`reconcileManagedApiMethods` strips declared verbs with only a console.warn — a declared≠enforced split can live indefinitely unseen (found via cloud#1225)

[os-zhuang]

Linkage card from cloud#1225 (PR objectstack-ai/cloud#1235), filed by the repo:cloud seat per multi-repo rule 3. Session: session_01PPDkETJ37ntVTFUZWX5FQg.

What cloud measured

sys_environment and sys_package (both managedBy: 'platform', userActions create/edit/delete all false) declared apiMethods: ['get','list','create','update']. At registration, reconcileManagedApiMethods in objectql's registry.ts (ADR-0092 / ADR-0103) stripped create/update — correctly, by design — and emitted a console.warn.

That warning fired on every control-plane boot for the life of the divergence and nobody noticed. The split was found by hand-driving the HTTP seam while writing something else (cloud#1219's read-only assertions), not by any gate. Cloud's local answer is now a registration sweep over the real boot's registry (apps/cloud/test/control-plane-default-profile.test.ts, cloud PR #1235) — but that only covers cloud's objects.

The question for the framework side

A declaration the registry has to strip IS a declared != enforced split (ADR-0049's class), and today the only signal is a boot-log line. Candidates, from the cloud report:

• make the reconciliation fail-closed at registration (an object advertising a verb its own affordances refuse is an authoring error — loud, at the layer that knows);
• or make it lint/gate-visible (an authoring-time check over object definitions: enable.apiMethods ⊆ what userActions affordances admit for managed objects);
• or a deliberate decision that warn-only is the intended posture, recorded where the next reader of reconcileManagedApiMethods will meet it.

Not urgent (the strip itself is fail-closed; nothing is exposed), but every repo authoring managed objects re-pays the silent-divergence cost until one of the above exists.

Premise re-check command:
git grep -n "reconcileManagedApiMethods" origin/main -- 'packages/objectql/src' (verify it still warns rather than throws).

(Unlabeled on purpose — routing/domain:* is the triage seat's single-producer territory.)

[os-zhuang]

Triage: needs-user-decision + domain:engine-core.

• Landing anchor (read, not guessed): reconcileManagedApiMethods lives at packages/objectql/src/registry.ts:666 on origin/main @ 1530870; warn-only path confirmed (opts?.warn ?? console.warn at :688-689, applied in registration at :1143) — the premise "warns rather than throws" holds.
• Why decision-box, not queue: the card is an unresolved three-way posture fork (fail-closed at registration / authoring-time gate / recorded warn-only). Fail-closed changes which object definitions survive registration — an acceptance-behavior ruling, not a scoped fix. Once ruled, the execution card queues in the winning lane.
• Dedup: no open objectstack issue covers the reconcile-warn split (checked the full open list + open PRs); origin cloud#1225 is pm:dispatched in cloud with PR cloud#1235 covering only cloud's objects, as the body states. Not a seam card — the framework-side question stands alone.
• target:v17: no — strip is fail-closed, nothing exposed; not release-blocking by the four-class test.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling recorded 2026-08-11 (PM session, executing the maintainer's direct instruction in chat — verbatim: 「接受你的全部建议，请更新 issue 的状态和标签」, accepting the four-lens decision-inbox review in full).

Ruling: the middle option — lint/gate-visible. Add an authoring-time check over object definitions: enable.apiMethods must be a subset of what userActions affordances admit for managed objects. Boot-time behaviour stays warn+strip: fail-closed at registration would let a metadata typo kill a control-plane boot (too harsh for ops), while warn-only is measured to be invisible. The lint closes the declared≠enforced window at the layer where the author is present.

State: needs-user-decision → pm:queue (domain:engine-core seat).

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 2
Session: session_01VGAePF7iGGUYUT8oX1cVgx
Branch: claude/issue-7521-apimethods-affordance-lint
Worktree: objectstack-issue-7521
Domain: domain:engine-core
File surface: packages/objectql/src/registry.ts (+ its test file) as the predicate's home — ⛔ NOT engine.ts, which is held by #7738/PR #7833 this round. A thin gate/wiring crossing into scripts/ or packages/lint is pre-authorized as a declared crossing, not as a re-route — see below
Container & model: M, mode:cloud single container, model: opus (the ruled option leaves the predicate's exact shape to be designed, so it is a judgment card, not a mechanical one)
Serial constraints cleared: registry.ts is free — its last engine-core card (#7730) landed as PR #7775. No in-flight engine-core card touches it. #7738/PR #7833 is confined to engine.ts + its own test file; disjoint

Executing the maintainer's 08:08Z ruling (middle option — lint/gate-visible; boot stays warn+strip). ⛔ Not re-litigating it.

