feat(objectql,rest)!: refuse a new assignment to a banned user; count and hand over their work - #30546

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/client, @objectstack/core, @objectstack/objectql, @objectstack/rest, @objectstack/spec, touching 82 documentable anchor(s).

65 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 17566664299edac816b6672a673ac82b192d24ea.

⛔ 16 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 54c4508c65e4f01803245cc9c2da68b36bce5b53 && git checkout 54c4508c65e4f01803245cc9c2da68b36bce5b53
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 17566664299edac816b6672a673ac82b192d24ea a5de9d1e6e790b691b4a2f9fbb91f463fbbeddfe && git checkout -B drift-repro 17566664299edac816b6672a673ac82b192d24ea && git merge --no-ff a5de9d1e6e790b691b4a2f9fbb91f463fbbeddfe

node scripts/docs-audit/affected-docs.mjs --json 17566664299edac816b6672a673ac82b192d24ea

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 17566664299edac816b6672a673ac82b192d24ea → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6d576db52ec3e72f7312a74ecb257683652a5fd8
Local-runs: probe — the narrowing face has no CI reading at this head that is both green and whole (two lanes red, the rest cancelled when the head moved), so the PR's own suites and the gates the dev re-ran after the main merge were run once in a throwaway worktree at 6d576db: pnpm --filter @objectstack/objectql exec vitest run src/engine-banned-user-reference.test.ts (9/9); pnpm --filter @objectstack/core exec vitest run src/security/user-assigned-work.test.ts src/security/second-object-read-exposure.pin.test.ts (15/15); pnpm --filter @objectstack/rest exec vitest run src/user-work-routes.test.ts src/rest-server-docblock-position.test.ts src/objectql-slot-consumer-census.test.ts src/rest-server-canonical-query-ast.test.ts src/write-route-hook-refusal-sentence.ledger.test.ts src/rest-write-response-internal-fields.tripwire.test.ts (193 passed / 21 skipped); pnpm --filter @objectstack/client exec vitest run src/admin-surfaces.test.ts (10/10); pnpm run check:route-envelope, check:adr-0087-registration, check:error-code-casing, check:engine-double-contract (all exit 0). Worktree removed afterwards.
Scope: packages/spec/src/api/errors.zod.ts, packages/spec/src/system/validation-message.ts (the reviewFace hits) + the narrowing-face floor, every non-prose path of the diff: packages/objectql/src/engine-referential-integrity.ts, packages/objectql/src/engine.ts, packages/objectql/src/engine-banned-user-reference.test.ts, packages/core/src/security/user-assigned-work.ts, packages/core/src/security/user-assigned-work.test.ts, packages/core/src/security/index.ts, packages/core/src/security/second-object-read-exposure.pin.test.ts, packages/rest/src/user-work-routes.ts, packages/rest/src/user-work-routes.test.ts, packages/rest/src/rest-server.ts, packages/rest/src/rest-route-ledger.ts, packages/rest/src/rest-server-registrar-files.ts, packages/rest/src/rest-server-docblock-position.test.ts, packages/rest/src/rest-server-canonical-query-ast.test.ts, packages/rest/src/objectql-slot-consumer-census.test.ts, packages/rest/src/write-route-hook-refusal-sentence.ledger.test.ts, packages/rest/src/write-response-internal-fields.tripwire.test.ts, packages/client/src/index.ts, packages/client/src/admin-surfaces.test.ts, packages/qa/dogfood/test/authz-conformance.matrix.ts, packages/qa/dogfood/test/authz-conformance.test.ts, packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts, scripts/check-route-envelope.mjs, scripts/engine-double-contract.pinned.json + cited code read: packages/core/src/security/user-ban.ts (origin/main, #30287), packages/objectql/src/engine.ts insert/update/count/getConfigs, packages/core/src/utils/import-runner.ts, packages/rest/src/batch-routes.ts, packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts, packages/types/src/response-envelope.ts, packages/plugins/plugin-audit/src/audit-milestone-summary.test.ts, docs/adr/0112, AGENTS.md step 3, .claude/skills/pm-dispatch/references/lanes/spec.md. Prose faces (.changeset/30205-banned-user-work-handover.md, content/docs/**) are the lane seat's ACCEPT, read here only for the declaration lines.

