fix: a disabled package's objects leave /auth/me/permissions, and actions that launch into it are no longer served - #28969

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/core, @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/plugin-hono-server, @objectstack/plugin-security, touching 23 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/core/src/security/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

17 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json ff88105061012c8b14f7ec937d7b3113e404e922.

⛔ 8 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 74fc7b4d305b168d7c329958d009a8022d42172f && git checkout 74fc7b4d305b168d7c329958d009a8022d42172f
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ff88105061012c8b14f7ec937d7b3113e404e922 0a0e00229cd391adb51908655bf967c0008bef4b && git checkout -B drift-repro ff88105061012c8b14f7ec937d7b3113e404e922 && git merge --no-ff 0a0e00229cd391adb51908655bf967c0008bef4b

node scripts/docs-audit/affected-docs.mjs --json ff88105061012c8b14f7ec937d7b3113e404e922

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ff88105061012c8b14f7ec937d7b3113e404e922 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 934a10f59b985b8de6035b99e2434b0b7ea21457
Local-runs: none
Scope: packages/core/src/security/effective-object-permissions.ts, packages/core/src/security/effective-object-permissions.test.ts, packages/core/src/security/index.ts, packages/metadata-protocol/src/protocol.ts, packages/metadata-protocol/src/protocol-meta-item-face.ts, packages/objectql/src/registry.ts, packages/objectql/src/bound-action-foreign-object.test.ts, packages/objectql/src/package-disable-enforcement.test.ts, packages/plugins/plugin-hono-server/src/current-user-endpoints.ts, packages/plugins/plugin-hono-server/src/current-user-endpoints-effective-objects.test.ts, packages/plugins/plugin-security/src/security-plugin.ts, packages/plugins/plugin-security/src/get-effective-object-permissions.test.ts + packages/runtime/src/action-execution.ts (resolveRouteActionDeclaration), packages/runtime/src/domains/actions.ts (the dispatch door), packages/runtime/src/domains/packages.ts (the enable door's gate), packages/objectql/src/engine.ts (getSchema, the current_user.can() resolver seam), scripts/check-changeset-no-major.mjs and scripts/check-adr-0087-registration.mjs (ruling A on #25105, the level rule), .changeset/28877-disabled-package-grants-and-launch-actions.md (the declaration under review, read against the rule)

Reviewed at 2026-11-02T05:13Z against merge-base b15b634c16845712490ae43f889516e813c9390a (two commits: de04ea75, 934a10f5). Face: Clause-②: yes (narrowing) on the PR body and the changeset ⇒ the narrowing face; record-recognisers --paths finds no schema or governed path, so the floor is every path of the diff outside the prose faces (all twelve above). Author objectstack-fleet[bot].

① Derived judgments

Row 1 — /auth/me/permissions leaves out a disabled package's objects. RIGHT.

• One predicate, no second spelling. registryObjectPackageDisabled(registry) calls registry.isObjectPackageDisabled(name) on the registry itself. The data plane's refusal (assertObjectRegistered → isObjectOfDisabledPackage in protocol.ts) calls the same method. SchemaRegistry.isObjectPackageDisabled resolves the name through resolveObjectKey and asks the OWNER's package (#7557), so the map leaves out exactly the objects /data/<object> refuses 404 OBJECT_PACKAGE_DISABLED. The objectql pin asserts both halves on one harness (assertObjectRegistered throws the code; the map has no entry).
• Byte-identical doors. The only two production builders of the map are plugin-hono-server (/auth/me/permissions) and plugin-security (ISecurityService.getEffectiveObjectPermissions); both hand isObjectPackageDisabled: registryObjectPackageDisabled(ql?.registry). The engine's current_user.can() resolver seam is registered by the security plugin with that same method (registerEffectiveObjectPermissionsResolver), so the console, the server's visibleWhen/formula/defaultValue evaluation and the write wall read one map. The hono and security pins assert JSON.stringify equality with the core function; the security pin evaluates current_user.can('deal','read') through ExpressionEngine and gets false for an admin (super-user seed) and a member (explicit grant). The hono route's catch answers the closed shape and needs no accessor.
• can() false: the omission runs LAST, over the explicit grant, the super-user seed and the wildcard's coverage; the '*' entry is kept (it is not an object, and objectPermissionGrants reads the object's own entry). Pinned per source in core and for read/create/edit/delete in objectql.
• Re-enable without restart: core caches nothing; the security plugin memoises set resolution, not the map; the registry's enablePackage flips the record in place. Pinned in objectql, hono and security.
• No caller left out. git grep buildEffectiveObjectPermissions on the head: the two doors above and the tests; nothing builds the map without the accessor. Failure posture: a registry without the method disables nothing, and a throwing predicate warns and leaves the map whole (the same guard as the seed and the apiOperations annotation). That is fail-open to main's answer, display-only, since the data plane still refuses the object; it matches isObjectOfDisabledPackage's optional-call posture and is acceptable.
• Not pruned, by the order's wording: the fields slot still carries OBJECT.FIELD entries of a disabled object. can() does not read it; the dev records it as a carrier-seat finding. Noted, not a defect of this PR.

