refactor(rest): move registerUiEndpoints into ui-routes.ts (#23050 slice 10)

[objectstack-fleet]

Part of #23050
Clause-②: no

Slice 10 of the rest-server.ts split, by slice 1's pattern (landed note 6136102437, steps 1–6), slice 2's getter refinement (6189011700) and slices 3–9's shape (slices 8 and 9: PR #23882, PR #23959). The body of RestServer#registerUiEndpoints (GET {basePath}/ui/view/:object/:type, the identity- and ownership-gated door onto the protocol's getUiView) moves to ONE new module, packages/rest/src/ui-routes.ts. The route table, the ordered registrations, every handler's source and digest, the published dist/*.d.ts and both bundles' export lists are byte-identical. Every reader whose reading included a moved line now reads it where it is, with its sum unchanged.

No token of the body changed. The body calls no class static, so the static exception (6205442867) is not used. It reads no provider field, so the provider ruling (6215084478) does not apply: nothing in the host is a getter. The ruled order of its guards is unchanged, byte for byte and at runtime (below).

One module-level type moved with the body, by pattern step 5. The body types its request through TransportScopedMetaRequest, a type alias declared in rest-server.ts and not exported. The claim says to export helpers from where they are declared. For a type alias, that changes the published .d.ts (measured below, twice), and slice 1's step 5 already rules for exactly this case: "A type alias moves with the body, because exporting one changes the .d.ts." So the alias block (its docblock and declaration, 40 lines) moved verbatim to ui-routes.ts, gaining only export. rest-server.ts imports it back for its 12 other typed uses. This mirrors slice 1's ServerScopedDataRequest. The alias's final home is asked as an open question in the report, as slice 1's was.

rest-server.ts goes from 9,995 to 9,915 lines (base 68ffa5dc1a). The card stays open for the later slices; #23050 remains open after this PR.

The pattern, applied

Members the moved body reads, from an AST walk of the method (TypeScript compiler API with a type checker, symbol-resolved, base 68ffa5dc1a): registerUiEndpoints (JSDoc :8284, method :8313–:8374, body :8314–:8373, 60 lines).

kind	member	reads	class declaration
field	routeManager	1, the register call (:8318)	:2026, private
method	resolveRequestEnvironmentId	1 (:8329)	:2322, private async
method	resolveExecCtx	1 (:8342)	:2872, private async
method	enforceAuth	1 (:8343)	:2472, private
method	enforceEnvironmentOwnership	1 (:8344)	:2597, private
method	resolveProtocol	1 (:8345)	:2404, private async

The body has no bare this, no element access on this, no function keyword and no RestServer.NAME access. The seat's text count (the same six members, one read each) is confirmed.

Control walk (the same walker, same base): the registerSearchEndpoints stub (:8999) reads routeManager, resolveProtocol, resolveExecCtx and enforceAuth once each (slice 9's host literal). enforceEnvironmentOwnership itself (:2597) reads extractProjectIdHeader once, plus ANONYMOUS_DENY_STATUS and ANONYMOUS_DENY_BODY from @objectstack/core. Both match what their source says.

Module-level reads (the same walk):

• handleRouteError (./error-response.js): still used across rest-server.ts, so its import stays; the module imports the same name from the same module.
• GetUiViewRequest (type, @objectstack/spec/api): read ONLY by this body (2 hits in rest-server.ts at base: the import and this use). Its import name moved with the body, leaving a two-line pointer comment in the import block, as slice 6 did for ErrorCode.
• TransportScopedMetaRequest (declared :299): see above and the measurement below.

Host shape (slice 1's shape B): UiRouteHost (6 members) lists exactly the members the body reads, each typed RestServer['m'], in the body's read order. The class keeps the private method with its name, docblock and position. Its body is now a host literal plus registerUiEndpoints.call(host, basePath). Methods go as late-bound closures, (...a) => this.m(...a). The call site in registerRoutes' registerForBase (this.registerUiEndpoints(bp);, base :4805, head :4772, under api.enableUi) is unchanged: registerRoutes (75 lines) diffs to 0 between base and head.

Fields, checked one by one:

field	read when	reassigned after registration?	handed over as
routeManager	registration only (one register call, a top-level statement of the body)	its one swap wraps registerMetadataEndpointsInner, not this registrar	value

No other field is read. The environment, the caller, the ownership verdict and the protocol are each resolved per request by a method, so no getter is owed.

Late binding and the guard order, measured (a one-off vitest file, copied in, run under the verify lock, deleted; not committed). A source RestServer gets five instrumented members planted on the instance BEFORE registerRoutes(), and the door is driven. Then five new ones are planted AFTER registration, and the door is driven again. Each member records its call.

• Head: MEASURE before: 200 {"answeredBy":"early",…} | order early:env,early:ctx,early:auth,early:own,early:proto and MEASURE after: 200 {"answeredBy":"late","env":"env_late",…} | order late:env,late:ctx,late:auth,late:own,late:proto | early calls after re-plant 5. Result: Tests 1 passed (1). The members reached are the late ones, in the ruled order (resolve the environment once, resolve identity in it, refuse anonymity, compare ownership, then resolve the protocol).
• Ablation through scripts/ablation-replace.mjs: the host literal's enforceEnvironmentOwnership: (...a) => this.enforceEnvironmentOwnership(...a), was replaced by enforceEnvironmentOwnership: this.enforceEnvironmentOwnership.bind(this),. Anchor 1 → 0; blob b429a90b19d3 → 97583add2404.
  • Result: order late:env,late:ctx,late:auth,late:proto, with the early guard called a sixth time, and Tests 1 failed (1).
  • Restored by the tool: blob b429a90b19d3 equals HEAD, and git diff HEAD is empty.
• Base leg: the base rest-server.ts (blob 1c7f7e45a921) was restored into the tree under a trap, then git checkout HEAD with blob and diff proof. The answers are the same as the head's, and Tests 1 passed (1).

