plugin-grid's local EXPLAIN_BATCH_MAX_RECORD_IDS has reached its own stated expiry — the spec pin now exports the constant

[yinlianghui-tw]

Found while taking the measurement for #5899 (see PR #6284 for the full population). Filed unassigned as an observation, for PM triage. Not fixed there — out of that card's scope.

The situation

packages/plugin-grid/src/hooks/useRecordCrudVerdicts.ts:74 declares the server's batch cap locally, and its own doc comment states the condition under which it should stop existing:

Declared locally because the pinned @objectstack/spec@17.0.0-rc.6 predates the batch form and exports neither the constant nor the request/response types; the pin bump (objectui#4636) supersedes this declaration.

const EXPLAIN_BATCH_MAX_RECORD_IDS = 200;

That condition has been met. The tree's pin is now @objectstack/spec@17.2.0, and @objectstack/spec/security exports:

declare const EXPLAIN_BATCH_MAX_RECORD_IDS = 200

Verified by resolving the installed package and reading the export, not by reading the changelog.

Why it matters, and why it is not urgent

The values agree today, so nothing is broken right now. What is broken is the guarantee: this is a hand copy of a server contract constant whose whole point is that over-cap requests are refused with 400 VALIDATION_FAILED rather than truncated. If the server relaxes or tightens the cap and the spec follows, the local 200 keeps the client paginating at the old boundary with no signal anywhere — a faithful copy passes every value comparison, which is the reference-identity argument scripts/check-spec-symbol-derivation.mjs's own header makes.

The declaration is also self-documenting about this: it does not claim to be canonical, it claims to be temporary. It has simply outlived the reason.

Why nothing caught it

check-spec-symbol-derivation.mjs rule 1 flags a local symbol declared under a name the spec exports — which is exactly what this is, now that the spec exports the name. It could not see it: both scanners skip non-exported declarations, and this const is module-local. That hole is #5899's subject.

Fix shape

Import the constant from @objectstack/spec/security and delete the local declaration (keeping the useful half of the comment — why the cap exists and what the server does with an over-cap request). Worth checking whether the request/response types the same comment mentions are now exported too, and whether WireRecordVerdict just below it can go the same way.

Measured on a76b18cf2 against @objectstack/spec@17.2.0.

Related: #5899 (the instrument hole that hid it), PR #6284 (the census), #4636 (the pin bump this declaration named as its own successor).

[yinlianghui-tw]

Triage: pm:queue + domain:ui, Task, S — the local declaration's own expiry condition is met (spec pin 17.2.0 exports EXPLAIN_BATCH_MAX_RECORD_IDS), so this is the declaration's stated successor arriving, not a judgement call. Fix per the card: import from @objectstack/spec/security, delete the local const, keep the why-the-cap-exists half of the comment. In the same pass check the two riders the card names — whether the batch request/response types are now exported (adopt if so) and whether WireRecordVerdict can go the same way; each is adopt-or-report-why-not, no third option.

---

Generated by Claude Code

[os-support-ai]

Claim: PM loop round R1 (wave 4)
Session: session_011SfZeFWrhGLHmfq61xbz4q
Branch: claude/issue-6286-explain-batch-cap-from-spec
Worktree: objectui-issue-6286
Domain: domain:ui
File surface: packages/plugin-grid/src/hooks/useRecordCrudVerdicts.ts + its tests (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: opus
Clause-②: no — a module-local hand copy of a server contract constant starts being imported from the package that owns it. The value does not change, no accept set moves, no public surface widens.
Serial constraints cleared: packages/plugin-grid is free — no open PR touches it (checked by changed-file list, ⛔ not by title; the four open PRs from this round are on renderers/action/, plugin-designer + app-shell, plugin-gantt, and examples/schema-catalog + apps/site). In-flight siblings this wave are packages/fields/src/widgets/ (#6285), packages/components/src/renderers/overlay/ (#6278) and app-shell/.../inspectors/ (#6287) — all disjoint.

