feat(service-print): print a record's print page to a PDF in headless Chromium as the requesting user, and archive it on the record

[objectstack-fleet]

Fixes #22269

Clause-②: yes (widening)

Print page ③ of the B′ split: @objectstack/service-print, a render service with one engine (headless Chromium) that renders a record's print page under the requesting user's own principal and archives the PDF, as that user, as a sys_file attached to the record. It builds on the landed file-attachments archive, which it widens with a caller-scoped face, and binds to the principal-session mint of the seam card #23772.

Binding state: bound. #23772 has landed (PR #23786), and so has the fix that lets a minted session boot the console (#23813). The service reads IAuthService.mintPrincipalSession through ONE package-local adapter, packages/services/service-print/src/principal-session.ts (principalSessionMinterOf), which is typed by the contract's own IAuthService and PrincipalSession. status() reports unavailable, naming that member, only where the composed auth service does not offer it.

What it adds

• PrintServicePlugin registers the in-process print service (IPrintService): status() and printRecordToFile({ app, object, recordId, page, filename? }, context). Explicit composition; no route, no metadata key, no error code, no requires token.

• One engine, two placements (ruling of record on this card, OQ5 → B):

  • local: OS_PRINT_CHROMIUM_PATH / chromiumPath. Per render, chromium.launchServer({ executablePath, headless: true }) and chromium.connect to it, one browser process per render. Disposal closes the connection, then the server, and kills the process if a close does not settle within 2 s;
  • remote: OS_PRINT_BROWSER_ENDPOINT / browserEndpoint, a DevTools WebSocket endpoint, chromium.connectOverCDP per render. Its context closes first, then the connection, each bounded the same way;
  • both need OS_PRINT_CONSOLE_URL / consoleUrl, the console URL that browser reaches (/_console included). A console URL carrying credentials (user:password@) is refused, and so is configuring both placements at once; each is reported as misconfigured.
  • playwright-core 1.63.0, pinned exact on this package only (already in the lockfile).

• Loud at start():

  • the plugin probes the engine (launch or connect, read the version, close) and logs the placement and Chromium version;
  • an absent, misconfigured or unreachable engine is one warn naming the setting;
  • status() reports ready | unconfigured | misconfigured | unavailable with the reason;
  • the plugin never logs the remote endpoint or the console URL beyond scheme and host, and status() never shows more: the endpoint may carry a token, and a value that does not parse is described as unparseable, never echoed.

• ICallerFileAttachmentService (@objectstack/service-storage, exported type, minor): the file-attachments service's caller-scoped face, on the same slot and the same one writer. IFileAttachmentService and attachFile are unchanged.

  • assertMayAttach(parentObject, parentId, context) throws the insert's own refusal without writing:
    • PERMISSION_DENIED / 403 when ISecurityService.explain says the caller may not create sys_attachment;
    • ATTACHMENT_PARENT_ACCESS / 403 when the attach rule (parent EDIT) refuses.
  • attachFileAs(input, context):
    • writes one sys_file owned by the caller, and one sys_attachment inserted under the caller's own context, so every insert gate judges the caller and uploaded_by is stamped;
    • acts in the caller's organization only: an organizationId other than the context's tenantId (or null when it names none) is PERMISSION_DENIED / 403, before anything is read or written.
  • A system or user-less context is refused PERMISSION_DENIED / 403 on both verbs.

• Refusals, in the ruled order, all before any mint or launch. Each pin asserts code + status, and that mint, render and archive were never called:

  #	condition	code / status
  1	not a human user acting for themselves (no context, system, agent/service/guest/system kind, an authGate hold)	PERMISSION_DENIED / 403
  2	engine not ready (unconfigured, misconfigured — e.g. both placements, or a console URL with credentials — never probed, or a service a print needs not composed)	SERVICE_UNAVAILABLE / 503
  3	unknown page	RESOURCE_NOT_FOUND / 404
  3	a malformed request field; a page of another object, no print, or not the object's default record page	VALIDATION_ERROR / 400
  4	record read AS THE CALLER returns nothing, or the read is refused 403	RECORD_NOT_FOUND / 404
  5	object without enable: { files: true }	FILES_DISABLED / 403
  5	the caller may not create attachments (assertMayAttach)	PERMISSION_DENIED / 403
  5	the caller may not attach to this record: the attach rule, parent EDIT (assertMayAttach)	ATTACHMENT_PARENT_ACCESS / 403

  An engine whose last probe failed, with every service composed, is probed once more only after step 5. If that probe fails too, the answer is SERVICE_UNAVAILABLE / 503. So no browser is launched or connected before any of the refusals above.

• Then:

  • mint (TTL 60 s, twice the 30 s render budget, under the contract's 120 s ceiling);
  • render: one 30 s deadline over every step, from open to page.pdf, so a stall answers TIMEOUT / 504; the cleanup after it is bounded, and a browser that arrives late is closed;
  • archive: attachFileAs as the caller;
  • revoke in finally (pinned after a failed render and after a refused archive).
  • A revoke that itself fails never replaces the print's outcome. It is logged at error on the plugin's logger, naming the user and a 12-hex fingerprint of the session (never the token or the cookie), and the 60 s TTL ends the session (pinned through the plugin).

• The page binding: the browser loads CONSOLE/apps/APP/OBJECT/record/ID with the minted cookie, waits for the print root (data-print-page) AND window.__objectui.idle for 3 consecutive polls, then document.fonts.ready, then page.pdf({ preferCSSPageSize: true }) — the print keys are mapped to CSS once, by the console.

• Showcase: showcase_invoice_document, the invoice's default record page, declares print; showcase_invoice declares enable: { files: true }. Section headings and the page label are translated (en, zh-CN).

• Docs:

  • content/docs/ui/print-pages.mdx (+ the ui landing row);
  • the OS_PRINT_* rows in content/docs/deployment/environment-variables.mdx;
  • the packages.mdx row;
  • README and changeset.

Measured (mechanism assumptions)

1. The archive. Built on the file-attachments writer as it is, run AS THE CALLER through attachFileAs; there is no second archive entry, and no IFileAttachmentService or packages/spec change.
   • The caller-scoped refusal chain runs before any mint or launch: the record read with the caller's own context (RECORD_NOT_FOUND), the FILES_DISABLED pre-check, and assertMayAttach.
   • The earlier gap is fixed. On a real showcase boot, attaching under the system context had left sys_file.owner_id and sys_attachment.uploaded_by null and skipped the parent-EDIT gate. Both rows now name the requester, and the attach rule judges them. This is pinned on a real showcase boot (print-service-archive.dogfood.test.ts, and the real render in print-service-render.dogfood.test.ts).
   • A reader who may read every invoice but edit none is refused PERMISSION_DENIED / 403 before any mint or render.
2. The page binding at .objectui-sha f96f771140, re-read at daeb77fc84dd, the pin at this head.
   • The console renders a record ONLY on its bound page: the object's default record page, else the first record page. No URL renders a named, non-default page for a record (RecordDetailView calls usePageAssignment(objectName) without pageName, RecordDetailView.tsx:640 at the pin).
   • The print root marker exists: PageRenderer stamps data-print-page on a print page.
   • Measured end to end with the console built at the pin, my driver, both placements, and a normally signed-in session. The invoice print page renders on A4 with its details, line-items table, Chinese header and footer, and page number (pdfinfo: 1 page, 594.96 x 841.92 pts; fonts include WenQuanYiZenHei). The run through the service itself with a minted session is item 3.
   • Missing surface (objectui): a route that renders a named print page for a record.
3. The mint (auth(spec,plugin-auth): a short-lived principal-session mint, an optional IAuthService member with its AuthManager implementation, the seam #22269's print service consumes (S2 of #22269) #23772) against the real console: boots, after plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813.
   • Before that fix, a minted session kept the console on "Opening your console…". The measured difference was that the short session was renewed on every get-session read.
   • With the fix merged (0cfd0c49bd), print-service-render.dogfood.test.ts prints through the service's own path, with a session minted by IAuthService.mintPrincipalSession, against the console built at daeb77fc84dd, on both placements. It asserts:
     • the console booted as the requester;
     • both rows name the requester;
     • the minted session answers 401 after the print, after a success and after a forced failure.
   • Green 6/6 at 9252cd175e, and again at 78e50355a2 after the round-3 driver changes.
4. The driver library.
   • Local: launchServer({ executablePath }) + connect. Remote: connectOverCDP(endpoint). Both work on Chromium 141.
   • Closing a CDP-connected browser leaves the remote browser running, and its render context (and cookie) gone (pinned).
   • The injected-launcher pins hold the bounded cleanup, with no browser: a close that never settles still answers within the budget plus the grace, and the local process is killed; an open that settles after the deadline is closed and never given a context.
5. The CJK pin: text extraction cannot tell glyphs from boxes (pdftotext returns the Chinese text from a tofu render). The pin asserts every Chinese code point is a ToUnicode target of an embedded font. Ablation (Chromium narrowed to a Latin-only fontconfig, no code change), both placements red: expected [ '发', '票', '客', '户', '名', '称', …(12) ] to deeply equal []; restored green.

Tests

• @objectstack/service-print: 79 tests.
  • config: both placements, misconfiguration, redaction, a console URL with credentials or one that does not parse;
  • service: every refusal, the order, the deferred re-probe, mint/render/archive/revoke, a failed revoke, the caller's own context, no credential in a message;
  • the driver with an injected launcher: the cookie redaction, one budget over every step, the bounded cleanup, a late open;
  • plugin start() loudness against a missing executable and a dead endpoint carrying a token, and the plugin-level revoke-log pin;
  • the real-Chromium engine on both placements: render as the session, A4 from @page, the CJK pin, timeout → TIMEOUT / 504, remote cleanup.
  • The Chromium file runs where OS_TEST_PRINT_CHROMIUM_PATH or PLAYWRIGHT_BROWSERS_PATH/chromium exists, and says it was skipped otherwise.
• @objectstack/service-storage: 1029 tests, including the caller-face pins against a real ObjectQL engine and its insert gates:
  • the system context refused on both verbs;
  • owner_id / uploaded_by = the caller;
  • ATTACHMENT_PARENT_ACCESS from the real insert gate;
  • PERMISSION_DENIED from explain;
  • FILES_DISABLED as the caller;
  • another organization refused.
• packages/qa/dogfood/test/print-service-archive.dogfood.test.ts: 9 tests.
  • The plugin as composed on a real showcase boot: unconfigured status, 503, 403.
  • The service over the real kernel services: unknown page 404; non-print page 400; another user's invoice hidden by RLS 404 (with a caller/system control); a reader who cannot attach, 403; a successful archive as one committed sys_file + one sys_attachment on the invoice, both naming the requester; the real mint revoked at the wire.
• packages/qa/dogfood/test/print-service-render.dogfood.test.ts: 6 tests, 3 per placement. The real render through the real console with a minted session, as Measured 3 describes.
  • It needs a built Console and a Chromium, and says it was skipped otherwise.
• These counts are the dev's runs: 79 and 1029 at 5a16f29db9; 9 and 6 at 78e50355a2. In CI the two Chromium-gated files skip, and the dogfood suite runs only in main's full battery.

