[os-support-ai]

Fixes #16245

Clause-②: yes

Every refusal ObjectStackProtocolImplementation and SysMetadataRepository raised opened with a bracketed tag that restates the code the same throw declares. The 2026-08-29 maintainer ruling is ONE envelope semantics — error is HUMAN LANGUAGE, code is the MACHINE TOKEN — and a prefix is removed because the same fact already rides the code axis. These met that condition by construction, so they are gone; code and status are untouched on every one of them.

27 files, 116 derived gate families, head 5e294644b2.

What was measured, not assumed

The inventory is 38, not the 30 in the card's title. Re-derived by pairing every throw site in the two named files with the code it declares, rather than by grepping literal tags:

reading	count
literal [tag] message openers	37
of those, restating their own declared code	37 (mismatches: 0)
openers spelled by interpolation	1
total	38

The card measured 31 tagged sites / 30 restatements on 2026-09-06; the tree moved 16 days, and [unanswerable_target] — the one mismatch, which #16145 already removed — is correctly absent from this re-derivation. Firing controls on the same command and scope: a nonexistent tag returns 0, unanswerable_target returns only its pin and a comment, and the pattern finds the idiom in 20+ files repo-wide.

The 38th is the one no grep could find. assertOverlayAllowed's shared emitter opened its message with an interpolated [${code}], built from the same variable it assigns to err.code three lines down — the most redundant member of the family and invisible to every literal-tag probe, which is why it is absent from the card's inventory.

Reachability re-verified. withoutDeclaredCodePrefix returns the message unchanged unless message.startsWith(error.code) AND a colon separator follows. [no_draft] starts with neither, so it was never stripped and reached the caller in error.message. This is a published-output change, which is why Clause-② is yes.

Nothing consumed the tag — the open question triage left on the card. The only consumers found anywhere are strippers: @object-ui/react's extractWriteErrorMessage and two plugin-detail call sites each remove a leading bracketed prefix before showing the sentence to a user, beside the SCREAMING_SNAKE: strip. They independently confirm the tag was arriving, and they cannot break on its absence — the regex simply matches nothing.

Two bracketed vocabularies are deliberately kept, because neither restates a declared code: the path [zod code] locators inside a validation headline, and the [rule] locators the author-time gate composes. The [Protocol] and [SysMetadataRepository] logger prefixes are likewise untouched and declared by name in the new pin.

The published docs this change falsified are repaired here

Removing the openers made documented payloads wrong. Repairing what this round makes false is part of the round.

• content/docs/api/error-catalog.mdx (:609, :660) — both documented INVALID_REQUEST payloads showed a message opening with the tag beside a code field already carrying the token. Hand-written page, edited directly.
• packages/spec/src/api/protocol.zod.ts:815 — the promotion describe() said the lookup answers 404 [no_draft]; it now names NO_DRAFT, the axis that still carries it.
• content/docs/references/api/protocol.mdx — AUTO-GENERATED from that source, so it was ⛔ never hand-edited: regenerated with check:generated --fix, which proved exactly 1 of 15 artifacts stale and rewrote only that one. The page moved exactly 1 line.

⛔ The three carriers in content/docs/releases/v17/ are deliberately left alone. Release notes record what shipped in the version they document; v17.1 and v17.2 did emit those tags, so those pages are historically accurate and are not a defect to repair.

The blast radius, closed

A message-text change breaks every pin asserting that text. Thirteen pins in packages/metadata-protocol, two in packages/runtime, six in packages/objectql, and two in packages/cli.

⚠️ The objectql and cli consumers surfaced on successive CI runs rather than together, because the shard stopped at the first failure and reported @objectstack/cli was scheduled but never reached. A green shard is only evidence about what it reached — the run that finally reported 11 of 11 scheduled package(s) reported, 0 never reached is the one that measured the whole set. The consumer scan is therefore repo-wide and not CI-led: the only remaining assertion on a removed opener anywhere in the tree is a packages/rest test that constructs its own error, which is fixture drift, not a consumer.

