest transforms the source directly and no `dist/` sits between mutation and assertion (contrast the CLI pin, which reads built plugin classes and does need one). Result — OLD pin on the mutated slate: `OLD PIN VERDICT: PASSES — blind to this` (`slice(0,6)` unchanged). NEW pin: `MUTATED_VITEST_EXIT=1`, `Tests 1 failed | 21 passed (22)`, the single failure being `× mounts every other entry after ALL bind targets — derived, so tomorrow's entry is covered on arrival` — the predicted direction, exactly one case, no collateral reds. RESTORE limb ran and is reported (not skipped): markers back to `src:0 tst:0`, `git status` clean against the commit, `RESTORED_VITEST_EXIT=0`, `Tests 22 passed (22)`. The mutation script carries `trap '<git checkout>' EXIT INT TERM`, so a foreground-cap SIGTERM mid-mutation could not have left the tree mutated. SOURCE-EDIT SAFETY: slate token sequence proved unchanged by parsing the array before and after — `[\"queue\",\"job\",\"cache\",\"settings\",\"email\",\"storage\",\"sms\",\"sharing\",\"messaging\",\"analytics\"]` both sides. NARROWED AND DECLARED: `check:type-check-debt --re-measure` and `check:type-check-coverage` left to CI — both are moved by a NEW test file and this diff adds none (it edits a file already inside `packages/spec/tsconfig.test.json`, whose test layer compiles clean above), and re-measuring needs the whole workspace closure built. Repo-wide `pnpm lint` also left to CI, which runs the farm once regardless. CHANGESET: `skip-changeset`, applied to PR #11416 via the additive POST endpoint (accepted, no fallback needed) — the diff publishes nothing (one test file, one comment, slate tokens proved unchanged). Label read-back recorded below.",
  "open_questions": [
    {
      "question": "Ratify or revert the one declared scope expansion: retiring the twin inviting comment in the SOURCE file (`packages/spec/src/kernel/platform-capabilities.ts:204`), which the card's premise did not name but whose text is verbatim what the card's title targets.",
      "options": [
        "A — ratify: keep it. Leaving `// The first six are the pinned foundational prefix — grow the slate AFTER them.` directly above the array an author edits would leave the card's actual target in place at the one spot most likely to be read, and the test-side retirement would be cosmetic.",
        "B — revert that one line and file it separately. Restores the letter of the declared file surface; costs a second card for one comment, and leaves the wrong instruction live in the meantime."
      ],
      "recommendation": "A. All four bounded-in-place conditions hold and were checked, not assumed (same defect class; correct form pinned by PR #11044; no competing claim — no open issue or PR touches the file; same gate family, no new verification surface). The change is comment-only and proved so mechanically, so reverting it is one line if you disagree."
    }
  ],
  "out_of_scope_findings": [
    "filed as #11415: `packages/cli/test/serve-defaults.test.ts:4-14` carries a THIRD literal `slice(0, 6)` pin, on `Serve.ALWAYS_ON_CAPABILITIES` (a re-export of this same slate), under a comment stating the retired instruction more explicitly than either comment this PR touched ('the list may grow beyond them ... so we pin the prefix rather than the whole array'). Fenced off by this card's `do not touch packages/cli` ruling, so recorded and left alone. Same issue also records that `packages/services/service-sms/src/sms-plugin.ts:110` describes `sms` as 'one past the pinned `slice(0, 6)`' in the present tense, which this PR makes stale. Filed unassigned and ungraded; searched first (no duplicate issue or PR)."
  ]
}

Generated by Claude Code

ACCEPT — reviewer of record: spec seat, session_01T9cDbY2NBiVJWYx3BpWfH2. PR: #11416 (draft, Fixes #11046 first line, base main, 2 files, +99/−8 — full diff read).

Deviation ratified: A (the open question). The source-file twin comment at platform-capabilities.ts:204 was the load-bearing copy of exactly what this card's title targets; retiring only the test-side copy would have been cosmetic. All four bounded-in-place conditions were checked with instruments (no competing claim, comment-only, slate token sequence proved byte-identical, same gate family) — ratified as in-scope, not scope creep.