Acceptance notes

• packages/spec/liveness's page.print row was flipped from planned to live on main before this head (PR fix(spec): page.print and the flow terminal-toast translations read live in the liveness ledger, so a print page is no longer warned that nothing applies it #23776, closing spec liveness: the console pin hop to objectui 1f23d5b070fa makes page.print and translation.flows.successMessage / errorMessage read planned while the shipped console applies them (family card; the parentDataSource leg is #23585) #23710). The finding first noted here is resolved, and needs no spec-lane follow-up.
• Observed on the real PDF, and routed at ACCEPT (the seat record on this PR):
  • The record details' "Show N empty fields" toggle reaches paper. This is card ② print rendering, an objectui follow-up.
  • Line-item column headings print field names rather than labels. That is not a renderer defect: record:line_items draws a column exactly as declared, and does not hydrate a label from the child field (packages/spec/src/ui/component.zod.ts:2494). The showcase page's columns declare no label, so the follow-up is in this repo's showcase.
• The CJK pin measures the browser's host fonts; a local placement without a CJK font prints boxes. The docs page says so.

Surface deviations (declared)

• packages/spec/llms.txt: the package count 71 → 72, forced by the new package (check:llms-txt), with a @objectstack/spec patch line in the changeset. No other packages/spec change.
• turbo.json and scripts/cross-package-test-inputs.mjs: the dogfood tests' declared inputs gain packages/services/service-print/src/** and packages/console/dist/index.html, the latter with heldBy (check:cross-package-test-inputs).
• content/docs/permissions/system-context.mdx: census rows 47d (the print service's system-context refusal) and 47e (the caller-scoped attach verbs' refusal) (check:system-context-census).
• scripts/docs-audit/handwritten-docs.json: the new docs page (check:docs-audit-scope).
• packages/services/service-storage/src/**: the caller-scoped face, as REWORK 6208156693 item 2 orders. storage-service-plugin.ts and attachment-access-hooks.ts were edited only after PR feat(service-storage): the sys_attachment read gate writes one ReadableIds leaf per parent object and does no pre-scan; D5's three classes keep the probe (ADR-0139 E7, attachments) #23767 merged. The hooks change is an extraction of the attach rule's verdict, with behaviour unchanged.

Seat edit · domain:services seat 2 · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T14:56Z: stale lines corrected to head 5a16f29db.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/service-print, @objectstack/service-storage, @objectstack/spec, touching 128 documentable anchor(s). ⚠️ 7 changed file(s) yielded no anchor (packages/services/service-print/LICENSE, packages/services/service-print/README.md, packages/services/service-print/package.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

61 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 161aee10478de783f37320d4f665153488571569.

⛔ 13 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 7 changed file(s) yielded no anchor (packages/services/service-print/LICENSE, packages/services/service-print/README.md, packages/services/service-print/package.json, …) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: PERMISSION_DENIED (literal, 37 pages)
• 32 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 146 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 161aee10478de783f37320d4f665153488571569 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 004ff06ee7fbd9d3d625a8474749bfba56342475 — the merge of head 5a16f29db960f6d14e058af2b926d959c8992a7e into base 161aee10478de783f37320d4f665153488571569, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 004ff06ee7fbd9d3d625a8474749bfba56342475 && git checkout 004ff06ee7fbd9d3d625a8474749bfba56342475
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 161aee10478de783f37320d4f665153488571569 5a16f29db960f6d14e058af2b926d959c8992a7e && git checkout -B drift-repro 161aee10478de783f37320d4f665153488571569 && git merge --no-ff 5a16f29db960f6d14e058af2b926d959c8992a7e

node scripts/docs-audit/affected-docs.mjs --json 161aee10478de783f37320d4f665153488571569

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 161aee10478de783f37320d4f665153488571569 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 · REWORK (patch round 1) · domain:services seat 2 · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T04:34Z

Reviewed against GitHub at head 4aa215ac5c and against the report 6208035645 on #22269. The build is sound where measured: a real render on both placements with a normal sign-in session, the refusal chain before any mint or launch, revoke in finally, the CJK pin ablated through a Latin-only fontconfig, and the archive committed. It cannot land yet, for two reasons the report itself names, plus the bind.

Blocking, with the seat's answers:

1. The mint does not boot the console (report open_questions[0]). This is now plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813, an in-scope sub-issue of print page ③ of #8346: a render service with one headless-Chromium driver renders a print page under the requesting user's principal and archives the PDF as a sys_file (M2) #22269 in this lane, claimed (6208138185) and dispatched. This PR binds mintPrincipalSession after plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 lands. Then: merge origin/main, bind through src/principal-session.ts, and run the real render with a MINTED session on both placements. That run is the card's acceptance; the sign-in-session run is not.
2. The archive must attach under the caller (report Q3). Ruling OQ7 A (6059363716) reads "pending, then attach under the caller, then commit". The system-context attachFile skips the parent-attachment gate and stamps no requester (measured: owner_id, uploaded_by and created_by all null). So the seat answers Q3 by the ruling: the attach runs as the caller, the parent-attachment gate fires for the caller, and both rows are attributed to the requester. Its check joins the refusal chain's files step, before any mint or launch. Accepting READ as the bar with system attribution would relax a ruled gate, and that is the maintainer's to grant, not this seat's. Constraint: ⛔ no packages/spec edit. Prefer one writer: a door in service-storage that reuses the file-attachments writer under the caller's ExecutionContext. If that is impossible without changing IFileAttachmentService, stop that item and report the minimal contract change; the seat routes it to the spec lane.

Answered, not blocking:

• Q2 (which page prints): A. Keep the default-record-page rule with its loud 400. The seat files the objectui card for a named-page print route at ACCEPT.
• Q4 (OS_PRINT_CONSOLE_URL / consoleUrl): A. Explicit composition.
• Q5 (CJK in CI): out of this PR. Provisioning Chromium in CI is a .github/workflows edit, a governed surface, so it is the maintainer's. The seat raises it in the round report. The pin stays as built: measured in agent containers, skipped with a warning elsewhere.
• packages/spec/llms.txt and '@objectstack/spec': patch: accepted as the gate-forced package count. The seat declares it to the spec seat at ACCEPT.
• Out of scope: the page.print liveness row still reads planned while two consumers read it, and two printing defects belong to objectui card ②. The seat files both at ACCEPT, after dedupe.

CI at 4aa215ac5c: Validate Package Dependencies is red in check:vendor-export-contract-resolve, because npm install better-auth@1.7.3 crashes with edgesOut in a scratch directory with its own package.json. That is not this PR's: the release PR #23481 failed identically at 2026-10-16T01:40Z, and it is #23788 (domain:devx, fix PR #23799 in flight). This PR merges main once that lands; no re-run is spent on it. The other checks were still running at this read.

Size: 2,795 changed lines before the bind and the attach. If the patch round crosses 3,000, the PR body gains ## 维护者速读(草稿), as the dispatch says.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · patch round 1, item 1 · domain:services seat 2 · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T06:22Z

Read against GitHub at head fb36ebb704 and on the round's own diff, 5cc84cc6cc..fb36ebb704 (12 files, +460/−92), not against the report (6209378010 on #22269). ⛔ Not an ACCEPT: item 2 of REWORK 6208156693 is still owed.

• Item 1, archive under the caller: met.
  • The attach rule's verdict is extracted once as mayEditAttachmentParent, and the beforeInsert gate calls the same body.
  • assertMayAttach asks the two questions the insert would ask: explain for the sys_attachment create, then the parent-EDIT verdict.
  • attachFileAs runs the one write path with the caller's context, so the real insert gates judge the caller again, uploaded_by is stamped by the existing hook, and sys_file.owner_id is the caller. A system or user-less context is refused PERMISSION_DENIED / 403.
  • No spec or IFileAttachmentService edit. The new exported type ICallerFileAttachmentService widens @objectstack/service-storage (minor, in the changeset), which this PR's Clause-②: yes (widening) already declares. The contract review owed before the queue judges it with the rest.
  • The three ablations each went red where they should. The void legs (no rebuild; an esbuild fold the preflight refused) are declared as void.
• The two reds on ff291771f0: fixed. check:slot-lookup (a typed sharing lookup) and the docs-anchor family are green.
• CI at fb36ebb704: 38 success, 5 roster skips, 0 failure. Validate Package Dependencies is green on this head.
• Answers to the report's open questions:
  • Q1, the explain pre-check: A, keep it. It puts the object-permission refusal before the mint and the launch, as ordered. It cannot let anything through that the insert would refuse, because the insert asks again under the caller.
  • Q2, the showcase grant: A, no change here, and no follow-up card. The print service follows the app's permissions, which is what the tests show. Nobody has asked for a member-prints demo, so this seat files nothing; a measured need goes to the examples' owner.
• The PR body: this seat edits it once, at ACCEPT. It appends the ## 维护者速读(草稿) (the change is 3,289 lines, over 3,000) with the seat's opinion filled in, and replaces the stale "Binding state" and archive paragraphs. One edit, after item 2, so the body describes the head that lands.
• Next:
  1. plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 lands.
  2. The dev merges origin/main and runs the real render with a minted session on both placements (item 2). This seat pokes the dev when plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 merges.
  3. The contract review (declaration face, TIER_DEFAULT).
  4. ACCEPT, then the maintainer's approval to merge.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 19f0174a137cbcf5794cd3d0b7adfee605578a59
Local-runs: none

PR #23811 (card #22269). The review is owed by the face of the Clause-②: yes (widening) declaration. What was read:

• the card's body and all 15 of its comments: the rulings 6204149204 and 6059363716, the split 6205566815, the claim 6206177900, the mint review's pointer 6206951646, and the dev reports 6208035645, 6209378010, 6212023512 and 6212686739;
• the PR's body, its 41 paths and its 3 comments, including the seat's REWORK 6208156693 and its item-1 check 6209463722;
• the net diff against the merge base 0cfd0c49bd, which carries the plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 fix;
• every file the hunks make a claim about, read at that base. Those paths have not changed between the base and the current origin/main 0af559e806.

None of the 41 paths is governed, and Governed Surface Queue Guard is green. The gate verdicts are the head's 43 check-runs, latest per name:

• 38 success;
• 5 skipped: Console Pin Gate, the Dogfood matrix, Dogfood Verify CLI, Packed-tarball smoke and Temporal Conformance. These are full-battery or opt-in jobs that do not run on pull_request;
• 0 failures.

The five required contexts are green.

① Derived judgments

1. @objectstack/service-print, a new published package: right.