The six objectql assertions split into two families, and only one is this card's to retire:

• Five pinned the opener itself. They move to the ENVELOPE (code + status), which is strictly stronger than what they had — two were bare rejects.toThrow(/regex/), which a plain Error would have satisfied. In each case the pre-change producer string carried the lowercase token ONLY inside the brackets, with zero occurrences elsewhere in the message.
• One is not that. protocol-object-overlay-layer.test.ts asserts captured console.warn output, and a log line has no envelope beside it — the code axis a caller reads does not exist there, so removing the opener took the only machine-readable token with it and left nothing to fall back on. Genuine collateral. ⇒ Fixed at the producer's log site, not in the assertion: the boot warning now prints the declared code itself, as the sibling branch twelve lines above already does. ⛔ The opener was NOT restored at the producer — that would reintroduce the defect for every caller in order to serve one log site.

Three pins elsewhere were only ever green because the tag happened to spell the token; they now read err.code.

os meta delete — two surfaces, two different answers

The CLI carries this refusal on both a human and a machine surface, and the two assertions do not move the same way.

• stdout is the human surface. printError prints the message and nothing else, so the token never belonged there. That assertion now reads the sentence, and the structural controls already in the test — exit code, the reset request's parentVersion, the if-match header — are what keep it from degrading into "something went wrong".
• --format json is the machine surface, and it already carries the token. Measured rather than assumed, by dumping the real envelope through a temporary probe with a proven restore:

{ "success": false,
  "error": "view/json_probe has been modified since you loaded it. Expected parent sha256:… but current is sha256:….",
  "code": "METADATA_CONFLICT",
  "httpStatus": 409 }

So the assertion reads code and httpStatus, which a prose match over error only ever approximated. ⛔ No producer change was needed and the opener was not re-added — errorCodeFields has carried this since #13347. Had the envelope carried no code, that would have been a real regression on a documented machine-readable surface and the fix would have belonged at the producer, exactly as it did for the boot log line above.

Tests

• pnpm --filter @objectstack/metadata-protocol test — 186 files / 2650 tests pass, 3 files and 19 tests skipped. typecheck exit 0, and --listFiles shows all 189 test files inside the tsc program, so the new pin is type-checked.
• packages/objectql — the 5 files, 159 tests, exit 0; typecheck exit 0. packages/runtime and packages/rest targeted — exit 0.
• pnpm lint — the whole repo, eslint . --no-inline-config, exit 0, zero findings. No narrowing was used.
• All 113 derived gate families run, 0 NOT MEASURED, 0 UNRUN, every exit code recorded and none is 3 (dispatch-gates --ran reconciliation). check:dual-build-cjs-loads and check:type-check-debt first answered PREREQUISITE NOT MET (exit 3, explicitly not a pass); the whole-workspace build they ask for was paid and both then read 0.

Two reverse verifications, each with on-disk proof and a proven restore:

1. One opener re-inserted at a named anchor (anchor 1 to 0, blob ce0ae6aafeb6 to 734afa23b233). The new absence pin went red, naming protocol.ts:8204. Restored; worktree blob equals the HEAD blob and git diff HEAD empty.
2. The log-site fix ablated to prove it is load-bearing rather than cosmetic. Because objectql resolves this package through dist, the mutation was rebuilt and confirmed present in both dist/index.js and dist/index.cjs before any verdict was read — an unbuilt ablation here would have stayed green and vouched for nothing. The test then went red. Restored, rebuilt, marker count in dist back to 0, whole-tree git status --porcelain empty.

Changeset

minor on both @objectstack/metadata-protocol and @objectstack/spec, measured rather than pattern-matched. Both are public, non-private packages. metadata-protocol ships files: ["dist", …] and the new message bytes appear twice each in dist/index.js and dist/index.cjs, while both controls (the old literal opener, the interpolated opener) read 0. spec ships dist and src/**/*.zod.ts, and the new describe bytes appear in dist/api/index.js and the browser builds. content/docs/** is shipped by no package, so the mdx edits publish nothing on their own. Clause-②: yes takes at least minor; no (narrowing) arm, because nothing an author can write is removed, renamed or narrowed.