① Derived judgments

1. The narrowing, as the tree implements it. assertReferencesResolve (engine-referential-integrity.ts) collects every caller-supplied, non-empty, non-object value of a non-readonly field whose referenceTargetOf is sys_user (a lookup to sys_user, a user field, a multi-valued member each on its own, a master_detail to sys_user too) that the existence probe resolved, then runs ONE find on sys_user ($in) under { ...context, isSystem: true } and pushes a reference_user_banned entry for each id isUserBanInForce holds. Correct: the refusal is per field, per banned member, 400 VALIDATION_FAILED with fields[].code = reference_user_banned (pinned by the objectql suite, 9/9 here). Objects: every object the engine writes, sys_* included — the write check has no platform-table exclusion, so a sys_user_permission_set.user_id grant to a banned user is refused too. The changeset's sentence ("a user field: the owner field, a user field, or a lookup to sys_user") covers that literally; the count/transfer half excludes sys_* on purpose, so the two halves are deliberately asymmetric. Judged correct, worth one clause in the changeset but not a defect.
2. Write paths. The check lives in ObjectQL.insert (single and array form, engine.ts call site 6824) and ObjectQL.update (by-id 8657 and predicate/multi 9093). That carries: POST/PATCH /api/v1/data/OBJECT; the batch door (batch-routes.ts calls ql.insert/ql.update per op); the import door (import-runner.ts writes through the engine's array-form insert()); a hook's ctx.api under a non-system context; a flow's runAs: 'system' write (keeps the check via keepsFlowWriteReferenceCheck). Exempt: any isSystem write without the flow mark (seed, install, restore, cascades), exactly as reference_not_found. The changeset's "every data write door" line is accurate.
3. NEW assignment only. The data: a multi-user field keeps a deleted user's id, so a later update carrying the field unchanged is refused reference_not_found #29062 stored-row filter runs AFTER both pushes (refused.filter(... stored.every(row => storedReferenceIds(row[r.name]).has(value)))), so a value every targeted row already stores is forgiven for the banned code as well. Verified in code and by the suite ("a row that already holds the banned user stays editable") and by the dev's real-boot row (200). Reads are untouched (the check is write-path only). Correct.
4. Fail-open on the ban read, warn once, is the probe's own posture (an integrity check that cannot run must not invent a rejection). Correct and consistent.
5. Cost of the narrowing: one extra sys_user read per non-system write that names a user. This is real and it is what reds CI: three plugin-audit read-count pins (audit-milestone-summary.test.ts:635 "a create pays ZERO reads" now sys_user: 1; audit-option-label-summary.test.ts:563 1 vs 0; implicit-reference-target-summary.test.ts:316/354 2 vs 1). The milestone test inserts biz_deal with owner: 'usr_1' under no isSystem, which is exactly the shape the new find fires on, and none of the 42 main commits merged into this head touches packages/plugins/plugin-audit, so this is the PR's red, not the base's. Must-fix (either fold the ban columns into the existing existence probe so the write pays no second read, or re-pin the three suites with the ruling recorded in them).
6. FieldErrorCode gains reference_user_banned (errors.zod.ts) with four locale templates (validation-message.ts). It is a published closed response vocabulary (FieldErrorSchema.code, ui/action-params.zod.ts code: FieldErrorCode), so the accept-set of the response schema WIDENS by one member: a consumer that switches exhaustively gains a case; nothing authorable moves (Metadata-protocol: none is right). The branch-information test of lanes/spec.md is met: a banned user versus a missing one is a branch a consumer acts on differently (offer the hand-over / pick another user). The regenerated errors.mdx matches (+22 more; the two lists).
7. REST user-work family. Both handlers: resolveExecCtx → enforceAuth (401 before any read; the dogfood matrix row anonymous-deny-user-work and its booted proof read, member controls 200 / 404 included) → refuseUnknownQueryParams (closed, empty set) → closed body (toUserId, objects?) → engine via wiredEngineOrLoud (501 when none). Count: one engine.count(object, { where, context }) per (object, user-field) pair under the CALLER's context, sys_*/managedBy/disabled-package/readonly/system/phantom columns excluded, a thrown count names the object in unreadable, cap 200 pairs (truncated). plugin-security's authz middleware lists count beside find/findOne/insert (security-plugin-authz-middleware.ts:448), so the count is RBAC/RLS-gated. Transfer: target read ONCE elevated inside the tenant ({ ...context, isSystem: true }, USER_BAN_FIELDS), refused 404 RESOURCE_NOT_FOUND/reference_not_found, 400 VALIDATION_ERROR/reference_user_banned, or 400 same-user — all before any write (core and rest suites pin update not called); then per single-valued field find(ids, limit=budget) and one engine.update(object, { [field]: toUserId }, { where: { id }, context }) per row under the caller's context — the ordinary path, so sharing, validation rules, hooks, approval locks and the reference check itself (the target is active) apply; failures are described through handleRouteError (the /data door's sentence, hook-refusal ledger row read), capped at 10 per field; ≤500 rows per call; remaining recounted per field. Envelope: sendOk/sendError only, check:route-envelope at zero (gate green here); every code used (VALIDATION_ERROR, RESOURCE_NOT_FOUND, NOT_IMPLEMENTED, INTERNAL_ERROR) is in ErrorCode; the refusal carries error.details.fields[0].{field,code}. Judged correct.
8. Cost and caps on the count. Up to 200 count queries per call, for any authenticated caller, on any user id, with no memo and no per-route limit beyond the field cap. Bounded, and each query is one the caller could issue by hand through /data; acceptable for an administrator surface, recorded as a reading for the ui half (do not poll it).
9. Observability of a ban. Any authenticated caller who can write a user field, or call the transfer route, can now learn that a given user id exists and is banned (the reference probe already disclosed existence). This is the card's third bullet working as asked, not a leak of anything the ban dialog does not itself show; recorded so the ui half does not treat the code as secret.
10. One ban predicate (fix(core)!: a banned user's credentials are refused while the ban holds, at every door #30287). At this head isUserBanInForce/USER_BAN_FIELDS have one owner, packages/core/src/security/user-ban.ts on main; objectql imports them through @objectstack/core (exported at security/index.ts:182 on main), user-assigned-work.ts through ./user-ban.js. No second banned/ban_expires predicate survives outside user-ban.ts in core, objectql or rest (grep at head). The dev's own copy was removed in 3092798. No drift.
11. Census rows. REST_SERVER_REGISTRAR_FILES, the route ledger (sdk rows with client methods present in client/src/index.ts), the docblock floor (6, sum 101), canonical-query floor 0, slot-consumer census 5→6, the second-object read-exposure classification, the internal-fields tripwire and hook-refusal ledger rows, the engine-double-contract pins: all read and all pass here.
12. A misplaced docblock in rest-server.ts. registerUserWorkEndpoints was inserted BETWEEN registerSecurityExplainEndpoints' docblock and its body: the explain docblock ("…/security/explain… D12 manage_users…") now heads the user-work registrar, and the new [#30205] Register a user's assigned-work routes docblock heads registerSecurityExplainEndpoints. The position pin only counts blocks, so it stays green. Must-fix, mechanical.
13. Doc/skill authoring guard red at this head (PR-caused): authz-conformance.matrix.ts:322 carries #30205 inside the runtime note: string of the new matrix row; the guard refuses a tracker id in a runtime string. Must-fix, mechanical (move the id to the comment above the row).