⚠️ Selection note, recorded because it departs from the standing Bug-first order. The maintainer's standing instruction is 「本车道应该优先处理bug」. This card is a Task, and it is being dispatched anyway because the lane's graded pm:queue Bug tier is empty — all seven were dispatched or routed this round. The Bugs that remain are either pm:blocked (#6272 genuinely blocked on #6154; ⚠️ #6262 / #5926 / #5521 carry no machine-readable Blocked-by: line, which is a half-state for triage) or newly filed and ungraded (#6306 / #6309 / #6317 — ⛔ not claimable, single-producer rule). So this is not a Bug being passed over.

Stale-premise check — run against origin/main, ⛔ not inherited

• ✅ The local declaration is still there: EXPLAIN_BATCH_MAX_RECORD_IDS = 200 in useRecordCrudVerdicts.ts, 1 occurrence.
• ⭐ That count is a reading — control on the same pathspec: 22 const declarations in the file, so the query resolves and the file is where the card says.
• ⚠️ The expiry condition itself is the card's central claim and I have NOT verified it from this seat — the card says the pin moved to @objectstack/spec@17.2.0 and that @objectstack/spec/security now exports the constant, "verified by resolving the installed package and reading the export, not by reading the changelog". I could not re-run that here (no installed node_modules in the PM checkout). ⛔ The dev must re-derive it before touching anything — this is the whole premise, and if the export is absent the card is not actionable.

裁决 (binding)

Import the constant from @objectstack/spec/security and delete the local declaration. The declaration's own doc comment names the condition under which it should stop existing ("the pin bump supersedes this declaration"), and the card's measurement says that condition is met.

⭐ Keep the useful half of the comment — why the cap exists and what the server does with an over-cap request (400 VALIDATION_FAILED rather than silent truncation). ⛔ Delete only the part that explains why it was declared locally, since that is what stops being true.

⛔ Premise fork — stop and report, do not improvise: if the installed spec does not export EXPLAIN_BATCH_MAX_RECORD_IDS, or exports it with a different value, ⛔ do not "fix" the mismatch and ⛔ do not keep the local copy silently. A value disagreement between a client hand-copy and the server contract is a different and more serious card — report it.

PM 机制假设 (verify — rebut freely)

1. The card also suggests checking whether the request/response types the same comment mentions are now exported too. ⭐ If they are, say so and scope it explicitly — folding a type migration into a constant import may be right, but it must be a stated decision, ⛔ not a drift.
2. The card notes check-spec-symbol-derivation.mjs rule 1 would flag exactly this shape (a local symbol under a name the spec exports) but cannot, because both scanners skip non-exported declarations — that hole is finding(tooling): check-spec-symbol-derivation.mjs skips every non-exported declaration, so the #5652 mirrors it was cited to catch were invisible to both rules #5899's subject. ⛔ Do not change the scanner.

Verification

⭐ The two worlds are hard to tell apart here, and that is the whole risk on this card. The values agree today (200 both sides), so any assertion on the value passes before and after — a textbook ghost assertion. What actually changes is reference identity: the client stops being able to drift from the server contract. Pin that: e.g. assert the imported binding is the spec's export (identity/provenance), not that it equals 200. ⛔ If no honest distinguishing assertion is available, say so rather than shipping a ghost dressed as a proof.

⭐ Ablation: revert the import alone; prove the mutation on disk. ⚠️ For a pure deletion-plus-import the honest proof is a before/after count on a single-line marker in each direction — three runs in this lane today had a probe silently no-op while exiting 0 (perl -i -pe matching nothing; grep -cF with a multi-line pattern counting every closing brace). Restore under trap … EXIT INT TERM with absolute paths; git diff HEAD --stat empty afterwards.

