core: `PluginStartupResult.startTime` carries an elapsed duration, and the spec contract for the same result declares it as `duration`

[os-sales]

Filed bare by the domain:spec execution seat — ⛔ no domain:* applied, that label has a single producer. The fix lands in packages/core, not in packages/spec, so routing is triage's call.

All readings taken against origin/main at 2026-09-05T09:09Z (⛔ not a working tree).

The defect

packages/core/src/plugin-loader.ts:91-95 declares:

export interface PluginStartupResult {
    success: boolean;
    pluginName: string;
    startTime?: number;
    ...
}

packages/core/src/kernel.ts assigns an elapsed duration into that field, on both the success and the failure path:

// kernel.ts:674
const startTime = Date.now();
...
// kernel.ts:685, 697
const duration = Date.now() - startTime;
...
// kernel.ts:694 (success), :704 (failure)
startTime: duration,

So a field named startTime never holds a start time. It holds milliseconds elapsed. This is not an ambiguous name that a reader has to look up — the name asserts the opposite of the value, which is the one failure mode a unit convention cannot rescue, because a reader who correctly assumes startTime is an instant will do arithmetic on it and get a number near the epoch.

It propagates one hop further: kernel.ts:69 private pluginStartTimes: Map<string, number> is fed the same duration at :687, and the map is handed out at :540 by getPluginMetrics().

What makes this more than a naming nit

The same file family already has the right name for this measure, and uses it correctly. Twelve lines above the defect, plugin-loader.ts:85 declares loadTime?: number, and :182 assigns loadTime: Date.now() - startTime — the identical computation, under a name that does not lie.

And the spec contract for this very result does not have the key at all. packages/spec/src/kernel/startup-orchestrator.zod.ts — the contract PluginStartupResult maps to, per packages/spec/api-surface/contracts.json:218 and the PluginStartupResult → kernel/startup-orchestrator.zod rows in the package CHANGELOGs — declares:

:149   duration: z.number().min(0).describe('Time taken to start the plugin in milliseconds')
:196   totalDuration: z.number().min(0).describe('Total time taken for all plugins in milliseconds')

The contract says duration. The implementation ships startTime holding that same duration. This is a declared ≠ enforced divergence between packages/core and the packages/spec contract it implements, and the divergence is the root cause — the name did not drift on its own, it drifted away from a contract that was already correct.

Blast radius, measured

• PluginStartupResult is exported from packages/core/src/plugin-loader.ts, so startTime is public type surface.
• Producers/consumers of the value, whole-repo (git grep over packages apps examples): kernel.ts:371 is the only call site of startPluginWithTimeout, and there are no readers of getPluginMetrics() or pluginStartTimes outside packages/core/src/kernel.ts. That zero is reverse-checked — the same search returns four live hits for PluginStartupResult itself, so the search reaches.
• Practical effect: the rename is contained inside packages/core, with the public type surface being the part that needs an ADR-0087 disposition rather than a silent edit.

Suggested shape (not a dispatch)

Align the implementation with the contract it already has: the elapsed measure is duration (or a unit-bearing name, if the convention landing in #14478 settles on one), the tombstone/retirement handled per ADR-0087 for the exported type, and pluginStartTimes / getPluginMetrics() renamed to say what they return.

Relationship to #14478 — read this before merging the two

This was surfaced while verifying the #14478 stack, and it is adjacent to that epic, not inside it:

• spec: duration-shaped number keys carry their unit in describe prose only — two ttl keys with different units in one block, bare timeout keys, unit-less tenant timeouts #14478's gate check:duration-unit-keys scans packages/spec/src/**, so it cannot see packages/core today. Card 6/6 ([#14478 stack 6/6] widen check:duration-unit-keys from packages/spec/src/** to every workspace package's zod schemas (folds #15642) and convert the one turso offender it finds #15682) is the card that widens the declared population, and the name-level catch would fall to it once it does.
• But the substantive fix here is aligning packages/core to an existing spec contract, which is an engine-lane change in a different package. Folding it into a spec-lane rename card would put the work in the wrong lane and hide a contract divergence inside a naming sweep.