Proof of move-only

• Moved body: base rest-server.ts lines 8314–8373, with one 4-space indent removed, against ui-routes.ts lines 118–177. diff exits 0 over the 60 lines.
  • Every non-empty line of the range carries the method indent. The range has one empty line and no trailing whitespace.
  • Every line with a backtick holds an even number of them, so no template literal spans the cut.
• Moved alias block: base rest-server.ts lines 260–299 against ui-routes.ts lines 54–93. diff exits 0 once the export keyword on the last line is set aside. A // note above it says why it moved, and that the block's "here" and "this file" still mean rest-server.ts, where the doors it describes live.
• The private method's docblock and signature (base :8284–:8313, head :8251–:8280) diff to 0.
• .d.ts: packages/rest/dist/index.d.ts and index.d.cts were built at base 68ffa5dc1a (before any edit), at the merge head 5da02e4b9, and again after the whole-workspace build.
  • All are byte-identical: sha256 7489de84bc6feccb7cb1f28bcbe4a97775324959c61c9bfc35e8a8c45a6f3bc9.
  • The head bundles carry a head-only marker (registerUiEndpoints.call: 1 hit in each of index.js and index.cjs, 0 at base), so the declaration was rebuilt from the moved source, not replayed.
  • src/index.ts is untouched.
• Why the alias could not be exported in place (both measured, each through ablation-replace.mjs, restored by blob and diff proof, and rebuilt back to 7489de84…):
  • export type TransportScopedMetaRequest… at its declaration gives dist/index.d.ts sha256 a82fe845e80c…: line 1625, a blank line, disappears.
  • a separate export type { TransportScopedMetaRequest }; statement gives the same a82fe845e80c… and the same one-line change.
  • Slice 1 measured this for ServerScopedDataRequest. Moving the alias, by contrast, leaves the .d.ts byte-identical (above).
  • The first attempt at the first counterfactual was a no-op: its anchor was a substring of its replacement, the tool refused it, and nothing ran. It was re-anchored and re-run.
• Export lists: the base and head ESM and CJS bundles each load with 39 exports and one sorted export-name list (sha256 b3246be6a1718700… on all four). No UI-module name is among them.
• Routes: a source RestServer runs on a recording mock server, with a protocol that answers every member. It is dumped under slice 9's eight configs plus a ninth, enableUi: false under scoped-optional, the door's own switch. The eight are: default; scoped-optional; scoped-required; every provider set; enableDiscovery: false; enableOpenApi: false; both off under scoped-optional; enableSearch: false under scoped-optional.
  • Each dump holds four files: getRoutes() (functions as arity); the ordered server registration calls; a whitespace-free sha256 of every handler's source; and that source.
  • 36 of 36 dump files are byte-identical, base 68ffa5dc1a vs merge head 5da02e4b9 (diff -r exits 0). A second base run was identical to the first.
  • Route counts: default 75 (1 UI door); scoped-optional 150 (2); scoped-required 75 (1); every-provider-set equal to default; discovery-off 73 (1); openapi-off 73 (1); both-off-scoped-optional 142 (2); search-off-scoped-optional 148 (2); ui-off-scoped-optional 148 (0).
  • The default config's routes and calls digests (6931d1a5d182… / ccb3bd12f10b…) are the ones slices 5–9 reported for it.
  • Because no token changed, every handler digest is identical with no mapping.
• The handler digest can fail: a positive control added one character to the moved handler ('…protocol implementation' → '…protocol implementation!', through ablation-replace.mjs; anchor 1 → 0, blob 2eab547e5bba → 1d0809727b0b).
  • Routes and calls were unchanged in all nine configs.
  • The handler digests differed in exactly the UI door of each mounted base: GET /api/v1/ui/view/:object/:type, and GET /api/v1/environments/:environmentId/ui/view/:object/:type where scoped. Nothing else differed, and nothing differed under enableUi: false.
  • Restored: blob 2eab547e5bba equals HEAD.

Readers re-pointed (sums unchanged, no gate loosened)

packages/rest/src/rest-server-registrar-files.ts gains ui-routes.ts with a [#23050 slice 10] comment (length 10 → 11). Every reader that pins its length re-reads its number:

reader	sum over the list	change
rest-server-query-number-census.test.ts	9 = 8 + 1 + 0 ×9	the UI body reads two path parameters as strings and coerces nothing; length 10 → 11
rest-server-canonical-query-ast.test.ts (repo project)	4 = 1 + 3 + 0 ×9 query: slots	floor ui-routes.ts: 0; length 10 → 11
meta-draft-read-door-census.test.ts	8 = 6 + 0 + 0 + 0 + 0 + 2 + 0 ×5	the UI body reads no draft; length 10 → 11
rest-server-docblock-position.test.ts	floors 4 + 3 + 3 + 8 + 3 + 8 + 5 + 3 + 3 + 4 = 44	floor ui-routes.ts: 4 (the module header, the moved alias's block, the host interface's and the function's). rest-server.ts gives up only the alias's block: 164 → 163, floor 100. Length 10 → 11
execctx-consumer-census.test.ts	62 sites = 22 + 9 + 5 + 7 + 8 + 1 + 5 + 2 + 1 + 1 + 1	the UI site is BARE and guarded on its next line, as before (46 bare / 16 caught unchanged). Mentions 121 → 125, the seam once (forwarder ×2 in rest-server.ts, interface member ×2 in the module); rest-server.ts 59 → 60. Forwarders 12 = (11 − 1) + 3 − 1; neither map gains an entry
ui-view-route-identity.measurement.test.ts	this.enforceAuth( 59, this.resolveExecCtx( 74 over the list (58 / 73 before, +1 each for the UI literal's forwarders; floors 40 hold)	the sliced reading is re-pointed (below); length 10 → 11
ui-view-route-tenancy.measurement.test.ts	as above; the ownership guard's call sites: 1	the sliced reading and the ownership pin are re-pointed (below); length 10 → 11
dogfood authz-conformance.test.ts (realtime tripwires)	0 hits over the eleven files	length 10 → 11
dogfood authz-probe-blind-spot.census.ts, rest-server.ts row	70 / 19 / 51 unchanged; this.routeManager.register( 63 = 20 + 9 + 5 + 7 + 8 + 1 + 6 + 4 + 1 + 1 + 1; private register*Endpoints( 16	new control ui-routes.ts: this.routeManager.register( 1; registrar list length 11; enforceAuth 104 → 108 re-anchored (the one call site moved and is counted in both readings; the four new occurrences are the seam once; no call site added); populationRule names the new module

The two ui-view measurement tests read this body directly, so they are re-pointed with care.

• The sliced reading. Both tests sliced rest-server.ts from private registerUiEndpoints( to private registerCrudEndpoints(. That span is now the host literal, whose forwarders spell this.enforceAuth(, this.resolveExecCtx(, this.enforceEnvironmentOwnership( and this.resolveProtocol( in the very order the tenancy test asserts, while calling none of them in a route. A slice there would pass the order assertions vacuously.
  • Both tests now slice ui-routes.ts, from export function registerUiEndpoints( to the function's own closing brace (the first column-0 brace after it), so neither the module header nor a later declaration can satisfy it.
  • Every toContain and every order assertion is unchanged. That the private method still mounts this one route is held, as before, by the identity test's §6 runtime attribution (byRegistrar.get('registerUiEndpoints') equals the one UI route).
• The ownership pin. this.enforceEnvironmentOwnership( over the list was pinned at exactly 1, "a single new call site plus its definition". Over the eleven files the spelling now reads 2: the one call site, which moved to ui-routes.ts, plus this slice's host-literal forwarder.
  • The pin now asserts both halves exactly: forwarders ((...a) => this.enforceEnvironmentOwnership(...a)) toBe(1), and call sites (spellings minus forwarders) toBe(1).
  • The call-site count is unchanged at 1, and a second forwarder reds as loudly as a second call site. Nothing is loosened.

