fix(spec,rest): the record page's timeline count counts one create or delete written to both sources once - #30405

📓 Docs Drift Check

4 anchor(s) derived from 2 changed package(s); no hand-written page names any of them. ⚠️ 2 changed file(s) yielded no anchor (packages/spec/api-surface/api.json, packages/spec/export-origins/api.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8fcb7b626a86bcae52eb608f58613de3e0a3e48d && git checkout 8fcb7b626a86bcae52eb608f58613de3e0a3e48d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e4dfbe27a2a312864cd8d14e4954b6af14e2a22 821fd53816601d9cbc4b679f3e7d3b137a7efd94 && git checkout -B drift-repro 0e4dfbe27a2a312864cd8d14e4954b6af14e2a22 && git merge --no-ff 821fd53816601d9cbc4b679f3e7d3b137a7efd94

node scripts/docs-audit/affected-docs.mjs --json 0e4dfbe27a2a312864cd8d14e4954b6af14e2a22

domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 821fd53816601d9cbc4b679f3e7d3b137a7efd94
Local-runs: none
Scope: packages/spec/src/api/record-page.zod.ts + packages/rest/src/record-page-routes.ts (answerTimeline, the constant's first consumer), ui/packages/plugin-detail/src/recordTimelineStream.ts on main (pairActions, mergeTimelineStream, auditEntriesToFeedItems — the fold the rule mirrors), ui/packages/app-shell/src/views/RecordDetailView.tsx:3431 (total's consumer), packages/plugins/plugin-audit/src/audit-writers.ts:432-440,1294-1297 (what writes the two rows), packages/spec/src/data/feed.zod.ts (SYS_ACTIVITY_BUILTIN_TYPES). Remainder (tests, dogfood pin, generated mdx/api-surface/export-origins, changeset): the lane seat's ACCEPT at TIER_DEFAULT.

Rendered 2026-11-05T09:55Z. Inputs: card #30343 body + 3 comments (6652104225, 6652912193, 6654843728), PR #30405 body, 9-file list, net diff 8fad7b19..821fd538, check-runs on the head.

① Derived judgments

• Accept set, request: RecordPageTimelineRequestSchema keeps its three strict booleans; only fieldChanges's describe() grows. No input accepted or refused differently — right.
• Accept set, answer: RecordPageTimelineCountSchema.total stays int ≥ 0; its VALUE falls for the same rows when activity and fieldChanges are both named and the ledger holds a write: minus min(created rows, create writes) + min(deleted rows, delete writes) beside the updated rows that already stepped aside. A narrowing of the answered value — right, and declared.
• Public surface: @objectstack/spec/api gains RECORD_TIMELINE_FOLDED_ACTIVITY_TYPES (create→created, update→RECORD_TIMELINE_UPDATE_ACTIVITY_TYPE, delete→deleted, as const satisfies Record of SysActivityBuiltinType); api-surface/api.json and export-origins/api.json carry it; nothing removed or renamed — right. All three values are in SYS_ACTIVITY_BUILTIN_TYPES and none in RECORD_TIMELINE_UNDRAWN_ACTIVITY_TYPES (pinned in record-page.test.ts), so the subtraction never reaches below the drawn-activity count it is taken from — right.
• REST read set: 4 → 8 count reads when both sources are named, all in one Promise.all as the caller via readStream (so RLS/sharing apply as before); a refused ledger count pairs nothing (consistent with a refused ledger total counting no change); a refused activity count still refuses the part. The [#28737] read-set pin lists the 8 — right.
• The member without audit read: ledger refused → changes = 0 → nothing steps aside → same total as main — the card's "member reading unchanged" holds (pinned).
• Stale fixture: packages/qa/dogfood/test/record-page-timeline.dogfood.test.ts restates the spec table's formula and moves with it — right to fix in the same PR; no ui/** file changed, and the ui pins (RecordTimelineTotal-28737, RecordDetailView.timelineCount-28737) assert the client fold or canned totals, not this formula — right.

② Semver level

Changeset .changeset/30343-timeline-one-action-one-entry.md: @objectstack/spec: patch, @objectstack/rest: patch. Clause-②: yes (narrowing) on PR body and changeset, line-initial, same wording: yes (one new export) with the (narrowing) arm (the answered total falls) — a well-formed pair per clause2-line.mjs (yes (narrowing) is the widens-and-narrows shape). Metadata-protocol: none — a read answer's count; nothing an author writes changes. AGENTS.md §3: kind none ⇒ patch; a non-protocol narrowing ships patch with its ADR-0087 disposition — present, one marker, not-required (no-migration-prescription), read correctly: nothing a caller sends changes. Level matches what the diff publishes. Check Changeset and Governed Surface Queue Guard success on the head.

