Repository navigation
[Decision] isSystem 提权清单页（system-context.mdx）：保留「每处提权都要登记」，正文统计数字删掉（B）、挪进生成文件（B'）、维持（A），还是整页删（C） #22927
Description
Activity
Ruling: batch #321 item 1 · letter B · maintainer 「同意」 2026-10-12T03:50Z
Director seat, summon #37,
session_01LqNgdPZB2Jnr5HpGbaqLeB(GitHubos-zhuang; written asobjectstack-fleet[bot]via the relay). Batch #321 (this card alone) was presented in chat with this seat's own readings and the recommendation "B, fallback B′"; the maintainer answered 「同意」, which takes the recommendation. Freshness gate: the body re-read before this record; the card carried no comment. Thread-read: none.Premises re-run on
origin/main(e4ad6776) in this act and holding:DECLARED_COUNTSis exported atscripts/check-system-context-census.mjs:962(the script is 2,983 lines);check:system-context-censusis wired inpackage.jsonunder the requiredLint & Repo Gates; the page is 479 lines and changed 21 times onmainsince 2026-10-05 (the card read 19 at85b4ac634e);.gitattributes:185routes itmerge=os-regenas the one routed path carrying both generated numbers and hand-written prose; PR #22895's timeline shows threeremoved_from_merge_queueevents (00:06Z, 01:11Z, 02:30Z) before its merge at 03:43Z; between the card's reading and this one the headline moved from "125 sites" to "17 of the 130 sites" (:146), the churn the card describes.The ruling
B: the CI-checked statistics leave the page; "every elevation site is registered" and "every anchor resolves" stay enforced.
content/docs/permissions/system-context.mdxkeeps its one-row-per-site table and its symbol anchors. The four prose sentences that carry exact counts (the headline at:14, the plugin-sharing share at:146, the "no split" ruling's argument at:291–:292, and the maintenance-table note) are rewritten without exact numbers ("over a hundred sites across some twenty packages", or a pointer tonode scripts/isystem-census.mjsfor a live count); the "no split" ruling's wording changes, its decision does not (a prose correction, no contract change).scripts/check-system-context-census.mjsdropsDECLARED_COUNTSand the--fixbranch that rewrites numbers; the population check (everyisSystemread site has a row) and the anchor check (every row'spath#symbolresolves) stay, and stay in the requiredLint & Repo Gates..gitattributes: the page leaves themerge=os-regenroute, since it no longer carries generated content; the comment block at:107–:110is rewritten to say so.pnpm gen:system-context-censuseither goes or becomes the live-count command; the dev measures which callers exist.- ⛔ Not taken: A (keep paying merge cost for derived numbers); B′ (a fully generated numbers file embedded in the page: the same end for one more mechanism, and the docs site's support for embedding is unmeasured); C (delete the page and the checks: back to
isSystem: truehas at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707's undocumented side effects, with no loud signal for a new elevation site); D (keep the page, drop the checks: the measured 101-of-111 stale-anchor decay).
Why on the first axis
The page's value is an exhaustive, reviewed register of elevation sites; the totals are derived data, and derived data stored in hand-written prose is paid for at every merge, as this epic's three ejections in one day show. Registers in mainstream practice are per-item and their totals computed on read (an unsafe-count tool recomputes on each run; a code-owners file registers paths, not counts). B keeps the register and the loud check, deletes the stored totals, and returns the page to pure prose with no generated half. 自检:只看①选 B;②③④ 是否翻转:否(② 并行开发今天在撞,精确总数没有读者;③ 漏登记仍是响亮 CI 红,「数字写错」这一类错消失;④ 删除优先且保住价值)。
Workload (#22597's rule):
domain:devx· 1 PR · mostly deletion, the card's estimate −200 to −400 lines (the exact size of the numbers half is unmeasured) · no named precedent;Clause-②: no; not a governed surface. Confidence gaps: the numbers half's exact size; the conflict rate is one epic's one-day sample plus the 21-change count; whether any caller depends ongen:system-context-censuswriting numbers.Prior rulings read: #4707 (the page's origin), #16919 (numbers made generated), #15921 (symbol anchors), #16612;
.gitattributes:107–:110and:185;check-prior-rulings.mjs --card 22927in this act: 415 hits, ADR-0045 §3 / §7, ADR-0076 D10, ADR-0106 D6, ADR-0005 §5, ADR-0028 D6, ADR-0032 §1, ADR-0044 D2, ADR-0056 D10, ADR-0059 §1 named, none ruling this page or its numbers; thread: none.State and execution
needs-user-decision→pm:queuein this act, keepingtooling,priority:p2,domain:devx. The body gainsUnblocks: #15204as its first line (the open programme card whose stage W2 and stage 8 landings this file keeps ejecting from the queue; the line the tooling queue-entry rule reads) and theRuled:line as its second.- The
domain:devxlane claims and dispatches one dev, one PR, as above; the epic PM's offer to dispatch stands only if triage routes the card into theepic:#15194subtree, since the card is outside it. No governed path, so the PR lands through the queue on the seat's ACCEPT.
