test(spec): security, ai, identity, integration, migrations, marketplace, meta-spelling and studio test titles state each cited decision in words instead of a tracker number (stage 14) - #21799

Part of #20749
Clause-②: no

Stage 14 of this card, and the fifth area of class (e): the test strings shipped under packages/spec/src, as ruled in 5902360492 on #20513. This stage takes the eight small directories together: security/, ai/, identity/, integration/, migrations/, marketplace/, meta-spelling/ and studio/. Their 91 test-title and test-string literals carried 96 tracker ids citing 65 records. 94 ids in 89 literals now either state what their record decided, in words (form D), or are dropped where the title already says it. Two ids stay, for the reason given below. Text only: no assertion, identifier, test count or code comment changes.

Census at the base (e83c9f6154)

Instruments: census10.cjs (md5 9d08602ab972b4b8643c90d64d40fa41), census.cjs (md5 6e42a45a926d375013c32d62f16a296e) and census-wide.cjs (md5 c98410a19529c439adb0afbfb00026a2), byte-identical to the copies stages 10 to 13 used. A literal counts as a test title when its folded message is argument 0 of a describe / it / test call, .each / .skip / .only chains included. Everything else is an "other" string.

The worktree was cut from origin/main at e83c9f6154, one commit past the claim's 8256a4b272. That commit touches only api/error-code-ledger.zod.ts, which is not a test file, so the test census is the same at both.

Both instruments read 1414 messages / 1500 ids in 315 files, the seat's reading at 8256a4b272. That is one more than stage 13's head reading (1413 / 1499 at 72513933ee), and the one id is in ui/component-props-unknown-members.pin.test.ts. It moved from 1 / 1 to 2 / 2 when #21764 (4331a6b16c, 2026-10-04T17:33Z) landed between the two readings. That commit removed one id-bearing string and added two: a ruling: value at :322 that the assertion at :417 matches with a regular expression on its number, and a describe title at :596. It joins the ui/ stages.

The eight directories read 91 messages / 96 ids in 34 files, the seat's figures.

• Controls. Lit, a title with three ids: migrations/migrations.test.ts:293. Lit, an expect message: identity/api-key-retirement.test.ts:82. Dark: the comment at security/permission.test.ts:309 ("The spec: retire the allowRestore / allowPurge permission props (ruled 2026-08-26; M2 anchor stays open, keys return with M2) #12497 refusal shape was measured as") reads 0. Planted in a scratch copy of the head security/explain.test.ts: an id put back into a title reads 1 / 1, and an id put into a comment reads 0.
• A wider pattern (any # plus digits) reads the same totals in seven of the eight directories. In studio/ it reads 5 / 5 at the base, because three literals in two test files are hex colours (#7c3aed, #2563eb, #94a3b8). None matches the gate's pattern.
• At the head: 1325 messages / 1406 ids in 282 files. ai/ reads 2 / 2 (the two needles below), and the other seven directories read 0 / 0. Nothing outside the eight moved. The wider pattern adds only the three hex colours.

How the area was chosen

Stage 10's rule ranks whole first-level directories by ids and takes the busiest within about 10% of the ~100-id bound. data/ (501), ui/ (416), api/ (201) and system/ (165) each exceed it alone, and the files directly in src/ (120) are 20% over. The eight small directories read 96 together, within the bound. That is the group the stage-12 and stage-13 ACCEPTs named, so the rule needed no second pass.

Named for the next stages (the head census, 1325 / 1406):

• data/ 501 in five stages. It has one subdirectory, so the files directly under it go in name order, in groups near the bound:
  1. aggregate-field-type-compatibility.test.ts to default-value-tokens.test.ts: 22 files, 109 ids;
  2. document.test.ts to filter-dotted-head.test.ts: 21 files, 109 ids;
  3. filter-empty-operator.test.ts to hook-body.test.ts: 21 files, 108 ids;
  4. hook.test.ts to record-surface.test.ts: 16 files, 107 ids;
  5. search-fields.test.ts to validation.test.ts (8 files, 16 ids) with data/driver/ (7 files, 52 ids): 68 ids.
• ui/ 416, about four stages.
• api/ 201, two.
• system/ 165, two.
• The files directly in src/, 120, one.
• The two needles left in ai/build-progress.test.ts and the one in contracts/approval-service.test.ts. Each leaves only together with the source docblock it pins.

What each id became

29 literals (33 ids) now state a decision in words. 60 literals (61 ids) drop a number the title already explains. Every cited record was read with its comments through REST: 60 answer 200. #6362, #8715 and #14676 answer 404, and their decisions were read from the landing commits. cloud#1967 and cloud#2172 answer 403, because the cloud repository is not attached to this session. cloud#1967's decision was read from what landed, and cloud#2172 is one of the two needles that stay.