• Exports. The exports map has the root entry only. It exports PrintServicePlugin, PRINT_SERVICE ('print'), PrintServicePluginOptions, IPrintService, PrintRecordRequest, PrintedRecordFile, PrintEngineStatus, PRINT_RENDER_TIMEOUT_MS, PRINT_SESSION_TTL_SECONDS, the three env-name constants, PrintPlacement and PrintPlacementOptions. PrintService, the driver and the deps stay internal.
• What the plugin registers. One in-process service and nothing else: no route, no action, no metadata key, no requires token and no new error code. Every refusal is typed to the standard or the registered catalogue, as OQ2 A, OQ3 A and OQ6 A rule.
• Name and lifecycle. The plugin name follows the com.objectstack.service.* siblings. start() probes the engine and warns once. That is a functional degradation, so warn is the right level. Every collaborator is resolved per call, and the missing-service report waits for kernel:ready, so no startup verdict is recorded.

2. The config options and env names: right.

• OS_PRINT_CHROMIUM_PATH, OS_PRINT_BROWSER_ENDPOINT and OS_PRINT_CONSOLE_URL are config values in the OS_{DOMAIN}_{NAME} shape. The test-only OS_TEST_PRINT_CHROMIUM_PATH is in the OS_TEST_* shape.
• A plugin option wins over its variable. Configuring both placements is misconfigured.
• The endpoint must be ws: or wss:, and it is described by scheme and host only. The console URL must be http: or https:, with no query and no fragment.
• OS_PRINT_CONSOLE_URL as a third setting stands on the seat's answer A to Q4.

3. playwright-core as a dependency: right.

• It is pinned exact at 1.63.0, on this package alone.
• The version was already resolved in the lockfile, which gains only the new importer. The esbuild re-resolution noted in 6208035645 is no longer in the net diff.
• It is loaded by dynamic import on the first probe or render. playwright-core downloads no browser at install.

4. service-storage's ICallerFileAttachmentService: right.

• The public surface. One new public name: a type, exported from the root entry. mayEditAttachmentParent is exported from its own module only, which the exports map does not address.
• A system or user-less context is refused. Both verbs refuse it with PERMISSION_DENIED / 403 (requireUserContext, pinned on both verbs).
• The insert still judges the caller. attachFileAs reads the parent as the caller; a 403 read folds into the same 404 as a missing row. It writes sys_file.owner_id as the caller, and runs the sys_attachment insert under the caller's own context, unchanged. Pinned: ATTACHMENT_PARENT_ACCESS from the real insert gate, FILES_DISABLED as the caller, and uploaded_by stamped by the existing hook.
• attachFile is unchanged. A null caller takes every old branch: the system read, no owner stamp, the system unit.
• The extraction is faithful. mayEditAttachmentParent is the old body verbatim, with the gate's own read of the parent handed in.
• Can the pre-check admit anything the insert would refuse? Yes, by construction, and it fails closed.
  • assertMayAttach asks two of the insert's questions, not all of them. The first is the CRUD create verdict, through ISecurityService.explain, whose contract is that it runs the enforcement path's own resolution. The second is the parent-EDIT verdict, over the caller's full envelope as the gate forwards it.
  • Three things are judged only at the insert: the size limit (which cannot be known before the render), the organization wall, and any other sys_attachment insert gate.
  • Each such refusal arrives after the render. The insert refuses it as the caller, the bytes and the pending row are discarded, and the session is revoked. Pinned: a refused archive still revokes, and nothing is left. So nothing the insert refuses is ever admitted.
  • The print service's header line "so a refused archive never costs a render" overstates this. That is wording, not a blocker.

5. The render's identity: right, with one pin gap.

• Context. The mint gets the request's own ExecutionContext, pinned by object identity, as item 1 of the mint review asked (6206951646).
• TTL. 60 s, under the 120 s ceiling and over the 30 s budget (pinned).
• Scope. The user's own full session, with activeOrganizationId set to context.tenantId (plugin-auth's mint at base), and never renewed on a read. It is not narrowed to read-only, and on the remote placement it leaves the process. Ruling 6204149204 accepted both.
• Revocation. Revoke runs in a finally:
  • after a success, a failed render and a refused archive (unit pins, run in Test Core);
  • at the wire after a success (the archive pin's real-mint leg answers 401 UNAUTHENTICATED);
  • at the wire after a forced failure (the render pin).
• No system-attributed PDF. A file-attachments slot without the caller verbs makes status() unavailable and a print 503 (pinned). The caller verbs refuse the system.
• No credential in a log, a response or a message.
  • The endpoint is redacted in every log line and every status. This is pinned against the real playwright-core with a dead endpoint that carries a token.
  • The engine-failure message passes through redact over both the endpoint and the cookie value. The mint's token equals cookie.value, so both spellings are covered.
  • No log line carries the cookie.
• Gap (not blocking, owed before landing): the cookie half of that redaction has no pin that can fail.
  • print-service.test.ts "the minted credential appears in no refusal message" fakes an engine error whose text never held the cookie.
  • The driver's INTERNAL_ERROR path is exercised by no test, with Chromium or without it.
  • Removing input.cookie.value from the secrets list leaves every suite green.
  • The fix runs in Test Core with no browser. createChromiumDriver(resolved, launcher) already takes a launcher. Inject one whose goto rejects with a message carrying the cookie value, and assert that the 500's message holds [redacted] and not the value.

6. IFileAttachmentService and IAuthService: unchanged.

• No packages/spec/src/** path is in the diff. Both contracts were read at base, and both are unchanged on the current origin/main.
• principal-session.ts imports the contract's IAuthService and PrincipalSession types, and reads the optional member at call time.

7. New names, and where they are registered: right.

• What is new. The service slot print, the package, and three env names.
• The slot. It is a non-core slot, like cluster, sms and messaging, so it needs no CoreServiceName entry (which would be a spec change). No route is added, so there is no route ledger or closed query set to declare.
• The registrations a new package owes are all present:
  • the Changesets fixed group;
  • the lockstep counts: 73 in backward-compatibility.mdx and in the publish-smoke comment, 72 in llms.txt by its own gate;
  • packages.mdx;
  • system-context census rows 47d and 47e;
  • the dogfood inputs in cross-package-test-inputs.mjs and turbo.json, with heldBy for the gitignored bundle entry, which CI never has;
  • handwritten-docs.json.
• Missing. The three OS_PRINT_* names are not in content/docs/deployment/environment-variables.mdx, a page that calls itself the full OS_* list. No gate reads that page; it is prose, for the seat.

8. The refusal order: right, with one wording gap.

• The order is: the principal, the engine, the page, the record read as the caller, then the files opt-in plus the attach rule, and only then the mint. Each step is pinned with code and status, and with nothing minted, rendered or archived.
• The gap. When the last probe failed, step ② probes again, and that launches or connects a browser before steps ③ to ⑤ run. No session and no page are involved.
• The PR body, the changeset and the docs say "before any session is minted or browser started", which is not exact on that path. Either narrow the words, or move the re-probe after step ⑤. Not blocking.

9. Notes on the code for the seat, none of them blocking:

• The render budget. The 30 s budget bounds the open, goto and the ready wait. newContext, addCookies, newPage, the fonts wait and page.pdf are unbounded, so a stalled remote browser can hold a call past the budget. The credential still ends at its 60 s TTL on the server.
• A rejecting revoke(). In the finally, its error replaces the call's outcome. After a success, the PDF is committed but the caller sees the revoke's error.
• The organization input. attachFileAs takes input.organizationId independently of context.tenantId. The print service passes tenantId, so the two agree here. The doc of organizationOfParent still says "as the system".
• Stale TSDoc. Two TSDoc references name FileAttachmentService.mayAttach; the verb is assertMayAttach.
• Credential hygiene. A ws:// endpoint off loopback carries the minted cookie to the remote browser in cleartext CDP frames. A consoleUrl with userinfo is not refused, and it is logged at info. Both are worth a line in the docs.

10. The showcase and the tests: right.

• The showcase. showcase_invoice gains enable: { files: true } and a default record page that declares print. That page therefore also becomes every showcase user's invoice record view. en and zh-CN translations are added.
• The dogfood source imports. The dogfood tests import service-print source by relative path, which follows the precedent of the route-ledger parity test, and they declare it as an input.
• The render pin's last change. It respells the bundle path as its index.html entry plus dirname, which reads as equivalent.
• The console pin. .objectui-sha is daeb77fc84dd at the green run, at this head, and on the current origin/main.

② Semver level

• @objectstack/service-print: minor, right. A new published package widens the surface. It is in the fixed group, so under pre mode it ships as the group's next 18.0.0-next.N. The precedent is service-mailbox: a new package at minor plus the fixed-group edit, with no pre.json edit.
• @objectstack/service-storage: minor, right. One new exported type and two new verbs on the registered instance, with attachFile unchanged.
• @objectstack/spec: patch, right. llms.txt is in spec's files, so the count text ships. No schema and no contract changes.
• The private packages touched (example-showcase and dogfood) need no entry.
• The Clause-②: yes (widening) line is on its own line in the PR body (line 3) and in the changeset.
  • It is a widening, at minor or above.
  • Nothing is narrowed: attachFile, IFileAttachmentService and IAuthService are unchanged.
  • So no breaking marker and no ADR-0087 disposition are owed.

③ Boundary flags

Escalated to the maintainer, not judged. Both items are .github/workflows edits, a governed surface.

• E1. CI provisioning of Chromium and a built Console for the render pin. Two facts for that decision:
  • The dogfood job builds no Console; the Console Pin Gate job does.
  • Both Chromium-gated files look for their browser in OS_TEST_PRINT_CHROMIUM_PATH, then in $PLAYWRIGHT_BROWSERS_PATH/chromium. That second path is this agent image's own symlink, not a path that playwright install creates, and no workflow sets either variable. A CI step must export OS_TEST_PRINT_CHROMIUM_PATH, or the files keep skipping.
• E2. Installing CJK fonts in CI. Ruling 6204149204 owes the CJK pin "on each placement CI can reach". Today CI reaches neither placement.

What the render pin's CI skip leaves unmeasured. These claims are measured in CI neither on the PR nor in main's full battery:

• a real Chromium render on either placement (chromium-driver.test.ts skips too);
• the page binding against the real console;
• the console booting under a minted session through a browser (the plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 class);
• revoke at the wire after a failed print;
• the cookie's absence from a real failure's message;
• A4 from @page, the CJK glyph pin, TIMEOUT / 504, and the remote placement's context cleanup.

They are measured only in the dev's container: green 6/6 at 9252cd175e. Only the path spelling has changed since.