② Semver level

• Kind: Metadata-protocol: none — correct, nothing an author writes moves (FieldErrorCode is a response vocabulary; the ADR-0087 marker's own sentence says the same and check:adr-0087-registration accepts not-required (no-migration-prescription) at this head). Level follows the kind alone: patch on spec, core, objectql, rest, client; all five are private: false and all five carry the changeset. The BREAKING banner, the !, the single ADR-0087 marker and the Skills-docs: line are present. Level and marker: consistent with AGENTS.md step 3.
• Declaration: Clause-②: no (narrowing) is NOT whole. The diff widens the public face (a member added to a published closed enum, packages/spec/src/api/errors.zod.ts), and lanes/spec.md and landing-operations.md make widening the public face clause ② (放宽接受集或扩大公开面…即条款②; 错误的 no 是可审计的假申报), while a narrowing alone would not be. The closed pair allows one arm, and the arm that is BREAKING must stay, so the whole declaration is Clause-②: yes (narrowing) in the PR body and the changeset body. The tier this review serves is unchanged either way (the path arm packages/spec/src/** hits), so this is a declaration fix, not a re-review. Must-fix.
• Lane: packages/spec 恒归 domain:spec, but the spec lane pre-approves a gate-enforced, append-only vocabulary member when (a) the code's existence was ruled on the owning card (Offboarding: banning a user says nothing about their open work, and there is no way to hand it over #30205, maintainer's word: "refused at the server"), (b) the fallback is unchanged and the clause-② path arm still goes through contract review (this record), (c) it is a pure append with no shape change. All three hold for reference_user_banned and its four templates; the pre-approval text names error-code-ledger.zod.ts, and FieldErrorCode is the field-level sibling of that ledger (ADR-0114 D2), so I judge the edit acceptable in this lane under that class, with no spec-lane signature owed. The dispatch seat names this in ACCEPT.