⚠️ Repo facts: vitest from the repo root (pnpm exec vitest run PATHS) — ⛔ --filter / cd packages/x hit a guard (objectui#3378) that in one observed form silently ran the wrong package and reported green; sanity-check the reported file/test count against the target's own. vitest's console is silenced here — write results to a file. type-check is hyphenated and runs tsc -p tsconfig.test.json. ⚠️ pnpm lint is turbo run lint (per-package eslint .); eslint.config.js sets no parserOptions.project, so linting is not type-aware. ⚠️ In this environment you cannot read a min() width back off style.width (happy-dom drops the longhand) — unrelated here, but it is the kind of environment fact worth knowing before writing a DOM assertion. Changeset: node scripts/check-changeset-presence.mjs; ⛔ never major.

⭐ Read-channel clause — corrected, use this order

1. git first (free; shallow clone → git fetch --deepen=500 origin before merge-base/A...B).
2. ⭐ UNAUTHENTICATED REST — https://api.github.com/repos/objectstack-ai/objectui/issues/6286 and .../comments?per_page=100. Measured working: 200, complete. ⭐ It also serves check-runs: .../commits/SHA/check-runs?per_page=100. Wrapper: python3 /home/user/pmtools/gh_issue.py 6286 — prints a completeness verdict.
3. ⛔ Rendered HTML page — FALLBACK ONLY, it silently truncates (measured: 15 of 31 timeline items, no error).
4. MCP for writes only, plus the one exempt dedup search before filing a finding.

Deliverables

• ⭐ Your OWN claim comment BEFORE the first edit. Your session id will match the PM's (subagent inside it) — say so explicitly; branch + worktree distinguish the seat. ⛔ Do not touch the assignee.
• Draft PR, first line Fixes #6286. ⛔ Do not mark ready, enqueue, or enable auto-merge.
• Terminal report as an issue comment on plugin-grid's local EXPLAIN_BATCH_MAX_RECORD_IDS has reached its own stated expiry — the spec pin now exports the constant #6286 first, then as your return message. ⛔ HTML-comment markers do not survive this sanitizer — plain-text first line os-dev-report, then the JSON.
• ⭐ Predict each measurement's direction before running it, and report every place you were wrong.

---

Generated by Claude Code

[os-support-ai]

Dev claim — os-dev subagent, dispatched for this card.

• Session: session_011SfZeFWrhGLHmfq61xbz4q — the same id as the PM claim comment above, and that is expected: I run as a subagent inside the PM session, so the session id cannot distinguish the seats. What distinguishes this seat is the branch and worktree below.
• Branch: claude/issue-6286-explain-batch-cap-from-spec (pushed empty at claim time as a write-route probe — HTTP OK)
• Worktree: /home/user/objectui-issue-6286
• Base: 090927f4f3a39ba708dd8a7a0eda2196d4ff79df (freshly fetched origin/main)
• Assignee: untouched, per dispatch.

File surface (as dispatched): packages/plugin-grid/src/hooks/useRecordCrudVerdicts.ts + its tests. Any breach of that surface stops the run and gets explained in the report rather than absorbed.

Order of work, stated up front because the card's premise is the whole risk: re-derive the expiry condition from the resolved package on disk first — @objectstack/spec/security must actually export EXPLAIN_BATCH_MAX_RECORD_IDS, and with value 200. Absent ⇒ card not actionable, report and stop. Present with a different value ⇒ a client/server contract disagreement, which is a different and more serious card — report and stop, do not "fix" it here.

Read-channel: git + unauthenticated REST only for reads; MCP for writes.

---

Generated by Claude Code

[os-support-ai]