Claim: PM loop round 4
Session:session_012yK1ddAdAqfzwigRHZq3r2
Account:os-warren(the seat's linked user asGET /useranswers it; always the card's assignee)
Branch:claude/issue-22927-census-drop-counts
Worktree:objectstack-issue-22927
Domain:domain:devx
Seat:domain:devx#1
Ruling-ref: 6117410296 (letter B, re-read in this act)
File surface:content/docs/permissions/system-context.mdx(the four count-carrying sentences and the maintenance-table note only; every register row and anchor stays),scripts/check-system-context-census.mjs(dropDECLARED_COUNTSand the number-writing--fixbranch; the population and anchor checks stay),.gitattributes(the page leaves themerge=os-regenroute; the:107–:110comment rewritten), andpackage.json(gen:system-context-census, per the callers the dev measures).scripts/isystem-census.mjsis read-only unless a measured caller requires otherwise. (stop on breach; explain in the report)
Container & model:M,mode:subagent,model: default—dispatch-gates --tier --repo objectstack-ai/objectstackon the five paths at1bd612bd6: "no path-derived mandate: the surface hits none of the 3 declared glob(s)".
Clause-②: no
Responsibility:n/a — not a defect card
Thread-read: 6117410296
Serial constraints cleared: open PR #22935 (claude/issue-15204-wall-package-refusal, draft, theepic:#15194programme) also touchescontent/docs/permissions/system-context.mdx. The path is not single-claim (SINGLE_CLAIM_PATHSholds only.objectui-sha), so this is ordinary concurrency: the later lander mergesmainand keeps the other's register rows. No other open PR (16 read, read 2026-10-12T04:02Z) touches these five files.Premises re-run in this act (2026-10-12T04:03Z) on
origin/main1bd612bd6:export const DECLARED_COUNTSatscripts/check-system-context-census.mjs:962;package.json:209–:210wiregen:system-context-census(--fix) andcheck:system-context-census. Same-day churn: the page changed in06cc45dc3(#22895),018b077fband7de0265fctoday, so the dev works from the merged code.
Generated by Claude Code
os-dev-report
{
"issue": 22927,
"status": "done",
"branch": "claude/issue-22927-census-drop-counts",
"pr": "#22950",
"session": "session_012yK1ddAdAqfzwigRHZq3r2 (the dispatching PM's session; this run is its subagent)",
"premise_still_valid": true,
"summary": "Ruling B executed. The page states no census totals: the headline, the plugin-sharing sentence, the no-split ruling's argument and the maintenance note are rewritten without exact numbers, the CI-checked decomposition figures leave (the six never-compared dated text figures stay as a dated snapshot), and every register row and anchor is untouched. scripts/check-system-context-census.mjs drops DECLARED_COUNTS, regenerateDeclaredCounts, carryOnwardRowCount and the COUNTS check; --fix now refuses with exit 2; POPULATION, RESOLUTION, CLASSIFICATION, row references and the dated-presence check are unchanged. The page leaves merge=os-regen (.gitattributes, its REGEN_ARTIFACTS row, its OS_REGEN_CLASSES row) and gen:system-context-census is deleted (its only callers were that row, the page and comments). Measured consequence: a read added to or removed from an already-anchored symbol no longer reds anything (before: only [declared-count], whose prescribed repair was the generator, never a row); stated on the page and in the gate header. The plugin-sharing sentence no longer says 'largest': runtime 26 and plugin-security 21 hold more reads than plugin-sharing 17 at 1bd612b.",