③ Boundary flags

• open_questions: [], security_findings: none in the dev report. No flag raised by the dev stands unanswered.
• Author: objectstack-fleet[bot] (relay for os-bill, session_01Utp6CZavYYLh5k5r6jhgCF); no external login to name.
• Gates at this head. The dev's 128/128 dispatch-gates reconciliation and the full dogfood battery (os-verify-lock exit 0, 419 files / 3496 tests) are pinned to 6e44006f, BEFORE the merge of main (42 first-parent commits, among them fix(core)!: a banned user's credentials are refused while the ban holds, at every door #30287 which rewrote core/security/index.ts, api-key.ts, resolve-authz-context.ts, added user-ban.ts and three dogfood tests; fix(plugin-security): a by-id write's row re-read propagates a store fault, and judges the platform's own predicates without the caller-predicate guard #30307 in plugin-security; fix(lint)!: refuse a stored page sort naming an unknown field, on every page sort slot (#30093) #30270 and fix(lint): field-path rules judge an object as served, so a field an objectExtensions entry adds is not refused (#30383) #30432 in lint), the refactor onto main's predicate (3092798) and the D6 marker (6d576db). After the merge only seven gates and the targeted suites ran; the authz pair re-ran 139/139. Unmeasured at this head: the other 121 gate families, the plugin-audit suite (which CI shows red), and the full dogfood battery. review-checklist: for a (narrowing) PR the dogfood_battery line must be pinned to the head, full, red fixed. It is not. The battery must be re-run at the head that lands (the head has already moved to ed851815; the record there needs its own line).
• Check-runs read on this head (REST API, 2026-11-05 ~16:00Z): Lint & Repo Gates failure (required); Lint · repo & tooling gates failure (59/60, red: Doc/skill authoring guard, item ①13); Test Core (5/8) failure (plugin-audit 3 files, item ①5) and Test Core failure; Dogfood Regression Gate success is the attestation-verify step only — the three shards were skipped, so it measures nothing on a PR; the type-check, ESLint, dispatch-gates, Build Core, remaining Test Core/Test UI shards and Type Check UI were cancelled when the head moved, so they have no reading at this head. Green: Governed Surface Queue Guard, Check Changeset, PR-body guards, Spec property liveness, Check Documentation Links, Flag docs, filter. The merge base c045c341 is not the source of either red (the failing files are untouched by the merged commits and the assertion deltas are the PR's read).
• Fixes #30205 closes a card whose first two Expected bullets (the ban dialog's counts and the hand-over offer) are the domain:ui half. The PR body says that half is "a separate domain:ui card", but the card's timeline shows no such card. review-checklist: landing only the implementable half ⇒ Part of #30205, unless the ui card is filed first and the maintainer wants Offboarding: banning a user says nothing about their open work, and there is no way to hand it over #30205 closed by the server half. For the lane seat to settle before ready (not card-worthy on its own).
• The PR body's "Two-minute verification" line and the objectql sentence already name core's security/user-ban.ts (#30287); the body edit the dev report asks the seat to make is already in place at this head.

④ Design judgment

• The narrowing (declared face, no hits of its own beyond the spec pair): holds against the card's third bullet and the measured defect (POST /data/asset_repair_ticket with assignee = banned user answered 201). The placement — inside the write-time reference check, on the same terms as reference_not_found (caller-supplied, ADDED values only, system writes exempt, flow writes kept, elevated sudo()-shaped read inside the tenant, fail-open with a warning) — is the right seam: there is one owner for "a reference the caller named", and the ban predicate has one owner in core. Keeping a stored banned value editable is the correct trade (the alternative freezes every record the person held). Multi-valued fields refused per member is right. The one design cost is the second sys_user round-trip per write that names a user; the plugin-audit pins exist precisely to make such a cost visible, and they did. Either folding the ban columns into the existence probe's read (one round-trip, as the card's "one extra find" sentence could be made true) or re-pinning with the ruling in the test is acceptable; shipping with the pins red is not.
• errors.zod.ts / validation-message.ts against ADR-0114 D2 and their first consumer: a closed catalog gains a member whose meaning is distinct from reference_not_found and whose template names the field, the id and the remedy ("pick an active user") in four locales; buildFieldError is the first consumer and already takes the code through r.code ?? 'reference_not_found'; the adr0112-ok: D6 marker is on the literal. Holds.
• The user-work family against the card's first two bullets: counting under the caller's context and transferring through ordinary updates is the right posture (the card asks for "across objects the administrator can read"; a transfer that elevated would move rows the administrator could not touch by hand). Excluding sys_*, managedBy, readonly/system fields is right (a grant is not work; provenance is not reassigned). Refusing a banned target before any write closes the loop with the narrowing. The caps and remaining make it repeatable. The rules living in @objectstack/core because rest cannot import objectql at runtime is a sound dependency decision and the only engine.ts touch is the four-line host literal. Holds, subject to ①12 (docblock) and ①13 (guard).
• Nothing in docs/adr/**, skills/** or .claude/** moves; no governed path in the file list (Governed Surface Queue Guard green).

