fix(plugin-approvals, plugin-security, service-messaging, service-realtime): nine titleFormat-only system objects declare a title pointer instead of taking the raw id

[objectstack-fleet]

Fixes #20044

Clause-②: no

What this changes

ADR-0079 resolves a record's title as nameField, then displayNameField, then a derivation. An explicit nameField takes precedence over the render-only titleFormat. The titleFormat describe (packages/spec/src/data/object.zod.ts) states the migration: 「an explicit nameField now takes precedence … Migrate a single-field title to nameField, a composite to a formula field designated as nameField」.

Nine services-lane objects declared a titleFormat and no pointer. At registration the registry's designate-only pass (provisionPrimary(…, { synthesize: false })) derives the first title-eligible field, which on all nine is id, and stamps it as nameField. A /meta read serves that stamp as if the author had written it. objectstack-ai/objectui#9436 (landed as objectstack-ai/objectui#10358) makes the record page honour the declared pointer, so each record page's H1 becomes the raw id once the console pin moves past it. This is the same remedy PR #20042 applied to five objects (#20015), repeated for these nine.

Measured per object

Each declaration was registered in a real ObjectQL registry on in-memory SQLite. One representative row was seeded and read back through findOne, and its H1 was read under ADR-0079's order next to the titleFormat rendering. The "main" columns were measured at b76aad5f6f, with the declarations as they stand on main. The "this branch" columns come from the committed pins.

Object	titleFormat	main: registered nameField / displayNameField	main: H1	titleFormat rendering	this branch: pointer	this branch: H1 (= resolveRecordTitle)
sys_approval_delegation	{delegator_id} → {delegate_id}	id / none	RcqJgHufg-44Qdbj (raw id)	usr_alice → usr_bob	display_title	usr_alice → usr_bob
sys_position_permission_set	{position_id} → {permission_set_id}	id / none	2lvPKcxu8uDzPCzk (raw id)	pos_sales → ps_crm_edit	display_title	pos_sales → ps_crm_edit
sys_user_permission_set	{user_id} → {permission_set_id}	id / none	F06WPbxwwcDPtxYt (raw id)	usr_alice → ps_crm_edit	display_title	usr_alice → ps_crm_edit
sys_user_position	{user_id} → {position}	id / none	WeYJnXQkg-O3NKIh (raw id)	usr_alice → sales_manager	display_title	usr_alice → sales_manager
sys_notification_delivery	{channel} → {recipient_id}	id / none	MjrV1FGgJdUhhoj7 (raw id)	email → usr_alice	display_title	email → usr_alice
sys_notification_preference	{user_id} · {topic} · {channel}	id / none	YuzjUl0Lsxsk4L9v (raw id)	usr_alice · billing.invoice · email	display_title	usr_alice · billing.invoice · email
sys_notification_receipt	{state}	id / none	3IWhzyEYVsd9JGeI (raw id)	read	state	read
sys_notification_subscription	{principal} · {topic}	id / none	aNY2Diw2O2_qvHT8 (raw id)	role:sales_manager · billing.invoice	display_title	role:sales_manager · billing.invoice
sys_presence	{user_id} ({status})	id / none	zRKJBDnWzfMtp9Ps (raw id)	usr_alice (away)	display_title	usr_alice (away) (scratch run, see Deviations)

The fix

The eight composites each declare display_title, a formula field with returnType: 'text' over the columns their titleFormat names. nameField and the displayNameField mirror point at it, as in #20042.

Object	display_title expression
sys_approval_delegation	record.delegator_id + ' → ' + record.delegate_id
sys_position_permission_set	record.position_id + ' → ' + record.permission_set_id
sys_user_permission_set	record.user_id + ' → ' + record.permission_set_id
sys_user_position	record.user_id + ' → ' + record.position
sys_notification_delivery	record.channel + ' → ' + record.recipient_id
sys_notification_preference	record.user_id + ' · ' + record.topic + ' · ' + record.channel
sys_notification_subscription	record.principal + ' · ' + record.topic
sys_presence	record.user_id + ' (' + record.status + ')'

sys_notification_receipt's title is the single column {state}, so nameField and displayNameField name state directly. That is the describe's migration for a single-field title. An explicit pointer is honoured whatever the field's type (ADR-0079 D4, resolveDisplayField). select is kept out of derivation only, which is why the pass skipped state and stamped id.