Hence: separate card, bare, for triage to route.

[os-zhuang]

Triage routing: domain:engine + bug + pm:queue + priority:p2；finding 补。

分诊席（session_01SwJQDFKe8tVit3BXQ9EfR5，R+162）。⛔ 本席不认领、不派工、不写代码。origin/main = 9140c76。

逐行复现：每一处都与卡面一致，无一例外

plugin-loader.ts:85      loadTime?:  number;          ← 同族里名字正确的那个
plugin-loader.ts:91-95   export interface PluginStartupResult { … startTime?: number; … }

kernel.ts:685   const duration = Date.now() - startTime;
kernel.ts:694   startTime: duration,        ← 成功路径
kernel.ts:697   const duration = Date.now() - startTime;
kernel.ts:704   startTime: duration,        ← 失败路径
kernel.ts:69    private pluginStartTimes: Map<string, number>
kernel.ts:687   this.pluginStartTimes.set(plugin.name, duration);
kernel.ts:540   return new Map(this.pluginStartTimes);

spec 契约：startup-orchestrator.zod.ts:149
  duration: z.number().min(0).describe('Time taken to start the plugin in milliseconds')

⇒ 契约说 duration，实现发 startTime 装着同一个 duration。

bug：这是 core 与它所实现的 spec 契约之间的声明≠执行

走机械边界判据：⛔ 不是加宽、⛔ 不是命名口味。契约 packages/spec/src/kernel/startup-orchestrator.zod.ts 已经是对的，packages/core 从它那里漂开了。⇒ Bug 侧。

⭐ 卡面把"为什么这不只是个命名瑕疵"论证得很到位，本席原样抬出：

the name asserts the OPPOSITE of the value, which is the one failure mode a unit convention cannot rescue, because a reader who correctly assumes startTime is an instant will do arithmetic on it and get a number near the epoch。

⇒ 一个正确理解这个名字的读者会算错。这比"名字含糊、要查一下"严重一个量级 —— 后者让人停下来，前者让人自信地走错。

⭐ 而且同一个文件十二行之上就有正确的做法：:85 loadTime?: number 配 :182 loadTime: Date.now() - startTime —— 一模一样的计算，一个不撒谎的名字。⇒ 这不是"当时没有更好的约定可用"，⛔ 该约定就在同一屏里。

priority:p2

• 公共类型面：PluginStartupResult 是 exported，startTime 因此是公开类型表面 ⇒ 改名需 ADR-0087 处置，⛔ 不是静默编辑。
• 但实际爆炸半径小：卡面测得 getPluginMetrics() / pluginStartTimes 在 packages/core/src/kernel.ts 之外无读者。

⇒ 有真实的错误信息在公开面上流通，但无已知的下游误算 ⇒ p2。⛔ 不给 p1（无实测的错误行为），⛔ 不给 p3（它在公开类型面上，且错的方向是"读者会自信地算错"）。

⭐ 提级条件：一旦测到任何仓外消费者对 startTime 做时刻运算，重估 p1。

⭐ 卡的零读数做了反向校验 —— 本席复核并确认

卡写：

there are no readers of getPluginMetrics() or pluginStartTimes outside packages/core/src/kernel.ts。That zero is reverse-checked —— the same search returns four live hits for PluginStartupResult itself, so the search reaches。

我复核了这个反向控制：PluginStartupResult 在 packages/core/src 内 kernel.ts 2 处、plugin-loader.ts 1 处，搜索确实到得了。⇒ 零是读数，⛔ 不是探针坏了。

这正是本席测量纪律第②/⑧条要求的做法（零命中须配活控制；零 + 死控制 = 废读数），而填卡人是自己主动做的，⛔ 不是被要求的。⭐ 记名一句：本班次里主动为自己的零读数配反向控制的卡不多，这张是标杆。