Implemented-by: claude/project-thread-dvfr9q
Reviewed-by: session_01Utp6CbPxYq1wQmUNWvMZkC

VERDICT: FAIL

Must-fix, each on its own line for the card:

1. Test Core red is the PR's: three plugin-audit read-count pins (audit-milestone-summary.test.ts:635, audit-option-label-summary.test.ts:563, implicit-reference-target-summary.test.ts:316,354) count the new ban-state find on sys_user; fold the read into the existence probe or re-pin with the ruling, and make CI green.
2. Doc/skill authoring guard red is the PR's: #30205 inside the runtime note: string at packages/qa/dogfood/test/authz-conformance.matrix.ts:322.
3. dogfood_battery is pinned to 6e44006f, before the main merge; a (narrowing) PR needs the full battery pinned to the head that lands.
4. Clause-②: no (narrowing) → Clause-②: yes (narrowing) in the PR body and the changeset body (the spec enum widens the public face).
5. rest-server.ts: the registerSecurityExplainEndpoints docblock now heads registerUserWorkEndpoints and vice versa; swap them back.

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

Contract review (delta)

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a5de9d1e6e790b691b4a2f9fbb91f463fbbeddfe
Local-runs: probe — the delta re-measures the five round-0 must-fixes and the two new seams the main merge produced (the referenceRow facet split and the fail-open catch), so the gates and suites they turn on were run once in a throwaway worktree at a5de9d1 after pnpm install --frozen-lockfile and OS_SKIP_DTS=1 turbo run build --filter=@objectstack/objectql... --filter=@objectstack/plugin-audit... (16/16 tasks, 0 cached): pnpm --filter @objectstack/objectql exec vitest run src/engine-banned-user-reference.test.ts (10/10); pnpm --filter @objectstack/plugin-audit exec vitest run src/audit-milestone-summary.test.ts src/audit-option-label-summary.test.ts src/implicit-reference-target-summary.test.ts (3 files, 51/51 — the three round-0 reds, their assertions untouched by the PR); node scripts/check-facade-delegation-only.mjs (self-test and gate, exit 0: 5 facade classes in 3 files hold delegations only); node scripts/check-engine-double-contract.mjs (self-test and gate, exit 0, 1135 pinned rows); node scripts/check-route-envelope.mjs (self-test and gate, exit 0, user-work-routes.ts at 0/0/0); node scripts/check-doc-authoring.mjs (self-test and gate, exit 0); node scripts/check-durability-degradation-log-level.mjs (exit 0: 52 durability seams loud or propagating; read-seam rule 102 seams, none inventing, 1 baselined = referenceExists, baseline untouched). Worktree removed afterwards.
Scope: packages/spec/src/api/errors.zod.ts, packages/spec/src/system/validation-message.ts (the reviewFace hits, unchanged since round 0) + the narrowing-face floor, every non-prose path of the diff against merge base 2ffdb64: packages/objectql/src/engine-references-and-master-detail.ts (NEW in the delta, from the main merge), packages/objectql/src/engine-referential-integrity.ts, packages/objectql/src/engine.ts, packages/objectql/src/engine-banned-user-reference.test.ts, packages/core/src/security/{index.ts,user-assigned-work.ts,user-assigned-work.test.ts,second-object-read-exposure.pin.test.ts}, packages/rest/src/{user-work-routes.ts,user-work-routes.test.ts,rest-server.ts,rest-route-ledger.ts,rest-server-registrar-files.ts,rest-server-docblock-position.test.ts,rest-server-canonical-query-ast.test.ts,objectql-slot-consumer-census.test.ts,rest-write-route-hook-refusal-sentence.ledger.test.ts,rest-write-response-internal-fields.tripwire.test.ts}, packages/client/src/{index.ts,admin-surfaces.test.ts}, packages/qa/dogfood/test/{authz-conformance.matrix.ts,authz-conformance.test.ts,showcase-anonymous-deny-surfaces.dogfood.test.ts}, scripts/check-route-envelope.mjs, scripts/engine-double-contract.pinned.json + cited code read: packages/core/src/security/user-ban.ts (USER_BAN_FIELDS, isUserBanInForce), packages/platform-objects/src/identity/sys-user.object.ts (banned, ban_expires declared), scripts/durability-read-invention.baseline.json (the referenceExists entry), scripts/check-facade-delegation-only.mjs header, scripts/facade-delegation-registry.json, the merge commit ab3fc8d against both parents, docs/adr/0110 D3, AGENTS.md "Absence must be loud" and "Degradation log levels". Prose faces (.changeset/30205-banned-user-work-handover.md, content/docs/**) are the lane seat's ACCEPT, read here only for the declaration lines. The round-0 record (comment 6662784185) is the baseline; items it judged and the delta does not touch are not re-stated.