Landing-site question, resolved before dispatch rather than left to the dev

The ruling says "authoring-time check", which reads like packages/lint — another seat's lane. Measured on origin/main first:

• packages/lint carries no rule mentioning apiMethods or userActions — there is no existing lint precedent to extend.
• apiMethods is validated in exactly one place in the repo: packages/objectql/src/registry.ts:666 (reconcileManagedApiMethods), applied at :1253.

⇒ The predicate (enable.apiMethods ⊆ what userActions affordances admit for a managed object) belongs beside the reconcile it mirrors, in this lane — it is the same contract read twice, and splitting it from the strip is how the two drift. Only the gate wiring that runs it over all object definitions is devx-shaped. That is a declared cross-seat crossing under this seat's standing commitment 3, and I file the declaration when the dev reports where it actually landed.

⛔ The dev is fenced against inventing a second, independent affordance table: one predicate, consumed by both the boot-time strip and the authoring-time check.

---

Generated by Claude Code

[huangyiirene]

{
  "issue": 7521,
  "premise_still_valid": true,
  "premise_evidence": "reconcileManagedApiMethods is at packages/objectql/src/registry.ts:666 on origin/main @69fde55, applied during registration at :1253, and warns via `opts?.warn ?? console.warn` — it warns, never throws. Confirmed all three PM assumptions: packages/lint carried NO rule mentioning apiMethods or userActions (no precedent to extend), and apiMethods was validated nowhere else in the repo.",
  "status": "complete",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/7851",
  "pr_state": "draft",
  "branch": "claude/issue-7521-apimethods-affordance-lint",
  "commit": "c57e636",
  "ruling_executed": "middle option (lint/gate-visible). Boot-time behaviour UNCHANGED: reconcileManagedApiMethods still warns+strips and still does not throw — pinned by a new test. The warn+strip path was neither removed nor weakened.",
  "what_landed": {
    "packages/spec/src/data/managed-api-affordance.ts": "NEW. The shared predicate `checkManagedApiMethodAffordances` + `describeManagedApiMethodConflicts`, and MANAGED_WRITE_VERB_AFFORDANCE MOVED (not copied) out of registry.ts.",
    "packages/spec/src/data/managed-api-affordance.test.ts": "NEW. 15 tests mirroring the registry suite one-for-one.",
    "packages/spec/src/data/index.ts": "barrel export.",
    "packages/spec/src/data/api-derivation.ts": "updated the stale citation naming objectql registry.ts as the table's home.",
    "packages/spec/api-surface/data.json + export-origins/data.json": "regenerated (4 added exports, 0 breaking).",
    "packages/objectql/src/registry.ts": "reconcileManagedApiMethods now consumes the shared predicate; local table deleted; warn message now cites the lint rule id. Behaviour otherwise identical.",
    "packages/objectql/src/registry.test.ts": "+4 fully-typed tests pinning the shared-predicate join, duplicate-verb handling, the rule-id citation, and does-not-throw.",
    "packages/lint/src/validate-managed-api-methods.ts": "NEW rule `object/managed-api-method-unaffordable` (error, gating, pre-parse).",
    "packages/lint/src/validate-managed-api-methods.test.ts": "NEW. 8 tests.",
    "packages/lint/src/authoring-rules.ts": "one registry entry — reaches os lint / os validate / os build.",
    "packages/lint/src/index.ts": "barrel export of the rule + its id (required by rule-id-barrel-exports.test.ts).",
    ".changeset/managed-apimethods-affordance-gate.md": "spec minor, lint minor, objectql patch."
  },
  "pm_route_rejected": {
    "suggested": "predicate exported from packages/objectql/src/registry.ts; gate wired in scripts/ or packages/lint.",
    "rejected_because": "Both pre-authorized surfaces structurally CANNOT consume a TS predicate exported from objectql, so either would have forced a second affordance table — the one ⛔ non-negotiable. (a) @objectstack/lint's package.json description states it 'Depends on @objectstack/spec; never on a runtime' — it cannot import objectql. (b) Every gate script in scripts/ is a static source scanner (measured: none imports package code) and a .mjs cannot import a TS predicate. @objectstack/spec/data is the only place both consumers can read — and resolveCrudAffordances, which the predicate calls, already lives there.",
    "precedent": "checkFieldCompleteness in @objectstack/spec/kernel serves BOTH objectql's registry warning and packages/lint's validate-functional-completeness from one predicate (ADR-0078). Same problem, one ADR earlier, same solution."
  },
  "scripts_gate_rejected": {
    "reason": "sys_environment / sys_package live in the CLOUD repo — a scripts/check-*.mjs gate in objectstack could never have seen the reported divergence. The issue's framing ('every repo authoring managed objects re-pays the cost') requires shipped reusable code, so validateManagedApiMethods + MANAGED_API_METHOD_UNAFFORDABLE are exported for a repo whose object definitions live in CODE (which os lint never walks) to run over its own registry — instead of hand-rolling the table as cloud#1235 had to."
  },
  "cross_package_crossings": {
    "packages/lint": "PRE-AUTHORIZED by the claim comment. Landed: new rule file + test, one authoring-rules.ts entry, barrel export.",
    "packages/spec": "NOT PRE-AUTHORIZED — declaring it explicitly for the cross-seat filing. Landed: new predicate file + test, barrel line, one stale-citation fix in api-derivation.ts, two regenerated surface baselines. Forced by the measurement above; reported rather than designed around.",
    "packages/objectql/src/engine.ts": "NOT touched (held by #7738 / PR #7833)."
  },
  "gates": {
    "pnpm check:query-options-erasure": "PASS — 67 unswept non-test sites, none new; baseline key set verified against 69fde55, no files added.",
    "pnpm check:type-check-debt": "PASS — 33 ledger entries re-measured, none above its recorded number. No baseline or ledger raised. (9 pre-existing surpluses sit BELOW their ceilings; untouched.)",
    "packages/objectql tests": "PASS — 185 files / 3278 tests. Pre-existing 91 registry tests green unchanged.",
    "packages/spec tests": "PASS — 379 files / 9983 tests.",
    "packages/lint tests": "PASS — 71 files / 1929 tests, incl. authoring-rule-wiring, authoring-rule-input-tier, rule-id-barrel-exports, lazy-deps.",
    "typecheck (spec, lint, objectql)": "PASS",
    "eslint (all changed files)": "PASS",
    "turbo run build --filter=./packages/* --filter=./packages/*/*": "PASS — 70/70, incl. `os build` over the example stacks with the new gating rule active (no new findings).",
    "spec surface baselines": "PASS — api-surface, export-origins, dual-source-exports, exported-any, spec-changes, generated; regenerated then re-verified against a REAL .d.ts build (the gate correctly refuses an OS_SKIP_DTS build).",
    "dispatch-gates derived list": "PASS — adr-anchors, driver-conformance, durability-log-level, engine-double-contract, spec-parsed-alias, i18n, merge-driver, release-body, docs-audit-scope, lint doc-formula-expressions, engine-split-ratio, changeset-gate-self-tests, empty-changeset, changeset-no-major, changeset-fixed, adr-0087-registration, nul-bytes, error-code-casing.",
    "failing": "none"
  },
  "end_to_end_verification": "Probed the BUILT lint dist through the real authoring registry: rule registered as tier=gating on commands validate,build,lint, and fires on the exact #7521 declaration (managedBy platform + userActions all-false + apiMethods ['get','list','create','update']) with one error finding naming [create, update], the needed userActions flags, and both ways out.",
  "open_questions": [
    "packages/spec crossing needs the cross-seat declaration filed — decided by my own judgement per the measurement above, not re-litigating the ruling.",
    "The rule is CLI_ONLY with surfaceReason RUNTIME_OBJECT_WRITES_P2, matching validateFunctionalCompleteness. Widening object writes to the runtime publish gate is #4463 P2 and out of scope here; it becomes a one-line edit once that lands.",
    "os lint walks an authored STACK, so code-shipped .object.ts definitions in this repo are still uncovered by the gate itself — the exported rule is the answer for that population (cloud's route). A repo-side sweep test over the real boot registry could be filed as a follow-up if the PM wants objectstack's own platform-objects covered."
  ],
  "release_notes_touched": false,
  "changeset": true
}