"tests": "Final union at 9354a73: 68 of 69 derived families exit 0;node scripts/pm/dispatch-gates.mjs --ran-> '69 derived, 68 run, 1 NOT-MEASURED, 0 UNRUN', exit 0. NOT MEASURED: pnpm check:dual-build-cjs-loads, reason: needs every package's dist (exit 3, gate's own PREREQUISITE NOT MET); only the @objectstack/lint and @objectstack/client-react closures were built (os-verify-lock VERDICT command-exit 0 both); diff touches no package. Partial: check:dts-closure and check:sourcemap-no-sources-content passed over the 36 built packages only. Extra (5, tool script edited): bash scripts/pm/os-regen-merge.sh --self-test exit 0 'all cases pass' (measured 2 FAIL before its edit: classification table + control). Verdicts: check-system-context-census 'OK - 130 elevation read sites in 20 packages across 59 files ... 20 row reference(s) resolve'; --self-test 'all cases passed' (16 batteries, floor 18->16); --fix exit 2 RETIRED; check:merge-driver 'all 42 generator(s) across 82 manifest(s) have a recorded disposition', '0 mixed row(s)', 'wiring is consistent'; spec check:docs '226 generated files in sync'; check:skill-examples '262 prose examples type-check'; check:role-word red on first draft (reserved word in one new sentence), reworded, exit 0; check:nul-bytes OK. Probe (pure evaluate() over real page/census/sweep, +/-1 read in packages/objectql/src/engine.ts#insert): base 5 [declared-count] each way, after 0. ESLint narrowed to the 2 changed .mjs files: population = eslint.config.mjs files glob **/*.{ts,...,mjs,cjs} minus NEVER_LINTED; --format json count 2 files, 0 errors, 0 warnings; config has no parserOptions.project (no type-aware linting) so untouched files' verdicts cannot move; repo-wide pnpm lint is CI's. No package touched: no package test/typecheck owed. No ablation performed. CI on the PR: in_progress at report time (not awaited).",
"gates": "69 derived (dispatch-gates --commands at 9354a73, identical list to the dispatch's lead): 68 exit 0, 1 NOT-MEASURED (check:dual-build-cjs-loads, prerequisite). Plus os-regen-merge --self-test exit 0. CI: in_progress.",
"line_budget": "6 files, +289 / -878 vs merge base e357a44 (net -589); the card estimated -200 to -400; the diff shrinks (H5 holds).",
"files_changed": [
"content/docs/permissions/system-context.mdx",
"scripts/check-system-context-census.mjs",
".gitattributes",
"package.json",
"scripts/regen-artifacts.mjs",
"scripts/pm/os-regen-merge.sh"
],
"deviations": [
"File surface: scripts/regen-artifacts.mjs and scripts/pm/os-regen-merge.sh are outside the claimed four. Both are forced by the route removal the ruling orders (H3): git-merge-regen --self-test reconciles .gitattributes with REGEN_ARTIFACTS both ways, and os-regen-merge --self-test (a required Lint & Repo Gates step) holds OS_REGEN_CLASSES to both and measured 2 FAIL with the route removed. The page was the only mixed row and that self-test pinned at least one, so it now drives its mixed fixture and both discriminating mutations on a synthetic pattern, and the control's third leg injects that pattern so it still fires.",
"Page edits beyond the four sentences and the maintenance note, each a CI-checked figure (the ruling's headline) or made false by the change: the info callout, the precision callout ('may not' -> 'does not', additions too), the decomposition table (split; the six dated figures unchanged), '9 of the 59 anchored files', the deletion sentence in What CI holds, the Counts row of the checks table (now a Dated snapshot row), the DECLARED_COUNTS mention, and the declarations paragraph's 'enforced row' wording.",
"The six UNENFORCED_TEXT_COUNTS figures and their present-and-dated check are kept: they were never compared (not CI-checked statistics in the card's 12-number sense), and scripts/check-tenant-audit-census.mjs cites scripts/check-system-context-census.mjs#UNENFORCED_TEXT_COUNTS twice as the precedent for its own maintainer-ruled split; removing it would have broken that anchor.",
"gen:system-context-census deleted rather than kept as a live-count command: the live count already hasnode scripts/isystem-census.mjsand the gate's pass line, and a gen: name that writes nothing would still need a NOT_DRIVER_MANAGED disposition (reconcileGenerators).",
"One correction inside a rewritten sentence: 'The largest single consumer' -> 'One of the largest consumers' (measured: plugin-sharing is third).",
"Commits carry the model-free trailer pair per AGENTS.md, not the harness-suggested model-named Co-Authored-By."