Acceptance notes

Noted, not filed, and ⛔ not ridden along:

1. packages/metadata-protocol/src/runtime-authoring-gate.ts still writes [invalid_metadata] in front of code = 'INVALID_METADATA' / status = 422. Same package, same family, same ruling, third producer — outside the two files this card named, and it reaches dist/index.js. The nearest same-class remainder and the obvious next increment.
2. packages/rest/src/rest-server.ts raises its own [invalid_request] opener, and packages/runtime/src/domains/packages.ts its own [writable_package_required] one. The idiom is repo-wide well beyond this card's two files.
3. packages/spec/src/api/protocol.zod.ts WAS taken, not merely flagged — the describe correction at :815 is in this diff, and triage's boundary comment 5571629394 names exactly that correction as part of the deliverable, which is what makes Fixes #16245 honest. packages/spec/src/api/plugin-rest-api.zod.ts:898 was taken too, on the at-tier review's reading: it described the same publishMetaItem door as answering 404 [no_draft] while protocol.zod.ts now says NO_DRAFT, and BOTH ship in this same @objectstack/spec minor — twice over, as published .zod.ts source and in dist/api/index.{js,mjs}. One release carrying two contradictory descriptions of one door is a defect in this change, not a follow-up. Nothing regenerates from it (all 15 spec artifacts re-checked clean). metadata_conflict on that line stays lowercase deliberately — it is the shared spelling in protocol.zod.ts too, so "correcting" it would introduce the very inconsistency this removes. ⚠️ PR feat(spec)!: split the translation bundle type — settings is a platform group, not a per-app one (#15178) #19600 also holds protocol.zod.ts, at @@ -27,7 and @@ -3167,9, while this diff's single hunk is @@ -812,7 — roughly 2,350 lines clear, so it is not a region collision. It goes to the merge queue, ⛔ never hand-sequenced.
4. Current-tense claims about current behaviour, outside this card's lane — found by git grep over the whole tracked tree at this head, with a dark control ([no_draft_xyzzy]) returning 0 so the probe discriminates. ⛔ Not edited:
   • packages/client/src/index.ts:2151 — JSDoc "404 [no_draft] when there is nothing to publish" (domain:cli).
   • docs/qa/platform-checklist/areas/access-security.json at :1816, :1818, :1875 (domain:devx).
   • docs/qa/platform-checklist/areas/studio-authoring.json at :477 and :514 — the same probe finds two more checklist carriers in a second area file (domain:devx).
5. Governed-surface carriers, ⛔ untouched (docs/adr/** is Tier H, and triage forbade touching it on this card): docs/adr/0005-metadata-customization-overlay.md:348 and docs/adr/0010-metadata-protection-model.md:480 and :485 each show a wire payload whose error opens with the retired tag. ⚠️ Those same ADR payloads also spell code in lowercase ("code": "not_overridable"), which disagrees with the SCREAMING_SNAKE rule and with what the runtime actually emits — a pre-existing inaccuracy this change does not cause but does sit beside.
6. Fixture drift, harmless but self-propagating: hand-written envelope fixtures in packages/spec/src/api/protocol.test.ts and mock refusals in plugin-security, cli, service-package and packages/client/src/client.test.ts still fabricate the bracketed spelling. They stay green because they construct their own errors, which is exactly how the idiom reaches the next author who copies one.
7. One byte changed beyond the tags — the seed-body refusal opened the published seed bodies failed… once its tag was removed, and now opens The published….

⛔ packages/*/CHANGELOG.md entries that quote the old tags are release-owned history in the past tense, describing what the code did when they were written. Not a falsified claim, and not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_013RDBh5DqXd2xnLwvHLgLFr

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/spec, touching 41 documentable anchor(s).