Readers outside the list:

• scripts/check-route-envelope.mjs (a gate's target paths, domain:spec): ui-routes.ts is declared dialectOnly with ratchet [tracking] Envelope-position convergence line for packages/rest's flat dialect — the live ratchet owner #9559, as the nine earlier modules are, at its measured stringError 1 / siblingCode 1. Its one hand-built refusal is the 501 { error: 'UI View resolution not supported by protocol implementation', code: 'NOT_IMPLEMENTED' }.
  • rest-server.ts drops by exactly that body: stringError 16 → 15 and siblingCode 14 → 13, each recorded as "NOT progress — the same MOVE".
  • The sums are unchanged: 15 + 13 + 8 + 1 + 0 + 0 + 0 + 0 + 1 + 0 + 1 = 39, and 13 + 15 + 8 + 9 + 4 + 1 + 0 + 0 + 3 + 0 + 1 = 54.
  • Its output differs from origin/main only in the rest-server.ts row and the new row (20 → 21 modules, 11 → 12 ratcheted). --self-test is green.
• No new ADR anchor: neither moved range cites an ADR-NNNN Dk. check-adr-anchors output is identical at origin/main and head (1770 decision-letter citations).
• No platform-checklist anchor names the UI registrar or the alias; check:platform-checklist output is identical at origin/main and head.

Red before the re-points, each measured with the move in place (9c34e1a99, the readers at their base text):

• @objectstack/rest local read Test Files 6 failed | 281 passed (287) and Tests 7 failed | 5895 passed | 326 skipped (6228). The failures were the four length pins (execctx, meta-draft, query-number, docblock), the docblock pin's unfloored new module, and both ui-view sliced readings: expected 'private registerUiEndpoints(basePath:…' to contain 'p.getUiView(', and the same for const isScoped = ….
• rest-server-canonical-query-ast.test.ts (repo) read Tests 2 failed | 248 passed | 11 skipped (261).
• The dogfood pair read Tests 2 failed | 106 passed (108): the realtime tripwire's length pin, and control "registrar list length" moved … expected 11 to be 10.
• check:route-envelope read ui-routes.ts NOT DECLARED, plus rest-server.ts stringError: found 15, declared 16 and siblingCode: found 13, declared 14.
• Each is green after the re-point. The tenancy test stopped at its first failing toContain, so its exact ownership pin was not observed red in that run. It was counted directly instead: 1 spelling at base, 2 at the move commit (1 call site plus 1 forwarder).

Readers examined and not re-pointed

• packages/spec (stopped at, per the dispatch, not edited): no reader there includes a moved line. packages/spec/liveness/rest_api.json cites rest-server.ts#registerRoutes for the if (this.config.api.enableUi) gate, the call site that did not move. Its second citation is registerDiscoveryEndpoints, slice 7's. packages/spec names TransportScopedMetaRequest in comments as living in packages/rest (e.g. protocol.zod.ts), never by file, and it still does. check:liveness output is identical at origin/main and head.
• Prose naming the method without a file, still true: the dogfood census note and comments, rest-route-ledger.ts, packages/runtime/src/route-ledger.ts and execctx-consumer-census.test.ts (dated history). The same holds for data-action-routes.ts' {@link TransportScopedMetaRequest}, which resolves by name exactly as it did before.
• docs/audits/2026-06-handwritten-docs-accuracy-followups.md cites rest-server.ts:2603-2612, a dated audit line outside both moved ranges (:260–:299, :8284–:8374). Released CHANGELOG.md text: not edited.
• Gates that walk packages/rest/src reach the moved code in its new file. Their outputs at origin/main and head differ only by the one scanned file:
  • check-meta-type-normalized 38 → 39;
  • check-dispatcher-error-vocabulary and check-error-status-conformance +1 file (57 classified sites unchanged);
  • check-undeclared-dep-imports +1 file, +1 specifier;
  • check-affected-docs: route sources 28 → 29 and registration call sites 23 → 24, by the *-routes.ts convention;
  • check-scripts-symbol-anchors: +4 file-level anchors, the gate's new comments.
• Identical at origin/main and head: check-adr-anchors, check-system-context-census, check-single-authz-resolver, check-rest-log-declared, check-durability-degradation-log-level, check-filter-alias-parity and check:platform-checklist.
• No rest-server.ts:NNNN line citation in a gated document falls in a moved range.

Acceptance notes

• objectql-slot-consumer-census.test.ts (slice 8's extra reader) is not touched: the UI body reads no provider slot, and it stays green.
• The moved [commit cc837dbfe] comments in the body still read true in the module: they describe the handler they sit in, and name execctx-consumer-census.test.ts by file, which still counts this site.
• The moved alias block's prose ("the doors here", "call sites in this file") describes rest-server.ts, where those doors live; the note above it in ui-routes.ts says so rather than editing the moved text.

Gates and tests

Measured at this branch: base 68ffa5dc1a; the move 9c34e1a99; the re-points c9b5a6440; and one merge of origin/main 0b6956490 (5da02e4b9: #23881 plugin-audit, cli and two checklist areas; #23937 spec tests; #23966 create-objectstack; no file in this diff). All builds and tests went through os-verify-lock. Every exit code was captured to a file before any pipe. Final head: 5da02e4b9.

• pnpm --workspace-concurrency=2 --filter '@objectstack/rest...' --filter '@objectstack/verify...' build exited 0 at the merge head. Then pnpm turbo run build --concurrency=2, the whole workspace, exited 0 (Tasks: 76 successful, 76 total), after which the @objectstack/rest .d.ts / .d.cts still equal base.

• pnpm --filter @objectstack/rest typecheck: exit 0 (tsc --noEmit, then check:test-typecheck: 0 file(s) / 0 error(s)).

• pnpm --filter @objectstack/rest exec vitest run --project local --maxWorkers=2: Test Files 287 passed (287), Tests 5902 passed / 326 skipped (6228).

• pnpm --filter @objectstack/rest exec vitest run --project repo --maxWorkers=2: Test Files 5 passed (5), Tests 250 passed / 11 skipped (261).

• pnpm --filter @objectstack/dogfood exec vitest run test/authz-probe-blind-spot.test.ts test/authz-conformance.test.ts: Test Files 2 passed (2), Tests 108 passed (108).

• Lint: pnpm exec eslint --no-inline-config --format json over the 13 changed files: exit 0, 13 results, 0 errors, 0 warnings. The published .d.ts is byte-identical, so no consumer outside packages/rest can lint differently. Repo-wide pnpm lint is CI's (Lint & Repo Gates).

• check:dev-prereqs and check:skill-frame-freshness (local-only) were not run: this diff touches no packages/spec build input and no four-axis frame file.

• No changeset: nothing any released package publishes changes (the .d.ts, export lists and routes above). skip-changeset is the seat's to apply on its own check.

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, with no paths, at 5da02e4b9. Its stderr names that commit, the --repo assertion holds, and it reads 13 paths against merge base 0b6956490, 477 changed lines.

  • It derived 79 commands, all run at 5da02e4b9 after the whole-workspace build, and every one exited 0. --ran reads: Run reconciliation — 79 derived, 79 run, 0 NOT-MEASURED, 0 UNRUN.
  • Among them: pnpm check:route-envelope, pnpm --filter @objectstack/spec run check:liveness, pnpm check:durability-log-level, pnpm check:dispatcher-error-vocabulary, pnpm check:dts-closure, pnpm check:dual-build-cjs-loads, pnpm check:published-files, pnpm check:cross-package-test-inputs, pnpm check:nul-bytes and pnpm check:pm-dispatch-gates (the battery took 299.7s on a shared box).
  • check-adr-anchors and check-platform-checklist are not derived; both also ran, exited 0, and printed output identical to origin/main.