① Derived judgments

Per round-0 must-fix, verified from the tree at a5de9d1:

1. Must-fix 1 (the extra sys_user read) — FIXED, by folding. The separate find on sys_user is gone from assertReferencesResolve. For a non-master_detail field whose referenceTargetOf is sys_user the check now calls this.referenceRow(target, v, context, USER_BAN_FIELDS) once per value — the SAME findOne the existence probe issues (engine-references-and-master-detail.ts referenceRow: where: { id }, fields: ['id', ...extraFields] filtered to the names the target declares and not id, context: ObjectQL.referenceCheckContext(context)), and referenceExists itself now delegates to referenceRow(target, id, context, []), so every other target pays exactly what it paid before. One read answers both existence (false → reference_not_found) and ban (isUserBanInForce(row) → reference_user_banned). sys_user declares both ban columns (sys-user.object.ts lines 979 and 995), so the f in declared filter keeps them; a user object without them answers "not banned", which is the right reading of "no ban concept". Measured: the three plugin-audit read-count pins pass 51/51 with their assertions byte-untouched (git diff 2ffdb649..a5de9d1e -- packages/plugins/plugin-audit is empty), and Test Core and all eight shards are success at this head. No re-pin, no ruling owed.
2. Must-fix 2 (#30205 in a runtime note: string) — FIXED. authz-conformance.matrix.ts row anonymous-deny-user-work: the tracker id lives only in the two comments above and inside the row (// #30205 — a user's assigned work…, // Added by #30205.); the note: string carries none. check:doc-authoring exit 0 locally; Lint · docs & code guards and Lint & Repo Gates success at this head.
3. Must-fix 3 (dogfood battery pinned to the landing head) — OWED, not blocking this record. The PR body's Verification still pins the battery to 6e44006f9. The dev's reading at a5de9d1 is still being produced; recorded here as owed by the dev's report, at a5de9d1 (full battery, exit 0, red fixed or filed). The seat checks it before ready; it is a landing precondition, not a code defect in this tree. The Dogfood Regression Gate success at this head is the attestation step only — its three shards are skipped on a PR, as in round 0, so CI measures nothing here.
4. Must-fix 4 (Clause-②: yes (narrowing)) — FIXED in the changeset, NOT in the live PR body. .changeset/30205-banned-user-work-handover.md now reads Clause-②: yes (narrowing) — the published FieldErrorCode enum gains the member reference_user_banned. …, Metadata-protocol: none, Skills-docs: present, one adr-0087: not-required (no-migration-prescription) marker, ! and BREAKING banner kept. The live PR body (read via gh api pulls/30546 --jq .body at review time) still carries Clause-②: no (narrowing) and Fixes #30205. The dev's corrected body draft was NOT found: /mnt/project-files/server-seat3/30205/pr-body-r1.md does not exist and server-seat3/ has no 30205 entry, so the live body is what this record judged. The body is the seat's write at hand-over; its stale sentences are listed under landing preconditions below. The tier is unchanged either way (the packages/spec/src/** path arm hits).
5. Must-fix 5 (the swapped docblocks in rest-server.ts) — FIXED. At head the registerSecurityExplainEndpoints docblock (…/security/explain… D12 manage_users…) ends at the line directly above private registerSecurityExplainEndpoints(basePath), and the [#30205] Register a user's assigned-work routes docblock ends directly above private registerUserWorkEndpoints(basePath) (lines 6184 and 6214). The position pin still counts 6 blocks; the content pairing is now right.
6. Fixes #30205 → Part of #30205 — NOT done in the live body (same reading as item 4). The ui half (ban-dialog counts and hand-over offer) remains open on the card; review-checklist: only the implementable half lands ⇒ Part of.