Row 2 — an action launching into a disabled package is withheld where #24400 withholds. RIGHT, with one acceptance-note correction (should-fix 1).

• The seam is spec(object-extension): the extension refusal says defineStack() attaches a top-level action with objectName: '<target>', but for another package's object it is never attached and the served object lacks it #24400's. boundServedActions replaced isPackageDisabled(_packageId) with isActionWithheldByDisabledPackage(action), whose first arm is that same test, so spec(object-extension): the extension refusal says defineStack() attaches a top-level action with objectName: '<target>', but for another package's object it is never attached and the served object lacks it #24400's rule is a strict subset. The three new arms: objectName object of a disabled package (see Premise correction), type: 'flow' target that only disabled packages ship (isFlowOfDisabledPackage), and a param objectOverride naming an object of a disabled package (isObjectPackageDisabled, the row-1 predicate). hasDisabledPackage() short-circuits the walk when nothing is disabled, so an enabled installation pays nothing and serves exactly what it served.
• Three served faces, one predicate: (a) the served object fold — attachBoundActions on the 'served' layer filters the object's OWN actions (where defineStack() leaves a same-stack bound action) and attaches only boundServedActions; registry.getObject and the protocol's getMetaItem({type:'object'}) both end there; (b) the protocol's effective served list — readFlattenedMetaItems filters only when request.type === 'action' && audience === 'served' && servedOverride (layer: 'effective'), which is what GET /meta/action calls; (c) the served by-name read — readMetaItemFace with face === 'served' answers a withheld action as a name with nothing behind it, as isItemOfDisabledPackage does. All three are pinned in one block on the real ObjectQL + protocol harness.
• Unchanged, and rightly: getMetaItemsForExecution / getMetaItemForExecution (audience 'execution'), getMetaItemsPerPackage (layer: 'per-package', servedOverride false — the package export), and the code layer (attachBoundActions(..., 'code'), getArtifactItem). The execution plane keeps the declaration so the ADR-0066 D4 gate, the activation ledger and the dispatch trichotomy still read it; the package export keeps what the package ships. Pinned ("the execution list and the code layer keep what each package ships").
• "Flow target only served by a disabled package": isFlowOfDisabledPackage answers true only when at least one flow of that name is registered AND every one is owned by a disabled package; a twin flow from an enabled package, a runtime-authored row with no _packageId, or a name the registry holds no flow for are not disabled. Right: the automation engine binds from the list, which omits only a disabled package's items, so a twin keeps the launch alive. Pinned including the twin registered AFTER the disable (which exercises the new registerItem('flow') invalidation).
• Cache invalidation is complete for the new verdict inputs: a flow registered or unregistered while any package is disabled, a package uninstall that removes flow/ items, and the uninstall of a disabled package each invalidateAll(); disable/enable already did (spec(object-extension): the extension refusal says defineStack() attaches a top-level action with objectName: '<target>', but for another package's object it is never attached and the served object lacks it #24400). A7 reddens exactly the twin-flow case.
• A withheld own-action still blocks an attached twin of its name (present is built from base, not kept): deliberate, so nothing stands in for a withheld action.

