finding: two code comments still say 26 shared AUTHORING_RULES — the live registry has 38

[claude]

Filed by the triage seat Routine (#5474 pilot) as the spin-off named in the 01:18Z round brief on #6015, so the verified fact does not die with PR #7483's body. Unassigned — recording, not claiming.

The drift

packages/lint/src/authoring-rules.ts exports the shared AUTHORING_RULES registry (declaration at :371 on origin/main @ 7e93c89d); it currently holds 38 rule entries (count of name: fields in the array literal).

Two code comments still describe the registry as having 26 entries:

site	text (verbatim fragment)
packages/objectql/src/plugin.ts:76	"runs the #4463 runtime authoring rules (the 26 shared AUTHORING_RULES that os validate / os lint run)"
packages/metadata-protocol/src/protocol.ts:2632	"so the whole #4463 gate — all 26 shared AUTHORING_RULES"

(The protocol.ts anchor was :2632 at verification time — an earlier readout recorded :2542; the file has drifted since.)

Why it matters (and why it is only a finding)

Nobody hits this at runtime — both sites are prose inside comments. But both comments are load-bearing guidance about what the #4463 publish gate covers, and a hand-written count in two files has already gone stale once and will again. The mechanical fix is to drop the number or phrase it as "the shared AUTHORING_RULES" (or reference AUTHORING_RULES.length where prose permits).

Routing note (deliberate leave-blank)

⛔ No domain:* applied: the two comment edits land in packages/objectql (domain:engine-core) and packages/metadata-protocol (domain:metadata) — a two-domain landing for a two-line prose fix, below contract-first splitting cost. Left unrouted by the triage seat on purpose; named in the round brief. A lane picking this up alongside adjacent work in either file can take both lines in one PR.

---

Generated by Claude Code

[os-zhuang]

Routing repair + cadence re-check (@ origin/main 1530870): appended domain:metadata — the finding grade is unchanged, no ownership taken.

• Routing rationale (resolves the earlier leave-blank): every stale "26" site lives in packages/metadata-protocol — src/protocol.ts:2632 and :3011, plus src/protocol.platform-schedule-org-gate.test.ts:545 and :567 — so the fix lands in one package ⇒ domain:metadata by the lane table. The registry itself (packages/lint/src/authoring-rules.ts:371) needs no edit; de-numbering or re-counting happens at the comment sites only.
• Premise re-verified, and the drift has widened: live registry counts 38 rows; the stale "26" mentions are now 4 code sites (the card filed 2). Still comment-only, nothing behavioral — HOLD stands; natural one-liner for a sweep pack in this lane.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings cadence re-check @ origin/main 4ed4160: HOLD — finding stands; domain:metadata kept as principal landing; one correction to the 05:11Z routing comment's rationale.

Correction (public readout, publicly corrected): the 05:11Z comment's claim that "every stale 26 site lives in packages/metadata-protocol" is wrong — packages/objectql/src/plugin.ts:76 still reads "the 26 shared AUTHORING_RULES" on today's main (it was in the card's own original table), plus packages/objectql/src/plugin.authoring-channel.test.ts:21 ("all 26 shared"). The label outcome (domain:metadata) survives the correction — see inventory — but the single-package premise it rested on does not.

Re-measured inventory (registry-count sites only, CHANGELOGs excluded as immutable history): live registry = 38 rows (name: count inside the AUTHORING_RULES literal at authoring-rules.ts:371). Stale "26"-as-rule-count prose: protocol.ts:2698, :3077, runtime-authoring-gate.ts:133, :435, platform-schedule-org-gate.test.ts:545, :567, runtime-authoring-gate.test.ts:288 (all metadata-protocol), plus the two objectql sites above — 9 sites, two packages, up from the card's 2 and the 05:11Z comment's 4.

⚠️ Scope trap for whoever takes this: the ~12 test-file headers repeating "which is why all 26 …" refer to "all 26 of this package's (file, verb) pairs" (see protocol.save-flow-canonicalization.test.ts:25 for the full sentence) — a different 26, not the rules registry. Do not blanket-edit the boilerplate; verify each site's referent.

Disposition: still comment-only, nothing behavioral — HOLD. The fix prescription upgrades from "two one-liners" to a small de-numbering sweep (drop the count or phrase as "the shared AUTHORING_RULES"), majority of sites in metadata-protocol ⇒ domain:metadata stays; the two objectql lines are below splitting cost and ride the same PR (cross-lane prose, no contract face).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (PM session, maintainer-directed: 「跑一轮集中定级」).

Graded: promote. Two comments teaching "26 shared AUTHORING_RULES" against a live registry of 38 is prose actively misinforming the next reader about gate coverage. S; re-anchor line numbers by grep before editing, per the card's own note.

finding → pm:queue (domain:metadata).

---

Generated by Claude Code

[huangyiirene]

Deferred at batch selection (round 1, domain:metadata seat) — recording the traps rather than just pushing it to a later round. Stays pm:queue, unassigned, dispatchable by whoever clears the two conditions below.

Why deferred — two independent blockers, not one:

1. packages/metadata-protocol/src/protocol.ts is serialized and currently held. PR fix(metadata-protocol): listCommits no longer hides env-wide commit history (#7779) #7814 (listCommits misses env-wide sys_metadata_commit rows — same strict organization_id equality #7705 fixed one function away #7779) holds it for listCommits and is in the landing window. Behind it this seat's hot-file queue runs Four more strict organization_id equalities left in protocol.ts — two measured (revertCommit / rollbackToPackageCommit), two unverified (duplicatePackage / reassignOrphanedMetadata) #7819 → A Studio-saved form authored with groups still degrades on the REST public-form routes — the producer fold does not reach stored rows #7134 → [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716. A two-line comment edit is not worth entering that queue out of order, and protocol.ts took six merges in one day — so the :2632 anchor in this card is already presumed stale (the card itself records it drifting from :2542). Re-anchor by grepping the comment text, not the line number.
2. It is a genuine two-domain landing. packages/objectql/src/plugin.ts:76 is domain:engine-core; only the metadata-protocol line is this seat's. The triage seat deliberately left it unrouted for exactly this reason, and a domain:metadata label has since been applied — which does not grant this seat the objectql line. Either it goes as a cross-domain exception designated by the triage seat, or a lane already inside one of those two files takes its own line.

⚠️ The trap worth naming, because it is the card eating itself: the fix must not be "change 26 to 38". The count is 38 as measured at 7e93c89d; AUTHORING_RULES grows, and writing a fresh hand-maintained number reproduces the exact defect this card records — it just resets the clock. The card's own prescription is the right one: drop the number, or phrase it as "the shared AUTHORING_RULES", or reference AUTHORING_RULES.length where prose allows. Whoever implements this should not re-derive the count at all — needing to know it is the smell.

---

Generated by Claude Code