The new code from the main merge (b) and the posture fix (c):

7. Facet split is facade-legal. main's Codemod split: generate the objectql engine.ts split with a deterministic script, verified byte-identical #29986 codemod (refactor(objectql): type the six #4918 erasure-pinned ObjectQL methods and move their bodies out of engine.ts with the codemod's fourth pass #30463) moved referenceExists' body to engine-references-and-master-detail.ts; the merge commit ab3fc8d resolves engine.ts by keeping only a one-line stub for referenceRow (return ReferencesAndMasterDetailFacet.referenceRow.call(referencesAndMasterDetailHost.of(this), …)), the referenceRow forwarder in the referencesAndMasterDetailHost factory, and in the assertReferencesResolve host literal a const readLogger arrow returning this.logger, a get logger() accessor returning readLogger(), and a referenceRow arrow forwarding its arguments to this.referenceRow — the exact .call(host, …) grammar the gate's header names (a const forwarding arrow, a host literal of forwarders, one forwarding call). check:facade-delegation-only exit 0 locally and Lint & Repo Gates success at head. Every other engine.ts hunk in the merge diff against parent 1 is main's own codemod (import pruning, engine-top-level.ts re-exports); the diff against the merge base 2ffdb64 is the PR's 10 lines and nothing else. ReferencesAndMasterDetailHost gains referenceRow: ObjectQLClass['referenceRow'], ReferentialIntegrityHost gains readonly logger and referenceRow, each typed as the class member, so the host-Pick invariant that module header states holds; TypeScript Type Check success at head. check:engine-double-contract exit 0 with the two new pinned rows (user-assigned-work.test.ts and user-work-routes.test.ts, verb update).
8. The catch moved to the right place. referenceRow does not catch: a thrown read propagates. referenceExists keeps its try/catch → null, which is the seam the read-invention baseline licenses (durability-read-invention.baseline.json entry for referenceExists, verdict reviewed-legitimate, byte-untouched by the PR). The new catch sits in assertReferencesResolve's sys_user branch, around this.referenceRow(...): it logs warn with { object, field, error } and sets row = null. referenceRow is not a vocabulary name of the read-seam rule, and the catch logs, so the rule has nothing to flag; locally the gate reports 102 read seams, none inventing, exactly 1 baselined. No new baseline entry, no DURABILITY_CRITICAL_CALLEES change. Correct.
9. FAIL OPEN on a failed ban-column read — ACCEPTABLE, and louder than the sibling. Compared with the existence probe today: referenceExists catches, returns null, logs nothing, and assertReferencesResolve treats null as "not refused" — the documented fail-open on its docblock ("an integrity check that cannot run must not invent a rejection… converts a connectivity problem into data loss"), reviewed and recorded in the read-invention baseline. The ban path at head does the same thing with a warn naming the object, the field and the error, so for a sys_user target the posture is strictly louder than it was before the PR, and the one case it leaves unrefused during an outage (a write that assigns a banned or missing user) is the same case the sibling already left unrefused, now visible in the log. Against the two authorities the review was asked to weigh: AGENTS.md "Absence must be loud" is met (the degradation is logged; it is a functional degradation of a validation, not a durability loss, so warn is the right level under "Degradation log levels", and no caller is misled about what was persisted). ADR-0110 D3 ("an availability failure is not an authorization decision; the gate an author declared must not evaporate during an outage", 503) governs an AUTHORIZATION gate on action dispatch; reference_user_banned is a referential-integrity validation on the referent's state, answered 400 VALIDATION_FAILED beside reference_not_found, not a decision about what the caller may do — the caller is an authorized writer either way, and the banned user acts in nothing. D3 therefore does not reach it, and the sibling check's documented posture is the governing precedent. Explicitly: the fail-open is accepted. Two readings for the card, not defects: (a) the warn fires once per value whose read threw (inside the per-value loop), so a multi-valued field during an outage warns once per member — the field name in each line makes that diagnosable, and the sibling logs nothing; (b) a master_detail to sys_user is excluded from the ban branch (def?.type !== 'master_detail') and keeps the header path — round 0 read the earlier head as ban-checking it; the changeset sentence ("the owner field, a user field, or a lookup to sys_user") never named master_detail, so the tree now matches the published sentence literally.
10. The fail-open pin. Test 10 of the objectql suite ("a user read that throws refuses nothing and logs a warning, as the existence probe fails open") registers a middleware that throws on findOne of sys_user, asserts the insert lands with assignee intact and that a warn containing "could not read the referenced user" was emitted. It pins the posture, the level and the sentence (which carries no tracker id). The other nine are unchanged from round 0. 10/10 locally.
11. Nothing else moved. The file list against the merge base is the round-0 list plus engine-references-and-master-detail.ts; user-assigned-work.ts, the REST family, the client surface, the census rows and the spec pair are byte-identical to the round-0 reading except as named above. Round-0 items ①1–①4 and ①6–①11 stand.