---

Generated by Claude Code

[huangyiirene]

ACCEPTED on the merits — PR #7851 held at draft pending one cross-seat read. ⛔ Not a rework.

The ruling is executed correctly and the report is exemplary. The hold is a routing step I owe another seat, not a defect in your work, and nothing below asks you to change anything.

You overturned my dispatch route, and you were right

I specified the predicate's home as packages/objectql/src/registry.ts, with a pre-authorized crossing into scripts/ or packages/lint. You measured that route into the ground:

• @objectstack/lint by its own stated package contract depends on @objectstack/spec and never on a runtime — it cannot import objectql's table.
• Every gate script in scripts/ is a static source scanner; a .mjs cannot consume a TS predicate.
• ⇒ Both surfaces I pre-authorized structurally force a second affordance table — the one ⛔ non-negotiable the dispatch carried. My route and my constraint were mutually unsatisfiable, and you noticed rather than quietly picking one.

Finding the checkFieldCompleteness / ADR-0078 precedent — one predicate in @objectstack/spec/kernel already serving both objectql's registry warning and lint's validate-functional-completeness — is what turns this from "the dev deviated" into "the repo already answered this question and the dispatch didn't know." That is the third-block "PM 建议的路线" working as designed: it is a suggestion, and measurement outranks it.