15 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via getReferences (sdk, the bare tail of client method meta.getReferences, bound to GET /api/v1/meta/:type/:name/references), meta.getReferences (sdk, the route ledger binds it to GET /api/v1/meta/:type/:name/references, selected by route anchor /:type/:name/references), meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/api/data-api.mdx (via /:object/export (route, bridged from symbol getMetaItem — its route source's handler names it))
• content/docs/concepts/metadata-lifecycle.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class), SysMetadataRepository (symbol, a top-level class), migrateStoredMetadata (symbol, a method of class ObjectStackProtocolImplementation), saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/data-modeling/drivers.mdx (via getMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/data-modeling/schema-design.mdx (via /:object/export (route, bridged from symbol getMetaItem — its route source's handler names it))
• content/docs/deployment/validating-metadata.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/kernel/cluster.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/kernel/contracts/metadata-service.mdx (via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its route source's handler names it))
• content/docs/kernel/services-checklist.mdx (via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation), getMetaItem (symbol, a method of class ObjectStackProtocolImplementation), saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/permissions/authorization.mdx (via saveMetaItem (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/permissions/permission-sets.mdx (via /:object/export (route, bridged from symbol getMetaItem — its route source's handler names it))
• content/docs/protocol/objectui/actions.mdx (via /:object/export (route, bridged from symbol getMetaItem — its route source's handler names it))
• content/docs/ui/actions.mdx (via /:object/export (route, bridged from symbol getMetaItem — its route source's handler names it))
• content/docs/ui/react-pages.mdx (via /:type/:name/references (route, bridged from symbol findReferencesToMeta — its route source's handler names it))
• content/docs/upgrading.mdx (via toVersion (literal, a string literal in rollbackMetaItem))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class), deletePackage (symbol, a method of class ObjectStackProtocolImplementation))
• content/docs/releases/v17/17-1.mdx (via findReferencesToMeta (symbol, a method of class ObjectStackProtocolImplementation))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e2c55edb1ecde1136c1b137f00d021fd8a840b25 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from abf6d9455143e9f7b0014253657634fd37f2402b — the merge of head 5e294644b26155abef6c6595ec0e80c68bb40537 into base e2c55edb1ecde1136c1b137f00d021fd8a840b25, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin abf6d9455143e9f7b0014253657634fd37f2402b && git checkout abf6d9455143e9f7b0014253657634fd37f2402b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e2c55edb1ecde1136c1b137f00d021fd8a840b25 5e294644b26155abef6c6595ec0e80c68bb40537 && git checkout -B drift-repro e2c55edb1ecde1136c1b137f00d021fd8a840b25 && git merge --no-ff 5e294644b26155abef6c6595ec0e80c68bb40537

node scripts/docs-audit/affected-docs.mjs --json e2c55edb1ecde1136c1b137f00d021fd8a840b25

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e2c55edb1ecde1136c1b137f00d021fd8a840b25 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-support-ai]

CI triage — Test Core (5/6) is this PR's failure

Measured 2026-09-22T08:04Z on head ea92663819b6.

Failing check: Test Core (5/6) — run 35701250713, job 106659953132. It is the only failure: every other completed check on this head is success or skipped; 4 Test Core shards and Type Check · workspace were still running at the time of reading.

Ruled out as not-this-PR's: the base is green. main's push run at 1f53b0b685 — this PR's base commit — concluded success. So these are not pre-existing failures, and not a flake.

Why it is this PR's: all 6 failures are in @objectstack/objectql, a package this diff does not touch. The diff updates 12 sibling test files under packages/metadata-protocol and 2 under packages/runtime for exactly this refusal-message shape change, and does not reach the objectql consumers of the same messages. The blast radius is incomplete.