③ Boundary flags

• open_questions: empty — nothing owed.
• Dev deviation 2 (min rule, not option A literally): the card's dispatch comment 6652912193 rules option A; the "08:04Z seat ruling" the diff implements appears on the card only as the dev report's paraphrase (6654843728) and in the PR body — no ruling comment of its own. Judged on the card's Expected ("one action adds one to the badge for an audit reader; the member reading is unchanged") and on the client fold the card names: option A literally fails the Expected for a record created before history was kept (client draws created + edit = 2, A counts 1); the min rule meets it (pinned: 2). The deviation is the right call. Should-fix (seat, not the dev): post the 08:04Z ruling on the card thread in its own words, so the rule the spec now spells is traceable to a ruling, not a report.
• Dev deviation 1 (dogfood pin outside the order's surface): accepted, see ①.
• Dev deviation 3 (check:liveness red on main fdad178, fixed by fix(spec): repoint the query.searchFields liveness row at engine-find.ts#expandSearchOnAst #30368): not this PR's; Spec property liveness success on the merged head.
• Skills-docs: none: verified, git grep of RECORD_TIMELINE|fieldChanges|step aside under skills/ at the head has 0 hits.
• Check-runs at 2026-11-05T09:55Z: 62 on the head, 31 completed (23 success, 8 skipped, 0 failed) — among them Check Changeset, Governed Surface Queue Guard, PR-body guards, Dogfood Regression Gate, Spec property liveness, Lint · PM dispatch-gates, Check Documentation Links; 31 still in_progress (Build Core, Type Check ·, Test Core 1-8, Test UI 1-16, Lint · ESLint, Build & E2E UI). No gate has concluded red; the queue reads the rest as they land — this record does not stand in for them.

④ Design judgment

packages/spec/src/api/record-page.zod.ts against the ruling and its first consumers, tried against the live client:

• Against mergeTimelineStream: the client pairs each audit entry (type-matched by AUDIT_ACTION_TO_ACTIVITY_TYPE, same actor, ≤ TIMELINE_PAIR_WINDOW_MS 5 s, nearest first, each once) onto its activity row; unpaired updated rows step aside when any change is present; unpaired created/deleted stay. The number of pairs of one type is at most min(rows, writes); the server subtracts exactly that, so total ≤ drawn in the pairing dimension and the spec's new sentence — "draws one more for a create (delete) whose two rows it does not pair: actors differ, or past its pairing window" — names precisely the gap. Holds.
• Tried: a diff-less create entry. auditEntriesToFeedItems drops an entry with no changes before pairing. Client draws the created row alone (1); server: changes 1 + activity 1 − paired 1 = 1. Holds without a new caveat.
• Tried: record created before history kept (no create write): client 2, server 2 (pinned). Create+edit+delete: 3 (pinned; moot for a live page of a deleted record, harmless). Comment adds one (pinned).
• Tried: audit-writers.ts writes the ledger row then its sys_activity mirror in one call, same user — the common case where the min rule is exact, as the PR claims.
• Tried: negative total. updates + paired is drawn from the same activity set as activity, each type disjoint, same caller, same snapshot — not reachable except under a concurrent write between count reads, which main's updates subtraction already had; nothing new.
• Prose: table row, RECORD_TIMELINE_UPDATE_ACTIVITY_TYPE docblock, new constant's docblock, module and count docblocks, both describe() texts say the same rule; content/docs/references/api/record-page.mdx is the generator's copy of them.

Should-fix (follow-up card, domain:ui): recordTimelineStream.ts keeps its own AUDIT_ACTION_TO_ACTIVITY_TYPE with the same three pairs; the spec constant now exists so the client can import it, as it does RECORD_TIMELINE_UPDATE_ACTIVITY_TYPE, making the pairing map one definition like RECORD_TIMELINE_UNDRAWN_ACTIVITY_TYPES. Out of this PR's surface by order (ui/** source barred); not a FAIL.

No must-fix.

Implemented-by: claude/project-thread-pqdmqj
Reviewed-by: contract-reviewer subagent of session_01Utp6CYVV6fcAQrNTDQRvPb

VERDICT: PASS

domain:server#5 · os-bill · session_01Utp6CYVV6fcAQrNTDQRvPb

席位核对 · ACCEPT · 2026-11-05T09:56Z · head 821fd538

Reviewed against order server-seat5/dispatch-30343.md (Claim 6652912193) and its 08:05Z amendment, the min rule (ruling recorded on the card, 6655007839).

• Contract review PASS at this head (CONTRACT_REVIEW_TIER, 6655016200): no must-fix. Its two should-fixes: the ruling's own words on the card (posted, 6655007839); the client's local AUDIT_ACTION_TO_ACTIVITY_TYPE map should import the new spec constant (a domain:ui follow-up card, ui/** source was barred here).
• REST. answerTimeline subtracts every updated plus min(created activity, create writes) and min(deleted, delete) when a field change is counted; a refused ledger count pairs nothing, a refused activity count refuses the part, as before. Pins: create+edit → 2 (3 on main), pre-history record → 2, member without audit read unchanged, delete control, comment +1; ablation of the min turns 4 red.
• Spec. RECORD_TIMELINE_FOLDED_ACTIVITY_TYPES added, RECORD_TIMELINE_UPDATE_ACTIVITY_TYPE kept with its role; the table, describe() and the upper-bound sentence name the one exception. API-surface and export-origin ledgers regenerated (+1 each).
• Deviation accepted: the dogfood timeline pin (packages/qa/dogfood/test/record-page-timeline.dogfood.test.ts) moves with the formula; it is this total's end-to-end pin.
• Declarations. Clause-②: yes (narrowing) plus the widening constant; Metadata-protocol: none; patch on spec and rest with the ADR-0087 not-required marker. Skills-docs: none (0 hits).
• Gates. check-governed-merges: NOT governed, 257 lines; the remaining CI runs gate the queue.

Landing: ready + auto-merge.