What carries CI on its own:

• Test Core, on this head:
  • the unit pins of the refusal chain, the TTL and the revoke;
  • the plugin's loudness, against the real playwright-core;
  • the config's redaction;
  • service-storage's seven caller-face pins, against a real ObjectQL engine and its insert gates.
• The archive pin and its wire-level real-mint leg (9 tests).
  • They need neither Chromium nor a Console, so they carry CI on their own.
  • They run only in main's full battery, because dogfood is skipped on pull_request and merge_group.
  • On this head they are measured only by the dev's local run (6212686739: 9 passed, 6 skipped).

Dev report 6208035645.

• Q1, the minted session does not boot the console. Answered by the REWORK 6208156693. Sub-issue plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 is closed and its fix is the merge base. Closed.
• Q2, which page prints. The seat's answer A holds in code: a 400 for any page that is not the default record page. The objectui card for a named-page route is the seat's to file at ACCEPT.
• Q3, attribution. The seat answered "attach as the caller", per OQ7 A. Implemented as ①4 describes. Closed.
• Q4, consoleUrl. The seat's answer A holds.
• Q5, CJK in CI. See E2.
• Deviations:
  • llms.txt: right; see ②.
  • The gate-required registry touches: right, as ①7 judges them. The cli tests that cite the inputs script are owned by CI, and Test Core is green on this head. The job logs cannot be reached from here, so whether that package was in this head's affected set is not read.
  • The lockfile's esbuild drift: gone from the net diff.
  • Page reads through the engine's schema registry: right. That is the registry the served pages come from, and the dogfood 404 and 400 pins exercise it on a real boot.
  • The archive gap: superseded by patch round 1.
  • The gate-runner passes, and no PR subscription: process only, superseded by the later rounds' 132/132.
• Out-of-scope findings (the page.print liveness row still reads planned; two objectui printing defects): the seat files them at ACCEPT, per 6208156693. Still owed.

Dev report 6209378010.

• Q1, the explain pre-check. The seat's answer A is right: as ①4 shows, it can only refuse earlier, and the insert judges again.
• Q2, the showcase grant. The seat's answer A, no change, holds.
• The PR body edits. These are the seat's single edit at ACCEPT (6209463722) and are still owed: the 3,000-line section, and the stale "Binding state" and archive paragraphs. The body today also:
  • says the archive runs attachFile as the system, with null attribution;
  • says "59 tests";
  • leaves ICallerFileAttachmentService out of "What it adds";
  • has a refusal table without the attach-rule rows of step ⑤. print-pages.mdx lacks them too.
• The extraction: verified; see ①4.
• The ATTACHMENT_PARENT_ACCESS leg pinned at the storage layer rather than in dogfood: acceptable. The dogfood pins the PERMISSION_DENIED leg with the real plugin-security.

Dev report 6212023512.

• The CI question: see E1.
• Deviations:
  • The render pin skipped in CI: judged above.
  • The verify-lock hold: process only.
  • The merge moved .objectui-sha to daeb77fc84dd: that is still the pin on the current main, so the render measurement stands for what lands.
  • One input each in the two input files: right.

Dev report 6212686739.

• No open questions.
• The reproduction on a fresh worktree explains the earlier red, and the fix (heldBy) is the gate's own spelling.
• The render pin was not run again at this head. Accepted on reading; see ①10.

Routed elsewhere, not this PR's:

• Items 2 and 3 of 6206951646: a render under impersonation, and a login/logout audit pair per print. This PR has no door, so both bind at the door of card ④, print page ④ of #8346: a record-page "generate PDF" action that calls the render service and attaches the archived PDF to the record #22270 (OQ2 A, OQ10 A). The seat hands them there.
• The p1 cloud adoption card. It is owed now that browserEndpoint / OS_PRINT_BROWSER_ENDPOINT is on a PR (6204149204, 6204256901). It should carry that ruling's measurement: the cloud images prune playwright-core and carry no Chromium and no CJK font.
• Size. 3,446 + 64 = 3,510 changed lines, which is over 3,000. Landing therefore waits for the maintainer's approval, whatever this record says. The PR body also owes the maintainer brief section, from the draft in 6209378010; that draft's plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 risk line is now resolved.

Implemented-by: session_01W2XFCTBfK4LabgqovmvSgK
Reviewed-by: session_018VqJPGA1NDNSCZsnecsChP

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · REWORK (patch round 2) · domain:services seat 2 · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T10:03Z

At head 19f0174a13. The contract record 6213039702 is PASS: CI 38 success with 5 roster skips; check-governed-merges: NOT governed, 3,510 changed lines. Item 2 of REWORK 6208156693 is met: the real render with a minted session on both placements, measured at 9252cd175e (6212023512), and the inputs fix with heldBy at 19f0174a13 (6212686739).

The record names one item owed before landing and several small defects in code this PR adds. Each has a real path and costs little, so they ride one round, not follow-up cards. ⛔ No new feature, no new surface.

Patch round 2, in this order:

1. The cookie-redaction pin (record ①5, owed before landing).
   • In service-print's Test Core suite, with no browser: inject a launcher into createChromiumDriver(resolved, launcher) whose goto rejects with a message that carries the minted cookie's value.
   • Assert that the 500's message holds [redacted] and not the value.
   • Ablate it: drop input.cookie.value from the secrets list, show the pin red, restore, and prove the restore.
2. A rejecting revoke() must not replace the call's outcome (①9).
   • After a committed archive, the caller gets the success. The revoke's failure is logged at error, naming the session by id, never by token.
   • After a failure, the original refusal wins, and the revoke's failure is logged the same way.
   • The session's 60 s TTL is the bound either way.
   • Pin both orders.
3. The 30 s render budget bounds the whole render (①9): newContext, addCookies, newPage, the fonts wait and page.pdf, not only open, goto and the ready wait. A stalled remote browser answers TIMEOUT / 504 within the budget. Pin it with the injected launcher.
4. The refusal-order wording (①8). Choose one:
   • move the re-probe after step ⑤, so no browser starts before the files and attach checks; or
   • narrow the words in the PR body, the changeset and print-pages.mdx.
     The first keeps the stronger sentence true. Record which you chose.
5. Docs and TSDoc, wording only:
   • the three OS_PRINT_* names in content/docs/deployment/environment-variables.mdx;
   • the step-⑤ attach-rule rows (PERMISSION_DENIED, ATTACHMENT_PARENT_ACCESS) in print-pages.mdx's refusal table;
   • the two stale FileAttachmentService.mayAttach references, which become assertMayAttach;
   • organizationOfParent's doc, which still says "as the system";
   • one credential-hygiene line each: a ws:// endpoint off loopback carries the minted cookie in cleartext CDP frames, so use wss:// or loopback; and a consoleUrl with userinfo is refused, or the docs say not to use one. If you refuse it in code, pin it.
6. Gates re-derived on the new head and run, exit codes captured, reconciled with --ran. Push. ONE os-dev-report addendum on print page ③ of #8346: a render service with one headless-Chromium driver renders a print page under the requesting user's principal and archives the PDF as a sys_file (M2) #22269.
   • ⛔ Do not edit the PR body. This seat edits it once at ACCEPT, with the 维护者速读 and the record's list of stale body lines.

Not in this round:

• E1 (CI provisioning of Chromium and a built Console) and E2 (CJK fonts in CI) are .github/workflows edits, so they go to the maintainer.
• The follow-up cards owed at ACCEPT are this seat's to file:
  • the objectui named-page print route;
  • the page.print liveness finding;
  • objectui card ②'s two printing defects;
  • the spec-seat note on llms.txt;
  • the p1 cloud adoption card, with ruling 6204149204's measurement;
  • items 2 and 3 of 6206951646, handed to card ④ print page ④ of #8346: a record-page "generate PDF" action that calls the render service and attaches the archived PDF to the record #22270.

After the round: CI read on the new head, a same-form re-review of the delta, then ACCEPT and the maintainer's approval to merge (3,510+ lines).

---

Generated by Claude Code

[objectstack-fleet]

Amendment to REWORK 6213065863 · domain:services seat 2 · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T10:04Z. ⛔ Not a new round: one more item rides patch round 2. It comes from the contract record's ①9 note on the organization input.

7. attachFileAs ties the organization to the caller.
   • Today input.organizationId is taken independently of context.tenantId. The print service passes the tenant, so this PR is safe. But ICallerFileAttachmentService is now an exported verb, and a future caller could pass another organization's id.
   • Refuse a mismatch where both are present, with PERMISSION_DENIED / 403 or the insert's own tenant refusal. Measure which, and use the one the platform already answers.
   • Pin the mismatch, and ablate it.
   • If you measure that the write is already walled to the parent's organization whatever the input says, show that with a pin instead, and say so. ⛔ Do not add a second check that cannot fail.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: f653bf5a7bc55acd2380a3619383caeb0edf2dc7
Local-runs: none

PR #23811 (card #22269). This is a same-form re-review after patch round 2. The review is owed by the face of the Clause-②: yes (widening) declaration: the only packages/spec path is packages/spec/llms.txt, which is outside the schema surface (packages/spec/src/**), and none of the 43 paths is governed.

What was read:

• the card's body and all 17 of its comments: the rulings 6204149204 and 6059363716, the design report 6059301379, the split 6205566815, the claim 6206177900, the mint review's pointer 6206951646, the dev reports 6208035645, 6209378010, 6212023512 and 6212686739, the round-2 addendum 6213778373, and the REWORK pointers;
• the PR's body, its 43 paths and its 6 comments: the previous record 6213039702, the REWORKs 6208156693 and 6213065863, the amendment 6213089444, the item-1 check 6209463722, and the docs-drift bot. There are no reviews and no review comments;
• the net diff against the merge base 0cfd0c49bd, the same base as the previous record. GitHub's diff and the local git diff agree byte for byte, apart from the abbreviated index hashes;
• the round alone, 19f0174a13..f653bf5a7b: one commit, 13 files, +356/−35;
• every file the hunks make a claim about, read at the base;
• what main did since then. CI ran on this head merged into main at f7e836da1e, 14 commits past the base. The 11 commits since, up to origin/main 944f03850e:
  • touch none of the code the hunks call: defaultRecordPageObject, recordNotFoundError, the two contracts, the mint, and the attachment hooks and gates;
  • do change page.zod.ts and component.zod.ts, retiring page-component visibility and form visibleOn. The PR's showcase page uses neither key, and GitHub reports the PR mergeable;
  • leave .objectui-sha at daeb77fc84dd, the same as at the head;
• playwright-core 1.63.0's own source, for the two close calls the driver's cleanup makes. I read an installed copy of the pinned version; I did not run it.

The gate verdicts are the head's 43 check-runs, latest per name:

• 38 success;
• 5 skipped: Console Pin Gate, the Dogfood matrix, Dogfood Verify CLI, Packed-tarball smoke and Temporal Conformance;
• 0 failures.

The five required contexts are green, and so is Governed Surface Queue Guard.