#	Test	Pinned	Now emitted
1	protocol-commit-history.test.ts:659	[NOT_OVERRIDABLE] opener	opener absent, guidance appended
2	protocol-commit-history.test.ts:855	same	same
3	protocol-meta-types-rich.test.ts:133	/not_(overridable|creatable)/	Metadata type 'agent' is code-only: …
4	protocol-meta.test.ts:634	/invalid_metadata/	view/bad_view failed spec validation: …
5	protocol-object-overlay-layer.test.ts:573	object_overlay_package_mismatch	[Protocol] Failed to hydrate object/myapp_invoice: …
6	protocol-writepath-object-ownership.test.ts:321	/not_overridable/	Metadata item 'object/myapp_invoice' is provided by a code package …

All paths are under packages/objectql/src/.

These are two families, not one. (1) and (2) pin the uppercase bracketed opener that #16245 exists to retire — updating those assertions is in scope. (3)–(6) pin a lowercase snake token, which is a different carrier from the uppercase bracket; if those messages have lost every machine-readable code token as collateral, the correction belongs in packages/metadata-protocol/src/protocol.ts, not in the assertions. Case 4 is the sharpest: line 632's expect(caught.code).toBe('INVALID_METADATA') still passes, so only the message text changed. Deciding that fork is the next step here; the six assertions will not be blanket-rewritten to match whatever the code currently emits.

Cross-lane note. packages/objectql is domain:engine, outside this card's domain:spec lane. Per the seat charter the card does not move and the fix stays in this PR, with the widened file face declared on the card. Separately, packages/spec/src/api/protocol.zod.ts (+1/-1 here) is also held by open PR #19600 — that overlap is left to the merge queue, not resolved in either PR.

The failed check has not been re-run: a re-run is only warranted for a failure that is not this PR's, and this one is.

---

Generated by Claude Code

[os-support-ai]

Contract review

Served-tier: 108/108 CONTRACT_REVIEW_TIER
Head-sha: 3a05af7bf9f50973caefe964aeec1ebc93199dc5

Rendered by an isolated review subagent, adopted by the seat after per-request transcript verification (contract-review.md:54 — 子代理档只取其转录 harness 逐请求 model 盖章). Verified by the seat: 108 of 108 stamped requests carry the constant's current value and no other model appears; the three keyword hits for fallback/overload in that transcript are tool-schema prose, ⛔ not notices. The subagent's own self-report read 17/17, its turn count — the transcript stamp count is the reading that governs.

① Derived judgments

• Accept set unchanged. No input newly accepted or refused; all 38 sites still throw the same code and status. Zero non-test +/- lines touch a .code =, .status = or httpStatus assignment; the error-code ledger is not in the diff and no code is minted.
• Public surface not enlarged. 38 published error.message strings lose a leading [tag] prefix. No new export, no new payload key. The added (code=X) on the hydrate console.warn is stderr, ⛔ not a contract surface.
• Clause-②: yes is CORRECT, reached independently of the card — and ⛔ not because the accept set widens, which it does not. It is because the diff changes bytes on a published output surface whose published text at merge-base AFFIRMED the old bytes: content/docs/api/error-catalog.mdx:609 and :660 documented message: "[invalid_request] …" beside code, and protocol.mdx:2277 said the door answers 404 [no_draft]. A no under SKILL.md:530 needs a Contract-text: citation negating the tag; none existed, so no would be refused under :531. Conformance class, which contract-review.md:13 forbids treating as mechanical.
• Consumers: none, measured. objectui's four sites (extractWriteErrorMessage, InlineEditSaveBar:155, DetailView:776, AssignedUsersSection:237) all STRIP a leading bracketed prefix; objectstack has no reader outside tests. Under the ruling no consumer is entitled to parse error.
• Inventory sound. 37 literal tagged non-comment lines at merge-base plus the interpolated opener at sys-metadata-repository.ts:1644 = 38; head = 0; dark control 0. The card's 30 was an undercount at its own head.

② Semver level

minor on both packages, verified against each files[] after a REAL build with positive and negative byte controls.