• origin/main moved on after the one merge, to 2e1562091 (five commits: fix(service-automation): a failing parallel keeps every branch's steps in the run log #23970, feat(platform-objects): User Preferences and Identity Links leave Setup's menu; the User page gains a Preferences tab #23936, test(dogfood): pin the undeclared-key refusal on the suite's SQL driver arms (#15953 slice 7) #23976, chore(objectui): move the console pin to f8267df93aba, past the spec deletion of checkPageComponentViewData #23973, fix(cli,runtime): refuse an uncreatable state, output or cache directory at once instead of looping in recursive mkdir #23979). None touches a file in this diff, packages/rest, the gate or the dogfood authz files.

  • The reconciliation's STALE TREE note names three derivation inputs main changed: scripts/check-cli-test-child-env.mjs, scripts/ci/spec-shape-retirements.json and scripts/sdui-manifest.record.json. All belong to families this diff does not touch.
  • CI runs the merge ref. Not merged again.

Per command (exit code), 79 lines:

node scripts/check-ci-filter-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-adoption.mjs :: exit 0
node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs --self-test :: exit 0
node scripts/check-dts-emitted.mjs --self-test :: exit 0
node scripts/check-issue-citations.mjs :: exit 0
node scripts/check-keyed-text-bounds.mjs :: exit 0
node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0
node scripts/check-platform-object-tenancy-census.mjs :: exit 0
node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0
node scripts/check-plugin-teardown-shape.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0
node scripts/check-registry-log-declared.mjs :: exit 0
node scripts/check-registry-log-declared.mjs --self-test :: exit 0
node scripts/check-rest-log-spy-declared.mjs :: exit 0
node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0
node scripts/check-scripts-symbol-anchors.mjs :: exit 0
node scripts/check-scripts-symbol-anchors.mjs --self-test :: exit 0
node scripts/check-self-test-wired.mjs :: exit 0
node scripts/check-self-test-wired.mjs --self-test :: exit 0
node scripts/check-self-test-workflow-commands.mjs :: exit 0
node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0
node scripts/check-system-context-census.mjs :: exit 0
node scripts/check-system-context-census.mjs --self-test :: exit 0
node scripts/check-undeclared-dep-imports.mjs :: exit 0
node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0
node scripts/check-whole-set-label-write.mjs :: exit 0
node scripts/check-whole-set-label-write.mjs --self-test :: exit 0
node scripts/docs-audit/check-affected-docs.mjs :: exit 0
node scripts/docs-audit/check-drift-comment.mjs :: exit 0
node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0
pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0
pnpm --filter @objectstack/spec run check:empty-state :: exit 0
pnpm --filter @objectstack/spec run check:liveness :: exit 0
pnpm --filter @objectstack/spec run check:strictness-ledger :: exit 0
pnpm --filter @objectstack/spec run check:variant-docs :: exit 0
pnpm check:agent-test-spelling :: exit 0
pnpm check:authz-resolver :: exit 0
pnpm check:bash32-floor :: exit 0
pnpm check:cli-command-ids :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:dispatcher-error-vocabulary :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:dts-closure :: exit 0
pnpm check:dual-build-cjs-loads :: exit 0
pnpm check:durability-log-level :: exit 0
pnpm check:engine-double-contract :: exit 0
pnpm check:entry-guard :: exit 0
pnpm check:error-status-conformance :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:issue-citations :: exit 0
pnpm check:lean-entry-closure :: exit 0
pnpm check:logger-receiver-detach :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:objectql-double-limit :: exit 0
pnpm check:org-identifier :: exit 0
pnpm check:page-declaration-shape :: exit 0
pnpm check:parse-guard :: exit 0
pnpm check:pm-dispatch-gates :: exit 0
pnpm check:pnpm-filter-targets :: exit 0
pnpm check:pnpm-flag-spellings :: exit 0
pnpm check:published-files :: exit 0
pnpm check:query-options-erasure :: exit 0
pnpm check:ratchet-remedy-authority :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:route-envelope :: exit 0
pnpm check:slot-lookup :: exit 0
pnpm check:sourcemap-no-sources-content :: exit 0
pnpm check:test-source-alias :: exit 0
pnpm check:tier-file-adoption :: exit 0
pnpm check:type-check-coverage :: exit 0
pnpm check:type-check-debt :: exit 0
pnpm check:watch-hint-literal :: exit 0
pnpm check:where-matcher :: exit 0

Cross-lane files in this diff: scripts/check-route-envelope.mjs (domain:spec, a gate's target paths: one new MODULES entry and the rest-server.ts row's two counts, each with a history comment; sums unchanged). The dogfood files (packages/qa/dogfood/test/authz-conformance.test.ts, authz-probe-blind-spot.census.ts) are re-pointed as in slices 3–9. No checklist file and no ADR anchor is touched. check-governed-merges --test over the 13 paths: NOT governed (0 of 13 paths hit the register); 477 changed lines.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 22 documentable anchor(s).

19 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 2e1562091cf850d7f3d1057f5ebb82e9ff8cb0be.

⛔ 5 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 4 cross-cutting symbol(s) contributed no route anchor: enforceAuth (23 routes), resolveExecCtx (28 routes), routeManager (19 routes), resolveProtocol (25 routes)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 18 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 2e1562091cf850d7f3d1057f5ebb82e9ff8cb0be → packageMentionDocs.

Which tree this was computed on

This run read content/docs from be80cf625e5a1a8006275e1ea7200925b00f481a — the merge of head 5da02e4b97d67a88a6a47f766613e51c1a12bc61 into base 2e1562091cf850d7f3d1057f5ebb82e9ff8cb0be, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin be80cf625e5a1a8006275e1ea7200925b00f481a && git checkout be80cf625e5a1a8006275e1ea7200925b00f481a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 2e1562091cf850d7f3d1057f5ebb82e9ff8cb0be 5da02e4b97d67a88a6a47f766613e51c1a12bc61 && git checkout -B drift-repro 2e1562091cf850d7f3d1057f5ebb82e9ff8cb0be && git merge --no-ff 5da02e4b97d67a88a6a47f766613e51c1a12bc61

node scripts/docs-audit/affected-docs.mjs --json 2e1562091cf850d7f3d1057f5ebb82e9ff8cb0be

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 2e1562091cf850d7f3d1057f5ebb82e9ff8cb0be → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 5da02e4b97d67a88a6a47f766613e51c1a12bc61
Local-runs: none

Face: the declaration face. This is a move-only slice of @objectstack/rest, and no token of the moved body changed. The diff does five things:

• it moves one registrar body into one new module, packages/rest/src/ui-routes.ts;
• it moves one module-level type alias, TransportScopedMetaRequest, into that module with the body, and rest-server.ts imports it back;
• it grows the registrar list 10 → 11 and re-points the nine readers of that list;
• it re-points one gate's target table, scripts/check-route-envelope.mjs;
• it adds the stub, one import, two pointer comments and their notes to rest-server.ts.

The 13-file list holds no published schema and no governed path. record-recognisers --template --paths over that list derives TIER_DEFAULT. Governed Surface Queue Guard concluded success. The PR body reads Clause-②: no with no arm, and the diff adds no changeset.