os-dev-report
{
"issue": 6286,
"status": "done",
"branch": "claude/issue-6286-explain-batch-cap-from-spec",
"pr": "#6333",
"premise_still_valid": true,
"summary": "Replaced the module-local EXPLAIN_BATCH_MAX_RECORD_IDS = 200 in packages/plugin-grid/src/hooks/useRecordCrudVerdicts.ts with an import from @objectstack/spec/security, keeping the why-the-cap-exists half of the doc comment on the import and dropping only the why-it-was-declared-locally half, per the binding ruling. Premise re-derived on disk from the resolved package before any edit — static (dist/security/index.d.mts re-export list plus declare const EXPLAIN_BATCH_MAX_RECORD_IDS = 200 in the shared chunk) and at runtime through the same specifier the source now uses (typeof number, value 200, control: 43 exported keys). No value disagreement, so the premise fork did not fire. CORRECTION to the card: @objectstack/spec@17.0.0 — not 17.2.0 — is the first release whose ./security exports the constant, measured against the published tarballs of 17.0.0-rc.6 / 17.0.0 / 17.1.0 / 17.2.0 (only the rc lacks it). That is load-bearing, not trivia: plugin-grid declares "@objectstack/spec": "^17.0.0" and scripts/check-spec-range-floors.mjs judges the range MINIMUM against the published artifact, so had 17.0.0 lacked the symbol this PR would have owed a floor bump — and a consumer resolving 17.0.0 would have got undefined, which in i += undefined degrades to one empty request and a silent fail-open for every row rather than a crash. It carries it, so no manifest change was owed and the declared file surface was not breached. Both card riders declined with evidence and filed as #6332 rather than dropped. Two environment corrections for the PM: (1) objectui's skip-changeset label DOES exist (59 labels; it sits on 7 closed PRs) — the standing instruction never to apply it there is correct, but its stated premise that the label does not exist is stale; the repo's own scripts/tests/ci-cd-pipeline-doc.test.ts documents it as auto-minted by being applied (objectui#4912), pins that no workflow or gate reads it, and pins the docs page to keep denying it, which is a stronger reason than the one in the standing text and one an agent who checks and finds the label present would otherwise talk itself out of; (2) the GitHub SEARCH API is blocked for this session ("sessions are bound to their configured repositories"), so the pre-filing dedup search ran as a repository-scoped issue LIST plus local filter.",
"tests": "All final measurements at head db31e5f (final commit), quoting each tool's own verdict line, never a post-pipe $?. [1] vitest, canonical root invocation pnpm exec vitest run packages/plugin-grid: 'Test Files 88 passed (88)' / 'Tests 827 passed (827)'. Changed-file slice: 'Test Files 2 passed (2)' / 'Tests 19 passed (19)' — count sanity-checked against the target's own 15 it( blocks plus my 4. [2] tsc, both projects the hyphenated type-check chains, run from the package dir: SRC_EXIT=0, TEST_EXIT=0. NOT-MEASURED guard: --listFiles confirms the new test is a real program input of tsconfig.test.json (1 hit) and correctly absent from the src project (0 hits), and that the spec declaration the import resolves to is 17.2.0's dist/security/index.d.mts. [3] eslint (plugin-grid's own eslint ., 124 files): 0 errors, 683 warnings, all pre-existing; blind-instrument guard via -f json — the new file was linted (1 entry, 0 errors, 0 warnings). [4] gates derived by enumerating each CI job's own step list, all exit 0: check:spec-symbols ('1305 files scanned against 4959 spec export names'), check:phantom-deps ('Every in-scope import is declared by the package that publishes it'), check:self-import, check:esm-specifiers, check:vi-mock-specifiers ('433 carry a mock; 651 bare (out of scope)'), check:control-bytes ('scanned 5197 tracked text file(s)'), check:pre-install-import-graph, check-changeset-presence ('3 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'), check-lint-coverage ('46/46 packages linted'), check-type-check-coverage ('41/41 packages compile their tests'). spec-range-floors is push+paths (release