① Derived judgments

Patch round 2, item by item, read from the diff at this head

1. The cookie-redaction pin: met. The item owed before landing (previous ①5) is cured.
   • What it pins: chromium-driver.unit.test.ts injects a launcher whose goto rejects with a message that carries the cookie's name=value. It asserts INTERNAL_ERROR / 500, [redacted] in the message, the value absent, and both handles closed.
   • It runs in Test Core: the default include picks it up, it has no skip gate, and the package's tsconfig compiles it.
   • It can fail. The staged error text holds no other secret, and the the local executable /usr/bin/chromium prefix sits outside the redaction. So dropping input.cookie.value from secrets leaves no [redacted], and the value stays in the message.
   • The dev's ablation reads exactly that red. The restore is proven by blob 58598ba5a5, which is the head's blob.
2. A rejecting revoke(): met.
   • revokeQuietly catches the error. A success stays a success, and after a failure the original refusal wins.
   • The failure is logged at error, naming the user id and a 12-hex sha256 fingerprint. In the logged error text the token and the cookie value are replaced. The 60 s TTL is named as the bound.
   • Both orders are pinned, and each pin fails on the round-1 finally, where the revoke's error replaced the outcome.
   • "By id": the contract's PrincipalSession carries no session id (it has token, cookie, expiresAt and revoke), so a fingerprint is the nearest name available. Met in substance.
3. One render budget: partly met.
   • What is met. Every step from open to page.pdf sits inside one Promise.race with the budget. It is pinned with a stall at newContext and a stall at pdf: each answers TIMEOUT / 504 within 290 to 2,000 ms, the browser is closed, and the cookie is absent from the message.
   • Each pin can fail. On the round-1 code the stalled step never settles, and the test dies at vitest's own timeout. A finally that skipped the browser close would read 0.
   • Gap (a), not pinned: the cleanup is not bounded by the deadline. The finally runs after the deadline. In playwright-core 1.63.0, context.close() sends Target.disposeBrowserContext with kNoTimeout and waits for the answer. So a browser that stops answering after its context opened still holds the call past 30 s, and the revoke waits behind it. The 60 s TTL still bounds the credential, server side.
     • The stub's close resolves at once, so neither stall pin can see this.
     • The driver comment "a browser that stalls on any of them answers TIMEOUT within the budget" claims more than its pins hold.
   • Gap (b), not pinned: a late open() is never closed. Playwright's own open timeout starts only after the launcher resolves, slightly later than the deadline. A browser that arrives in that window stays with the abandoned render, which goes on to set the cookie on a new context.
     • The window is narrow, the abandoned render's goto gets a 1 ms budget, and the session is revoked right after.
   • A cheap fix for both.
     • Bound the closes with a short grace period after the deadline. On the remote placement, closing the connection is enough, because playwright creates the context with disposeOnDetach: true.
     • Have the abandoned render close whatever it opens late.
     • Pin it with one stub whose close never settles and one whose open settles late.
   • Not blocking; see ③ for the seat.
4. The refusal-order wording: met, by moving the re-probe after step ⑤. The dev chose option A and recorded it (open_questions[0]); ①8 judges the order.
5. Docs and TSDoc: met.
   • The three OS_PRINT_* rows are on environment-variables.mdx, in a Printing section.
   • print-pages.mdx's table has the two step-⑤ attach rows.
   • Both mayAttach references are now assertMayAttach.
   • organizationOfParent's doc names the system for attachFile and the caller for attachFileAs.
   • The ws://-only-on-loopback line is in the config header, the docs page and the env row.
   • A consoleUrl with userinfo is refused in code and pinned in config.test.ts. The pin fails without the check: that URL is otherwise http: with no query, so it would resolve as configured.
6. Gates and report: met as reported. 132 commands derived, 132 exit 0, reconciled with --ran. One addendum was posted, and the PR body was not touched. CI's 43 runs agree.
7. attachFileAs ties the organization to the caller: met. See ①4.

The whole PR at this head

1. @objectstack/service-print, a new published package: right, unchanged by the round.

• Exports. The exports map has the root entry only. It exports PrintServicePlugin, PRINT_SERVICE, PrintServicePluginOptions, IPrintService, PrintRecordRequest, PrintedRecordFile, PrintEngineStatus, PRINT_RENDER_TIMEOUT_MS, PRINT_SESSION_TTL_SECONDS, the three env-name constants, PrintPlacement and PrintPlacementOptions.
• No new export this round. ChromiumLauncher is exported from the driver module only, which the map does not address. PrintServiceDeps.logger sits on an internal type.
• What the plugin registers. One in-process service, and nothing else: no route, no action, no metadata key, no requires token and no new error code.
• Lifecycle. start() probes the engine and warns once. That is a functional degradation, so warn is the right level. Collaborators are resolved per call, and the missing-service report waits for kernel:ready.

2. The config options and env names: right. The round narrows a new input only.

• The names. OS_{DOMAIN}_{NAME} for the three settings, OS_TEST_* for the test path. A plugin option wins over its variable. Both placements at once is misconfigured.
• The values. The endpoint must be ws: or wss:, and it is described by scheme and host only. The console URL must be http: or https:, with no query, no fragment, and now no userinfo. A URL with userinfo is refused without its value being echoed.
• Not a narrowing. consoleUrl / OS_PRINT_CONSOLE_URL is new in this PR and on no published version, so this is its accept set at birth.
• Note, not blocking. The two console-URL refusals after the userinfo check still quote the raw value (it is '…') into the boot warn. A value that does not parse (for example, one with userinfo and a non-numeric port) or one carrying a query is echoed whole.

3. playwright-core as a dependency: right, unchanged.

• It is pinned exact at 1.63.0, on this package only.
• The lockfile gains only the new importer.
• It is loaded by dynamic import, and it downloads no browser at install.

4. service-storage's ICallerFileAttachmentService: right, re-judged for item 7.

• The public surface. One type, exported from the root entry. mayEditAttachmentParent is exported from its own module only. Unchanged by the round.
• The refusal. For a caller, attach() refuses any organizationId other than the context's tenantId (or null when the context names none) with PERMISSION_DENIED / 403.
• Does it refuse every organization but the caller's own? Yes. The input is first validated to a non-empty string or null; undefined and '' are already a 400. Then it is compared by strict equality.
• Does it refuse before anything is read or written? Yes. It is the first statement after the pure input check. It runs before the engine and storage are resolved, before the size check, and before the parent read. It is pinned with nothing left behind.
• Does it break attachFile? No. The check sits under if (caller), and attachFile passes null. Its suite is unchanged and green.
• Is the null case right? Yes.
  • A caller acting in an organization may not pass null. This is pinned with the global parent; without the check, that case writes a pair outside the caller's organization.
  • A caller with no tenant must pass null, and the print service passes exactly that (pinned on the print side).
  • The answer is decided on the input alone. It says nothing about the parent, and the non-disclosure 404 for a parent walled elsewhere is untouched.
• The pin fails on each of its three legs without the check.
  • case_global with org_b reaches VALIDATION_FAILED with no status, after a sys_file was already written (the dev's ablation).
  • case_a with org_b answers the wall's 404.
  • case_global with null is admitted.
  • The restore is proven by blob 9e935c0f31, which is the head's blob.
• PERMISSION_DENIED rather than the insert's own tenant refusal: right. The amendment asked the dev to measure which one the platform answers, and the measured insert has none (deviation 2).
• Does the new refusal narrow a published accept set? No. It narrows what attachFileAs accepts, but the verb and its type were first introduced in this unmerged PR. attachFileAs has 0 hits on origin/main, so no published version carries it. The net diff against main adds the verb with this accept set at birth.
• Unchanged, and still right:
  • a system or user-less context is refused on both verbs;
  • the insert judges the caller;
  • attachFile is unchanged;
  • the extraction of the attach rule is verbatim;
  • the pre-check can only refuse earlier, never admit.
• Notes, not blocking.
  • (a) No storage-level pin admits a tenant-less caller that passes null.
  • (b) The two sides read "a tenant" with different predicates. The print service's nonEmptyString trims and storage's does not, so a whitespace-only tenantId would be refused after the render. That fails closed.
  • (c) The print service's header still says "so a refused archive never costs a render". The size limit and the other insert gates still refuse after the render. This is wording.

5. The render's identity: right. The pin gap is closed.

• Context and TTL. The mint gets the request's own context, pinned by identity. The TTL is 60 s, pinned.
• Scope. The user's own session, with activeOrganizationId set to tenantId, never renewed on a read. On the remote placement it leaves the process; ruling 6204149204 accepted that.
• Revocation. Revoke runs in a finally, now through revokeQuietly:
  • after a success, a failed render and a refused archive (unit pins);
  • at the wire after a success and after a forced failure (dogfood pins, measured in the dev's container).
• No system-attributed PDF. A slot without the caller verbs answers 503.
• No credential in a message.
  • The endpoint is redacted in every log and status. This is pinned against the real playwright-core, and now also on renderPdf's INTERNAL_ERROR message.
  • The cookie is redacted on the INTERNAL_ERROR path, now with a pin that can fail.
  • The TIMEOUT message names the console URL, which can no longer carry userinfo or a query.
• revokeQuietly's log line. It carries the user id, the fingerprint, and the error text with the token and the cookie value replaced.
  • The mint at base returns token equal to cookie.value (both are the signed value), so one replacement covers both. The pin puts the token into the revoke's error, and the logged line must not hold it.
  • Nothing in revokeQuietly can replace the outcome, except createHash on a non-string token (the contract types the token as a string) or a logger that throws.
• The sha256 fingerprint: acceptable credential hygiene.
  • It is 48 bits of sha256 over a signed token carrying a 32-character random part (about 190 bits). It cannot be inverted or guessed.
  • The session dies at 60 s anyway, and the fingerprint names the session without the credential.
  • Its value for correlation is limited: the store keeps the unsigned token, so matching a session row needs the auth secret. The user id and the time are the practical key. That is a usability point, not a hygiene one.
• Note, not blocking. PrintServiceDeps.logger is optional. The plugin's logger: ctx.logger is the one line that makes a failed revoke loud, and no plugin-level pin holds it: removing it leaves every suite green.

6. IFileAttachmentService and IAuthService: unchanged.

• No packages/spec/src/** path is in the diff.
• Both contracts were read at base, and both are unchanged on the current origin/main.
• principal-session.ts imports the contract's types.

7. New names, and where they are registered: right. The missing doc row is added.

• The print slot is a non-core slot.
• The three env names are now on environment-variables.mdx.
• The registrations a new package owes are all present: the fixed group; the counts (73, 73 and 72); packages.mdx; census rows 47d and 47e; the dogfood inputs with heldBy; and handwritten-docs.json.

