[hotlong]

Follow-up to #17753, found by a post-merge sweep rather than by the pin that PR added. ⛔ #17147 stays OPEN — this PR is not its closer.

⚠️ Worded this way deliberately. The earlier phrasing put a closing keyword immediately before the number, and GitHub's reference parser matches the keyword plus the number and ignores the negation around it — so on #17753's merge the card was auto-closed as COMPLETED (reopened since; see that PR's body).

Clause-②: no — no new key lands on any published payload. Two test-case titles, one test header note, one widened assertion in a test file, one changeset.

What the single-file pin missed

#17753's negative assertion read plugin-permission-enforcer.ts and checked the retracted sentence was gone from it. It was. But packages/runtime/src/security/artifact-granted-permissions.test.ts — the file #13457 added — carried the same phrasing as a case title:

it('a CONSENTED entry enforces exactly the consented surface and nothing beside it', …)

next to a sibling titled … — registered, and denies.

Neither case asserts a refusal, and neither could. Both read a permission bag through getPluginPermissions and check what it answers; nothing on the tree queries that registry, because SecurePluginContext has no production construction site and the fs/network gates have no caller at all. A case title is read as evidence (ADR-0033) — those two told a reader the platform confines plugins, which is exactly the defect #17147 exists to remove, in the one place a grep for the docblock would never look.

The fix, and why the pin changes shape

• Both titles now name what they assert: bag ANSWERS yes to … / its bag answers NO to everything.
• That file's header states the verb discipline out loud: answers / registered / bound, ⛔ never enforces / denies / gates / refuses / blocks until the seam exists — and points at the pin that decides when it does.
• granted-permissions-not-enforced.pin.test.ts's negative assertion becomes a repo-wide git grep over the same pathspecs as its other sweeps, excluding only its own specimen. The needle is held once as RETRACTED so the sweep and the single-file read cannot drift apart.
• Anti-vacuity limb: the raw result must still contain this file's own specimen, so a scan that is broken or looking at nothing cannot pass as a clean repo — .filter alone would hide both.

Ablated: restoring the old case title turns the sweep red and names the offending file.

check:cross-package-test-inputs still OK (28 packages); @objectstack/core test:repo and @objectstack/runtime src/security both green (6 and 141 tests).

The general lesson, recorded

A text pin that reads one file proves that file. This claim lived in six carriers across three repos, and the cheap correct shape was a sweep with an anti-vacuity control from the start.

Refs: #17147 · #13457 · PR #17753

🤖 Generated with Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json aaacf1d5c5ec02378e875e8cb88bf74bf4bcf73b → packageMentionDocs.