feat(tooling): a DETERMINED register so the swallow-census worklist means what its heading says

[claude]

Fixes #13886

The #12981 census prints its tier-1 bucket under the heading "[1] DARK members, by file — the repair worklist". On the merge base that bucket holds 5 rows and four of them are settled determinations, not outstanding repairs. Membership is decided on three mechanical conjuncts and a comment is trivia to the AST, so an annotation — the programme's own way of recording a determination — cannot move a site out of the bucket. That is measured, not inferred: writing the batch-8 determination into packages/verify/src/harness.ts left the census byte-identical. The heading is a true statement about membership and a false one about work, and two rounds were spent on the gap.

This adds the DETERMINED register the card named, in the shape the card named.

What it does — and the one thing it must not do

• A DETERMINED register keyed file::function, the granularity and the reason of the sibling gate's FAILURE_PROPAGATION_SITES in scripts/check-durability-degradation-log-level.mjs (never a line — line numbers churn; never a whole file — a file-wide key licences every future catch in it). That script is read as precedent and not imported: coupling a non-gate instrument to a merge-blocking one is the mistake WRITE_SHAPED_CALLEES already declines by copying the gate vocabulary by value.
• Membership does not move. A registered site stays a MEMBER, stays counted in [1] DARK, stays at tier dark. The register changes exactly one thing: which heading the row prints under. Proven by diff below and asserted arithmetically in the self-test.
• Every row is cross-checked, which the triage raised from the card's proposal to a hard requirement. A row is honoured only while (1) the file exists, (2) the determination is still written down at the row's declared scope, and (3) the file::function still resolves to a tier-1 DARK member. A row failing any of the three goes STALE: it reddens the self-test in both modes, prints a loud block in the census, and — the part that matters — excuses nothing, so its site goes straight back onto the printed worklist.

Two design points worth reviewing:

• The anchor is a distinctive sentence from the determination, not a bare [#12981] marker. A bare marker in a large file is kept alive by every unrelated repair that mentions the programme, so the cross-check would pass over a determination that had been deleted outright — a green certifying nothing. Matching is whitespace-normalised and comment-prefix-stripped: re-wrapping a comment is safe, rewording it is not, which is the sensitivity wanted (a reworded determination is one a person should re-read).
• A DARK site with no determination written down gets no row. packages/plugins/plugin-auth/src/auth-manager.ts::verifyMcpAccessToken is one today: batch 6 read it as a census FALSE MEMBER, but that reading lives in a report, not in the file, so there is nothing here to cross-check against. It stays on the printed worklist. The alternative — a row anchored on the file's unrelated [#12981] mentions — is exactly the "new lie carrier" the ruling forbids, and adding an annotation would need an edit outside scripts/, which this PR does not make.

The three registered rows:

key	verdict	anchor scope
packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert	fence lifted — the CALLER reports the refused insert at error (PR #13685)	file (the determination is recorded at the caller, in the same file)
packages/runtime/src/domains/keys.ts::handleKeysRequest	silent by design — every path out of the catch hands the caller a 500 envelope	site
packages/verify/src/harness.ts::inviteForAudienceGate	not a claim-to-persist — the helper answers void and the loss is refused one line later (batch 8)	site

The counts are byte-identical — full diff of the census output

Base is this PR's own merge base 96b627d13; the base reading was taken by running origin/main's copy of the script against the same tree. The only differences are the worklist annotation lines. Every count line is byte-identical, including MEMBERS 56/37, DARK 5/5, carries-error 24/19, channelled 27/14, QUIET 99, the AWAITED drop count and the SCOPE-resolver refusal count.

@@
   [1] DARK members, by file — the repair worklist:
     1×  packages/plugins/plugin-auth/src/auth-manager.ts
-    1×  packages/plugins/plugin-auth/src/ensure-default-organization.ts
     1×  packages/plugins/plugin-sharing/src/share-link-service.ts
-    1×  packages/runtime/src/domains/keys.ts
-    1×  packages/verify/src/harness.ts
+
+  DETERMINED, not outstanding                  3 site(s) in 3 file(s)
+    read on the merits and recorded in the file; still MEMBERS, still counted in [1] above —
+    a determination is a reading of a site, never a change to it:
+    packages/plugins/plugin-auth/src/ensure-default-organization.ts::tryInsert
+      the fence is lifted — the CALLER reports the refused insert at `error`  (PR #13685)
+    packages/runtime/src/domains/keys.ts::handleKeysRequest
+      silent BY DESIGN — every path out of the catch hands the caller a 500 envelope  (#12981, in-file determination)
+    packages/verify/src/harness.ts::inviteForAudienceGate
+      NOT a claim-to-persist — the helper answers `void` and the loss is refused one line later  (#12981 batch 8, in-file determination)
 
   ⚠️  A green from check-durability-degradation-log-level.mjs over any file listed
       above means NOT MEASURED for that site, never "level approved" (#12981 ruling).

That is the whole diff of the two outputs — diff -u reports nothing else.

Self-test — the register family is asserted in BOTH modes

The cross-check is asserted in --self-test=gated (what CI runs via check:swallow-census-controls) as well as --self-test. A STALE leg that only fired in a mode the farm never invokes would be the lie carrier again — that is the finding #13919 already paid for. It also passes that card's own admission test: a successful repair cannot destroy it. A register row names a site the programme ruled OUT of repair, so emptying the worklist does not touch one; a row does go STALE if someone repairs its site anyway, and that red is the sibling gate's stale-entry discipline, demanding a one-line deletion that lands with the repair. Categorically unlike POSITIVE_CONTROLS, where the cheapest way to green is to weaken the control.