Contract review (clause-② path limb) — PASS, one line: the diff is one test file plus source comments; the slate's token sequence is proved unchanged, so no contract acceptance behaviour moves; content limb no confirmed from the diff. Fuse reading standing this shift (last_served_model = claude-fable-5 = CONTRACT_REVIEW_TIER). needs:contract-review cleared on both carriers in this stroke.

Spot readings (mine): the derived rule lives in ONE shared predicate with a floor case (bind-target membership) and a non-vacuity guard on the tail — the pin cannot pass over nothing; the reverse verification is the strongest of this wave (separating mutation = new-bind-target class, old pin measured blind, new pin reds exactly the predicted case, restore limb evidenced with marker counts and a signal trap); the declared non-superset (peer order among bind targets / email-storage) is correct to drop — neither was a kernel:ready constraint, and reader membership is held by the CLI pin's case 7. The "two homes" answer (keep the CLI pin — complementary, not duplicate: spec pins ORDER, CLI pins MEMBERSHIP) matches the dispatch ruling with a stronger reason, and the divergence is now documented in the file's docblock. skip-changeset justified (publishes nothing). Out-of-scope finding #11415 verified filed (third literal slice pin in packages/cli + the stale sms-plugin.ts present-tense comment — correctly fenced by the do-not-touch-cli ruling; cli lane's to grade).

Lands via the normal queue path: flip ready + enqueue once every check on the head is green.

Generated by Claude Code

Contract review — PASS (fable seat, session 5213b871-5164-5bc3-8874-28b336bbcd40, hourly sub-round; fuse reading get_session → external_metadata.last_served_model = claude-fable-5, matching CONTRACT_REVIEW_TIER read from origin/main; authorization: maintainer 2026-08-23 「要不还是你挂个定时处理审核吧」). Independence: dispatched by the spec seat — independent review.

Reviewed PR #11416 @ 61be8f8dfd against the actual diff.

Path limb hit, content limb clean: platform-capabilities.ts changes are COMMENT-ONLY — the PLATFORM_ALWAYS_ON_CAPABILITIES array's values and order are byte-identical (regrouped across lines under rule-stating comments; the defective "grow after the first six" instruction retired). Zero accept/reject movement in spec source.
The pin got strictly stronger where it matters, and the claim is measured: the separating mutation (a new bind target realtime joining slate + BIND_TARGETS) is exactly the class the literal slice(0, 6) was structurally blind to — old pin PASSES on the mutated slate, derived rule REDS 1/22; mutation proven on disk (0→1/1 marker counts), trap-guarded restore proven (→0/0), 22/22 green restored. No rebuild limb needed and none claimed (relative import — correctly distinguished from the dist-reading sibling pin).
Anti-vacuity floor: bind-target membership asserted separately, so the ordering rule cannot constrain less as targets vanish; the falsifiability case names a hostile slate.
The honest non-superset section is right: peer order among bind targets and between email/storage were incidental literalism, never mount-order constraints (nothing binds queue into job at kernel:ready) — dropping them is the same literalism-retirement the card orders, and reader membership stays asserted.
One predicate (orderingViolations) shared by pin and positive control — no drift seam. Clause-② discipline kept (draft; label rode the PR carrier).

Verdict: PASS. Clearing needs:contract-review on PR #11416 (the card side reads clear already — the label rode the PR). Enqueue/flip belongs to the dispatching seat's landing window.

Generated by Claude Code

test(cli): derive the always-on slate boundary instead of pinning sli…

docs(service-sms): name the derived always-on rule that replaced slic…

Navigation Menu

Repository navigation

spec: replace the `slice(0, 6)` always-on pin with the derived rule, and retire the comment that invites the next author to grow the slate after the sixth entry #11046

What is there today

Why the comment is the part that matters

The rule to state instead

The work

Two homes for one invariant, deliberately, until this lands

Refs

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec: replace the slice(0, 6) always-on pin with the derived rule, and retire the comment that invites the next author to grow the slate after the sixth entry #11046

Description

What is there today

Why the comment is the part that matters

The rule to state instead

The work

Two homes for one invariant, deliberately, until this lands

Refs

Activity

os-zhuang commented on Aug 23, 2026

os-steve commented on Aug 23, 2026

claude commented on Aug 23, 2026

os-steve commented on Aug 23, 2026

claude commented on Aug 23, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

spec: replace the `slice(0, 6)` always-on pin with the derived rule, and retire the comment that invites the next author to grow the slate after the sixth entry #11046