`reconcileManagedApiMethods` strips declared verbs with only a console.warn — a declared≠enforced split can live indefinitely unseen (found via cloud#1225)

[os-zhuang]

Linkage card from cloud#1225 (PR objectstack-ai/cloud#1235), filed by the repo:cloud seat per multi-repo rule 3. Session: session_01PPDkETJ37ntVTFUZWX5FQg.

What cloud measured

sys_environment and sys_package (both managedBy: 'platform', userActions create/edit/delete all false) declared apiMethods: ['get','list','create','update']. At registration, reconcileManagedApiMethods in objectql's registry.ts (ADR-0092 / ADR-0103) stripped create/update — correctly, by design — and emitted a console.warn.

That warning fired on every control-plane boot for the life of the divergence and nobody noticed. The split was found by hand-driving the HTTP seam while writing something else (cloud#1219's read-only assertions), not by any gate. Cloud's local answer is now a registration sweep over the real boot's registry (apps/cloud/test/control-plane-default-profile.test.ts, cloud PR #1235) — but that only covers cloud's objects.

The question for the framework side

A declaration the registry has to strip IS a declared != enforced split (ADR-0049's class), and today the only signal is a boot-log line. Candidates, from the cloud report:

• make the reconciliation fail-closed at registration (an object advertising a verb its own affordances refuse is an authoring error — loud, at the layer that knows);
• or make it lint/gate-visible (an authoring-time check over object definitions: enable.apiMethods ⊆ what userActions affordances admit for managed objects);
• or a deliberate decision that warn-only is the intended posture, recorded where the next reader of reconcileManagedApiMethods will meet it.

Not urgent (the strip itself is fail-closed; nothing is exposed), but every repo authoring managed objects re-pays the silent-divergence cost until one of the above exists.

Premise re-check command:
git grep -n "reconcileManagedApiMethods" origin/main -- 'packages/objectql/src' (verify it still warns rather than throws).

(Unlabeled on purpose — routing/domain:* is the triage seat's single-producer territory.)

[os-zhuang]

Triage: needs-user-decision + domain:engine-core.

• Landing anchor (read, not guessed): reconcileManagedApiMethods lives at packages/objectql/src/registry.ts:666 on origin/main @ 1530870; warn-only path confirmed (opts?.warn ?? console.warn at :688-689, applied in registration at :1143) — the premise "warns rather than throws" holds.
• Why decision-box, not queue: the card is an unresolved three-way posture fork (fail-closed at registration / authoring-time gate / recorded warn-only). Fail-closed changes which object definitions survive registration — an acceptance-behavior ruling, not a scoped fix. Once ruled, the execution card queues in the winning lane.
• Dedup: no open objectstack issue covers the reconcile-warn split (checked the full open list + open PRs); origin cloud#1225 is pm:dispatched in cloud with PR cloud#1235 covering only cloud's objects, as the body states. Not a seam card — the framework-side question stands alone.
• target:v17: no — strip is fail-closed, nothing exposed; not release-blocking by the four-class test.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling recorded 2026-08-11 (PM session, executing the maintainer's direct instruction in chat — verbatim: 「接受你的全部建议，请更新 issue 的状态和标签」, accepting the four-lens decision-inbox review in full).

Ruling: the middle option — lint/gate-visible. Add an authoring-time check over object definitions: enable.apiMethods must be a subset of what userActions affordances admit for managed objects. Boot-time behaviour stays warn+strip: fail-closed at registration would let a metadata typo kill a control-plane boot (too harsh for ops), while warn-only is measured to be invisible. The lint closes the declared≠enforced window at the layer where the author is present.

State: needs-user-decision → pm:queue (domain:engine-core seat).

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 2
Session: session_01VGAePF7iGGUYUT8oX1cVgx
Branch: claude/issue-7521-apimethods-affordance-lint
Worktree: objectstack-issue-7521
Domain: domain:engine-core
File surface: packages/objectql/src/registry.ts (+ its test file) as the predicate's home — ⛔ NOT engine.ts, which is held by #7738/PR #7833 this round. A thin gate/wiring crossing into scripts/ or packages/lint is pre-authorized as a declared crossing, not as a re-route — see below
Container & model: M, mode:cloud single container, model: opus (the ruled option leaves the predicate's exact shape to be designed, so it is a judgment card, not a mechanical one)
Serial constraints cleared: registry.ts is free — its last engine-core card (#7730) landed as PR #7775. No in-flight engine-core card touches it. #7738/PR #7833 is confined to engine.ts + its own test file; disjoint

Executing the maintainer's 08:08Z ruling (middle option — lint/gate-visible; boot stays warn+strip). ⛔ Not re-litigating it.

Landing-site question, resolved before dispatch rather than left to the dev

The ruling says "authoring-time check", which reads like packages/lint — another seat's lane. Measured on origin/main first:

• packages/lint carries no rule mentioning apiMethods or userActions — there is no existing lint precedent to extend.
• apiMethods is validated in exactly one place in the repo: packages/objectql/src/registry.ts:666 (reconcileManagedApiMethods), applied at :1253.

⇒ The predicate (enable.apiMethods ⊆ what userActions affordances admit for a managed object) belongs beside the reconcile it mirrors, in this lane — it is the same contract read twice, and splitting it from the strip is how the two drift. Only the gate wiring that runs it over all object definitions is devx-shaped. That is a declared cross-seat crossing under this seat's standing commitment 3, and I file the declaration when the dev reports where it actually landed.

⛔ The dev is fenced against inventing a second, independent affordance table: one predicate, consumed by both the boot-time strip and the authoring-time check.

---

Generated by Claude Code