8. The refusal order: right, and now exact.

• The order. Steps ① to ⑤, then the deferred re-probe, then the mint.
  • Step ② refuses an engine that is unconfigured, misconfigured, missing a service, or never probed.
  • Only an engine whose last probe failed, with every service composed, is carried past step ② (reprobe). It is probed after assertMayAttach.
  • So no browser is launched or connected before any refusal of steps ① to ⑤.
• The pins.
  • An unknown page answers 404, and an attach refusal answers 403, each with the probe called once (the boot probe).
  • A recovered engine serves, in the order assertMayAttach, then the probe, then the mint.
  • Each pin fails on the round-1 order.
• Is anything newly reachable before the attach checks? Nothing that writes, mints or launches.
  • While the engine is down, steps ③ to ⑤ now run: the page lookup, the caller's own record read, the files opt-in, and the attach rule's read-only questions.
  • The caller therefore gets the specific refusal instead of a 503. Those are the answers the same caller gets on a healthy engine, so nothing new is disclosed.
• The mint's own refusals. On the re-probe path they come after the probe, as before. Probing before minting is the right order: no session is minted for an engine that does not answer.
• Wording. print-pages.mdx says "every one of them is decided before … a browser is started", which is slightly too broad for the re-probe's own 503, since that follows the probe. The paragraph under the table says so.

9. The previous record's code notes, re-judged:

• the render budget: partly cured (item 3);
• a rejecting revoke: cured;
• the organization input: cured;
• the stale TSDoc: cured;
• credential hygiene: cured, by the ws:// docs lines and the consoleUrl userinfo refusal in code.

10. The showcase and the tests: right, unchanged by the round.

• showcase_invoice keeps enable: { files: true } and its default record page that declares print.
• The dogfood tests import service-print source by relative path, with declared inputs.
• The console pin is daeb77fc84dd at the head and on main.

② Semver level

Unchanged:

• @objectstack/service-print: minor, right. A new package, in the fixed group.
• @objectstack/service-storage: minor, right. One exported type and two verbs, with attachFile unchanged. The round's refusal is the new verb's accept set at birth.
• @objectstack/spec: patch, right. llms.txt is the only change.
• The private packages touched need no entry.

The Clause-②: yes (widening) line is on its own line in the PR body (line 3) and in the changeset (line 9).

• It is a widening, at minor or above.
• Nothing published is narrowed. attachFile, IFileAttachmentService and IAuthService are unchanged, and attachFileAs and consoleUrl are new in this PR.
• So no breaking marker, no (narrowing) arm and no ADR-0087 disposition are owed.

③ Boundary flags

Escalated to the maintainer, not judged. Both are .github/workflows edits, a governed surface.

• E1. CI provisioning of Chromium and a built Console for the render pin.
• E2. CJK fonts in CI.

No workflow sets OS_TEST_PRINT_CHROMIUM_PATH or PLAYWRIGHT_BROWSERS_PATH, so both Chromium-gated files still skip in CI.

Dev addendum 6213778373.

• deviations[0]: the real-console render was not re-run at this head. Accepted. Here is what the round changed and how it is measured:
  • The deadline restructure. It runs the same success path that the fixture console exercises on both placements: open, context, cookie, page, load, ready wait, fonts and PDF. So the fixture runs measure it as well as the real console would.
  • What the real console adds. The console's boot under a minted session, and the page binding. The round changed neither: the mint, the URL and the ready predicate are untouched.
  • Unmeasured by every run, fixture, real console or pin: the two cleanup gaps of item 3.
  • The service-level changes (the deferred re-probe, the quiet revoke, the organization refusal and the userinfo refusal) never run in the driver tests. They are pinned with fakes in Test Core, and against a real ObjectQL engine in service-storage, which is where each one is decided. The plugin's logger wiring for a failed revoke is pinned nowhere.
  • Both browser runs happened in the dev's container only. In CI, the restructured render path rests on the four injected-launcher pins (E1).
• deviations[1]: PERMISSION_DENIED / 403. Right; see ①4.
• open_questions[0]: item 4. A is right, and it is the option the seat preferred.
• out_of_scope_findings: none.
• Tests. The dev reports service-print 73/73, service-storage 1,029/1,029, and the dogfood print tests 9 passed and 6 skipped, at this head.
  • In CI, Test Core is green. Both packages are in the diff, so they are in its affected set; I did not read the job logs.
  • The dogfood archive pin and the render pin are skipped on pull_request, so at this head they are measured only by the dev's run.
• Gates. 132 run, 132 exit 0, reconciled. CI agrees.

Carried from the earlier reports, unchanged.

• 6208035645:
  • Q1: closed (plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813).
  • Q2: the default-record-page rule A holds in code.
  • Q3: attach as the caller is implemented.
  • Q4: A holds.
  • Q5: E2.
• 6209378010: Q1 A and Q2 A hold.
• 6212023512 and 6212686739: E1; the render pin's path respelling is accepted.

For the seat, at ACCEPT.

• Item 3's two cleanup gaps. Either one more small fix, or a follow-up card, before card ④'s door (print page ④ of #8346: a record-page "generate PDF" action that calls the render service and attaches the archived PDF to the record #22270) ships. Cloud uses the remote placement, where a browser that stops answering would leave each print call waiting. Not blocking this record.
• Owed before landing, as already planned: the PR-body edit. It owes the maintainer brief section (3,771 + 68 = 3,839 changed lines) and the replacement of the stale lines. At this head the body still:
  • says "Binding state: this PR lands after auth(spec,plugin-auth): a short-lived principal-session mint, an optional IAuthService member with its AuthManager implementation, the seam #22269's print service consumes (S2 of #22269) #23772", with status() unavailable until then. It has been bound since patch round 1, and auth(spec,plugin-auth): a short-lived principal-session mint, an optional IAuthService member with its AuthManager implementation, the seam #22269's print service consumes (S2 of #22269) #23772 and plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 have landed;
  • says the archive runs IFileAttachmentService.attachFile, and keeps the "Gap, measured" paragraph with null attribution. The archive now runs attachFileAs as the caller;
  • says "59 tests"; service-print now has 73;
  • leaves ICallerFileAttachmentService and its organization refusal out of "What it adds";
  • has a refusal table without the step-⑤ attach rows and without the deferred re-probe;
  • does not mention the consoleUrl userinfo refusal or the quiet revoke.
• The follow-up cards owed at ACCEPT, per 6213065863:
  • the objectui named-page print route;
  • the page.print liveness finding;
  • card ②'s two printing defects;
  • the spec-seat note on llms.txt;
  • the p1 cloud adoption card, with 6204149204's measurement;
  • items 2 and 3 of 6206951646, handed to card ④ print page ④ of #8346: a record-page "generate PDF" action that calls the render service and attaches the archived PDF to the record #22270.
• Size. The PR is over 3,000 changed lines, so landing waits for an authorized approval, or a human merge, whatever this record says.

Implemented-by: session_01W2XFCTBfK4LabgqovmvSgK
Reviewed-by: session_018VqJPGA1NDNSCZsnecsChP

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · REWORK (patch round 3, small) · domain:services seat 2 · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T11:38Z

At head f653bf5a7b. The re-review 6214644798 is PASS: the item owed before landing (the cookie-redaction pin) is cured, and items 1, 2 and 4–7 of patch round 2 are met. CI: 38 success with 5 roster skips.

Three small items remain, each on a real path. The maintainer's approval is owed for this PR anyway (3,839 lines), so they ride one more round now rather than two follow-up cards. ⛔ No new feature, no new surface.

Patch round 3:

1. Item 3's cleanup gaps (record ①, item 3, gaps (a) and (b)).
   • The finally's closes are bounded by a short grace period after the deadline. On the remote placement, closing the connection is enough (disposeOnDetach: true); on the local one, the browser process is killed if close does not settle.
   • The abandoned render closes whatever it opens late.
   • Pin both with the injected launcher: one stub whose close never settles (the call still answers TIMEOUT / 504 within budget plus grace, and the revoke still runs), and one whose open settles after the deadline (it is closed). Ablate one and show it red.
   • Correct the driver comment so it claims only what the pins hold.
2. No raw console URL in a log line (record ①2, note). The console-URL refusals after the userinfo check describe the value by scheme and host only, as the endpoint is described. A value that does not parse is described as unparseable, never echoed. Pin it with a value carrying userinfo and a non-numeric port, asserting that the userinfo text appears in no log line and no status.
3. The revoke-failure log is wired (record ①5, note). Pin at the plugin level that a failed revoke reaches the plugin's logger at error, so that removing logger: ctx.logger turns the pin red. Ablate it.
4. Gates re-derived and run, exit codes captured, reconciled with --ran; push; ONE os-dev-report addendum on print page ③ of #8346: a render service with one headless-Chromium driver renders a print page under the requesting user's principal and archives the PDF as a sys_file (M2) #22269.
   • ⛔ Do not edit the PR body.
   • ⛔ No workflow edits (E1 and E2 are the maintainer's).

The record's other notes stay as notes: a storage pin for a tenant-less null caller, the whitespace-only tenantId predicate that fails closed, and two wording lines. Carry them only if a hunk you touch already holds them.

After the round: CI on the new head, a same-form check of this delta, then ACCEPT, the one PR-body edit, the follow-up cards, and the maintainer's approval.

---

Generated by Claude Code

[objectstack-fleet]

维护者速读

改了什么

• 新增 @objectstack/service-print。它把一条记录的打印页在无头 Chromium 里渲染成 PDF,并作为附件挂到这条记录上。它是进程内的 print 服务,不加路由、不加元数据键,也不加错误码。
  • 引擎只有 Chromium 一种,部署位置有两种:
    • 本机可执行文件(OS_PRINT_CHROMIUM_PATH)。每次打印用 chromium.launchServer 起一个浏览器进程,再连上它;关闭不及时就强制结束该进程。
    • 远程浏览器端点(OS_PRINT_BROWSER_ENDPOINT),每次打印连接一次。
  • 两种位置都还需要 OS_PRINT_CONSOLE_URL。
• 以请求人本人的身份渲染。 通过已合入的 IAuthService.mintPrincipalSession(auth(spec,plugin-auth): a short-lived principal-session mint, an optional IAuthService member with its AuthManager implementation, the seam #22269's print service consumes (S2 of #22269) #23772)为请求人签发一个 60 秒的短期会话。打印结束后,无论成败,都在 finally 里吊销。吊销失败不改变打印结果,但会记一条 error 日志,只写用户 id 和会话指纹,不写令牌。
• 归档也以请求人身份写入。 @objectstack/service-storage 的附件服务新增"以调用者身份"的一面(ICallerFileAttachmentService:assertMayAttach、attachFileAs)。写入口还是原来那一个。
  • 文件行和附件行都记名到请求人。
  • 附件的每一道插入闸门都按请求人判定。
  • 只能写进请求人自己所在的组织。
  • 原有的系统身份入口 attachFile 不变。
• 先拒绝,后动手。 下列情况都在签发会话、启动浏览器之前拒绝:
  • 调用方不是本人(403);
  • 引擎没准备好(503);
  • 页面不存在(404),或不是该对象的默认打印页(400);
  • 记录读不到(404);
  • 对象没开附件(403);
  • 无权创建附件,或无权编辑这条记录(403)。
• showcase 和文档。 showcase 的发票开启附件,发票的默认记录页换成一张打印页(中英文)。文档新增"打印页"一页,环境变量页加三个 OS_PRINT_*,另更新包列表和 changeset。