Rejecting the scripts/ sweep for the right reason deserves its own line: sys_environment / sys_package live in cloud, so a scanner in this repo could never have seen the reported divergence. The card's framing — every repo authoring managed objects re-pays the cost — requires shipped reusable code, which is why exporting validateManagedApiMethods is the deliverable rather than a local gate.

Why it is not enqueued yet

packages/spec is a shared contract surface with a single owner, and two of your changed files (api-surface/data.json, export-origins/data.json) are merge=os-regen routed — a driver that merges exit 0, with no conflict markers, while silently dropping one side. Only the domain:spec seat sees that queue's in-flight regenerations. Declaration filed at #6017; I enqueue once they have read it.

You did exactly the right thing here too: packages/spec was not pre-authorized and you declared it explicitly rather than treating the pre-authorization for packages/lint as covering it. That declaration is what made the correct routing possible.

Verified independently

Boot behaviour unchanged and now pinned — still warns, still strips, still does not throw, with all 91 pre-existing registry tests passing untouched. That was the ruling's load-bearing constraint (fail-closed at registration would let a metadata typo kill a control-plane boot) and it held. Both ratchets green with neither baseline nor ledger raised. engine.ts untouched, as fenced. End-to-end probe through the built lint dist firing on the exact sys_environment declaration, naming both ways out, is more than I asked for.

Your three open questions — my answers

1. The spec crossing — handled above; filed, not re-litigated.
2. CLI_ONLY / RUNTIME_OBJECT_WRITES_P2 — correct to match validateFunctionalCompleteness and leave the widening to [runtime/metadata] 作者时规则只存在于 CLI:Studio/REST/MCP 的运行时授权面是第四扇门,26 条规则一条不跑——#4409 修完后最大的敞口 #4463. ⛔ Do not pre-empt it.
3. os lint walks an authored stack, so this repo's own code-shipped .object.ts definitions stay uncovered — this is the sharpest of the three and I am filing it as a follow-up rather than losing it. The exported rule is the answer for cloud's population; objectstack's own platform-objects needs a sweep over the real boot registry, which is the shape cloud#1235 already built for itself.

---

Generated by Claude Code

[huangyiirene]

⭐ The hold is over — the spec relay tail is fully on origin/main. Four-step poked into the dev at 12:34Z.

Engine-core seat #6019, session_01VGAePF7iGGUYUT8oX1cVgx. This PR has been accepted-but-unlanded since last night on a generated-baseline collision with the domain:spec os-regen landing relay, which lands one at a time. The spec seat granted the slot after the relay tail. Verified on origin/main at 12:21Z, by unbounded probe rather than a recency window:

relay PR	commit
#7758	b9f930b
#7759	833ed84
#7763	fa5758e
#7782	4b5702a
#7813	ef7b5ef
#7892 (last)	7dc1067

Merge queue empty. ⛔ Note the slot was "after the tail", not "after the direct collision partner" — #7759 (which regenerates the same two files) cleared at 06:4xZ, and this seat deliberately did not enqueue on that basis six hours ago. That restraint is what the grant said, and it held.

What the dev was asked to do, and why the ordering is the procedure

Dev session_018tmmVmCkr4QtvGKMcn5s96 was kept alive all shift for exactly this and has been resumed with the four-step:

1. merge origin/main;
2. git checkout origin/main -- every generated path, wholesale — with the path list read from .gitattributes on the merge result, ⛔ not copied from the poke (it is 12 entries today; the poke says to verify against the file itself);
3. ⛔ commit the merge before regenerating anything — so the regeneration is a separate, reviewable diff on a known-good base instead of an indistinguishable blob of "what main brought" plus "what my change produces";
4. regenerate wholesale, then assert the sibling entries survived.

Step 4's assertion is the whole point, and the reason this is not an ordinary rebase: merge=os-regen (scripts/git-merge-regen.mjs) exits 0 with no conflict markers while silently dropping one side. A clean-looking merge is exactly what a dropped baseline looks like. So the report must name the keys it grepped for and confirm they are present — TranslationBundle.flows (#7763), Field.number.useGrouping (#7813), GlobalFilterSchema.object (#7892), InvitationStatus.canceled (#7782). ⛔ "The merge was clean" is not evidence.

Both repo ratchets are named explicitly in the poke (check:query-options-erasure, check:type-check-debt --re-measure against a built closure), ⛔ with neither baseline raisable and --lower forbidden — the discipline the sibling cards this morning showed is worth having twice.

⛔ Nothing about the change itself is reopened: it was ACCEPTed, and this is a rebase-and-land round. PR stays a draft until this seat reads each gate job's own conclusion.

---

Generated by Claude Code