docs(comments): re-scope the #8959 CBP residue note to what #9138 actually closed - #14132

Fixes #13722

Comments only, one paragraph, one file. Final commit 1d1263f26.

The false sentence

packages/plugins/plugin-security/src/security-plugin.ts — the [#8959] paragraph at the controlled_by_parent stand-down site in assertControlledByParentWrite — said the #8772 ramp has "two code legs and neither has landed yet", and that #9138 "is dispatchable now but not yet merged".

Located by symbol and text, never by line number: the card cites :6351-6367, and after #14049 (09e4b0ece) landed upstream in the same file the paragraph is at :6484-6500. Anchored on the literal string neither has landed yet.

Falsified before rewriting — and the card's suggested rewrite did not survive intact

Read directly from the API rather than from the card's paraphrase:

The card then proposed re-scoping the residue claim "to the raw .parse() path". Measured against today's code, that would have replaced one false sentence with another. It is true for one of the three residue shapes and false for the other two.

forceCbpMasterDetailRequired (packages/spec/src/data/object.zod.ts) returns early on required === true and never inspects readonly / system. So the two provenance-flagged shapes are still newly authorable through ObjectSchema.create() itself — not merely through raw parse. Measured by running the built dist of @objectstack/spec and @objectstack/lint:

===== A. builder path: ObjectSchema.create() =====
M1   CBP + master_detail, `required` OMITTED          -> ok=true required=true   (forced)
M1c  CONTROL same shape, sharingModel private          -> ok=true required=false  (not forced)
M2   CBP + master_detail + `required: false`           -> ok=false  (refused, located error)
M2c  CONTROL same shape, sharingModel private          -> ok=true required=false  (accepted)
M3   CBP + master_detail + required:true + READONLY    -> ok=true  ACCEPTED
M4   CBP + master_detail + required:true + SYSTEM      -> ok=true  ACCEPTED
M5   CBP + master_detail + READONLY, required OMITTED  -> ok=true required=true readonly=true
M5b  CBP + master_detail + SYSTEM,   required OMITTED  -> ok=true required=true system=true

===== B. raw parse path: ObjectSchema.safeParse() =====
M6   safeParse CBP + `required: false`   -> success=true  required=false
M7   safeParse CBP + required OMITTED    -> success=true  required=false   (not forced at parse)
M7c  CONTROL safeParse with alias `isRequired` -> success=false unrecognized_keys@fields.order_id

===== C. lint relationship/master-detail-required =====
M8   required OMITTED            -> ["warning"]   | also fired: delete-behavior, line-items-inline-edit
M9   required:true + READONLY    -> []            | also fired: delete-behavior, line-items-inline-edit
M10  required:true + SYSTEM      -> []            | also fired: delete-behavior, line-items-inline-edit
M11  required:false              -> ["warning"]   | also fired: delete-behavior, line-items-inline-edit

Every zero above is a reading, not an absence:

• M9 / M10 report no master-detail-required finding, and in the same lint call two other rules do fire — so the linter is live on that object and the zero is about the predicate, which is still def.required !== true at severity: 'warning'.
• M7c is the control for the parse leg: the same safeParse refuses an alias key, so M6/M7's success=true is a decision and not a comparator that always says yes.
• M1c / M2c are the controls for the builder leg: the same shapes under sharingModel: 'private' are not forced and not refused, so the force is CBP-scoped rather than unconditional.

M5 / M5b are the sharpest reading: the force mints the two flagged shapes. A readonly or system master reference authored with required omitted comes out of create() as required: true plus the flag — which is exactly a shape validateRecord skips (if (def.system || def.readonly) continue;), leaving the security gate the sole refusal. That matches omissionRefusedByValidation's own predicate, def?.type === 'master_detail' && !!def?.required && !def?.readonly && !def?.system.

The rewritten paragraph states all of that, plus the parts of the old text that re-measured true (#8772 ruled; #9139 held for v18; main still 17.x — packages/spec is 17.2.0).

The non-comment diff is empty — with a live comparator

Both versions transpiled with removeComments: true and compared two independent ways (output text and ts.createScanner token stream), plus two controls:

raw byte lengths: BASE=398918  WORKING=400382  (raw sources differ: true)

### SUBJECT - BASE vs WORKING TREE (this PR diff)
  stripped-TEXT : A sha=ee8e85d25ba0ae6b (136185 B)  B sha=ee8e85d25ba0ae6b (136185 B)  -> IDENTICAL
  TOKEN stream  : A n=11864 sha=799a1855bdacd000  B n=11864 sha=799a1855bdacd000  -> IDENTICAL

### REVERSE CONTROL - WORKING TREE + one-token CODE change ('insert' -> 'update')
  stripped-TEXT : ... -> DIFFERENT   first diff line 2241
  TOKEN stream  : ... -> DIFFERENT   first diff index 10817: A="11:'insert'" B="11:'update'"

### CONTROL 2 - WORKING TREE + comment-TEXT change
  stripped-TEXT : -> IDENTICAL
  TOKEN stream  : -> IDENTICAL

subject non-comment diff EMPTY     : true
reverse control reports NON-empty  : true
comment-only control reports EMPTY : true
OVERALL: PASS

Exit code captured before any pipe: node noncomment-diff.cjs ... ; echo "EXIT=$?" gave 0. An earlier run exited 9 because control 2's anchor matched 0 times — reported as NOT RUN, not as a pass; the anchor was fixed and the control then actually ran.

Gates

Re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path arguments — the script took the change set from the merge base itself), both output sections read whole. 21 matched families plus 2 convention-triggered i18n families. All run at 1d1263f26:

• 22 PASS — including check:comment-mask-adoption, check:doc-authoring, check:keyed-text-bounds, check:system-context-census (whose declared population is literally this file), check:tenant-audit-census, check:published-files, check:test-source-alias, check:type-source-resolution, check:nul-bytes, and check:i18n-stale-fill.
• pnpm check:i18n first exited 1 with its own verdict line reading PREREQUISITE NOT MET — the workspace CLI is not built / "Nothing was checked". Not recorded as a red: the named build closure was run and the gate then passed, reporting plugins/plugin-security in sync (7 bundle(s)) and OK (9 package(s)).
• 2 NOT MEASURED, both exit 3, neither a pass and neither a red:
  • check-test-completeness — grades a saved turbo run test log; the gate's own text says to record the local reading as NOT MEASURED. CI supplies the log.
  • check:dual-build-cjs-loads — needs a full pnpm build; still reports missing dist/ for ~73 packages after the i18n closure. CI runs it.

Beyond the family: pnpm lint (eslint . --no-inline-config) run repo-wide in the foreground, exit 0, 5623 files linted, 0 findings — and this PR's file is confirmed present in that population at errors=0 warnings=0, so the zero is a measurement rather than a file eslint never opened. pnpm --filter @objectstack/plugin-security typecheck exit 0 (it runs tsconfig.test.json too). @objectstack/plugin-security vitest: 94 files / 1764 tests passed.

No changeset: comments-only, publishes nothing. Same disposition as #14049, the reference PR for this shape, which carried skip-changeset for a diff that included this same file.

Out of scope, filed not fixed

#14130 — the adjacent [#9137] freeze note cites record-validator.ts:993 / :1003 for the provenance skip; both anchors have rotted (the guard is at :1037 / :1047, and :993/:1003 land on unrelated docblock prose while still being in range). Filed unassigned rather than folded in, because #13722's ruling fences this card to the one paragraph. Same class as #13556, different carrier.

The repo-wide sweep of similar stale comments is not addressed here; that surface belongs to #14046, which stays open.

Generated by Claude Code