为什么改

• export: PDF / print document generation — re-planned for v18, superseding the #1301 NOT_PLANNED closure #8346 的裁决 B′(M2)要求服务端生成与控制台打印一致的 PDF,并归档到记录上。本 PR 就是其中的第 ③ 张卡。你已把 PDF 定为 18.0 正式版必需(p1),并裁定引擎可本机、可远程,云上用远程。
• 用请求人本人的身份渲染和归档,是为了一条底线:用户归档不了自己看不到的记录,也挂不了自己手动挂不了的附件;附件也能追溯到具体的人。这是设计轮 OQ7 A 的要求。上一版用系统身份归档,附件不记名;本 PR 已按裁决改正。

风险与代价(含回滚)

• 凭据会离开进程。 远程位置时,短期会话 cookie 会发给远程浏览器;你在两种位置的裁决里已接受这一点。缓解措施:
  • 会话 60 秒失效,用完即吊销;
  • 端点只记协议和主机;
  • 错误信息里的 cookie 和端点令牌都会脱敏;
  • 带用户名密码的控制台地址一律拒绝,日志里也不出现原始控制台地址。
  • 本机位置的浏览器控制端口只监听本机回环,路径是随机值,只活一次渲染。下面的核对里建议再显式写死为 127.0.0.1,作为后续加固。
• 行为变化。 能看记录、但无权编辑或无权上传附件的用户,会在渲染前收到 403。这和他们在界面上手动上传附件的结果一致。在 showcase 里,目前只有管理员能把发票打印成附件。
• 只能打印对象的"默认记录页",因为控制台目前只按默认页渲染记录。因此 showcase 的发票记录页对所有用户都换成了这张打印页。按名字打印其他页,需要 objectui 先加路由,本席已立卡 console: no route renders a record on a NAMED record page — RecordDetailView asks usePageAssignment(objectName) without pageName, so the server's print service can print a record only on its object's default record page objectui#12715。
• 依赖。 新包带入 playwright-core 1.63.0,只用于这个包,精确锁定版本,安装时不下载浏览器。没配置时不加载浏览器,只在启动时 warn 一次。
• CI 测不到的部分。 真实 Chromium 渲染、经真实控制台的端到端打印、中文字形,CI 里都不跑,只在开发容器里测过:第 3 轮在 78e50355a 重测,两种位置 6/6。要让 CI 装 Chromium 和中文字体,得改 .github/workflows(受管面),由你另行决定。
• 回滚。 revert 本 PR 即可,不需要数据迁移:
  • 新包整体移除。它还没发布过,也没有别的包依赖它。
  • service-storage 的新增部分是纯增量:一个导出类型、两个方法,attachFile 没动,既有调用方不受影响。
  • showcase 的发票回到原来的记录页,去掉附件开关和几条翻译。
  • 文档和包计数随之恢复。
  • 回滚前已归档的 PDF 是普通附件,会继续保留。
  • 只想停用打印的部署,可以不回滚代码,从组合里拿掉 PrintServicePlugin 就行。

席位意见

• 建议批准合入。 理由:
  1. 两次契约复核都是 PASS(6213039702、6214644798)。新包、新导出类型、版本级别(service-print minor、service-storage minor、spec patch)和"拓宽"声明都被判定正确。没碰 packages/spec/src/**,附件和认证两个契约也没改。
  2. 席位和复核提出的问题,三轮补丁都已逐项落实,每项都有反向验证(拿掉修复,测试变红):
     • 归档改为以请求人身份;
     • 用真实签发的会话在两种位置端到端打印;
     • cookie 脱敏有了能失败的测试;
     • 吊销失败不覆盖打印结果;
     • 一个预算管住整个渲染,清理也有上限;
     • 组织必须是调用者自己的;
     • 日志不含原始控制台地址;
     • 插件层的吊销日志有测试钉住。
  3. 第 3 轮的改动本席逐文件读过(7 个文件,+341/−38),与开发报告一致。最后一次合并只带入 main 的改动,PR 自身没有新改动。
• 如实说明没测到的:
  • CI 不跑真实浏览器和真实控制台(见上)。
  • 78e50355a2 上的 Test Core (6/6) 红在 @objectstack/metadata-protocol 的测试上。日志被截断,失败的测试名无法恢复,所以原因没查明。这个包不引用本 PR 的任何包;开发在两个 head 上本地各跑一次,都是绿的。新 head 5a16f29db 上 CI 全绿(38 项通过,5 项按名单跳过,0 项失败),这个红没有复现。
• 范围外的事项都已有去处(见下方核对),不阻塞本 PR。

你要做的(一个动作)

• 请用 os-zhuang 或 hotlong 账户在 PR feat(service-print): print a record's print page to a PDF in headless Chromium as the requesting user, and archive it on the record #23811 上点 Approve。本 PR 改动 4,142 行,超过 3,000 行,必须人工批准。批准后由本席完成落地。
• 如果不同意合入,请改点 Request changes,写一句原因;本席按原因安排下一步。

席位核对 · ACCEPT · domain:services seat 2 (#21118) · os-elon-musk · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T14:54Z

Read at head 5a16f29db9 (the PR object's head), not from the reports. The net diff is against the merge base 0744f94366. The merge 5a16f29db9 adds no PR-side change: the net diff of 78e50355a2 against its own base has the same stat, 44 files, +4,074/−68. The landing form is the four-piece one, because 4,142 changed lines is over 3,000.

1. 形态 (form)

• Closing keyword. Fixes #22269 is line 1 of the body. The card is delivered whole: S1 (the archive, now its caller-scoped face) and S3 + S4 (the service, both placements, the CJK pin, the page binding). S2 is auth(spec,plugin-auth): a short-lived principal-session mint, an optional IAuthService member with its AuthManager implementation, the seam #22269's print service consumes (S2 of #22269) #23772, which landed as PR feat(spec,plugin-auth): a short-lived principal-session mint, IAuthService.mintPrincipalSession, implemented by AuthManager #23786. The checks The card this PR closes must claim this branch and Part-of PR must not also close its card are both success.
• Clause-② line. Clause-②: yes (widening) is on its own line: body line 3 and changeset line 9. Both contract records judge it right.
• File surface (get_files): 44 paths.
  • packages/services/service-print/**: 17 files, new.
  • packages/services/service-storage/src/**: 5 files.
  • Two dogfood tests, five showcase files, and seven content/docs/** files (six pages and ui/meta.json).
  • Registry files: .changeset/config.json, the changeset, pnpm-lock.yaml, turbo.json, scripts/cross-package-test-inputs.mjs, scripts/publish-smoke-pack.mjs and scripts/docs-audit/handwritten-docs.json.
  • packages/spec/llms.txt.
  • Governed paths: 0. Governed Surface Queue Guard is success at this head.
  • merge=os-regen paths: 0 (grep os-regen .gitattributes on origin/main: 15 rules, none matched).
• Changeset levels (.changeset/22269-print-render-service.md): @objectstack/service-print minor, @objectstack/service-storage minor, @objectstack/spec patch. Judged right in 6214644798 ②. The private packages touched (example-showcase, dogfood) owe no entry.

2. 前提实测 (measured premises)

• The bind is landed.
  • principal-session.ts:3 imports the contract's IAuthService and PrincipalSession. :36-38 reads auth.mintPrincipalSession at call time.
  • The member is on origin/main (packages/spec/src/contracts/auth-service.ts:323). auth(spec,plugin-auth): a short-lived principal-session mint, an optional IAuthService member with its AuthManager implementation, the seam #22269's print service consumes (S2 of #22269) #23772 and plugin-auth: a session minted by mintPrincipalSession never boots the console — the console loops on boot, so #22269 cannot render under the requester #23813 are closed.
• The archive runs as the caller.
  • print-service.ts:269: assertMayAttach(object, recordId, context) runs in step ⑤. That is before the deferred re-probe at :273-278 and before the mint at :285.
  • :288-298: attachFileAs(…, context), with organizationId set to the caller's tenantId or null.
  • file-attachment-service.ts:
    • requireUserContext refuses the system context and a context with no user;
    • attach() refuses another organization before any read or write;
    • owner_id is set to the caller;
    • the sys_attachment insert runs under the caller's context, unchanged.
  • The body's old "Gap" (owner_id / uploaded_by null) is fixed and pinned: print-service-archive.dogfood.test.ts:245-246 and print-service-render.dogfood.test.ts:236-237.
• Round 3, read file by file (f653bf5a7b..78e50355a2: 7 files, +341/−38). The seat's same-form check of this delta:
  • The local placement is now chromium.launchServer({ executablePath, headless: true, timeout }) plus chromium.connect(server.wsEndpoint()) (chromium-driver.ts:220-223).
    • Disposal closes the connection, then the server. If the close does not settle within CLOSE_GRACE_MS (2 s, :111), it calls server.kill() (:225, :234).
    • The remote placement closes the context, then the connection, each bounded the same way (:218, :269).
  • An open that settles after the deadline is released by the abandoned render (stillWanted, :273-278).
  • The four new driver pins use the injected launcher: remote close never settles; local close never settles, so the process is killed; a late open is closed and never given a context.
  • No raw console URL. describeConsoleUrl (config.ts:110-117) gives the scheme and host, or (a value that is not a URL). It is used at config.ts:205 and :212, and in the plugin's info line (print-service-plugin.ts:100). It is pinned with print:topsecret@…:abc in config.test.ts and in print-service-plugin.test.ts.
  • The revoke log is wired. print-service-plugin.ts:73 passes logger: ctx.logger. print-service-plugin.revoke-log.test.ts mocks playwright-core, so it runs on every host. It asserts exactly one error line carrying a 12-hex fingerprint and not the token.
  • The dev's ablations (A: the late-open check; B: the logger line) went red and were restored by blob (6215865756).
• playwright-core 1.63.0's server binding. Read in the installed bundle, …/playwright-core@1.63.0/…/lib/coreBundle.js:
  • launchServer builds path: /${createGuid()} with maxConnections: Infinity (:57206-57207), then server.listen(options.port, options.host) (:57208);
  • listen(port = 0, hostname, defaultPath) sets hostname ??= "localhost" (:10175, :10177);
  • an upgrade on any other path answers 400, and the Host and Origin are allow-listed (:10202-10216);
  • createGuid is 16 random bytes in hex (:7969-7970);
  • the public type documents host as "defaults to localhost, accepting connections only from the loopback interface" (types/types.d.ts:18141-18146).
• The page binding's premise still holds at the pin. .objectui-sha is daeb77fc84dd, at the head and on origin/main. RecordDetailView.tsx:640 calls usePageAssignment(objectName) without pageName, both at the pin and on objectui main f8267df.
• page.print liveness is not the finding the body says. The row is already live at this PR's merge base: packages/spec/liveness/page.json:76, flipped by PR fix(spec): page.print and the flow terminal-toast translations read live in the liveness ledger, so a print page is no longer warned that nothing applies it #23776, and spec liveness: the console pin hop to objectui 1f23d5b070fa makes page.print and translation.flows.successMessage / errorMessage read planned while the shipped console applies them (family card; the parentDataSource leg is #23585) #23710 is closed. The body's Acceptance note is stale and is corrected in the body edit.
• Size. The PR object reads additions 4,074 + deletions 68 = 4,142.