Inputs:

• card [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050: its body and all 42 comments. These include the triage 6126748916, slice 1's acceptance 6135541164 and landing 6136102437, slice 2's refinement 6189011700, the seat ruling on the static receiver 6205442867, the seat ruling on providers in 6215084478, the slice 10 claim 6218443248 and the slice 10 os-dev-report 6220278484;
• slice 9's record 6217704682 on PR refactor(rest): move registerSearchEndpoints into search-routes.ts (#23050 slice 9) #23959, used as precedent;
• PR refactor(rest): move registerUiEndpoints into ui-routes.ts (#23050 slice 10) #23990:
  • its body;
  • its file list: 13 files, +347 / −130, which matches git diff --numstat file for file;
  • its one comment, the advisory Docs Drift Check;
  • its timeline: the labels, and the declaration 6220378958 on [PM seat] domain:spec — 🟢 os-elon-musk · session_01HjR8RUwTPQ3TgbfKihmxp9 #6017;
• the net diff against the merge base 0b6956490a;
• the 44 check-runs on this head, read last.

Method: read-only. Every count below was read off the git objects of the merge base and the head with git show, text diff and grep, plus one text-only count script. That script applies each reader's own rule to the text: the execctx site, mention and forwarder rules; the ui-view pair's three spellings; the dogfood population rule with its forwarder slice and controls; the docblock opener and stacking rule; querySlots; the draft and coercion tokens; the two realtime tripwire regexes. No repository code was built, tested or re-run.

The merge base's rest-server.ts blob (1c7f7e45a9) is the same blob as at the dev's base 68ffa5dc1a. Between those two commits nothing changed under packages/rest, in the gate, in packages/spec/liveness or in scripts/adr-anchors. Only two checklist areas and one new dogfood test changed, and that test reads no rest-server.ts. So the PR's base line numbers apply as written. The merge commit 5da02e4b97 changes none of the 13 files.

① Derived judgments

No accept set changes and no public surface changes. Each change the diff makes is judged below.

1. The moved body is byte-identical once de-indented: right.

   • Base rest-server.ts :8314–:8373 is 60 lines. With one 4-space indent removed, it equals head ui-routes.ts :118–:177. diff finds 0 differing lines.
   • Every non-empty line in the range starts with 4 spaces. The range has one empty line and no trailing whitespace.
   • Its two template literals, ${basePath}/ui (base :8314) and ${uiPath}/view/:object/:type (:8320), each sit on one line. Every other backtick in the range is in a line comment. So removing the indent changed no runtime string.
   • The body has no RestServer. access. The static exception was not used, and no token changed.
   • The rest of rest-server.ts changes in four hunks, +21 / −101 in total:
     • the GetUiViewRequest import name removed, with a 2-line pointer (head :151–:152);
     • the alias block removed (40 lines), with a 4-line pointer (head :261–:264);
     • the new import and its comment (head :311–:312);
     • the stub: 13 lines in place of the 60-line body (head :8280–:8294).
   • The removed lines add up: 1 + 40 + 60 = 101. The file goes from 9,995 to 9,915 lines.
   • The private method keeps its name, its JSDoc and its position. Base :8284–:8313 and head :8251–:8280 diff to 0.
   • registerRoutes is identical: base :4790–:4864 against head :4757–:4831, 75 lines, diff empty.
     • The call site moved from base :4805 to head :4772 only because of the lines removed above it.
     • It is still guarded by api.enableUi and still sits between registerMetadataEndpoints and registerSearchEndpoints. So the registration order holds on every base.

2. The host lists exactly what the body reads: right.

   • The body's code reads of this. (comments excluded), one each:
     • routeManager (module :122);
     • resolveRequestEnvironmentId (:133);
     • resolveExecCtx (:146);
     • enforceAuth (:147);
     • enforceEnvironmentOwnership (:148);
     • resolveProtocol (:149).
   • No comment in the body mentions this..
   • UiRouteHost (:102–:109) declares exactly these 6, in that order. Each is typed by indexed access on the class.
   • The body has no bare this, no element access on this and no function keyword.
   • Its module-level free identifiers are exactly three:
     • handleRouteError, imported from ./error-response.js, the module rest-server.ts imports it from. rest-server.ts still uses it (31 → 30 mentions), so its own import stays.
     • GetUiViewRequest, imported as a type from @objectstack/spec/api. At base rest-server.ts had 2 mentions: the import and this use. So moving the import name is right.
     • TransportScopedMetaRequest, the moved alias (item 4).
   • The module's only import from ./rest-server.js is import type { RestServer }. It is erased at build, so this slice adds no runtime import cycle.
   • So the seat's count of six members, one read each, holds.

3. Value or closure, member by member: right.

   • routeManager goes by value.
     • Its one read is the top-level register call, which runs during registration.
     • The class assigns the field only in the constructor (head :2138) and in the try/finally swap around registerMetadataEndpointsInner (:5146 / :5150, inside registerMetadataEndpoints).
     • The UI registrar has one call site (:4772), and it runs after registerMetadataEndpoints has returned. So it is outside that window.
     • The interface marks the member readonly.
   • The five methods go as late-bound closures. Their receiver is still the server, so a spy set on the server after registration is still the one reached.
   • No getter is owed. The body reads no field at request time. The environment, the caller, the ownership verdict and the protocol are each resolved per request by a method.
   • No provider is read, so the seat's provider ruling (6215084478) does not apply.
   • The dev's late-binding measurement, its closure ablation and its base leg are the dev's, not re-run here. They match this reading, including the ruled guard order.

4. TransportScopedMetaRequest moved verbatim, is still one declaration, and reaches nothing published: right.

   • Verbatim. Base rest-server.ts :260–:299 (the docblock and the declaration, 40 lines) against head ui-routes.ts :54–:93. The only differing line is the last one, which gains export .
   • One declaration. At head the tree holds one declaration of the name, ui-routes.ts :93, and rest-server.ts holds none. rest-server.ts imports it type-only at :312.
     • Its typed uses there go from 14 to 12 lines: the declaration and the UI use left, and the 12 other uses stay.
     • This is exactly slice 1's shape for ServerScopedDataRequest (declared in data-action-routes.ts :157, imported back at rest-server.ts :278).
   • Nothing reaches the published .d.ts:
     • @objectstack/rest publishes dist, README.md and CHANGELOG.md only.
     • Its build runs the root tsup.config.ts: one entry, src/index.ts, with splitting: false.
     • src/index.ts is untouched. It has no export *. It re-exports from ./rest-server.js by name only: RestServer, the types RestProtocol and MountedRoute, and metaItemPackageBinding. It names no ui-routes module.
     • No public RestServer signature names the alias. All 12 uses are local const annotations inside private members: metaListSource, serveMetaItemLayered, registerMetadataEndpointsInner (7), readFormObjectDefinitions and registerFormEndpoints (2). A private member is emitted in the .d.ts with no type at all.
     • UiRouteHost and registerUiEndpoints appear only inside a private method body, which declaration emit does not reach.
   • The dev's .d.ts sha 7489de84… and the two export-in-place counterfactuals (a82fe845…) are the dev's evidence, not re-run here. They are what this construction predicts, and slice 1 measured the same thing.

5. No other module-level helper gained an export: right.

   • The diff adds or removes no export line in rest-server.ts. It has 39 lines starting with export at base and at head.
   • ui-routes.ts exports three names: the alias, UiRouteHost and registerUiEndpoints. None is reachable from src/index.ts.