Premise correction (the objectName arm). IN SCOPE as a bounded in-place fix, and declared. The order says "withheld wherever #24400 withholds an action bound to a disabled package's object" on GET /api/v1/meta/action. The dev measured on the first head that #24400 withheld it only by hiding the object: the enabled package's action bound by objectName to the module's object was still listed and served by name (listed= true byName= true object= OBJECT_PACKAGE_DISABLED). The arm is one line on the same predicate, in the same files and gate families, pinned by bound_to_member in the [#28877] block, ablated A8 (reddens only that case, 46/47), and declared in the changeset's FROM (third bullet) and TO (objectql bullet) and in the PR body's Acceptance notes. Not scope creep: without it row 2's "wherever #24400 withholds" would be false on /meta/action. The seat records the premise correction on the card at hand-back.

Row 3. Not touched; answered by row 2 (the dialog is not reached once the action is withheld). The seat answers row 3 on the card.

Caller classes. Admin and member are both measured for row 1 (security pin: ops_admin seed, sales grant; objectql pin: wildcard and explicit grant). Row 2 reads no caller: the withholding is in the served metadata. Nothing that legitimately needs a disabled package loses access: the Packages page reads GET /api/v1/packages (the package type is never filtered) and PATCH /packages/:id/enable is gated on the manage_metadata system permission, not the object map; /meta/object already omitted the disabled objects before this PR. A system context gets the same omission, which is consistent: assertObjectRegistered refuses every caller. The dispatch door POST /actions/OBJECT/ACTION is unchanged in code; see should-fix 1 for its answer.

Out of scope held. No change to navigation, the disable door or the data-plane refusal.

Evidence. Red first: row 2 at BASE for the three row-2 files reddens exactly the "disabled" and twin-flow cases (2/47), row-1 files green; row 1 with the omission ablated reddens exactly the omission cases in all four packages, row-2 cases green. Ablations A3–A8 each redden only their own cases (A3 protocol filter: the list assertion only; A4 flow arm: "disabled" + twin; A5 override arm; A6 own-actions filter: the inline action; A7 flow-registration invalidation: the twin; A8 objectName arm). Controls: before-disable, re-enable, twin flow, execution list, code layer, '*' kept, the other package untouched. Full package suites green on de04ea75, the second commit re-run in its own files on 934a10f5 (47/47); typecheck exit 0 on all five. Full dogfood battery on 934a10f5 (narrowing arm): 382 files / 3156 tests passed, no failure. Gates: 71 derived, 70 exit 0, check:dual-build-cjs-loads NOT MEASURED locally (needs every dist/), left to CI's Build Core. Overlap: #28903 (app-shell PackagesPage, UI) and #28889 (closed, UI permissions provider) touch none of this diff's files.

CI on the head at review time: no red. Completed success: Check Changeset, Governed Surface Queue Guard, Dogfood Regression Gate, every Lint lane, Type Check · source gates and · debt ledger, Live E2E UI, PR-body guards, Check PR Size, Flag docs. Still in progress: Build Core (carries dual-build-cjs-loads), Test Core 1–8, Type Check · workspace and · consumer gates, Build & E2E UI, Test UI 1–16, Type Check UI. The landing precheck ② is the seat's read of the final check-runs.

② Semver level

Declared: Clause-②: yes (narrowing) · Metadata-protocol: narrowed · minor on core, objectql, metadata-protocol, plugin-hono-server, plugin-security · BREAKING banner with FROM → TO · <!-- adr-0087: not-required (no-migration-prescription) … -->. PR body and changeset agree with each other, and the level follows the declared kind, so the gates are green.