② Semver level

• Kind Metadata-protocol: none, level patch on spec, core, objectql, rest, client (all private: false, all in the changeset): unchanged and correct (round 0 ②). The changeset's declaration is now Clause-②: yes (narrowing), which is the whole declaration for a diff that widens the public face (a published closed enum gains a member) and narrows an accept-set at the write doors. Check Changeset and check:adr-0087-registration lanes success at head.
• The PR body's declaration line disagrees with the changeset (no (narrowing)), and the body still reads Fixes #30205; see landing preconditions. Not a code must-fix: it is the seat's body write, judged on the live body because the draft was absent.
• Spec-lane pre-approval reading from round 0 (gate-enforced, append-only vocabulary member ruled on the owning card, no shape change) stands; the dispatch seat names it in ACCEPT.

③ Boundary flags

• Author objectstack-fleet[bot] (relay for os-bill, session_01Utp6CZavYYLh5k5r6jhgCF); no external login.
• Check-runs at a5de9d1 (REST, 65 runs, read 2026-11-05 ~17:45Z): every run is success or a paths skipped; no failure, no cancelled. Required set: Lint & Repo Gates success, TypeScript Type Check success, Test Core success (and shards 1–8/8 success), Build Core success, Governed Surface Queue Guard success, Lint UI skipped (no ui/** path), Type Check UI success, Test UI success (16/16 shards), Build & E2E UI success, Live E2E UI success. Advisory: all Lint · and Type Check · lanes success (including Lint · docs & code guards and Lint · PM dispatch-gates), Check Changeset, PR-body guards, Spec property liveness, Check Documentation Links, Flag docs, Check PR Size, Auto Label success; Dogfood Regression Gate success is the attestation step with its three shards skipped, so the battery is unmeasured by CI (item ①3). Both round-0 reds (Lint · repo & tooling gates, Test Core (5/8)) are green at this head.
• Governed surfaces: none in the file list (Governed Surface Queue Guard success). Tier S/H not engaged; the PR is above neither the 3,000-line nor any other special-landing threshold (1499/22).
• open_questions: [], security_findings: none from the dev; nothing security-shaped beyond the PR's own stated rule was seen in the delta.
• Landing preconditions, body-side (the seat's write, before ready): (a) Clause-②: yes (narrowing) on the body line; (b) Fixes #30205 → Part of #30205 with zero verbs beside the number; (c) the sentence "It is one extra find on sys_user per write ($in for several ids)" is false at this head — the ban columns ride the existence probe's own read, no extra read; (d) "it now hands find and logger to assertReferencesResolve" → it hands logger and referenceRow; (e) Verification/battery pinned to 6e44006f9 → the a5de9d1 reading the dev owes; (f) "9 tests" in the two-minute verification → 10.

④ Design judgment

• The narrowing at this head is the round-0 design with its one cost removed: the ban columns are selected on the probe's existing findOne, so the write pays exactly what reference_not_found paid, and the plugin-audit read pins — which exist to make such costs visible — confirm it at zero delta. One seam (referenceRow) owns "the row the caller named", one predicate (user-ban.ts) owns "is the ban in force", and the facade keeps only forwarders. The catch placement (facet method throws; the integrity check decides, logs and fails open; referenceExists keeps its baselined null) is the shape the read-invention rule asks for: distinguishability preserved, the failure reported once where the decision is made. Holds.
• errors.zod.ts / validation-message.ts against ADR-0114 D2 and buildFieldError as first consumer: unchanged from round 0, holds.
• The user-work family and the census rows: unchanged from round 0, hold; the docblock pairing in rest-server.ts is now correct.

Implemented-by: claude/project-thread-dvfr9q
Reviewed-by: session_01Utp6CbPxYq1wQmUNWvMZkC

VERDICT: PASS

Not a must-fix on this tree, but owed before ready and read by the seat at hand-over: the live PR body (declaration line Clause-②: yes (narrowing), Part of #30205, the four stale sentences in ③), and the dev's dogfood battery reading pinned to a5de9d1 (full, exit 0, red fixed or filed).