docs(runtime): keys.ts's catch annotation states its measured determination instead of promising a gate entry (#12981 batch 10b)

[claude]

Fixes #12981 — batch 10b, the closing half of batch 10, under the ruling Q1 = A (#12981 comment 5543738972). Batch 10a is PR #15458.

Why

The annotation at the handleKeysRequest catch in packages/runtime/src/domains/keys.ts promised a FAILURE_PROPAGATION_SITES entry, keyed keys.ts::handleKeysRequest, "in the step that widens DURABILITY_CRITICAL_CALLEES". That promise is falsified by the ruling's own instrument: the widening that was actually sanctioned adds the seeder wrappers tryInsert / tryUpdate, and neither matches a seam in handleKeysRequest; the only name that would match is bare insert, which the swallow-family census refuses by design (measured at 36 quiet degradations in 30 files). So an entry keyed at that site would not be early — it would be STALE on arrival, and the gate deletes entries that excuse nothing.

What changed

One file, comment-only. The note now states the measured truth:

• the catch delivers on every path — measured by batch 10a's dev with the gate's own catchDeliversFailure(): with a matching vocabulary name present, every path out of this catch reaches deps.error;
• the determination is carried by the census's DETERMINED register row for packages/runtime/src/domains/keys.ts::handleKeysRequest in scripts/measure-durability-swallow-family.mjs, which re-verifies on every run that the file exists, that the determination sentence is still written at the site, and that the site is still a tier-1 DARK member — going STALE, loudly, otherwise. A gate entry would have proved the delivery alone;
• no gate entry is owed.

The register's anchor sentence — [#12981] This catch is silent BY DESIGN and it is NOT a durability swallow. — is kept byte-identical; only the surrounding promise is rewritten. The "do not bolt on a log" instruction and the http-dispatcher.keys.test.ts pin pointer are unchanged.

The register row, before and after

Identical, which is the point — diff of the two census readings exits 0:

    packages/runtime/src/domains/keys.ts::handleKeysRequest
      silent BY DESIGN — every path out of the catch hands the caller a 500 envelope  (#12981, in-file determination)

listed under DETERMINED, not outstanding 3 site(s) in 3 file(s) before and after, with --self-test reporting 3 DETERMINED register row(s) cross-check clean on both sides.

The row is proved live over the edited file, not merely still printed. Ablation on the committed tree: the anchor sentence was reworded on disk (silent BY DESIGN → quiet ON PURPOSE; injected marker count 1, original 0, counted on disk before the run), and the census answered

  ✗ 1 STALE row(s) in the DETERMINED register — each one still counts as OUTSTANDING above,
    packages/runtime/src/domains/keys.ts::handleKeysRequest  [anchor-gone]

then the file was restored with git checkout HEAD -- ABSOLUTE_PATH under a trap ... EXIT INT TERM, proved by state: restored blob 1408cfb21954547ac6a1c8bd5a0e889e258f5ca8 equals the HEAD blob, and git diff HEAD for that path is empty.

Verification

All on the final commit 0afa8ba3e. Exit codes captured by redirecting first, then reading $?; verdicts quoted from each tool's own line.

• Non-comment diff is empty — git diff -U0 filtered to lines that are not // comments produces nothing. No code changed.
• pnpm check:durability-log-level exit 0, verdict line unchanged before and after (whole output diff exits 0): 29 durability-critical catch seam(s), all loud, rethrowing or propagating to the caller (4 propagating, declared).
• node scripts/measure-durability-swallow-family.mjs exit 0 before and after, reading byte-identical (diff exit 0); --self-test exit 0 both sides: 4 positive control(s) ... 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total.
• Typecheck pnpm --filter @objectstack/runtime typecheck exit 0 (tsc --noEmit plus check:test-typecheck: OK), after building the dependency closure (pnpm --workspace-concurrency=2 --filter '@objectstack/runtime^...' build, exit 0 under the shared verify lock, VERDICT command-exit 0). A bare first attempt failed on unbuilt deps (TS2307), which reads exactly like a broken import.
• Derived family node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths passed; it read the change set itself) — 33 commands, every one run. 32 exit 0, including check:nul-bytes. check:pm-dispatch-gates is not in this card's family, so nothing was owed under the lock there.
• NOT MEASURED: pnpm check:dual-build-cjs-loads exits 3 — PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ ... ⛔ This is NOT a pass: nothing was measured. Its self-test passed (93 cases). A full pnpm build was not run for a comment-only diff; CI measures it.
• Whole-repo pnpm lint (eslint . --no-inline-config) exit 0 — run in full, no narrowing, so no narrowing evidence is owed.
• Control-byte self-scan of the edited file (grep -naP over the C0 range plus DEL): no hits.

Changeset

skip-changeset: the diff is a comment in a published package (@objectstack/runtime) — no behaviour, no types, no exports, nothing to publish. Label applied on this PR by the additive endpoint and read back.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 61 of 219 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e8c7956c46c0e8abda9d259ce07ba5f64e072c47 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e3eaad4008fc7b1fa008417b2d0c826384810597 — the merge of head 0afa8ba3ee0722b6bdf511160e2576946555d444 into base e8c7956c46c0e8abda9d259ce07ba5f64e072c47, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e3eaad4008fc7b1fa008417b2d0c826384810597 && git checkout e3eaad4008fc7b1fa008417b2d0c826384810597
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e8c7956c46c0e8abda9d259ce07ba5f64e072c47 0afa8ba3ee0722b6bdf511160e2576946555d444 && git checkout -B drift-repro e8c7956c46c0e8abda9d259ce07ba5f64e072c47 && git merge --no-ff 0afa8ba3ee0722b6bdf511160e2576946555d444

node scripts/docs-audit/affected-docs.mjs --json e8c7956c46c0e8abda9d259ce07ba5f64e072c47

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[claude]

ACCEPT — PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk.

Reviewed against the three-dot diff origin/main...claude/issue-12981-batch10b-keys-annotation (merge base 0db29473c, head 0afa8ba3e): one file, +25/−7, every changed line a // comment (non-comment filter of the diff is empty), matching the PR file list. The note now states what the ruling Q1 = A (comment 5543738972) established — no FAILURE_PROPAGATION_SITES entry is owed, the delivery was measured with catchDeliversFailure(), and the determination is carried by the census's DETERMINED register row — and the row's anchor sentence is byte-identical, so the register cross-check stays live (dev's ablation reds [anchor-gone], restore proven by blob). No overlap with the queued batch 10a (#15458 touches only check-durability-degradation-log-level.mjs). skip-changeset is right for a comment-only change. Fixes #12981 closes the programme card on merge; #15473 (the census why prose carrying the same refused promise) is graded on the card. Flipping ready and arming auto-merge now.

---

Generated by Claude Code