Judged:

• Clause-②: yes (narrowing) — RIGHT. The published surface widens (one optional member on EffectiveObjectPermissionsSchemaSource, registryObjectPackageDisabled, isActionWithheldByDisabledPackage on the registry and the protocol module) and two served answers narrow while a package is disabled. yes + the (narrowing) arm is the one legal spelling for widen+narrow.
• Metadata-protocol: narrowed — WRONG. The kind is "the change to what a metadata author can write": narrowed is a key removed or tombstoned, a value refused, a requirement tightened. Nothing an author writes is refused or tightened here: every object, flow, action, type: 'flow' target and objectOverride is accepted exactly as before, and the changeset's own ADR-0087 marker says so in terms ("no spec key, authorable spelling, export or stored shape is removed, renamed or re-shaped"). What narrows is two served answers under a runtime package state. That is a non-protocol narrowing, and ruling A on changeset levels: minor only when the metadata protocol changes (added / narrowed / semantic), patch otherwise; release notes grouped by what the reader must do (maintainer ruling A, 2026-10-21) #25105 (check-changeset-no-major.mjs, its ruling block and self-test) says: "A non-protocol widening (REST) or narrowing (a driver, a posture) ships patch and keeps its BREAKING banner and its ADR-0087 disposition unchanged." The repo's precedent is exactly this shape: eleven changesets with Clause-②: yes (narrowing) + Metadata-protocol: none at patch (the orgless-boot refusal, the CBP master boot refusal, the plugin-auth load refusal, the datasource-refused line in objectql, …), each banner saying "it changes what boots/serves, not what a metadata author can write, so it ships as patch".
• Consequence of the mis-declaration: narrowed is a breaking carrier of its own (signal 5 in the ADR-0087 gate) and the release-notes classifier files a narrowed bullet with a not-required disposition under "需手动处理 — action required: narrowed, with no ADR-0087 conversion", telling every reader of five packages' release notes that an authored key needs hand migration. None does. The five-package minor footprint follows the same error: under none every introduced entry is patch, and the level gate refuses a minor beside none, so the two lines and the five levels move together.
• adr-0087: not-required (no-migration-prescription) — RIGHT, and still required after the fix: the (narrowing) arm and the BREAKING banner each declare breaking, so a disposition is owed, and this category is the honest one (no migration prescription anywhere in the body; the gate validated it, exit 0 locally and Check Changeset green).
• Five packages, not one: right. Each of the five publishes a changed runtime (core: the function; objectql: the predicate and the fold; metadata-protocol: the list and by-name filters; the two plugins: the accessor handed over). After the fix, five patch entries.

Must-fix M1 (changeset + PR body, no code): in .changeset/28877-disabled-package-grants-and-launch-actions.md and the PR body, Metadata-protocol: none; all five frontmatter entries patch; the banner line reads "shipped as patch" (a served-answer narrowing, not what an author writes). Keep Clause-②: yes (narrowing), the BREAKING banner, FROM → TO and the adr-0087: not-required (no-migration-prescription) marker unchanged.

③ Boundary flags

• open_questions: none from the dev.
• Dev-flagged, out-of-scope findings (carrier: the seat), both read and agreed: the fields slot still carries a disabled object's OBJECT.FIELD entries (harmless, can() reads objects); the dispatch door still answers its own 404. Neither needs a card now.
• Should-fix S1 (PR body wording, no code): the Acceptance note "the dispatch door … still answers the launch's own refusal (404 "Flow … not found")" is true for a bound action that keeps a top-level copy (the execution by-name read finds it, ownsRoute admits it, the launch fails), but not for an action declared only inside the object (the test's inline_enroll): resolveRouteActionDeclaration reads ql.getSchema = registry.getObject = the served fold, misses the withheld embedded action, and the execution by-name read has no standalone item, so the answer is ADR-0110 D3's "no declaration" 404. Fail-closed, nothing runs ungated, the console no longer draws the button; only the note's text is wrong.
• Should-fix S2 (hand-back): the seat records on the card the premise correction (spec(object-extension): the extension refusal says defineStack() attaches a top-level action with objectName: '<target>', but for another package's object it is never attached and the served object lacks it #24400 hid a bound action only by hiding its object; the objectName arm closes it), answers row 3 as "answered by row 2", and notes the fields slot finding as carried.
• Landing precheck ②: CI was in progress at review time with no red; the seat reads the final check-runs (Build Core for dual-build-cjs-loads, Test Core, Type Check workspace/consumer) before queueing.
• Overlap: none on this diff's files (feat(app-shell): offer Disable / Enable on a suite's module rows from the served disableable verdict #28903 is the UI disable toggle, the same feature's other half; fix(plugin-list): offer the In a queue toggle only when the organization has a queue #28889 closed).
• Author is objectstack-fleet[bot]: no login note owed.

