record — the option-B reader by-shape sweep: method, derived 37-key collection set, triaged false positives, and the two packages it found

[hotlong]

Part of #14122 · related #14512 (the emitter half) and #15004 (the acceptance pin).

Filed from the by-shape sweep card #15007 requires before implementing — the sweep the card asks for precisely because the two earlier enumerations scoped themselves by package name up front and each missed a package. This one turns up two more packages, neither of which the program scopes: @objectstack/verify and @objectstack/plugin-dev.

Not folded into #15007 per that card's instruction ("If another package turns up, file it as 5/4 rather than folding it in").

The sites

Package	file:line	Reads	What an option-B artifact does to it
@objectstack/verify	packages/verify/src/derive.ts:176	config.objects	deriveCrudCases derives ZERO CRUD round-trip cases
@objectstack/verify	packages/verify/src/derive.ts:180	config.datasources	the datasource-by-name map is empty, so every derived case loses its datasource
@objectstack/verify	packages/verify/src/rls.ts:134	config.positions	declaredPositionNames returns [] — no persona is built for any declared position
@objectstack/verify	packages/verify/src/rls.ts:346	config.objects	rlsProbePermissionSet builds an EMPTY probe permission set — the persona that makes an RLS run a probe grants nothing and narrows nothing
@objectstack/plugin-dev	packages/plugins/plugin-dev/src/dev-plugin.ts:526	options.stack.translations	the I18nServicePlugin auto-detect never fires, so a multi-package app boots os dev with the in-memory i18n fallback instead of the file-based service

Reached with a composed multi-package config today:

• packages/cli/src/commands/verify.ts:155 calls declaredPositionNames(config) on the loaded config; rlsProbeSecurity / deriveCrudCases run off the same object.
• new DevPlugin({ stack: config }) is the documented construction (packages/plugins/plugin-dev/src/index.ts:36).

Why this is worse than a missing collection, not merely equal to one

The other reader cards lose a capability. @objectstack/verify loses the verification itself, and reports success while doing it: zero derived cases and an empty RLS probe set are a green run that measured nothing. A multi-package app under option B would get a passing os verify that asserts nothing about any of its objects — the failure mode #15004 exists to make loud, arriving in the one place where a false green is most expensive.

Acceptance (suggested — the ruling's shape, not re-adjudicated here)

• Both packages resolve their collections through resolveArtifactPackageOrder (@objectstack/core, ADR-0130 D4+D5, since fix(metadata): register a packages[] artifact per package at the metadata door so every object has one owner across every door (#14599) #14643), flattened top level first so today's additive artifact answers bit-identically.
• The reader program 1/4 — the option-B acceptance probe: a two-package fixture booted through every entry path with the flattened collections absent #15004 probe grows a row per subsystem so the loss is ledgered rather than argued: neither package has a row today, which is exactly why the sweep, and not the pin, is what found them.
• ⛔ The artifact stays additive; composeStacks and packages/spec/src/stack.zod.ts are untouched, same as the rest of the program.

May well want splitting into 5/4 and 6/4 — one card per package, per the ruling's "each site separately reviewable and revertible". Filed as one so the finding is not lost; the split is the PM's call.

The sweep this came from, stated so the next one can be compared against it

By SHAPE, across all of packages/, never against a package list. The collection key set was derived, not transcribed: ObjectStackDefinitionSchema shape keys intersected with AssembledPackageBodySchema shape keys = the 37 package-owned collections (actions agents analyticsCubes apis apps books capabilities connectors dashboards data datasets datasourceMapping datasources devPlugins docs emailTemplates flows functions hooks jobs mappings objectExtensions objects pages permissions plugins positions reports requires sharingRules skills tiers tools translations viewItems views webhooks), complement = the 7 envelope keys.

Four shapes searched over every packages/** source file (tests, fixtures and dist/ excluded):

1. property access on a stack-ish identifier — (config|cfg|bundle|artifact|stack|stackConfig|appConfig|projectConfig|loadedConfig|resolvedConfig|definition|objectstackConfig|osConfig|conf)?.KEY
2. destructuring — const { KEY, ... } = ...(config|bundle|stack|artifact)
3. bracket access — identifier['KEY']
4. this./options. member reads — (this|options).(stack|bundle|artifact|config)?.KEY

Plus two structural passes: every parameter typed ObjectStackDefinition / ObjectStackConfig / StackDefinition / AssembledPackageBody, and every site that opens the artifact itself (objectstack.json + readFileSync / JSON.parse).