path), not a per-PR job — the floor question is settled by the tarball measurement above instead. ABLATION: revert the import alone, under trap ... EXIT INT TERM with absolute paths (REPO_ROOT via git rev-parse --show-toplevel). Mutation proved on disk with a single-line marker in EACH direction (restored local decl 0 -> 1; spec import 1 -> 0) plus a blob-hash comparison against the HEAD blob (5065876b -> ff9c2bcc, differs). Result: 4 of 4 FAILED in useRecordCrudVerdicts.batchCap.test.tsx, while all 15 in rowRecordCrudVerdict.test.tsx stayed GREEN — the ghost demonstrated rather than asserted. Restored via the trap and verified byte-exact: git diff HEAD --stat empty and the blob hash back to 5065876b. NO REBUILD NEEDED and the reason is stated rather than assumed: vitest aliases @object-ui/plugin-grid to src/ and the test imports the hook by relative path, so nothing reads plugin-grid/dist; the mutated file is the one the runner executes. The mocked dependency does resolve to node_modules dist, but the mutation does not touch it. PREDICTIONS I GOT WRONG (4, each changed the work): (a) predicted @objectstack/spec@17.0.0 would LACK the constant — it has it; that killed my next prediction, (b) that this PR would owe a floor bump to ^17.2.0 in packages/plugin-grid/package.json — it owes none, which also meant the dispatched file surface was never breached; (c) predicted the first ablation would run 4 of 4 red — it ran 3 of 4, and the survivor was a ghost I had written myself ('exactly cap ids is one request' passes under a cap of 200 as readily as under a cap of 3). Fixed in commit db31e5f by asserting the cap+1 side in the same case; the second ablation is 4 of 4. This is the single most valuable thing the ablation did on this card. (d) predicted spec/dist/security/index.d would DROP OUT of plugin-grid's src tsc program when ablated, and offered it as a second provenance signal — it does not drop out (still 1), because packages/types/dist/index.d.ts carries export type * as Security from '@objectstack/spec/security'. A degenerate control; it is labelled as such in the PR body and offered as evidence of nothing. GHOST DISCLOSURE, stated plainly as instructed: no assertion on the VALUE can distinguish the two worlds here, so none is offered as proof. The honest distinguishing assertion available in this codebase is behavioural reference identity — stand the spec module in at a cap of 3 via vi.mock(...importOriginal) and assert the request chunking follows it, which no hand copy of 200 can produce. Because check-vi-mock-specifiers.mjs judges RELATIVE specifiers only (its own verdict counts this one among '651 bare (out of scope)'), an inert bare-specifier mock has no gate, so the file carries a control case asserting the factory ran and that the stub differs from the shipped value. The pre-existing cap assertion in rowRecordCrudVerdict.test.tsx now derives its fixture and bound from the same export instead of re-typing 200/250 — a cleanup, explicitly NOT a two-world assertion, and the ablation says so. PRE-EXISTING RED, reported so a cold reader is not misled: both tsc projects fail with TS2307 on @object-ui/types / @object-ui/i18n until pnpm --filter '@object-ui/plugin-grid^...' build is run in a fresh worktree. Unrelated to this change (the errors are in files it does not touch).",
"open_questions": [],
"out_of_scope_findings": [
"filed as #6332: useRecordCrudVerdicts still hand-shapes the explain request/response — the spec exports ExplainRequest and ExplainDecision but no standalone batch records[] entry type (ExplainRecordAttribution is the layer-level attribution, a different thing), and adopting the response type would turn the hook's fail-open guards into type-level dead code; the contract-first move is ExplainDecisionSchema.safeParse, which is a behaviour change needing its own card. Labelled finding + domain:ui, no pm:queue, no assignee. Dedup: repository-scoped list of 243 open issues (control: 250 items including 7 PRs) filtered locally on WireRecordVerdict/ExplainRequest/ExplainDecision/useRecordCrudVerdicts — 1 hit, #6286 itself."
]
}