• No NULL part reaches a formula. Every column the titles read is required: true, so the formulas carry no null guard, like fix(plugin-approvals, service-automation, service-messaging): title five system objects with a text formula instead of the raw id #20042's required-column formulas. fix(plugin-approvals, service-automation, service-messaging): title five system objects with a text formula instead of the raw id #20042's NULL-part legs covered nullable columns, and none of these nine titles has one. The write path refuses an omitted title column with VALIDATION_FAILED, naming the field with code required. Where the column declares a default, the write fills it instead: preference topic / channel become '*', receipt state becomes 'delivered', and presence status becomes 'online'. The engine pins cover both behaviours. A row written around the engine with a NULL title column (raw SQL) makes the formula evaluate to null. This was measured in a scratch run, where the titleFormat rendering of that row would be usr_alice → instead.
• No stored column. A formula is computed on read, and the synced tables carry no display_title column. No search-companion column appears either: a formula is never a companion source, and select is not title text. The pin runs provisionSearchCompanion over the registered body, the step a pinyin-enabled registry runs, and resolveSearchCompanionSources answers []. No migration runs.
• titleFormat is unchanged on all nine objects, for renderers that still read it first.
• $search scans the same fields. A formula is never a search target, and neither was id. On sys_notification_receipt, state (a select) was already in the auto-default set and now leads it. The lead changes the order only, never the members, and none of the nine declares searchableFields.

Security: the three permission-assignment tables

sys_position_permission_set, sys_user_permission_set and sys_user_position bind permissions, so the new field was checked against their existing read access:

• Each formula reads only its own row's columns: the foreign keys (position_id, permission_set_id, user_id) and the position name. It never reads a field of the record a key points at, so it never traverses a lookup the reader may not see.
• None of those columns is hidden, guarded by requiredPermissions or masked (maskingRule). The pin asserts all three per column, and each was ablated on its own. They were already served to every reader of the row, and they appear in highlightFields and titleFormat.
• No row scope, permission set, apiMethods, managedBy or userActions entry changes. display_title is read-only. The shipped permission sets grant these objects object-level access only (default-permission-sets.ts) and carry no field entries.

Tests

One new file per package. The three engine files boot the real ObjectQL engine on in-memory SQLite with the real declarations:

• plugin-approvals/src/sys-approval-delegation-display-title.test.ts (6 tests)
• plugin-security/src/objects/sys-security-assignment-display-title.test.ts (18 tests, 6 per object)
• service-messaging/src/objects/notification-display-title.test.ts (24 tests, 6 per object)
• service-realtime/src/objects/sys-presence-display-title.test.ts (2 tests; no engine, see Deviations)

Per object, the engine files assert:

• the body the registry holds after registration names the new pointer, for both nameField and displayNameField;
• a seeded row's H1 is the literal titleFormat text, is not the row's id, equals the titleFormat rendering of that row, and resolveRecordTitle agrees;
• a row missing a title column is refused (VALIDATION_FAILED, field named, code required), or is filled from the declared default and titled by it;
• the formula reads exactly the titleFormat columns, one level deep, each required, none hidden / permission-guarded / masked;
• no display_title column exists in the synced table, and no search companion is provisioned.

Runs at 17db356e01, the head of this PR:

Suite	Result
@objectstack/plugin-approvals, full (vitest run --maxWorkers=2, at d040485b5b)	51 files, 790 tests passed
@objectstack/plugin-security, full (at d040485b5b)	134 files, 2663 tests passed
@objectstack/service-messaging, full (at d040485b5b)	46 files, 503 tests passed
@objectstack/service-realtime, full (at d040485b5b)	5 files, 33 tests passed
the three rewritten engine files, at 17db356e01	6 + 18 + 24 passed
typecheck, all four packages, at 17db356e01	exit 0; check:test-typecheck OK for plugin-approvals (ledger unchanged) and plugin-security (0 errors)

Only the three engine test files changed between d040485b5b and 17db356e01. tsc --listFiles finds every new test file inside a typecheck program: plugin-approvals and plugin-security tsconfig.test.json, service-messaging and service-realtime tsconfig.json.