Implemented-by: claude/project-thread-ads4rl
Reviewed-by: session_0186vfjHHMsRXC9EUT9hTFMo

VERDICT: FAIL — one must-fix (M1, the Metadata-protocol: kind and the five levels; prose faces only, no code change). Rows 1 and 2 are correct against ruling A on #28117 and #24400's seam; re-review on the corrected head is a declaration read.

Generated by Claude Code

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0a0e00229cd391adb51908655bf967c0008bef4b
Local-runs: none
Scope: packages/core/src/security/effective-object-permissions.ts, packages/core/src/security/effective-object-permissions.test.ts, packages/core/src/security/index.ts, packages/metadata-protocol/src/protocol.ts, packages/metadata-protocol/src/protocol-meta-item-face.ts, packages/objectql/src/registry.ts, packages/objectql/src/bound-action-foreign-object.test.ts, packages/objectql/src/package-disable-enforcement.test.ts, packages/plugins/plugin-hono-server/src/current-user-endpoints.ts, packages/plugins/plugin-hono-server/src/current-user-endpoints-effective-objects.test.ts, packages/plugins/plugin-security/src/security-plugin.ts, packages/plugins/plugin-security/src/get-effective-object-permissions.test.ts + packages/runtime/src/action-execution.ts (resolveRouteActionDeclaration), packages/runtime/src/domains/actions.ts (the dispatch door), packages/spec/src/stack.zod.ts (mergeActionsIntoObjects, copies and keeps the top-level action), scripts/check-changeset-no-major.mjs (ruling A on #25105), .changeset/28877-disabled-package-grants-and-launch-actions.md (the corrected declaration)

Round 2, reviewed at 2026-11-02T05:23Z. Re-pin of the record on 934a10f5 (comment 6569625622, FAIL on M1) onto the new head. Merge-base unchanged (b15b634c). git diff 934a10f5..0a0e0022: one file, the changeset, +7/−7, nothing else — the code tree, the twelve floor paths and every test are byte-identical to the reviewed head, so ① of the first record stands unchanged and is not re-derived here. Author objectstack-fleet[bot].

① Derived judgments

• Rows 1 and 2, the premise correction, caller classes, evidence and overlap: as recorded on 934a10f5, unchanged (same tree). RIGHT.
• New PR body, checked for accuracy. Declaration lines read Clause-②: yes (narrowing) / Metadata-protocol: none, matching the changeset. No stale narrowed or minor wording remains anywhere in the body. The dispatch-door Acceptance bullet now separates the two cases correctly: an action with a top-level copy (a bound action registered as a standalone action item) still resolves through the execution by-name read and answers the launch's own 404 "Flow … not found"; an action declared only inside its object's actions is no longer in the served fold ql.getSchema reads, so the door answers the ADR-0110 D3 "no declaration" 404. Both facts hold on the code: resolveRouteActionDeclaration reads ql.getSchema = registry.getObject (served) first, then the execution by-name read. The HotCRM example is right: generate_quote is a top-level action with objectName: 'crm_opportunity' (src/sales/actions/opportunity.actions.ts in the hotcrm checkout) and defineStack()'s merge only copies it into the object, keeping the top-level item. The bullet says the inline case is read from the review and not re-measured on this head; honest, and S1 is closed.
• The Verification block says what the new head changes (changeset only) and that the three changeset gates exit 0 on it locally; CI confirms the same (below), which is the reading this record relies on.