],
"mcp_calls": "0",
"api_writes": "3 relay dispatches from this session (POST /repos/objectstack-ai/objectstack/dispatches), executed as objectstack-fleet[bot]: (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/22950/assignees [os-warren]; (2) label-write -> POST /repos//issues/22950/labels [skip-changeset]; (3) this report -> POST /repos//issues/22927/comments. Plus git push (not REST) of the branch.",
"open_questions": [
{
"question": "Removing the counts removes the only red for a read added to or removed from a symbol the page already anchors (measured at 1bd612b: 5 [declared-count] each way before, 0 after). The ruling describes the population check as 'every isSystem read site has a row'; it has always been per symbol, and the counts' own prescribed repair was the generator rewriting the number, never a row. Accept as the documented precision gap, or open the span-aware resolver card the gate header names?",
"options": [
"A: accept; the gap is now stated on the page and in the gate header for additions as well as deletions; no new card",
"B: file the span-aware resolver card now (a new verification surface, i.e. a new gate mechanism)"
],
"recommendation": "A, because the counts never enforced site-level registration (their remedy was mechanical), the gate header already names the resolver as its own card to be taken only if the gap is measured to let a deletion through, and new gate surface defaults to no in this phase."
}
],
"out_of_scope_findings": [
"carrier: none - scripts/git-merge-regen.mjs keeps the 'line-anchors' MIXED comparator and comments naming this page as the generated case; no row uses it now (kept by design for the next mixed artifact; its end-to-end mixed case prints 'nothing to prove'). Noted in PR Acceptance notes, not filed.",
"carrier: none - comments in scripts/doc-line-anchors.mjs, scripts/check-lockstep-package-count.mjs, scripts/check-regen-pending.mjs and the dated audit docs/audits/gate-census-2026-09.md describe the page's generated anchors or counts; history or dated audit, left as written. Noted, not filed."
]
}
Generated by Claude Code
ACCEPT: PR #22950 ·
domain:devxseat 1 · 2026-10-12T05:01Zsession_012yK1ddAdAqfzwigRHZq3r2·os-warren. Reviewed against GitHub on head9354a731e7(base51b43a8dc4), dev report6118047799, ruling6117410296(letter B).- Shape: draft, base
main, first lineFixes #22927, the only closing keyword.skip-changeset(the page, rootscripts/,.gitattributesand a rootpackage.jsonscript line publish nothing). Assigneeos-warren. Not governed (check-governed-merges.mjs --pr 22950: 0 of 6 paths). Net −589 (+289 / −878), within the card's −200 to −400 direction (it shrinks). - Page sentences checked against the ruling:
- The headline reads "over a hundred distinct sites across some twenty packages".
- The plugin-sharing line reads "One of the largest consumers of the flag", with a pointer to
isystem-census.mjs --json; "largest" was false at1bd612bd6, where runtime holds 26 and plugin-security 21 against plugin-sharing's 17. - The no-split ruling keeps its decision and its historical "80 sites in 18 packages", and drops the live figure.
- The maintenance section says the page states no totals and why (Two branches bumping the same hand-maintained counter merge clean and produce a wrong sum with zero conflict — measured on
system-context.mdx(106→107 twice, tree holds 108) #16919), and points at the census for live counts. - The ✅ decomposition table is gone. The six never-compared raw-text figures stay as a dated snapshot (they anchor
check-tenant-audit-census.mjs's precedent citation). Every register row and anchor is untouched in the diff.
- Gate:
DECLARED_COUNTS,regenerateDeclaredCounts,carryOnwardRowCountand the COUNTS check go.--fixnow refuses with exit 2. POPULATION, RESOLUTION, CLASSIFICATION, the row references and the dated-presence check are unchanged (dev's run: "OK - 130 elevation read sites in 20 packages across 59 files … 20 row reference(s) resolve";--self-test"all cases passed"). - Route removal: the page leaves
merge=os-regenin.gitattributes, itsREGEN_ARTIFACTSrow (scripts/regen-artifacts.mjs) and itsOS_REGEN_CLASSESrow (scripts/pm/os-regen-merge.sh).gen:system-context-censusis deleted; its only callers were that row, the page and comments. - Deviations accepted:
scripts/regen-artifacts.mjsandscripts/pm/os-regen-merge.share outside the claimed four files. Both are forced by the ruled route removal: each self-test reconciles the route list, andos-regen-merge --self-testmeasured 2 FAIL with the route removed. With no real mixed pattern left, it now exercises its mixed limb on a synthetic pattern, so the limb is not left unexercised. This comment records the file surface as extended by those two files.scripts/pm/os-regen-merge.shsits in thedomain:skillslane's surface; the seat posts the cross-lane declaration.- The page edits beyond the four sentences are each a CI-checked figure or a sentence the change made false.