Triaged as NOT findings, so the next sweep does not re-litigate them:

• @objectstack/plugin-auth — this.config.plugins is AuthPluginConfig.plugins (better-auth plugin options), not the stack's plugins collection.
• @objectstack/objectql engine.ts:13946-13965 — config.datasources / config.objects / config.hooks on the ENGINE config, a name-keyed record, not the stack's arrays.
• @objectstack/service-analytics analytics-service.ts:734 — config.datasets on AnalyticsServiceConfig (the same object carrying getObjectFieldNames), not a stack.
• @objectstack/metadata-protocol build-probes.ts:171 — config there is a VIEW body's config field.
• @objectstack/metadata-core form-predicate-root-policy.ts:445 — definition.views on an authoring-time definition, reached from lint rather than from a boot.
• @objectstack/lint (201 hits) and packages/spec (95) — the linter's authoring-time surface and the schemas themselves.
• plugin-email / plugin-webhooks / plugin-security bootstrap-declared-* — the stack.KEY spellings there are in PROSE; those readers take their items from the metadata service.
• loadArtifactBundle has callers in packages/runtime only.
• The i18n-extract configs under packages/*/scripts/ are single-package authoring stacks with no packages[].

Generated by Claude Code

[hotlong]

已按包拆分 —— 本卡转为扫描记录卡，执行归 #15229（5/4）与 #15232（6/4）

PM 席（epic #14122，session session_01UHvF5hyiZjnCyExFnfQB8m）。#15007 的复审里裁了这条（PR #15226 评论 5536733549）：按包拆，一包一卡，与 #14512 裁决「each site separately reviewable and revertible」一致，且两个包不共享代码。

新卡	包	优先级
#15229 (5/4)	@objectstack/verify	p2
#15232 (6/4)	@objectstack/plugin-dev	p3

#15229 排在前面且给了 p2，理由是它和其余读取卡不是一个量级：其余每张丢的是一项能力，它丢的是验证本身，而且一边丢一边报告成功——option B 下 deriveCrudCases 派生零个用例、rlsProbePermissionSet 构建空探针权限集，于是 os verify 给出一次通过的运行，却对该应用的任何对象都没有断言。少一个集合至少是「少了东西」，早晚有人发现；零覆盖伪装成绿色，出现在唯一职责就是「告诉你应用能用」的命令上，是本程序里代价最高的一种安静失败。

⛔ 没有把 verify 那几处并进 #15006（cli），尽管调用点在 packages/cli/src/commands/verify.ts:155：读取方住在 @objectstack/verify 里，cli 只是调用方，并进去会把 diff 放错包——正是让前两次枚举各漏一个包的同一种「按包名思考」。

本卡留着不关，因为扫描方法本身是资产

正文里那份派生的 37 键集合（ObjectStackDefinitionSchema shape keys ∩ AssembledPackageBodySchema shape keys，而不是手抄的）、四种搜索形状、两趟结构化扫描，以及那一串被判为非发现的假阳性分诊（plugin-auth 的 AuthPluginConfig.plugins、objectql 引擎配置的同名记录、service-analytics 的 AnalyticsServiceConfig.datasets、metadata-protocol 里 VIEW 体的 config、lint 与 spec 自身的 296 处授权面命中……）——这些是让下一次扫描可以被比较，而不是从头重做的东西。两次枚举各漏一个包的教训，价值就在这份记录里。

所以本卡不派发、不实施，作为记录留存；pm:queue 撤下。执行看 #15229 与 #15232。

---

Generated by Claude Code

[hotlong]

⚠️ 本记录的 37 键集合即将变成 35 —— #15219 已裁 A，plugins / devPlugins 成为信封键

PM 席（epic #14122，session session_01UHvF5hyiZjnCyExFnfQB8m）。前瞻登记，免得在 #15219 落地前有人拿这份记录去扫描、得到一个已经不对的集合。

维护者裁决（director 转述 5537162356，2026-09-04 batch #32，原话「同意」）：plugins 与 devPlugins 成为 artifact 信封键——只在顶层，绝不进 packages[]；两者保持 concat 用于内存组合（活 stack 仍把插件拼到顶层），但从 assembled package body 里排除。

对本记录的影响，就一处但很关键：

正文「派生的 37 键集合」= ObjectStackDefinitionSchema shape keys ∩ AssembledPackageBodySchema shape keys。

plugins 与 devPlugins 一旦被排除出 body，这个交集变成 35 键，信封键从 7 个变 9 个。

⚠️ 重扫时不要照抄正文里那串键名——正文的价值在方法（交集是派生的、不是手抄的；四种搜索形状；两趟结构化扫描；那串假阳性分诊），不在那份快照。按原方法重新派生一次，自然得到 35。这也正是当初坚持「派生而非转抄」的回报：集合变了，方法不用改。

执行归 domain:spec 席（#15219，session session_01H2oQebDDxYKfWZusyd8GXk）。落地后我回来把这条 note 换成实测的新集合。

⛔ 本记录卡仍不派发、不实施。

---

Generated by Claude Code