• @objectstack/metadata-protocol — positive in both bundles: No pending draft exists for 2/2, is locked (_lock= 2/2, is not draftable 1/1, (code= 1/1. Negative, both bundles: [no_draft] [item_locked] [invalid_request] [not_overridable] [metadata_conflict] [commit_not_found] [destructive_change] [writable_package_required] all 0. ⚠️ Its DTS step did not complete in the isolated worktree (unbuilt sibling types) — an environment chain, ⛔ not a PR defect; CI Build Core is green at head.
• @objectstack/spec — positive: answers 404 NO_DRAFT present in both dist api bundles. Negative: the bracketed spelling absent.
• content/docs/** ships in no package.

③ Boundary flags

No pin was weakened — all 23 repointed assertions were checked one by one; seven moved from a prose token to code plus status, which is strictly stronger. The new absence pin carries a floor (≥5 new Error( per file, ≥30 combined) and a by-name allow-list of the two logger prefixes. No gate weakening, no security or permission boundary, no migration shape. Kept vocabularies (path [zod code], [rule]) name WHICH finding mid-sentence and never the envelope code ⇒ consistent with the ruling. PR #19600 overlap: @@ -27,7 / @@ -3167,9 versus this diff's @@ -812,7 ⇒ ⛔ not a region collision, merge queue arbitrates.

⛔ Two owed changes, both inside the reviewed face and both one line:

1. The changeset headline is contradicted by measured shipped bytes. It states that refusal messages no longer open with a bracketed tag restating the code the same throw declares — but the same package's third producer, runtime-authoring-gate.ts:774, still throws [invalid_metadata] with code = 'INVALID_METADATA', and it SHIPS: that opener is present 1/1 in both dist/index.js and dist/index.cjs. The PR body discloses the producer; the consumer-facing changeset does not. ⇒ scope the headline to the two producers, or otherwise make it true. ⛔ Extending the removal to that third file is beyond triage's boundary and is NOT demanded.
2. Two contradictory describes for ONE door ship in the same @objectstack/spec minor. packages/spec/src/api/plugin-rest-api.zod.ts:898 still describes publishMetaItem as answering 404 [no_draft] while protocol.zod.ts:815 now says NO_DRAFT. Both ship twice over — as published .zod.ts source and in dist/api/index.{js,mjs}. It reaches no generated page and DEFAULT_DISCOVERY_ROUTES has no runtime consumer, which is why this is a one-line correction and ⛔ not a wire defect.

Recorded, ⛔ not blocking: seedApplied.error and duplicatePackage.failed[].error carry no code axis at all, so on those faces the removed tag was the only in-prose machine token — no published contract promised it and no consumer reads it, but a follow-up card may be wanted. Stale carriers outside the dev's inventory: migrations/registry.ts:4828,5395, migrations/entries/semantic/18.admin-export-wildcard-removed.ts:26, identity/eval-user.zod.ts:124. Construction sat at the judgment tier per 强制条款② and the constant moved to its current value at 2026-09-22T08:04Z, after the 06:21Z claim — ⛔ not a verdict input; this at-tier review is the compensating control.

Not measured: whether plugin-rest-api.zod.ts is held by another open PR's single-writer surface — the on-push gate answers it. The dev's own local gate-family and test runs were taken as reported, ⛔ not re-run (contract-review.md:34).

Implemented-by: claude/issue-16245-bracketed-tag-refusal-openers
Reviewed-by: session_013RDBh5DqXd2xnLwvHLgLFr

VERDICT: FAIL

---

Generated by Claude Code

[os-support-ai]

Contract review

Served-tier: 64/64 CONTRACT_REVIEW_TIER (seat-measured, 2026-09-22T12:47Z)
Head-sha: 5e294644b26155abef6c6595ec0e80c68bb40537

Rendered by an isolated review subagent on the head above, which supersedes the FAIL record #19683 (comment) on 3a05af7bf9. The PR's own contribution moved by exactly 13 content lines between the two reviewed heads (diff of the two merge-base-to-head patches, hunk headers excluded): the changeset headline swap and the one-line plugin-rest-api.zod.ts hunk. Every other file of the 27 is byte-identical in what the PR contributes, so measurements on those are carried from the superseded record and said so below; everything the two new commits and the merge touched was re-measured.