② Semver level

• M1 closed. Changeset frontmatter: core, objectql, metadata-protocol, plugin-hono-server, plugin-security all patch. Body: Clause-②: yes (narrowing), Metadata-protocol: none, the BREAKING banner now reads "shipped as patch: a non-protocol narrowing takes patch and keeps this banner and its ADR-0087 disposition (no authored value is refused)", FROM → TO unchanged, <!-- adr-0087: not-required (no-migration-prescription) … --> unchanged. That is exactly ruling A on changeset levels: minor only when the metadata protocol changes (added / narrowed / semantic), patch otherwise; release notes grouped by what the reader must do (maintainer ruling A, 2026-10-21) #25105 (check-changeset-no-major.mjs: "A non-protocol widening (REST) or narrowing (a driver, a posture) ships patch and keeps its BREAKING banner and its ADR-0087 disposition unchanged") and the repo's precedent for served-answer and boot-refusal narrowings.
• Level and kind agree: none ⇒ every introduced entry patch; the (narrowing) arm and the banner still declare breaking, so the ADR-0087 disposition is owed and not-required (no-migration-prescription) remains the honest one (no migration prescription in the body).
• Changeset gates on the head, read from CI check-runs. Two Check Changeset runs exist on 0a0e0022: the first (started before the PR body was patched) is red — its annotation quotes Metadata-protocol: narrowed read from the PR body against the five patch levels, i.e. the body/changeset disagreement that existed for a few minutes, not a defect of the head. The re-run after the body edit (job 125109296368) is completed :: success: check-empty-changeset (added 1, none modified), check-adr-0087-registration (one declared-breaking changeset, not-required (no-migration-prescription), notice-level only) and check-changeset-no-major all pass. The newest run governs. Governed Surface Queue Guard, PR-body guards, every Lint lane, Dogfood Regression Gate, Type Check · source gates and · debt ledger: success.

③ Boundary flags

• S1 (dispatch-door note) closed in the body; S2 (hand-back of the premise correction, row 3, the fields finding to the card) is the seat's, unchanged.
• The old head's Test UI and TypeScript Type Check parents read failure only because their shards were cancelled when this push superseded them (annotations: "concluded 'cancelled', not success"); no test or type signature, nothing to carry.
• Landing precheck ②: at review time Build Core (carries dual-build-cjs-loads), Test Core 1–8, Test UI 1–16, Type Check · workspace, · consumer gates and UI, Build & E2E UI and Live E2E UI are still in progress on 0a0e0022, with no red among them; the seat reads the final check-runs before queueing. No local run was made.
• open_questions: none. Overlap: unchanged (feat(app-shell): offer Disable / Enable on a suite's module rows from the served disableable verdict #28903 UI, fix(plugin-list): offer the In a queue toggle only when the organization has a queue #28889 closed).

Implemented-by: claude/project-thread-ads4rl
Reviewed-by: session_0186vfjHHMsRXC9EUT9hTFMo

VERDICT: PASS — M1 and S1 closed on 0a0e0022; declaration, levels and disposition agree with ruling A; the code tree is the one reviewed on 934a10f5.

Generated by Claude Code

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-11-02T05:24Z · head 0a0e0022 · claimed by seat 2 on #28877

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」.

1. Shape:
   • A draft against main that fixes disabled package: /auth/me/permissions still grants its objects so current_user.can() stays true, and an app action whose flow ships in the disabled package is still drawn and fails with Flow not found #28877. It declares Clause-②: yes (narrowing) and Metadata-protocol: none, and ships patch with the BREAKING banner and FROM→TO, per ruling A on changeset levels: minor only when the metadata protocol changes (added / narrowed / semantic), patch otherwise; release notes grouped by what the reader must do (maintainer ruling A, 2026-10-21) #25105.
   • check-governed-merges --pr 28969 reads NOT governed (0 of 13 paths), +510 / -18. Landing tier S.
2. Contract review at CONTRACT_REVIEW_TIER:
   • Round 1 on 934a10f5 (6569625622) failed on M1 only, the changeset level and declaration.
   • Round 2 on this head 0a0e0022 (6569759873) is a PASS. M1 is closed, the code tree is identical to round 1's, and S1 (the dispatch-door bullet in the body) is closed.
3. Gates:
   • The red Check Changeset run (125107869678) read the body before the body edit. Its re-run on this head (125109296368) is green.
   • The remaining lanes were still running at the time of this ACCEPT, with no red. Auto-merge waits for them, and the merge queue re-runs CI against current main.
4. Serial: none.
5. Landing: pr_ready + automerge_enable through the relay.

Generated by Claude Code