Ablations (committed state 17db356e01, scripts/ablation-replace.mjs)

The object files are imported relatively from source, so no dist/ sits on the resolution path and no rebuild is involved. Every leg printed ok mutation landed before its run and ok restored: blob == HEAD after it. The tree equalled HEAD after each of the 33 legs.

Leg	Mutation	Result
ptr-id, 8 formula objects	both pointers → 'id' (#20015's shape)	red on the pointer and H1 tests of that object, e.g. expected '22o5f2s01PYV_LAL' to be 'usr_alice → usr_bob', expected 'Hc3c8fIEvdtL9EZZ' to be 'pos_sales → ps_crm_edit', expected '1-dAWCH9Y12B-1z4' to be 'email → usr_alice'; presence: expected 'id' to be 'display_title' from the designation pass
ptr-removed, receipt	both pointers deleted (main's state)	red 3: expected 'id' to be 'state', expected 'fKk2vvHoRePGTkDD' to be 'read', expected 'nwVM_6ig0mkb28sJ' to be 'delivered'
ptr-removed, delegation and presence	both pointers deleted	red 1 each, on the displayNameField mirror only (expected undefined to be 'display_title'); the H1 stays right, see Acceptance notes
req, 8 objects	one title column required: true → false	red on the refusal test (promise resolved … instead of rejecting) and the inputs test (recipient_id: expected false to be true); presence: the inputs test
withheld, 6 legs	hidden: true on an input (delegation, delivery, presence, sys_position_permission_set); requiredPermissions on sys_user_permission_set.user_id; maskingRule: 'name' on sys_user_position.position	red on the inputs test each time, e.g. user_id: expected [ 'view_assignment_subjects' ] to deeply equal [], position: expected 'name' to be undefined
col, 7 objects	Field.formula( → Field.text(	red 4 or 5, including to not include 'display_title' and the companion pin
companion-receipt	state: Field.select([…], { → state: Field.text({	red 1: expected [ 'state' ] to deeply equal []

The first version of the companion pin read the synced table's columns for __search. The engine the tests boot builds its registry with the companion off (it follows OS_SEARCH_PINYIN_ENABLED), so that pin could not fail, and the companion-receipt leg stayed green. It was replaced by the provisionSearchCompanion form above, which goes red on that leg.

Gates

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the real diff derived 62 families. All 62 were run at 17db356e01, and --ran (with an exit code recorded per family) reconciles: "62 derived famil(ies) accounted for — 62 run, 0 NOT-MEASURED (a DERIVED zero — all 62 recorded an exit code and none of them is 3)".

• check:registry-log-declared first went red on an intermediate commit whose tests constructed a SchemaRegistry. That requires an OS_REGISTRY_LOG declaration in three vitest.config.ts files outside this change. The pin was rewritten not to construct one, and the gate is green at 17db356e01.
• check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (six unrelated packages had no dist/). After building them it passed: "104 published require entry point(s) across 67 package(s) load".
• GITHUB_TOKEN="$GH_TOKEN" node scripts/check-issue-citations.mjs: exit 0.
• check:i18n-coverage (at 3fc935d944, the bundle commit; nothing after it touches a bundle or a declaration): OK, "13 config(s), 621 baselined untranslated string(s), none new".
• Narrowed eslint over the 41 changed .ts files (--no-inline-config --format json): 41 files, 0 errors, 0 warnings, 0 ignored. The config never enables type-aware linting (eslint.config.mjs around line 328: no parserOptions.project), so a file's verdict depends on that file alone. The repo-wide pnpm lint is CI's.

The derivation notes the tree is 7 commits behind origin/main. Two gate inputs changed across that range: scripts/check-spec-docblock-symbol-anchors.mjs and scripts/doc-authoring-prose-id.baseline.json. None of those commits touches a file in this diff.

i18n

node scripts/check-i18n-bundles.mjs --write --filter=… regenerated the four packages' bundles, and its output is committed unedited. The English bundles gain display_title's label and help. The zh-CN, ja-JP and es-ES bundles carry the generator's English fill, and the source-hash companions record those fills. A second --write is a byte-for-byte fixed point. check:i18n and check:i18n-stale-fill are green. #20042 translated its new leaves by hand, but this dispatch said the bundles are regenerated by tooling and never edited by hand. The translated values can be hand-written in a later change, which AGENTS.md allows.