① Derived judgments

• Accept set unchanged — re-measured. Zero +/- lines in the two producers' merge-base-to-head diff touch a .code =, .status = or httpStatus assignment; the error-code ledger is not among the 27 files; no code minted. main moved protocol.ts by 62 lines (A stopped or rolled-back bulk batch now names a causal row that did not fail, and calls the real error "unknown" — live on main since #19432 #19452) between the two merge-bases and the merge was conflict-free; it added no opener (see inventory).
• Inventory re-derived with the pin's own detector, not by literal grep: merge-base 38 openers (protocol.ts 32, sys-metadata-repository.ts 6 — 17 distinct literal tags plus the interpolated [${code}] site, whose two codes NOT_CREATABLE/NOT_OVERRIDABLE are already in the set), head 0/0, new Error( floor 86 against the pin's 30, dark control [no_draft_xyzzy] 0. The changeset's "NO_DRAFT, ITEM_LOCKED, NOT_OVERRIDABLE and the 14 others" is therefore exactly 17 and true; the one - line carrying [unanswerable_target] is a comment, not a throw.
• Public surface not enlarged — carried. No new export or payload key; the producers' contributed diff is message text only, byte-identical to the previously reviewed head.
• Clause-②: yes is CORRECT — re-measured from the diff itself. The - lines of this PR show the published docs AFFIRMED the old bytes at merge-base (content/docs/.../error-catalog.mdx:609 and :660 documented message: "[invalid_request] …" beside code; protocol.mdx:2277 said the door answers 404 [no_draft]), so a no under the skill's clause-② rule would have had no negating Contract-text: to cite. Conformance class, not mechanical. Carried on all three carriers: PR body line 3, the claim comment, the changeset.
• The documented payloads now match the producers — re-measured. error-catalog.mdx's two INVALID_REQUEST messages are the templates at protocol.ts:292 and protocol.ts:15438, neither with an opener; the three FROM → TO rows resolve to protocol.ts:8204, :14141/:14209 and sys-metadata-repository.ts:1642, none opening with a bracket.
• Consumers: none — carried, spot-checked. objectui's extractWriteErrorMessage still strips the leading bracketed tag at packages/react/src/utils/error-message.ts:86; it cannot break on the tag's absence.

② Semver level

minor on both packages, consistent with the changeset, verified against each files[] and a REAL build in an isolated worktree at this head (tsup, JS bundles), positive and negative controls:

• @objectstack/metadata-protocol (files: dist, README, CHANGELOG) — dist/index.js and dist/index.cjs: all 17 retired literal openers 0/0 each, interpolated [${code}] 0/0; positives No pending draft exists for 2/2, is locked (_lock= 2/2, (code= 1/1. Owed change 1 verified in tree and bytes: runtime-authoring-gate.ts:774 still throws [invalid_metadata] and it ships 1/1 in both bundles — which is exactly why the headline is now scoped to ObjectStackProtocolImplementation and SysMetadataRepository, the two classes whose bytes read 0. The scoped headline is true; the previous one was not.
• @objectstack/spec (files: includes dist and src/**/*.zod.ts) — owed change 2 verified in tree and bytes: [no_draft] is 0 across the whole of packages/spec/src and 0 files across the whole built dist; 404 `NO_DRAFT` reads 2/2 in dist/api/index.js and dist/api/index.mjs (both describes of the one publishMetaItem door), and the two shipped .zod.ts sources carry it 1+1. One door, one description.
• content/docs/** ships in no package — re-read off both manifests.