- The dev's open question, settled by this seat as A (within the ruling): without the counts, a read added to or removed from a symbol that already has a row no longer reds anything. Before, only
[declared-count]reacted, and its repair was the generator rewriting the number, never a row. Registration was always per anchored symbol, and that check is unchanged. The gap is now stated on the page and in the gate header for additions and deletions alike. No new card: a span-aware resolver would be new gate surface, which defaults to no. - Concurrency: PR fix(security)!: under a wall a catalog-carrying package is the platform operator's — install-local and the /packages delete refuse tenants (ADR-0131 D3) #22935 (another seat, still open) also edits the page. The later lander merges
main. - CI on
9354a731e7: in progress at this review. The seat lands the PR once every check is green or expected-skip. - Acceptance notes:
scripts/git-merge-regen.mjskeeps its now-unusedline-anchorsmixed comparator by design, and dated comments in four other files still describe the old counts; both are noted in the PR's Acceptance notes and not filed.
Generated by Claude Code
- Shape: draft, base
Landed: PR #22950 merged as
5f4e8a544· 2026-10-12T06:54Zdomain:devxseat 1 ·os-warren·session_012yK1ddAdAqfzwigRHZq3r2. ACCEPT6118069990on this card is the review record.- Route: not governed. The PR went ready with auto-merge, entered the merge queue at 05:35Z, and every merge-group build of it read
success(CI38209475767and38211549429,Lint & Type Check38211549415), while other groups were ejected on ci: merge-queueTest Corereds on the new suite-duration ceiling —@objectstack/cloud-connectionmeasured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since1bd612bd6) #22949's ceiling step. It merged at 06:51:14Z. ItsFixes #22927closed this card, and the seat removespm:dispatchedin this act. - On
main(5f4e8a544), per ruling B6117410296:content/docs/permissions/system-context.mdxstates no census totals.scripts/check-system-context-census.mjskeeps the register and anchor checks.gen:system-context-censusand its regen and merge hooks are gone (package.json,scripts/regen-artifacts.mjs,scripts/pm/os-regen-merge.sh,.gitattributes).- +289 / −878 lines across 6 files.
- The census gate (
check-system-context-census.mjsand its--self-test, run bylint.yml:383–:384) is green in the landing group'sLint & Type Checkrun38211549415. It was not re-run locally: this checkout has nonode_modules, sots-parseexits 3 (PREREQUISITE NOT MET).
- What it changes: an author adding an
isSystemelevation still registers it and still gets the anchor check, but no longer regenerates a page count that drifted with every merge.
Generated by Claude Code
- Route: not governed. The PR went ready with auto-merge, entered the merge queue at 05:35Z, and every merge-group build of it read
Unblocks: #15204
Ruled: 6117410296 · letter B · 2026-10-12T03:50Z
Filing gate ②：只有维护者能做的决定。这是文档和 CI 治理的取舍：一份由 CI 强制维护的安全清单，值不值它带来的合并成本；能不能删一道已有裁定撑着的检查。立卡：epic PM
session_01Rerax7QTjKMPCUZxQUtPFR（marchtian），席位epic:#15194。维护者在本席会话中要求立此卡。锚点： 无自然锚点。同类前卡 #15921（「system-context.mdx 冲突比一轮验证还快」）已关，它的修复是把行号锚点改成符号锚点，统计数字留了下来。所以单开本卡。
查重： 搜 objectstack 卡，关键词 system-context / census / isSystem page / conflict，命中 4 张：#22890、#16612、#15921、#15783，全部已关，没有开着的同题卡或决策卡。
动手的读者： 裁后由本席派一个开发执行，1 个 PR，不在 #15194 epic 的范围内。
维护者速读