---

Generated by Claude Code

[os-support-ai]

os-dev-report

{
  "issue": 6286,
  "status": "done",
  "branch": "claude/issue-6286-explain-batch-cap-from-spec",
  "pr": "https://github.com/objectstack-ai/objectui/pull/6333",
  "premise_still_valid": true,
  "summary": "Replaced the module-local `EXPLAIN_BATCH_MAX_RECORD_IDS = 200` in packages/plugin-grid/src/hooks/useRecordCrudVerdicts.ts with an import from `@objectstack/spec/security`, keeping the why-the-cap-exists half of the doc comment on the import and dropping only the why-it-was-declared-locally half, per the binding ruling. Premise re-derived on disk from the resolved package before any edit — static (dist/security/index.d.mts re-export list plus `declare const EXPLAIN_BATCH_MAX_RECORD_IDS = 200` in the shared chunk) and at runtime through the same specifier the source now uses (typeof number, value 200, control: 43 exported keys). No value disagreement, so the premise fork did not fire. CORRECTION to the card: @objectstack/spec@17.0.0 — not 17.2.0 — is the first release whose ./security exports the constant, measured against the published tarballs of 17.0.0-rc.6 / 17.0.0 / 17.1.0 / 17.2.0 (only the rc lacks it). That is load-bearing, not trivia: plugin-grid declares \"@objectstack/spec\": \"^17.0.0\" and scripts/check-spec-range-floors.mjs judges the range MINIMUM against the published artifact, so had 17.0.0 lacked the symbol this PR would have owed a floor bump — and a consumer resolving 17.0.0 would have got undefined, which in `i += undefined` degrades to one empty request and a silent fail-open for every row rather than a crash. It carries it, so no manifest change was owed and the declared file surface was not breached. Both card riders declined with evidence and filed as #6332 rather than dropped. Two environment corrections for the PM: (1) objectui's `skip-changeset` label DOES exist (59 labels; it sits on 7 closed PRs) — the standing instruction never to apply it there is correct, but its stated premise that the label does not exist is stale; the repo's own scripts/__tests__/ci-cd-pipeline-doc.test.ts documents it as auto-minted by being applied (objectui#4912), pins that no workflow or gate reads it, and pins the docs page to keep denying it, which is a stronger reason than the one in the standing text and one an agent who checks and finds the label present would otherwise talk itself out of; (2) the GitHub SEARCH API is blocked for this session (\"sessions are bound to their configured repositories\"), so the pre-filing dedup search ran as a repository-scoped issue LIST plus local filter. FORMATTING NOTE: this comment re-posts issue comment 5410976937 unchanged except for this sentence, in the fenced house shape used by every other os-dev-report comment sampled in this repo (5 of 5: #6278, #6075, #6167, #6259, #5306). The first copy was un-fenced, and the MCP comment path appends a 'Generated by Claude Code' footer to every report body, so an un-fenced payload breaks a parser that does json.loads on everything after the marker line. This copy is the canonical one.",
  "tests": "All final measurements at head db31e5fe9 (final commit), quoting each tool's own verdict line, never a post-pipe $?. [1] vitest, canonical root invocation `pnpm exec vitest run packages/plugin-grid`: 'Test Files 88 passed (88)' / 'Tests 827 passed (827)'. Changed-file slice: 'Test Files 2 passed (2)' / 'Tests 19 passed (19)' — count sanity-checked against the target's own 15 `it(` blocks plus my 4. [2] tsc, both projects the hyphenated `type-check` chains, run from the package dir: SRC_EXIT=0, TEST_EXIT=0. NOT-MEASURED guard: `--listFiles` confirms the new test is a real program input of tsconfig.test.json (1 hit) and correctly absent from the src project (0 hits), and that the spec declaration the import resolves to is 17.2.0's dist/security/index.d.mts. [3] eslint (plugin-grid's own `eslint .