Deviations

• sys_presence's rendered-title pin is not committed. @objectstack/service-realtime declares neither @objectstack/objectql nor @objectstack/driver-sql. An engine test there needs both as devDependencies, which edits package.json and pnpm-lock.yaml, outside the claimed file surface. The committed file pins the designation pass (provisionPrimary, the step the registry runs) and the formula's inputs. The rendered title was measured through the real engine in a scratch run, not committed: usr_alice (away), equal to the titleFormat rendering.
• The inherited commit (3a1ea534a4) was kept and amended by a follow-up commit, not rewritten. Its formulas were re-derived against each titleFormat and all nine match. sys_notification_receipt's titleFormat is exactly {state}, so state is its one field. The follow-up rewraps overlong comment lines and corrects "all required" for two-column titles. It narrows the plugin-security note to what the declared read path shows, and replaces a comment that promised the presence test holds the rendered text.
• origin/main was not merged. It moved 7 commits, none touching a file in this diff, so there is nothing to conflict.

Acceptance notes

• Removing both pointers from a formula object does not bring the defect back: display_title then wins derivation tier 2 (the _title affix). Measured on sys_approval_delegation and sys_presence, where only the displayNameField mirror went missing. The explicit pointer is kept because the describe prescribes it and fix(plugin-approvals, service-automation, service-messaging): title five system objects with a text formula instead of the raw id #20042 declared it.
• A formula is a field of its own under field-level security. The masker (field-masker.ts maskResults) deletes fields by name and knows no formula inputs. A deployment that hides an input column through a permission-set field entry therefore does not hide display_title with it. That holds for every formula field, fix(plugin-approvals, service-automation, service-messaging): title five system objects with a text formula instead of the raw id #20042's five included. No shipped declaration or permission set restricts these inputs. Noted, not measured.
• Where an input is a lookup, the title carries the stored foreign key, as the titleFormat substitution did (fix(plugin-approvals, service-automation, service-messaging): title five system objects with a text formula instead of the raw id #20042's request_id likewise).
• The title-format-retired lint warning stays on all nine objects, because titleFormat stays (as in fix(plugin-approvals, service-automation, service-messaging): title five system objects with a text formula instead of the raw id #20042).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/plugin-approvals, @objectstack/plugin-security, @objectstack/service-messaging, @objectstack/service-realtime, touching 23 documentable anchor(s).

15 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/approvals.mdx (via sys_approval_delegation (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/automation/hook-bodies.mdx (via nameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition))
• content/docs/data-modeling/formulas.mdx (via nameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition), display_title (literal, a string literal in displayNameField; a string literal in nameField))
• content/docs/data-modeling/objects.mdx (via SysUserPermissionSet (symbol, a top-level const object), displayNameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition), nameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition), sys_approval_delegation (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/data-modeling/schema-design.mdx (via displayNameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition), nameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition))
• content/docs/deployment/environment-variables.mdx (via sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/administrator-guide.mdx (via sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/authentication.mdx (via sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/authorization.mdx (via sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/delegated-administration.mdx (via sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/permission-sets.mdx (via sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/positions.mdx (via sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/permissions/profiles.mdx (via sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/plugins/packages.mdx (via sys_presence (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/ui/forms.mdx (via nameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition))