6. The registrar list and every reader were re-counted, and no reader was loosened: right.

   • The list grows 10 → 11 by one appended entry. Exactly nine files import it, at base and at head, and all nine are in the diff. Each moves its length pin 10 → 11.
   • execctx census. Its site rule counts lines that hold this.resolveExecCtx(environmentId, req).
     • Sites: 62 at both. Base 23 + 9 + 5 + 7 + 8 + 1 + 5 + 2 + 1 + 1; head 22 + 9 + 5 + 7 + 8 + 1 + 5 + 2 + 1 + 1 + 1.
     • Split: 46 bare / 16 caught at both. The UI site is bare, and the enforceAuth guard is its next line (:147).
     • Mentions of resolveExecCtx: 121 → 125. rest-server.ts goes 59 → 60 (one site out, one forwarder's 2 mentions in). The module holds 3 (the site 1, the interface member 2).
     • Forwarder lines in rest-server.ts: 11 → 12. The pin is exact: (11 − 1) + 3 − 1 = 12.
     • Neither map gains an entry. That is right: the module carries one registrar, and that registrar reads the seam.
   • ui-view pair (counted over the list):
     • this.enforceAuth( 58 → 59 and this.resolveExecCtx( 73 → 74. rest-server.ts stays at 19 and 34 (one site out, one forwarder in). The floors of 40 are unchanged.
     • The ownership pin split is exact, not a loosening.
       • The old pin was spellings of this.enforceEnvironmentOwnership( over the list, exactly 1. The method's declaration never matched that spelling, so the 1 was the call site.
       • Over the eleven files the spelling now reads 2: the call site (moved to ui-routes.ts :148) and the host literal's forwarder (rest-server.ts :8290). The forwarder string contains the spelling once, so the subtraction counts each forwarder exactly once.
       • The new pins are forwarders exactly 1 and non-forwarder spellings exactly 1. Together they admit one state only, as the old pin did.
       • A second call site reds (2). A second forwarder reds (2). A forwarder respelt, for example as a bound method, reds (0). A call site written in the forwarder's shape counts as a forwarder and reds (2).
       • Its reach is the same list as before. So the call-site count still holds at 1, and no state the old pin refused is now accepted.
     • The sliced readings were re-pointed correctly.
       • Both tests now slice ui-routes.ts from export function registerUiEndpoints( to the first column-0 closing brace after it. That brace is the function's own (:178, the file's last line), so the slice is exactly the function.
       • Each sliced term occurs once in the slice, in the asserted order: resolveRequestEnvironmentId, resolveExecCtx, enforceAuth, enforceEnvironmentOwnership, resolveProtocol.
       • Every assertion on the slice is positive, and the new slice is narrower than the old one (which ran on to private registerCrudEndpoints( and took in that method's JSDoc). So no assertion got weaker.
       • The dev's reason is right: the host literal spells the four guarded terms in the same order while calling none of them in a route. A slice of rest-server.ts would now pass the order assertions vacuously.
       • That the private method still mounts the one route stays pinned at runtime: the identity test's §6 wraps each private registrar on the prototype and asserts registerUiEndpoints mounts exactly the UI route.
   • dogfood blind-spot row:
     • this.routeManager.register( stays at 63 = 20 + 9 + 5 + 7 + 8 + 1 + 6 + 4 + 1 + 1 + 1.
     • private register*Endpoints( 16, registerPerItemRoute( 8, const registerPerItemRoute = 1 and the forwarder slice 1 are each unchanged.
     • The population 70 / 19 / 51 is unchanged. The UI door is outside registerMetadataEndpoints before and after.
     • enforceAuth goes 104 → 108: rest-server.ts 43 → 44, and the module 3.
       • The four new mentions are the seam once: the forwarder 2, the interface member 2.
       • The one call site moved and is counted in both readings. No call site was added.
       • It is an exact re-anchor, as in slices 3–9.
     • The new control ui-routes.ts: this.routeManager.register( reads 1. registrar list length reads 11.
     • populationRule now names the new module and the moved registrar.
   • docblock pin:
     • The module has exactly 4 TSDoc openers (:3, :54, :95, :111), none stacked, and its floor is 4.
     • The // note above the moved alias block sits above its opener, so the block still binds the declaration at :93.
     • rest-server.ts gives up only the alias's block: 164 → 163 (floor 100). Nothing there became stacked.
     • The floors' sum goes 40 → 44 = 4 + 3 + 3 + 8 + 3 + 8 + 5 + 3 + 3 + 4, and the sum is pinned exactly.
   • query-number 9, canonical-query 4, meta-draft 8:
     • The module has 0 Number / parseInt / parseFloat tokens and no unary plus. The body reads its two path parameters as strings.
     • It has 0 query: slot lines (by querySlots' own regex) and 0 draft tokens.
     • Each new floor is 0, and each sum is unchanged.
   • dogfood realtime tripwires: both probe regexes read 0 on each of the eleven files.

7. scripts/check-route-envelope.mjs is re-pointed, not loosened: right.

   • The gate's diff is +31 / −2. The two removed lines are the rest-server.ts row's two numbers, 16 and 14, now 15 and 13, each with a "NOT progress — the same MOVE" history comment. The rest is one new MODULES entry and its comment. No rule or other entry changes.
   • Counted on the module by scanSource's own rules, over its two .json( calls:
     • :165, res.json(view): the argument is not an object literal, so it counts toward neither dialect;
     • :167, the 501 body with a string-literal error and a top-level code: 'NOT_IMPLEMENTED': stringError 1 and siblingCode 1.
     • So both counts are 1, as declared.
   • rest-server.ts loses exactly those two .json( lines, and the stub has none. So its row drops by exactly 1 and 1.
   • Both sums hold, read off the head's table:
     • stringError: 15 + 13 + 8 + 1 + 0 + 0 + 0 + 0 + 1 + 0 + 1 = 39;
     • siblingCode: 13 + 15 + 8 + 9 + 4 + 1 + 0 + 0 + 3 + 0 + 1 = 54.
   • auditDialectOnly requires each count to equal its pin and reds in both directions. So the pins are as tight as before.
   • The new entry is dialectOnly with ratchet #9559, like the nine moved modules before it.
   • The module matches discover()'s *-routes.ts convention, so an undeclared one reds NOT DECLARED (the dev's red-before reading). A MODULES declaration also takes the file out of the express-writer walk (discoverExpressRoutes), so no EXPRESS_RESPONSE_MODULES entry is owed.
   • Lint · docs & code guards and Lint & Repo Gates concluded success.