3. 门禁 check-runs

• At this head, final: 43 check-runs, latest per name: 38 success, 5 skipped (the roster set), 0 failures. Every Test Core shard (1/6–6/6) and the aggregate Test Core are success. The five required contexts (TypeScript Type Check, Test Core, Build Core, Lint & Repo Gates, Governed Surface Queue Guard) are all success. The 78e50355a2 red did not reproduce. Which shard carried @objectstack/metadata-protocol#test here cannot be read from the retained logs, so that red's root cause stays NOT established.
  • Earlier reads, kept as history:
  • At the read of 2026-10-16T14:25Z: 41 runs.
    • 23 success.
    • 5 skipped, the roster set: Console Pin Gate, the Dogfood matrix, Dogfood Verify CLI, Packed-tarball smoke and Temporal Conformance.
    • 12 in_progress: Test Core 1/6–6/6, Build Core, Build Docs, Type Check · workspace, Type Check · consumer gates, Type Check · debt ledger, and Scaffold outside the monorepo.
    • 1 queued: Lint & Repo Gates.
  • At a second read, 2026-10-16T14:43Z: 42 runs. 34 success, 5 skipped, 3 in_progress (Test Core 2/6, 3/6, 4/6), 0 failures.
    • Test Core (6/6) (job 117019991739) is success: turbo Tasks: 75 successful, 75 total, and check-test-completeness: OK (13 of 21 scheduled package(s) reported … 31956 test(s) declared and all accounted for).
    • Its retained log again starts inside @objectstack/runtime's output, so it does NOT show whether @objectstack/metadata-protocol#test ran in this shard. Shards are planned by package from the affected set, so a green 6/6 alone does not answer whether the red reproduced.
  • The ruleset's five required contexts are TypeScript Type Check, Test Core, Build Core, Lint & Repo Gates and Governed Surface Queue Guard. At the first read only the last had reported: success.
• At 78e50355a2. 36 success, 5 skipped, 2 failure: Test Core (6/6) (job 116959459657) and the aggregate Test Core. The failing task is @objectstack/metadata-protocol#test.
  • Its output is not recoverable. The retained log starts inside @objectstack/runtime's output, and the run carries no annotations (6217531959).
  • The package imports none of service-print, service-storage or the showcase. Its suite passed locally at 78e50355a (20595 passed) and at 5a16f29db (20598 passed).
  • Root cause: NOT established. Not called a flake.
• At f653bf5a7b and 19f0174a13. 38 success, 5 roster skips, 0 failures (6214644798, 6213039702).

4. 接受的偏差 (accepted deviations)

• packages/spec/llms.txt 71 → 72, with an @objectstack/spec patch line. Forced by check:llms-txt, which counts non-private @objectstack/* packages. The fixed-group count, 73, is a different set. Declared to the spec seat (§5).
• The registry touches. turbo.json and scripts/cross-package-test-inputs.mjs add the dogfood inputs, with heldBy for the gitignored Console entry. system-context.mdx gains census rows 47d and 47e. handwritten-docs.json lists the new page. These are gate-required, and 6213039702 ①7 judged them right.
• service-storage edited beyond the claim's "measured gap only". This was ordered by REWORK 6208156693 item 2. The two files the claim excluded, storage-service-plugin.ts and attachment-access-hooks.ts, were edited only after PR feat(service-storage): the sys_attachment read gate writes one ReadableIds leaf per parent object and does no pre-scan; D5's three classes keep the probe (ADR-0139 E7, attachments) #23767 merged at 2026-10-16T02:21Z. The hooks change is an extraction (mayEditAttachmentParent), verbatim per 6213039702 ①4.
• Round 3: the local placement moved from chromium.launch to chromium.launchServer + chromium.connect. Accepted.
  • It is the one way playwright-core exposes the process to kill: same library, version and engine, still one browser per render.
  • It was measured on a real Chromium through the driver suite, and in the real-console render on both placements, 6/6 at 78e50355a.
  • Security observation, accepted with a follow-up. The call passes no host (chromium-driver.ts:220). In the pinned 1.63.0, the control socket therefore binds to localhost (loopback only), under a 128-bit random path, with other paths refused 400 and Host and Origin allow-listed. It lives for one render. That is acceptable as built.
  • The loopback bind rests on a library default, though. A version bump that changed it would widen the socket silently, and maxConnections: Infinity means anything that reaches it is served. So an explicit host: '127.0.0.1' is filed as hardening card service-print: the local placement's chromium.launchServer binds its control socket on playwright-core's DEFAULT host — pass host: '127.0.0.1' so a library change on a version bump cannot widen it beyond loopback #23968 (§5 g), not a blocker.
• Not carried, as noted (6214660811):
  • no storage-level pin for a tenant-less caller passing null;
  • the whitespace-only tenantId predicate, which fails closed;
  • the print-service header's "so a refused archive never costs a render";
  • print-pages.mdx's "decided before … a browser is started", which is slightly broad for the re-probe's own 503 (the next paragraph says so).
  • All four are wording or a pin on a fail-closed path. No card.
• The showcase invoice's printed line-items headings are raw field names: the page's record:line_items columns declare no label (§5 c). Cosmetic, on example data, and not a gate. Accepted with a follow-up card rather than a fourth round on a PR that is waiting for the maintainer anyway.
• The real-console render was last measured in the dev's container (6/6 at 78e50355a; the render path is unchanged since). CI skips it (E1).

5. 范围外去向 (where out-of-scope items go)

• a. A route that renders a NAMED print page for a record (body Measured 2; seat answer Q2 A in 6208156693): console: no route renders a record on a NAMED record page — RecordDetailView asks usePageAssignment(objectName) without pageName, so the server's print service can print a record only on its object's default record page objectui#12715, filed with this record. The print service widens its default-page rule in the PR that binds to that route.
• b. page.print liveness planned: no card. It is already live on main (PR fix(spec): page.print and the flow terminal-toast translations read live in the liveness ledger, so a print page is no longer warned that nothing applies it #23776, closing spec liveness: the console pin hop to objectui 1f23d5b070fa makes page.print and translation.flows.successMessage / errorMessage read planned while the shipped console applies them (family card; the parentDataSource leg is #23585) #23710). The PR body note is corrected.
• c. Card ② defects on paper. Re-read at the pin, they split by landing:
  • The "Show N empty fields" button is objectui's: print page: the record details' "Show N empty fields" button prints on paper — DetailSection draws it on a print page, where card ② already opens collapsed sections because record:details prints every field it declares objectui#12717, filed with this record. DetailSection.tsx:736 at the pin draws it on a print page, while :188 already opens collapsed sections there. Near hit: objectui#12618 (open, the on-screen fold of all-empty sections), cross-linked, and not in the same batch.
  • The line-item headings that print field names are NOT an objectui defect. record:line_items draws a column exactly as declared: "this block does NOT hydrate a column from the child object's field … an identity-only { name } column is a text cell headed by its name" (packages/spec/src/ui/component.zod.ts:2494). This PR's showcase page declares identity-only columns (invoice-document.page.ts:60). It goes on an objectstack card for the showcase page, which this seat files at its next fire (the per-fire filing cap of three is spent on the cards above), with a contract alternative (hydrate, as the master-detail carriers do) left to the spec seat.
• d. llms.txt 71 → 72 and the @objectstack/spec patch line: a cross-lane note to the spec seat post [PM seat] domain:spec — 🟢 os-elon-musk · session_01HjR8RUwTPQ3TgbfKihmxp9 #6017.
• e. The p1 cloud adoption card (ruling 6204149204; grade 6204256901). Its home is objectstack-ai/cloud, where the fix lands. This session cannot reach that repo, so a seat that can files it from the draft. Until then it is held on this seat's post.
• f. Items 2 and 3 of 6206951646 (impersonation attribution; the per-print login/logout audit pair): handed to card ④ print page ④ of #8346: a record-page "generate PDF" action that calls the render service and attaches the archived PDF to the record #22270 by a comment, since this PR has no door.
• g. The explicit host: '127.0.0.1' on launchServer: service-print: the local placement's chromium.launchServer binds its control socket on playwright-core's DEFAULT host — pass host: '127.0.0.1' so a library change on a version bump cannot widen it beyond loopback #23968 (domain:services), filed with this record. Grade is triage's.
• E1 / E2 (CI provisioning of Chromium and a built Console; CJK fonts in CI): the maintainer's (.github/workflows). Raised in the round report; no card from this seat.

6. 落地条款 (landing terms)

• Approval. Landing waits for an APPROVED review by os-zhuang or hotlong (GOVERNED_APPROVERS, scripts/pm/check-governed-queue-guard.mjs:619). The approval is not tied to commit_id, and a later push does not expire it. A human's direct merge is itself the review record.
• In the same stroke as this record:
  • needs-user-decision goes on this PR;
  • review is requested from both accounts, through the REST route that leaves the draft bit alone. The PR author is objectstack-fleet[bot], so neither request meets the author-identity 422;
  • print page ③ of #8346: a render service with one headless-Chromium driver renders a print page under the requesting user's principal and archives the PDF as a sys_file (M2) #22269 gets the pointer ACCEPT → PR #23811 comment <id>.
• After an authorized approval, the seat lands it:
  1. the landing pre-check (node scripts/pm/check-governed-merges.mjs --pr 23811, the Tier H route for more than 3,000 lines);
  2. every check success or an expected skip at the head;
  3. a re-read of mergeable_state (dirty means merge origin/main first);
  4. clear needs-user-decision;
  5. pr_ready, then automerge_enable, through the relay;
  6. confirm MERGED from two readings, the queue branch and origin/main;
  7. then, in the same act: print page ③ of #8346: a render service with one headless-Chromium driver renders a print page under the requesting user's principal and archives the PDF as a sys_file (M2) #22269 closes through Fixes, pm:dispatched comes off, closed_by_pull_requests is checked, the PR subscription ends, and the dev session is archived.
• Until then the PR stays draft, outside the queue, and is listed as awaiting a human merge in the round report.

---

Generated by Claude Code