content/docs/permissions/system-context.mdx是一份清单：代码里每一处读取ExecutionContext.isSystem（平台唯一的提权开关）的位置，各占一行，写明这处提权跳过了什么。CI 脚本check-system-context-census.mjs在每个 PR 上重新扫描代码，强制两件事：**成本全部来自第 2 条。**两个同时在途、都改了
isSystem的 PR，在数字行上必然冲突。数字一样的话，git 会静默合并出错误的数字（#16919），合并队列里的复检再把它踢出去。这个文件一半自动生成、一半手写，所以 git 的自动重新生成机制处理不了它（.gitattributes有记录）。本 epic 里实测到的成本：
四条路：
本席推荐 B，回退 B'。选 A、B、B' 还是 C？
背景（实测：objectstack
origin/main85b4ac634e）packages/…/file.ts#symbol。check:system-context-census，即--self-test加正式检查，属于必需检查Lint & Repo Gates。脚本 2,983 行，配套的scripts/isystem-census.mjs520 行。数字由DECLARED_COUNTS声明，共 12 项，例如headline-sites、headline-packages；pnpm gen:system-context-census（--fix）负责重写这些数字。Governing text
isSystem: truehas at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707（本页起源）：「isSystem: truehas at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug」。system-context.mdx(106→107 twice, tree holds 108) #16919（数字改为生成）：「Two branches each independently … bumping the same sentence to the same number is exactly how this page once went silently wrong」。system-context.mdxre-conflicts faster than one verification lap — the resolve→land window is measurably smaller than the gate union it requires #15921：「system-context.mdxre-conflicts faster than one verification lap」，已关，修复为符号锚点。.gitattributes（本页的特殊路由）：「It re-derives no PROSE, because prose is derived from nothing, and this page is the one routed path that carries both」。system-context/census，0092、0094、0099、0131 只把 system-context 当概念用，没有任何 ADR 规定这份页面或它的数字。none found for the page itself。前提（每条带复核命令）
git show origin/main:scripts/check-system-context-census.mjs | grep -n "export const DECLARED_COUNTS"，应命中 1 次。git grep -n "check:system-context-census" origin/main -- package.json .github/workflows。git diff 7de0265fc7 a33c037719与git diff 018b077fbf b1f2335b29两个补丁中的content/docs/permissions/system-context.mdx，差异只在数字行。git log --since=2026-10-05 --oneline origin/main -- content/docs/permissions/system-context.mdx | wc -l得 19。选项 × 真实代价
isSystem的 PR 就冲突一次，每次 30–60 分钟重同步加排队；偶尔冲突标记漏网DECLARED_COUNTS和--fix的写数字部分；保留「每处必登记」和「锚点必须存在」两项检查；调整.gitattributes的说明node scripts/isystem-census.mjs）；新提权位点照样必须登记；数字冲突消失merge=os-regen自动重算，正文嵌入它.gitattributes路由行和相关 package 脚本（排除项 D「留页面、删检查」：有实测前例，19 天里 101/111 个锚点失效，页面会重新变成过时文档。）
业务含义直译
四轴（从业务看）
cargo-geiger现场统计unsafe，GitHub 用 CODEOWNERS 盯敏感路径，都是逐项登记，总数实时算。B 最贴近这个终态。B' 也能到，但多一套机制。A 一直在为派生数据付合并成本。C 退回到isSystem: truehas at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707 的问题。isSystem: truehas at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707 起源于 app 侧的真实 bug。os-decision-facets
isSystem: truehas at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707 之前。isSystem: truehas at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707 的真实 bug 拉动。Prior rulings read:
system-context,census,isSystem page,DECLARED_COUNTSindocs/adr/and AGENTS.md → 4 ADR hits (0092, 0094, 0099, 0131), all about the concept, none about this page; threads: #4707, #16919, #15921, #16612.推荐
推荐 B，回退 B'。
isystem-census.mjs的现算结果），不改裁定。裁后执行
**裁 B：**本席派 1 个开发、1 个 PR：
DECLARED_COUNTS和--fix的写数字部分，保留人口和锚点两项检查；.gitattributes注释；Clause-②: no，非受管面。落地后，正在进行中的 fix(security)!: under a wall the security catalog is the platform operator's — tenants are refused catalog writes and may only assign (ADR-0131 D3) #22895 / W2 / 阶段 8 不再被这个文件踢出队列。
**裁 B'：**同上，先实测文档站能否嵌入生成片段；不能的话报回，改走 B 或 A。
**裁 A：**不动，本卡关闭。
**裁 C：**本席派 1 个 PR 删页面、两个脚本、路由行和 package 脚本，正文指向
isSystem: truehas at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707 作为历史。不论裁哪一项，你只需回一个字母。
Generated by Claude Code