8. The readers left untouched read no moved line: right.

   • Line citations: the tree holds 51 rest-server.ts:NNNN citations outside released CHANGELOG text. None falls in a moved range (base :260–:299, :8284–:8374).
   • ADR anchors: neither moved range cites an ADR-NNNN, so no anchor is owed. packages__rest__src__rest-server.ts.json names no moved token. No ADR names registerUiEndpoints or the alias; every ADR hit on the search terms is a ui/view.zod.ts path.
   • packages/spec:
     • liveness/rest_api.json :49 cites rest-server.ts#registerRoutes for the if (this.config.api.enableUi) gate. That line did not move (head :4771).
     • No liveness evidence string quotes a moved line. The probe strings uiPath, UI View resolution, isScoped = basePath.includes and routeEnvironmentId each read 0 there.
     • protocol.zod.ts (5) and protocol.test.ts (7) name the alias as packages/rest's, never by file. So they stay true.
   • The platform checklist: the only item that names both rest-server.ts and a search term is access-security.json item 14. Its hit is the path src/ui/views, and its anchor is #registerFormEndpoints. No checklist anchor names the UI registrar or the alias.
   • Every other mention of registerUiEndpoints is one of the 13 diff files, or prose that names the method without a file: authz-conformance.matrix.ts :20, authz-conformance.test.ts :181 / :201, the dogfood census notes, rest-route-ledger.ts :129 and packages/runtime/src/route-ledger.ts :181. The private method still exists and still mounts the route, so each stays true.
   • Other source readers of rest-server.ts read tokens the move does not carry. objectql-slot-consumer-census counts objectQLProvider: 14 in rest-server.ts at both, 0 in the moved body. The test that names the UI route and the ownership guard (rest-exec-ctx-principal-kind.test.ts :308) does so in a comment and drives the route at runtime.
   • Gates that walk packages/rest/src still reach the moved code in its new file.
   • Pre-existing stale prose, moved verbatim: two items, none of them read by a gate (③ items 2 and 3).

② Semver level

• skip-changeset is right. Nothing a released package publishes changes.
  • @objectstack/rest:
    • The .d.ts and the export list hold by construction (① items 4 and 5).
    • The routes and their registration order hold by the move (① item 1).
    • The bundle's code is reorganised (the moved function and its .call), with no change to any behaviour, export, type or route. So there is nothing for a changelog to say.
  • The rest of the diff:
    • tests, including @objectstack/dogfood's (a private package);
    • the test-side registrar list, which src/index.ts does not reach;
    • comments;
    • one gate's target table.
  • The one runtime difference is the handler's this. It is now the host literal, not the server. The body reaches the server only through the six handed members, and each method forwards to the server. A stack trace gains one forwarder frame, which the execctx census skips by design. No shipped wiring can observe it.
  • A move that changes no behaviour is not a feature or a fix. So no patch changeset is owed. Slices 1–9 landed on the same reading.
• Clause-②: no is right.
  • The door reads req.params.object, req.params.type and, on the scoped mount, req.params.environmentId, as before. What it passes to getUiView is unchanged.
  • No route is added or removed, and no spec key moves.
  • No accept set widens or narrows, so no (narrowing) arm is owed.
  • Line 2 of the PR body carries the line. No changeset exists to carry it a second time.
• The changeset check's history:
  • Check Changeset concluded failure at 16:43:59Z, before the label.
  • skip-changeset was written at 16:49:46Z by objectstack-fleet[bot], the seat's write path.
  • The re-run concluded skipped at 16:49:49Z.

③ Boundary flags

Every dev flag is answered or escalated. The flags come from the PR body's Acceptance notes and from the report's (6220278484) deviations, out_of_scope_findings and open_questions.

1. open_questions[0]: where TransportScopedMetaRequest finally lives. ESCALATED to the seat, non-blocking.
   • Today's home is correct: one declaration, no copy, nothing published moved (① item 4). It is unexpected, because the alias serves the /meta doors and the form doors, not the UI door.
   • This record's reading agrees with the dev's recommendation A: the /meta slice moves it beside its users, or into one small shared module (which ServerScopedDataRequest could share). That is slice 1's ruling A for ServerScopedDataRequest.
   • For the seat: rule it, and name the carry in the /meta slice's claim. Its 12 uses sit in 5 members: registerMetadataEndpointsInner holds 7, the meta helpers metaListSource and serveMetaItemLayered hold 2, and registerFormEndpoints and readFormObjectDefinitions hold 3. So the forms slice is a reader of it too.
2. Acceptance note and out-of-scope finding 1: the moved alias docblock's deixis. Answered: right for a move-only slice. Its "the doors here" and "call sites in this file" describe rest-server.ts, and the // note above it (ui-routes.ts :49–:53) says so. Carried with item 1.
3. Acceptance note: the moved [commit cc837dbfe] comments still read true. Mostly verified. They describe the handler they sit in, and they name execctx-consumer-census.test.ts by file, which still counts this site.
   • Non-blocking, not this slice's: the second comment (ui-routes.ts :134–:136) says "the 52 sites whose very next statement is the shared anonymous floor". The census now pins 46 bare sites, all guarded on the next line. The count was already stale at base, and the comment moved verbatim.
   • For the seat: carry it to the first non-move edit of that comment, as slice 9's record carried the UNDECLARED_WHOLE_NUMBER_PARAM docblock. That docblock is untouched here, as the claim ordered.
4. Acceptance note: objectql-slot-consumer-census.test.ts is not touched. Answered: right (① item 8).
5. Deviation: the "conflict" over exporting the alias in place. Answered: right, and no ruling is owed. Slice 1's step 5 in the landing the claim adopts (6136102437) already rules this exact case: "A type alias moves with the body, because exporting one changes the .d.ts." The claim's .d.ts order and step 5 point the same way.
6. Deviation: the tenancy test's ownership pin. Answered: exact, not a loosening (① item 6).
7. Deviation: the two sliced readings now read ui-routes.ts. Answered: right (① item 6).
8. Deviation: GetUiViewRequest's import name moved, leaving a 2-line pointer. Answered: right (① item 2). It mirrors slice 6's ErrorCode.
9. Deviation: no getter, so a late-binding measurement and a closure ablation stand in for a getter ablation. Answered: right (① item 3).
10. Deviation: nine route configurations, slice 9's eight plus enableUi: false. Answered: the dev's evidence, not re-run. It covers the door's own switch, as the claim asked.
11. Deviation: origin/main moved on after the one merge. Answered: not blocking. CI runs on the merge ref with base 2e1562091c, and Lint & Repo Gates and TypeScript Type Check concluded success there. The five later commits touch none of the 13 files.
12. Out-of-scope findings 2 and 3: packages/spec readers and file-less prose. Answered: verified (① item 8). No packages/spec file is edited, as the claim ordered. docs/audits/2026-06-handwritten-docs-accuracy-followups.md cites rest-server.ts:2603-2612, outside both moved ranges.
13. Out-of-scope finding 4: the Tier H carries (docs/adr/0076-…, 0111-…, 0138-…). Answered: unchanged by this slice (① item 8).
14. The other deviations are not contract matters: the two void first attempts (both restored with blob proof), the harness smoke outside the lock, the lock's batch-last-exit line, the comparison worktree, the commit trailers and footer, and the scratch and cleanup notes.
15. Cross-lane: the one cross-lane file is the gate (domain:spec). Its declaration 6220378958 on [PM seat] domain:spec — 🟢 os-elon-musk · session_01HjR8RUwTPQ3TgbfKihmxp9 #6017 (16:50:26Z) came before this review. It states the counts this record re-counted, and no objection follows it on [PM seat] domain:spec — 🟢 os-elon-musk · session_01HjR8RUwTPQ3TgbfKihmxp9 #6017 at read. The dogfood files are this lane's, re-pointed as in slices 3–9. No checklist file is touched.
16. The dogfood pair has no PR-time verdict.
    • The sharded Dogfood Regression Gate leg and Dogfood Verify CLI skipped. The aggregate Dogfood Regression Gate concluded success.
    • The edits are attested by the dev's local run (108 passed) and by the static recount in ① item 6.
    • Not blocking, by CI's design. The seat watches main's first full battery, as for slices 4–9.
17. The Docs Drift Check (advisory) lists 19 hand-written pages and 5 release-owned pages. The routes, their order and each handler's logic are unchanged, so this move can falsify none of them.
18. PR shape:
    • The PR is a draft with base main.
    • Line 1 is Part of #23050 and line 2 is Clause-②: no.
    • The body has no closing keyword, and Part-of PR must not also close its card concluded success.
    • The assignee is os-tesla. The labels are size/m, tests and skip-changeset.
    • Marking it ready is the seat's act.
19. Tier: the file list derives TIER_DEFAULT. That is the tier this record serves, as the claim promised.
20. Gate verdicts on this head. There are 44 runs over 40 names. Taking the latest run per name: 28 success, 9 skipped, 0 failure, 3 in progress.
    • The one superseded failure is the pre-label Check Changeset (②).
    • The 9 skips are Auto Label, Check PR Size and Check Changeset (their label-event re-runs), Build Docs, Console Pin Gate, Dogfood Regression Gate (matrix), Dogfood Verify CLI, Packed-tarball smoke (opt-in) and Temporal Conformance (live PG + MySQL).
    • The successes include:
      • Build Core, and Test Core 1/6, 5/6 and 6/6;
      • TypeScript Type Check and the four Type Check · lanes;
      • all eight Lint · lanes and Lint & Repo Gates;
      • Spec property liveness and Governed Surface Queue Guard;
      • both No other open PR may claim … checks and The card this PR closes must claim this branch.
    • In progress at read: Test Core (2/6), Test Core (3/6) and Test Core (4/6). Test Core is a required context. The seat re-reads all three before landing.