Dropped only (61 ids): #123, #3544, #4001 (4), #4641, #4703, #4737, #4911, #5337, #5481, #5515 (4), #5685, #5955, #6628, #6698, #6861, #6919, #7113 (4), #7319 (2), #7990, #8326 (6), #8424, #8715, #9885, #11503, #12497, #12840 (2), #14103, #14676 (2), #14825, #15028, #15680, #15813, #16870, #17425, #17487, #18728 (4), #18978, #20321, #21260 (2), cloud#1967.

• Each of these titles already states the decision it pins: for example "the cap is 200: exactly 200 ids parse, 201 are refused (never truncated)" for security/explain needs a batch form (recordIds[]) — the list row kebab cannot consume the record-level verdict without 2N probes per page #8326, or "unknown keys are rejected, not stripped" for 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001. In skill-trigger-condition-value-shape.test.ts:130, "(ComparisonOperatorSchema 的 $gt/$gte/$lt/$lte 不含 string,与平台自己只产出字符串的日期宏解析器相矛盾 #5685: no stricter than the runtime)" became "— no stricter than the runtime".
• #123 in ai/conversation.test.ts:294 ('Support Chat - Case #123') is a placeholder that cites no record: objectstack#123 is an unrelated broken-links report. The string is a fixture's session name, an input only. No assertion reads it, so dropping the number moves nothing.
• cloud#1967 in ai/solution-blueprint.test.ts:674: the record answers 403. Its decision is read from 3e3ecb0e8f and its CHANGELOG entry: the strict mirror the design model generates against carries the applier's SNAKE_CASE constraints. The title already says "VALUE parity".
• #3896 is the sharing-rule card (POST /data/sharing/rules bypassing SharingRuleSchema). The skill title cited it as an "audit close-out", the batch that removed triggerPhrases along with other dead clusters. The title now states the decision that landed with the key's tombstone (ai/skill.zod.ts:386) and its conversion entry (conversions/registry.ts:2744): phrases were never matched, and activation is triggerConditions intersected with the agent's skills[].
• The it.each rows at ai/knowledge-source.test.ts:97 and :98 feed a %s placeholder. vitest 4.1.11 formats %s with String(value) and does not truncate it (@vitest/utils baseFormat). Only $name interpolation goes through the 40-character objDisplay. Both rows are short anyway, and the name comparison below confirms both full names.

The two ids that stay

ai/build-progress.test.ts:236 and :237 are expect(SOURCE).toContain('cloud#2172') and expect(SOURCE).toContain('objectui#7388 block 2'). They are not titles. They are the expected values of assertions that read the ai/build-progress.zod.ts docblock and pin that its liveness watch names its two carriers (:84-85). Changing them needs a code comment and assertion logic, which this claim excludes. They leave together with that docblock's citations, like the contracts/approval-service.test.ts:274 needle.

Readers

• Test-name filters: none. A tracked-tree search for -t and --testNamePattern finds only packages/qa/dogfood/README.md:142 (-t "owner-scoped"), which is unrelated.
• Snapshots: none. No __snapshots__ directory exists under the eight directories, and no .snap file is tracked under packages/spec.
• Projects: two touched files are listed in packages/spec/vitest.repo-tests.json: ai/tool-confirmation-prescription-tense.pin.test.ts and identity/position-delegatable-enforcer.pin.test.ts. Both were run in the repo project at the base and at the head, and the other 32 in local.
• By substring: every old literal, plus a window around each id (263 needles), was searched across the tracked tree outside its own file. No gate, doc, filter, snapshot or scripts/check-*.mjs self-test reads one. The hits are:
  • the plan's own siblings: unknown keys are rejected, not stripped (#4001) in the four files this PR edits;
  • this card's later stages: same-text titles in data/driver-nosql.test.ts:375, data/driver/memory.test.ts:548, data/driver/turso.test.ts:172 and ui/dashboard.test.ts:717 (carries its unit (#15680)), data/object.test.ts:105 ((#5955)) and ui/action.test.ts:1612 (#3896 close-out). They are already in the data/ and ui/ census;
  • comments and release text: the comment at ai/agent.test.ts:193, the security/sharing.zod.ts:261 docblock, two packages/spec/CHANGELOG.md entries and content/docs/releases/v17/17-0.mdx:326. None reads a test title, and none is this card's share.
• Migration tooling and generated files: docs/protocol-upgrade-guide.md, packages/spec/spec-changes.json, packages/spec/src/migrations/registry.ts and the 842 files under migrations/entries/, together with spec-changes.ts, chain.ts, index.ts and types.ts. Searched for every changed literal whole, at the base and at the head (178 needles), they read 0 hits. The lit controls resumeAuthority, ui-notification-action-embed-config-retired and element-filter-and-form-node-refused hit 5, 4 and 2 files. migrations.test.ts finds each entry by its id, never by a title.