Three declared controls were added, run against synthetic registers so no leg needs the working tree mutated:

1. a row whose anchor sentence is absent from its own function must report anchor-gone and excuse nothing;
2. a row whose site the census does not report as a tier-1 DARK member must report not-a-member and excuse nothing;
3. coexistence: excused + outstanding == dark, and every excused key is still in members. This is the one that proves the register and the tier-1 DARK positive control cannot fight — the control asserts a file yields a member at tier dark, the register asserts the same site is still such a member before it excuses anything, and membership is computed before the register is consulted.

✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier,
  3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as
  declared, 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
✓ measure-durability-swallow-family self-test, gated families (#13919): … 3 DETERMINED register row(s)
  cross-check clean, 56 member site(s) total

Ablation — the STALE leg fires, and the site is not silently excused

Reworded the in-file determination in packages/verify/src/harness.ts ("silent BY DESIGN" to "silent BY ACCIDENT") under a trap ... EXIT INT TERM restore. No build/dist leg is owed: the census reads the target file as text off the working tree (parseSourceFile on an absolute path), so nothing resolves through a package exports to a dist/.

Mutation proven on disk by occurrence counts on the anchored text — pre old-count: 1 new-count: 0 to post old-count: 0 new-count: 1 — never by the editor's exit code.

MUTATED   --self-test=gated  -> exit 1
  DETERMINED register row is STALE: packages/verify/src/harness.ts::inviteForAudienceGate [anchor-gone]
    the determination is no longer written in `inviteForAudienceGate`: the anchor sentence
    "[#12981] This catch is silent BY DESIGN and it is NOT a durability swallow." is not there.

  census, same tree:
    [1] DARK members, by file — the repair worklist:
      1×  packages/plugins/plugin-auth/src/auth-manager.ts
      1×  packages/plugins/plugin-sharing/src/share-link-service.ts
      1×  packages/verify/src/harness.ts        BACK on the worklist, NOT excused
    DETERMINED, not outstanding   2 site(s) in 2 file(s)
    ✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above

RESTORED  --self-test=gated  -> exit 0

Restore proven byte-identical rather than by exit code: git checkout HEAD -- ABSOLUTE_PATH, git diff HEAD empty, and git hash-object back to the HEAD blob 3325fd058232f51af1f8739d3c6c914327e1fb4d. Post-restore occurrence counts back to old 1 / new 0. git status --porcelain on the branch shows only the one intended file.

Gates

Derived on the final tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written path list). Change set: 1 path, scripts/measure-durability-swallow-family.mjs, vs merge base 96b627d13. Union re-run after the final commit; git rev-parse --short HEAD at that run: 9c1beba32.

Reconciliation via --ran: 16 derived, 14 run, 1 NOT-MEASURED, 1 UNRUN.

• RAN-PASS (14, each exit 0): check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, pm/bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:swallow-census-controls, check:watch-hint-literal. Exit codes captured by redirect-then-read, never across a pipe.
• NOT-MEASURED (1): node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET. It grades a saved turbo run test log and the family names it with no argument; its own text says to record this as NOT MEASURED, and that it is not a red.
• UNRUN (1), declared: pnpm check:pm-dispatch-gates — cap-killed at 520s under the container's foreground ceiling. Recorded as UNRUN, not NOT-MEASURED, exactly as the reconciler's own warning demands (a run the OS killed leaves no verdict). CI runs it in Lint & Repo Gates. What it could plausibly touch was checked by hand instead: its pin ['scripts/measure-durability-swallow-family.mjs', 'selfTestMode', true] still holds (selfTestMode is unrenamed), and its end-to-end --ran case drives this card by path, not by the file's literals.

Beyond the derived family, because this diff edits a gate-class script and adds path literals to it: pnpm check:nul-bytes (0), pnpm check:declared-population-live (0), node scripts/check-self-test-wired.mjs (0), node scripts/check-self-test-workflow-commands.mjs (0), node scripts/measure-self-test-floor.mjs (0), and the script's own suite in both modes (0 / 0).

Changeset

None, and the skip-changeset label is applied. This diff is scripts/** only and publishes nothing from any package. Direct precedent, same file: the #13919 landing (PR #14413) carried skip-changeset and no changeset, on a strictly wider diff (it also touched package.json and lint.yml).

Coordination

• The #12981 swallow census has controls that nothing ever runs — wire the families the repair programme cannot destroy, or leave the instrument a measurement? #13919 has LANDED (793065de2) — SELF_TEST_MODES and the check:swallow-census-controls wiring are in. The hot-serial the triage named is discharged and this PR is the later lander on that file, as ordered.
• PR fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 9) is still open and draft at 8d79c623f and edits the SAME file in one disjoint block, POSITIVE_CONTROLS. This PR ⛔ does not touch POSITIVE_CONTROLS. When fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383 lands it moves the census to 55/36 and DARK to 4/4 and repoints the tier-1 DARK control at packages/verify/src/harness.ts — that shift is fix(plugin-sharing): report a refused resolveToken usage stamp once as a durability degradation — #12981 batch 9 #14383's, not this one's, and this PR's own before/after stays byte-identical on every count either way. harness.ts::inviteForAudienceGate being both a positive control and a register row is compatible by construction and is control (3) above.
• Batch 10 (widening DURABILITY_CRITICAL_CALLEES and declaring keys.ts::handleKeysRequest) has not landed — zero hits for handleKeysRequest under scripts/ on the base. This card lands before it, as the triage ordered. ⛔ Batch 10 must not re-key this register: the keys.ts row's own note says so in the file.

Draft on purpose — not ready, no auto-merge.

Dev session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33602264534 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (5/6) — 失败步骤: Publish this shard's attestation（日志不可读，点进 job 看）
• Test Core (2/6) — 失败步骤: Publish this shard's turbo run summary（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)