Implemented-by: claude/issue-23050-s10-ui-endpoints
Reviewed-by: session_018t6a5rvqPRvEDMCVVW9kYT

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · #23050 slice 10 (UI view) · domain:cli seat 2 · os-tesla · session session_018t6a5rvqPRvEDMCVVW9kYT · 2026-10-16T17:09Z · reviewed head 5da02e4b97d67a88a6a47f766613e51c1a12bc61, against GitHub and the branch, not against the report's prose. Holder of claim 6218443248; report 6220278484 on #23050.

1. Shape.
   • Draft, base main, assignee os-tesla.
   • Line 1 is Part of #23050, so the card stays open for later slices. Line 2 is Clause-②: no.
   • 13 files, +347 / −130.
   • check-governed-merges --pr 23990: NOT governed (0 of 13 paths); 477 changed lines.
   • git merge-tree is clean against origin/main 2e1562091c. The two files main changed under packages/qa since the merge base read no rest-server.ts.
2. Move-only, read by this seat on the git objects.
   • Base rest-server.ts :8314–:8373 (60 lines), with one 4-space indent removed from each non-empty line, equals head ui-routes.ts :118–:177. diff exits 0, and both sides have md5 abcef414….
   • The TransportScopedMetaRequest block, base :260–:299 (40 lines), equals head ui-routes.ts :54–:93 once its added export is set aside. It is still one declaration.
   • The stub (head :8280–:8294) hands over six members: routeManager by value and five methods as late-bound closures.
   • packages/rest/src/index.ts is untouched. The dev measured dist .d.ts / .d.cts byte-identical to base (sha256 7489de84…), with export lists of 39 each. Exporting the alias in place measured a82fe845…, so the alias moved with the body, by slice 1's step 5 (6136102437).
3. The review is the ## Contract review record 6220613093 on this PR.
   • It was served at TIER_DEFAULT (the declaration face; record-recognisers --paths over the 13 paths derives it), isolated and read-only.
   • It is PASS on this head.
   • It finds the ui-view tenancy pin's split into "forwarders" and "call sites" exact, not a loosening.
4. Changeset: none. This seat applied skip-changeset on its own check: no .changeset file is touched, and the published surface is byte-identical (item 2).
5. Gates, pinned to the head. Check-runs on 5da02e4b97 read at this stamp, latest run per name: 41 names, 32 success, 9 skipped, 0 failure, nothing running.
   • The successes include Build Core, Test Core 1–6/6, TypeScript Type Check and the four Type Check · lanes, all eight Lint · lanes, Lint & Repo Gates, Spec property liveness, Governed Surface Queue Guard and the aggregate Dogfood Regression Gate.
   • The 9 skips are roster names: Build Docs, Console Pin Gate, Dogfood Regression Gate (matrix), Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance, and the label-event re-runs of Auto Label, Check PR Size and Check Changeset. The first Check Changeset run, before the label, was the expected red.
   • The dev's local subset at this head: 79 of 79 derived gate commands exit 0 (--ran: 0 NOT-MEASURED, 0 UNRUN). @objectstack/rest local: 5902 passed; repo: 250 passed. Typecheck exit 0. The dogfood pair: 108 passed. Eslint over the 13 files: 0 errors, 0 warnings.
6. Cross-lane, declared before review: scripts/check-route-envelope.mjs, on domain:spec's post (6220378958).
   • The new module is at 1 / 1: the one 501 NOT_IMPLEMENTED body.
   • rest-server.ts goes 16 → 15 and 14 → 13, and both sums hold at 39 and 54.
   • The dogfood files are this lane's. packages/spec is not touched.
7. Accepted deviations:
   • the alias moved with the body (item 2);
   • GetUiViewRequest's import moved with its one reader, leaving a 2-line pointer, as slice 6 did for ErrorCode;
   • route identity used 9 configurations: slice 9's 8 plus enableUi: false;
   • there is no getter, so a late-binding measurement with a closure ablation stands in for the getter ablation;
   • origin/main moved after the one merge, through five commits that touch none of the 13 files.

Seat ruling on the open question (where TransportScopedMetaRequest lives): A.

• The /meta slice moves the alias next to its users, or into one small shared module that ServerScopedDataRequest may share. That slice re-points every import.
• Until then the alias stays in ui-routes.ts with its note. The forms slice runs first, and imports it from ui-routes.ts as rest-server.ts does now.
• This matches slice 1's ruling A for ServerScopedDataRequest. The move is d.ts-neutral, as this slice measured.
• 承接者: the /meta slice's claim names this carry.

Carried, not edited here. A new head would need a new review, even for text that is only comments.

• The moved [commit cc837dbfe] comment (ui-routes.ts :134–:136) says "the 52 sites". The execctx census now pins 46 bare sites. It was already stale at base and moved verbatim. 承接者: the first non-move edit of that comment, which this lane owns, as slice 9 carried UNDECLARED_WHOLE_NUMBER_PARAM's docblock.
• The alias docblock's "the doors here" and "this file" still mean rest-server.ts, and the // note above it says so. It travels with the ruling above.

Landing: pr_ready + automerge_enable through the relay, in this act.

• On landing the card stays with this seat for its next slice (forms), by the lane's order.
• This seat watches main's first full battery after the landing for the dogfood pair, as for slices 4–9.

---

Generated by Claude Code