[objectstack-fleet]

Fixes #21878

Clause-②: no

What changes

plugin-audit's record-change mirror wrote each activity row's record label (record_label, and the label inside the created / deleted / generic updated summary) from a fixed list of field names (name, subject, title, full_name, label, first_name, company, email), falling back to the record id. That list was a second display-name dialect beside ADR-0079's resolveDisplayField, which the same file already used for referenced-record titles. An object titled by company_name therefore showed its record id on every activity row.

Now, in packages/plugins/plugin-audit/src/audit-writers.ts:

• titleFieldOf(objectName) is the ONE answer for "which field titles a record of this object in an activity row": resolveDisplayField over the registered definition (the cached getObjectDef lookup the file already had, no second lookup), flooring to the id when nothing resolves, when the resolver lands on id, when the title field is a credential (collectMaskedReadFields) or internal (collectInternalReadFields). Those three skips were inline in resolveLookupTitles; they moved here, and resolveLookupTitles now asks titleFieldOf too.
• recordLabel(record, titleField, id) reads that field's value from the same masked ledger view as before. A null, structured or blank value floors to the id; it never borrows another populated field. The fixed key list is deleted, not extended.
• The field answer the activity row declares as the label's source (the declaration the read-side redaction keys on) is the resolved field.

No packages/spec edit, no change to the read-side gating, no change to the comment hooks, no backfill: rows already written keep their stored label.

Measured, per the dispatch's hypotheses

• H1, held. recordLabel(record, id) at audit-writers.ts:299 (base e085a8c3) picked from the 8-key list and took no object definition. One caller, the activity mirror. Red pin on a company_name-titled object: with the key list put back (ablation below) the new pin reads expected '3JO4ITH0my2YkCtR' to be 'ARDCOMPANYONE41' — the card's symptom.
• H2, held. The one caller already had getObjectDef (the cached engine.getSchema lookup the referenced-title path and the milestone path use). It is reused; no second lookup.
• H3, measured. Over the bundled example objects, each registered through a real ObjectQL registry so the answer is the materialized nameField (registered answer equals authored answer for all 32): 27 keep their label field; 5 change. The "before" column models the list as "first list key the object declares".

object	before	after
crm_contact	full_name (a formula with no returnType: 'text', so ADR-0079 does not derive it)	first_name, its registered nameField
crm_opportunity_line_item	id	product
showcase_expense_line	id	merchant
showcase_ext_order	id	customer_id
showcase_invoice_line	id	description

The same measurement over 50 platform objects (@objectstack/platform-objects): 24 move from the id to their declared nameField, and 3 change field to it — sys_email_template name to label, sys_invitation email to display_title, sys_scim_connection_credential label to connection_id. In every case the new field is the one the record page titles the record by. Objects titled by name / title / subject are unchanged.

• H4, held. activity-field-redaction.ts redactActivityRows serves record_label (and the summary that interpolates it) whole only when every declared source field is served to the reader. The declaration now names the resolved field, so a reader not served company_name is served neither; pinned in the unit file and at the REST door.
• H5, held. Nothing rewrites stored rows; only rows written from now on change.

Tests

All at head e0da4f8a5d.

• pnpm --filter @objectstack/plugin-audit exec vitest run --maxWorkers=2: 40 files, 641 tests passed.
• pnpm --filter @objectstack/plugin-audit typecheck: exit 0, test layer included (check:test-typecheck OK, 0 debt). Run at 1088327afd; git diff 1088327afd e0da4f8a5d -- packages/plugins/plugin-audit is empty.
• Dogfood, --project isolated: the new activity-label-display-field.dogfood.test.ts plus the sibling activity-field-values.dogfood.test.ts: 2 files, 14 tests passed, against a rebuilt plugin-audit dist/. pnpm --filter @objectstack/dogfood typecheck: exit 0.
• New unit file audit-record-label-display-field.test.ts (real kernel, ObjectQL, SQLite driver, AuditPlugin; the security service is the one stand-in): company_name labels on create / update / delete with company_name declared as the source; name, title, subject labelled as before; an explicit nameField wins over name; a blank title and an empty name beside a populated title both floor to the id; a credential title floors to the id; a reader not served company_name gets neither label nor summary, and the control keeps both.
• Fixture triage in audit-writers.test.ts: four localized-summary cases wrote a record of person_qualification, an object the fake engine never declared, and passed only because the key list guessed name from the record. Disposition: declare the object (titled by name), since a real engine writes only registered objects. Assertions unchanged.
• Narrowed lint: eslint --no-inline-config --format json over the four changed TypeScript files: 4 files, 0 errors, 0 warnings. All four sit inside the config's linted population (--print-config resolves each). eslint.config.mjs enables no type-aware linting, so this diff cannot move a verdict on an untouched file. pnpm lint itself is CI's.