⛔ 9 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v13.mdx (via SysPositionPermissionSet (symbol, a top-level const object), SysUserPosition (symbol, a top-level const object), sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v14.mdx (via sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v15.mdx (via sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v16.mdx (via nameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition), sys_approval_delegation (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_presence (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-0.mdx (via nameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition), sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-1.mdx (via sys_user_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-2.mdx (via nameField (symbol, a field of const object NotificationDelivery; a field of const object NotificationPreference; a field of const object NotificationReceipt; a field of const object NotificationSubscription; a field of const object SysApprovalDelegation; a field of const object SysPositionPermissionSet; a field of const object SysPresence; a field of const object SysUserPermissionSet; a field of const object SysUserPosition), sys_position_permission_set (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))
• content/docs/releases/v17/17-4.mdx (via sys_user_position (symbol, a field of const object enObjects; a field of const object esESObjects; a field of const object jaJPObjects; a field of const object zhCNObjects))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7ddf396109b9d423cf52c2e5b69b0e34f235e7f5 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from a9fbf69a090b2ed35cdbd30e56440c9fbfb11573 — the merge of head 17db356e015ace978e64e642025164acdd6607b6 into base 7ddf396109b9d423cf52c2e5b69b0e34f235e7f5, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a9fbf69a090b2ed35cdbd30e56440c9fbfb11573 && git checkout a9fbf69a090b2ed35cdbd30e56440c9fbfb11573
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7ddf396109b9d423cf52c2e5b69b0e34f235e7f5 17db356e015ace978e64e642025164acdd6607b6 && git checkout -B drift-repro 7ddf396109b9d423cf52c2e5b69b0e34f235e7f5 && git merge --no-ff 17db356e015ace978e64e642025164acdd6607b6

node scripts/docs-audit/affected-docs.mjs --json 7ddf396109b9d423cf52c2e5b69b0e34f235e7f5

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7ddf396109b9d423cf52c2e5b69b0e34f235e7f5 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 36089293345 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — evidence pointers (#5623) > is green against a verbatim copy of the shipped ledgers
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — evidence pointers (#5623) > stays green when the missing path is attributed to ANOTHER repo
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — evidence pointers (#5623) > never bounds a citation attributed to ANOTHER repo
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — evidence pointers (#5623) > prints the citation count and how many are in range, in the documented two
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — symbol anchors (#12516) > stays GREEN on the drifted BEFORE-state — the honest residual this grammar e
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — symbol anchors (#12516) > prints the anchor count and how many resolve, equal on a green run
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — the evidence-scan population (#13041) > stays GREEN when a `dead` entry carries the SAME rotted pointe
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — the evidence-scan population (#13041) > declares every status either scanned or explicitly unscanned, 
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — the live-elsewhere criteria (#13483) > is green on the shipped ledgers and publishes the population be
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — the README state table (#7257) > is green against a verbatim copy, and says how many rows it checked
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — the generated count artifact (#7377) > is green against a verbatim copy, and says the artifact is curr
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  @objectstack/spec:test:  FAIL   local  scripts/liveness/check-liveness.test.ts > check:liveness — the evidence summary line (#5623) > prints declared and resolved as separate numbers, equal on a green
    ↳ 失败原因: @objectstack/spec:test: AssertionError: Spec liveness gate (registry-rooted) — governed types: object, field, flow, action, hook, permission, position, agent, tool, skill, dataset, page, view, report,
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• scripts/liveness/check-liveness.test.ts — 24h 内已弹出 3 个 PR（feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079、fix(plugin-hono-server): drop the retired ui-plugin arm from UI auto-discovery #20086、fix(plugin-approvals, plugin-security, service-messaging, service-realtime): nine titleFormat-only system objects declare a title pointer instead of taking the raw id #20087），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: scripts/liveness/check-liveness.test.ts #20089（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 2 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

Queue-build triage · run 36089293345 red: not this PR's diff · domain:services seat · 2026-09-25T03:26Z

• What failed: Test Core (1/6), @objectstack/spec scripts/liveness/check-liveness.test.ts (20 cases, one cause). The key-mention anchoring check reports a single unanchored citation: permission/objects.allowExport → packages/plugins/plugin-hono-server/src/current-user-endpoints.ts, a file that no longer names the property.
• Why it isn't this PR's: this PR touches none of plugin-hono-server, packages/spec/liveness/ or the liveness scripts. On main, current-user-endpoints.ts does name allowExport (lines 494 and 504–505), so main holds.
  • The only open PR that edits that file is PR feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079. It sat ahead of this one in the queue: its own queue build (36088336600) failed, and it was removed from the queue at 03:16Z.
  • The red build was pr-20087-dc92452a…, based on a queue head that still contained feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079.
• No re-queue needed: this PR was not removed. The queue rebuilt it without feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen #20079 at 03:16:58Z (run 36089725358, in progress). No re-run and no push are needed from this PR.

---

Generated by Claude Code