③ Boundary flags

Dev open_questions: []. Flags raised, each answered:

• Third producer left out (runtime-authoring-gate.ts) — correct: outside the two files the triage comment bounded, and the changeset no longer claims it. Remains a same-class follow-up, ⛔ not owed here.
• metadata_conflict left lowercase on the corrected line — correct, and the seat's unjudged observation is resolved as NOT a finding of this change. plugin-rest-api.zod.ts:898 is the POST /:type/:name/publish route entry and protocol.zod.ts:895 is PublishMetaItemResponseSchema.version — the SAME door, both spelling its 409 metadata_conflict; flipping :898 alone would recreate one-door-two-spellings, the defect class the superseded FAIL record named as its item 2. The lowercase-code prose class is pre-existing (18 such lines across packages/spec/src/**/*.zod.ts at merge-base and at head, count unchanged by this PR; the ledger's own comment at error-code-ledger.zod.ts:612 records the residue as left as-is; ADR-0112 lineage Two error-code vocabularies are both live: StandardErrorCode is lowercase snake_case, the servers emit SCREAMING_SNAKE #3841/ADR-0112 batch 2: sweep the ~100 lowercase snake_case error-code emitters to the SCREAMING catalog #4003 closed on the emitters). A spec-wide prose normalisation would be its own card; ⛔ not this PR's to carry.
• PR feat(spec)!: split the translation bundle type — settings is a platform group, not a per-app one (#15178) #19600 also holds protocol.zod.ts — carried: this diff's single hunk @@ -812,7 is unchanged since the prior head; merge queue arbitrates. The prior record's one unmeasured item — whether plugin-rest-api.zod.ts is held by another open PR's single-writer path — is now answered by the head's green No other open PR may claim the same single-writer path check.
• Regen commit 5e294644b2 — the committed tree is the criterion: protocol.mdx differs from merge-base by exactly the ONE organizationId row that the one-line source change derives, and the restored enableOnInstall row equals main's. ⛔ check:generated was not re-run by the reviewer (derived gate family).
• No pin weakened — carried. None of the 23 repointed assertions' files changed between the two heads. The absence pin at head re-read: floor ≥5 new Error( per producer and ≥30 combined (measured 86), logger prefixes Protocol/SysMetadataRepository allow-listed by name, literal AND interpolated arms.
• Recorded, ⛔ not blocking, carried: seedApplied.error and duplicatePackage.failed[].error carry no code axis; stale bracketed spellings survive in comments (error-code-ledger.zod.ts:612, identity/eval-user.zod.ts:124, migrations/registry.ts:4828,5395, 18.admin-export-wildcard-removed.ts:26) and in the three read-only content/docs/releases/v17/ pages, which are historically accurate.

CI at this head: 42 check runs, all completed, every one success or skipped, 0 failures.

Nothing in this record derives from a dispatch instruction; the prior record was used to choose what to re-measure, not what to conclude.

Implemented-by: claude/issue-16245-bracketed-tag-refusal-openers
Reviewed-by: session_013RDBh5DqXd2xnLwvHLgLFr

VERDICT: PASS

---

Tier control — measured by the seat, not reported by the reviewer

The subagent self-reported 11/11 by counting its own turns. That is not the reading the protocol takes: the governing control is the transcript's per-request harness model stamp, and get_session is ⛔ not admissible as corroboration. So the seat counted the reviewer's transcript itself:

• 64 assistant requests, 64 stamped claude-fable-5-1 — every per-request "message":{"model":…} in the transcript, no exceptions.
• 74/74 counting every model field in the transcript, per-request stamps and advisorModel alike.
• Dark control: 0. Every "model"/"advisorModel" occurrence in the transcript, filtered for anything other than claude-fable-5-1, returns empty — no other model name appears anywhere in 692 KB of transcript.
• The three keyword hits for fallback/overload were read in context and are all tool-schema prose, ⛔ not fallback notices.
• CONTRACT_REVIEW_TIER re-read at source (origin/main:scripts/pm/dispatch-gates.mjs) = claude-fable-5-1, matching the stamps.

So the reviewer was served at tier for every request it made, and the Served-tier: line above carries the measured count in place of the reported one.

The reviewer also flagged, for anyone running it from the shared checkout: dispatch-gates.mjs --tier printed tier names from a STALE TREE (checkout 14+ commits behind) — read the constant from origin/main, not from that output.

---

Generated by Claude Code