`, 124 files): 0 errors, 683 warnings, all pre-existing; blind-instrument guard via `-f json` — the new file was linted (1 entry, 0 errors, 0 warnings). [4] gates derived by enumerating each CI job's own step list, all exit 0: check:spec-symbols ('1305 files scanned against 4959 spec export names'), check:phantom-deps ('Every in-scope import is declared by the package that publishes it'), check:self-import, check:esm-specifiers, check:vi-mock-specifiers ('433 carry a mock; 651 bare (out of scope)'), check:control-bytes ('scanned 5197 tracked text file(s)'), check:pre-install-import-graph, check-changeset-presence ('3 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'), check-lint-coverage ('46/46 packages linted'), check-type-check-coverage ('41/41 packages compile their tests'). spec-range-floors is push+paths (release path), not a per-PR job — the floor question is settled by the tarball measurement above instead. ABLATION: revert the import alone, under trap ... EXIT INT TERM with absolute paths (REPO_ROOT via `git rev-parse --show-toplevel`). Mutation proved on disk with a single-line marker in EACH direction (restored local decl 0 -> 1; spec import 1 -> 0) plus a blob-hash comparison against the HEAD blob (5065876b -> ff9c2bcc, differs). Result: 4 of 4 FAILED in useRecordCrudVerdicts.batchCap.test.tsx, while all 15 in rowRecordCrudVerdict.test.tsx stayed GREEN — the ghost demonstrated rather than asserted. Restored via the trap and verified byte-exact: `git diff HEAD --stat` empty and the blob hash back to 5065876b. NO REBUILD NEEDED and the reason is stated rather than assumed: vitest aliases @object-ui/plugin-grid to src/ and the test imports the hook by relative path, so nothing reads plugin-grid/dist; the mutated file is the one the runner executes. The mocked dependency does resolve to node_modules dist, but the mutation does not touch it. PREDICTIONS I GOT WRONG (4, each changed the work): (a) predicted @objectstack/spec@17.0.0 would LACK the constant — it has it; that killed my next prediction, (b) that this PR would owe a floor bump to ^17.2.0 in packages/plugin-grid/package.json — it owes none, which also meant the dispatched file surface was never breached; (c) predicted the first ablation would run 4 of 4 red — it ran 3 of 4, and the survivor was a ghost I had written myself ('exactly cap ids is one request' passes under a cap of 200 as readily as under a cap of 3). Fixed in commit db31e5fe9 by asserting the cap+1 side in the same case; the second ablation is 4 of 4. This is the single most valuable thing the ablation did on this card. (d) predicted `spec/dist/security/index.d` would DROP OUT of plugin-grid's src tsc program when ablated, and offered it as a second provenance signal — it does not drop out (still 1), because packages/types/dist/index.d.ts carries `export type * as Security from '@objectstack/spec/security'`. A degenerate control; it is labelled as such in the PR body and offered as evidence of nothing. GHOST DISCLOSURE, stated plainly as instructed: no assertion on the VALUE can distinguish the two worlds here, so none is offered as proof. The honest distinguishing assertion available in this codebase is behavioural reference identity — stand the spec module in at a cap of 3 via vi.mock(...importOriginal) and assert the request chunking follows it, which no hand copy of 200 can produce. Because check-vi-mock-specifiers.mjs judges RELATIVE specifiers only (its own verdict counts this one among '651 bare (out of scope)'), an inert bare-specifier mock has no gate, so the file carries a control case asserting the factory ran and that the stub differs from the shipped value. The pre-existing cap assertion in rowRecordCrudVerdict.test.tsx now derives its fixture and bound from the same export instead of re-typing 200/250 — a cleanup, explicitly NOT a two-world assertion, and the ablation says so. PRE-EXISTING RED, reported so a cold reader is not misled: both tsc projects fail with TS2307 on @object-ui/types / @object-ui/i18n until `pnpm --filter '@object-ui/plugin-grid^...' build` is run in a fresh worktree. Unrelated to this change (the errors are in files it does not touch).",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #6332: useRecordCrudVerdicts still hand-shapes the explain request/response — the spec exports ExplainRequest and ExplainDecision but no standalone batch records[] entry type (ExplainRecordAttribution is the layer-level attribution, a different thing), and adopting the response type would turn the hook's fail-open guards into type-level dead code; the contract-first move is ExplainDecisionSchema.safeParse, which is a behaviour change needing its own card. Labelled `finding` + `domain:ui`, no pm:queue, no assignee. Dedup: repository-scoped list of 243 open issues (control: 250 items including 7 PRs) filtered locally on WireRecordVerdict/ExplainRequest/ExplainDecision/useRecordCrudVerdicts — 1 hit, #6286 itself."
  ]
}

---

Generated by Claude Code