Ablation: the fixed key list put back

Through scripts/ablation-replace.mjs (anchor hit 1, blob 47497d1d8eed to 61d82281885f), committed fix first.

• Unit, source-resolved: 7 red, 4 green, as predicted. Red: both company_name label cases, the explicit nameField case, the empty-name floor, the credential floor, and both read-side cases (the label at rest was the id). Green, as predicted: name / title / subject, the blank-company_name floor, the registry control. Restore: blob after restore 47497d1d8eed equals HEAD, git diff HEAD empty.
• Dogfood, dist-resolved: mutate, rebuild plugin-audit, ablation-dist-preflight found the marker in both JS bundles, then 2 red (the company_name label case; the withheld reader was served a record_label) and 2 green (the name case, the empty-title floor). Restore: source blob equals HEAD, rebuilt, ablation-dist-preflight --absent exit 0 (marker absent from all 6 built files, tree clean), then the green dogfood run above.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at e0da4f8a5d: 70 commands, all run, and the --ran reconciliation reads 70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN. Two first readings were build-state, not this diff: check:dts-closure exited 1 on @objectstack/hono's declarations while my own closure build was rewriting that dist/ (re-run: 0, 169/169 present), and check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET, on packages this worktree had not built yet (re-run after the full build: 0).

Acceptance notes

• crm_contact's activity label moves from the full name to the first name, because the example's full_name formula declares no returnType: 'text' and its registered title is first_name. The activity label now agrees with the record page. Whether the example should title contacts by full_name is the example's call. Carrier: none.
• A formula title (display_title on several platform objects) is declared as the label's only source, though its value is computed from other fields. A reader served the formula field is served the same value by the data plane, so the label serves nothing the data plane does not.
• The writer's per-installation object-definition cache (getObjectDef, getFieldDefs) is never invalidated, so a definition changed at runtime may be read stale by the label, milestones and enable.activities alike. This was read from the source, not measured, and it predates this change. Carrier: none.
• origin/main advanced 4 commits past the base e085a8c3; none touches a file of this diff or what the gate derivation reads. Not merged; the queue rebuilds on current main.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-audit, touching 4 documentable anchor(s).

18 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 607463d736046d8d692d64cf16ea6804d1609f38.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 607463d736046d8d692d64cf16ea6804d1609f38 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cbc4bbfbd3eb57be033b4a19c9436d39cba6570d — the merge of head e0da4f8a5d07a1461ca1a23f8a90df0e80383115 into base 607463d736046d8d692d64cf16ea6804d1609f38, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cbc4bbfbd3eb57be033b4a19c9436d39cba6570d && git checkout cbc4bbfbd3eb57be033b4a19c9436d39cba6570d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 607463d736046d8d692d64cf16ea6804d1609f38 e0da4f8a5d07a1461ca1a23f8a90df0e80383115 && git checkout -B drift-repro 607463d736046d8d692d64cf16ea6804d1609f38 && git merge --no-ff e0da4f8a5d07a1461ca1a23f8a90df0e80383115

node scripts/docs-audit/affected-docs.mjs --json 607463d736046d8d692d64cf16ea6804d1609f38

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 607463d736046d8d692d64cf16ea6804d1609f38 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Re-queued once · seat domain:services#1 · session_011K3zqE8Pv1Evw5hc8tZCnN · 2026-10-05T17:30Z

The merge queue removed this PR at 2026-10-05T17:28Z. Its merge group's TypeScript Type Check aggregate failed only because the Type Check · consumer gates lane was cancelled. That lane hit the job's 20-minute execution limit inside "Build workspace packages", before any gate step ran, after its checkout alone took about 6.5 minutes (17:08 → 17:14:35). No test, typecheck or gate reported a finding.

• The same lane passed on this PR's head e0da4f8a within the limit. The merge groups queued just before and after this one passed.
• It died before any check body ran, so this is the one re-run the rules allow. If the group fails again, the seat treats it as real and does not re-queue.

---

Generated by Claude Code