Text-only proof

Stage 10's scratch tool (textonly10.cjs, md5 d5e4801dbb4329ab1984da91e92fc47c) compares base and head file by file on three legs:

1. Skeleton: the full AST, with string pieces masked. It must be identical.
2. Comments: every comment, byte-equal.
3. Strings: each changed string leaf must sit in a test-call title position or on a declared line, must carry a tracker id before, and must carry no # plus digits after. The declared lines are ai/conversation.test.ts:294, ai/knowledge-source.test.ts:97 and :98, identity/api-key-retirement.test.ts:82 and integration/connector.test.ts:1163.

• Result: 34 of 34 files SAME on all three legs, as predicted in writing before the run. ai/build-progress.test.ts reads SAME with 0 changed.
• Totals: 89 changed literals, 84 titles and 5 declared. The diff's + and - lines are exactly the 89 planned lines, and every file keeps its line count.
• Controls (10 of 10 as predicted, on scratch copies, each anchor hit once): identifier rename DIFF; numeric literal DIFF; comment edit COMMENT DIFF; a non-title string given an id VIOLATION; a rewritten title given a new id VIOLATION; a title that was id-free at base edited VIOLATION; one title reverted to base SAME; a declared string keeping an id VIOLATION; an undeclared expect message changed VIOLATION; a title re-split into a + chain DIFF.

Test counts: the 34 files were run at the base, in a separate base worktree at e83c9f6154, and at the head, with --project local --project repo. Both sides read 911 / 911 passed, with the same count and status sequence per file in 34 of 34. 310 full test names change, and each equals the base name with the planned replacements applied (0 mismatches). No full name repeats on either side.

Changeset: skip-changeset

Measured, not assumed:

• npm pack --dry-run of @objectstack/spec lists 2068 files. 0 of the 34 touched files are in it, and no *.test.ts at all. The controls src/security/permission.zod.ts, src/ai/knowledge-source.zod.ts and dist/security/index.js are in it.
• In the built dist/, five new phrases and four old literals each read in 0 files. The control Unrecognized key(s) on reads in 42.

So this PR publishes nothing, and no changeset is added.

Verification (at b364b8179b)

• pnpm turbo run build over all packages: 71 / 71.
• @objectstack/spec:
  • vitest run --project local: 615 files, 18358 passed, 1 todo.
  • typecheck exit 0, including check:test-typecheck (52 files / 246 errors / 135 pinned signatures held). Its program holds all 34 touched files, counted with tsc --listFilesOnly -p tsconfig.test.json.
• Gates: dispatch-gates --commands derived 79 families, the same set as stage 13, and all 79 exit 0. --ran reconciles: 79 derived, 79 run, 0 NOT-MEASURED, 0 UNRUN.
  • The five roster families whose rosters sit under a touched directory were also run, and each exits 0: check:meta-url-spelling, check:spec-changes, check:authz-resolver, check:error-code-casing and check:filter-alias-parity.
• ESLint, a proven narrowing: --no-inline-config over the 34 files reads 0 errors and 0 warnings. The population comes from ESLint's own config: 34 configured, 0 ignored. No file sets parserOptions.project or projectService, so no untouched file's verdict can move.
• check-governed-merges --test: NOT governed, 178 changed lines.

Acceptance notes

• The two build-progress needles stay with the ai/build-progress.zod.ts docblock they pin. The contracts/approval-service.test.ts:274 needle is untouched, as the claim required.
• Same-id test titles in other packages are their lanes' test-string shares. A search of describe / it / test lines outside packages/spec finds 90 lines citing ids this PR handled, in 16 packages: plugin-security 28 (14 files), rest 20 (7), service-automation 11 (7), lint 5 (4), plugin-audit 4 (3), runtime 4 (2), qa/dogfood 3 (2), plugin-hono-server 3 (1), client 2, platform-objects 2, plugin-sharing 2, cli 2, objectql 1, connectors 1, formula 1 and plugin-approvals 1.
• Code comments still carry ids in these files and their sources, for example ai/agent.test.ts:193 and security/sharing.zod.ts:261. Comments are not this card's share, and none is touched here.
• origin/main moved two commits past the base before this PR opened (fix(cloud-connection): refuse install-local sample data for a session with no active organization (ADR-0123 D2/D4) #21780, docs(pm-dispatch): say how the claim reads the Clause-② public surface #21783). Neither touches packages/spec or any file here, so nothing was merged. The gate reconciliation noted that two baselines changed across them (query-options-erasure, slot-lookup). This diff feeds neither, and the queue re-runs both on the merged generation.

Generated by Claude Code