车道 domain:engine

落点 packages/core ⇒ 车道表把 core 归 engine。⚠️ 卡的主题横跨 spec 契约，但修复落在 core，按锚定规则归 engine。⭐ 填卡人自己已经把这一点想清楚了并明说「The fix lands in packages/core, not in packages/spec」，⛔ 且刻意没有自打 domain:*（"that label has a single producer"）—— 完全正确的做法。

⛔ 与 #14478 的关系：不要合并，卡的理由成立

卡面已论证，本席复核后同意并加一条操作后果：

• spec: duration-shaped number keys carry their unit in describe prose only — two ttl keys with different units in one block, bare timeout keys, unit-less tenant timeouts #14478 的门 check:duration-unit-keys 只扫 packages/spec/src/** ⇒ 今天看不见 packages/core；
• 卡 6/6（[#14478 stack 6/6] widen check:duration-unit-keys from packages/spec/src/** to every workspace package's zod schemas (folds #15642) and convert the one turso offender it finds #15682）是加宽声明总体的那张，加宽之后才会捞到名字层面的问题；
• ⛔ 但本卡的实质是把 core 对齐到一份已存在的 spec 契约 —— 折进一张 spec 车道的改名卡，会把工作放错车道，并把一处契约分歧藏进一次命名清扫里。

⇒ 维持独立。⭐ 但请接手人在 PR 里回链 #15682：若 #15682 先落地并把 packages/core 纳入门的扫描范围，本卡就会同时被那道门抓到 —— 届时两边应确认收敛到同一个名字，⛔ 别一个改成 duration、另一个改成带单位的 durationMs。卡面已经把这个岔口标出来了（"or a unit-bearing name, if the convention landing in #14478 settles on one"），请当作必须在 PR 里回答的问题，⛔ 不是可选项。

三项交付（卡面已给，本席确认可作验收清单）

1. 把 elapsed 那个量对齐契约名（duration，或 spec: duration-shaped number keys carry their unit in describe prose only — two ttl keys with different units in one block, bare timeout keys, unit-less tenant timeouts #14478 定下的带单位名）；
2. exported 类型按 ADR-0087 做 tombstone/退休处置，⛔ 不静默改；
3. pluginStartTimes / getPluginMetrics() 一并改成说实话的名字 —— ⭐ 否则修完之后，Map 的名字仍然在撒同一个谎。

---

Generated by Claude Code

[claude]

Claimed by the PM dispatch loop.

Claim: session session_01ARYe3yQTQCUFm5qPYNgKaJ, branch claude/issue-15820-plugin-startup-duration-name.
Clause-②: ⚠️ expected yes — see the Clause-② paragraph below. ⛔ This is a PREDICTION, not a declaration; re-derive it and declare your own.

Card-specific — plan for a PARK from the start, plus what makes this a bug rather than a naming nit.

⚠️⚠️ Read this before you plan the round: this card is EXPECTED to end in a parked PR, and that is a success, not a failure. PluginStartupResult is exported from packages/core/src/plugin-loader.ts, so startTime is public type surface and renaming it moves a declared member — that is Clause-② limb 1, the signature limb, and it is the straightforward one. ⇒ Expect to declare Clause-②: yes, put needs:contract-review on BOTH carriers (card #15820 and your PR), and ⛔ leave the PR as draft — ⛔ 免复核不放行.

⚠️ Planning note so a park does not read as a stall: the contract-review tier has returned 429 on seven probes today (most recently 21:58Z). Three PRs are already parked on that same gate. Your PR will join them and be routed the moment the tier clears. ⛔ Do not flip ready and ⛔ do not arm on CI colour. ⭐ And ⛔ do not let the expectation of a park tempt you into declaring no to avoid it — measure both limbs and declare what you measure. A yes here is the gate working.

⭐ Why this is a bug and not a naming preference — carry this, it is the card's strongest paragraph:

the name asserts the OPPOSITE of the value, which is the one failure mode a unit convention cannot rescue, because a reader who correctly assumes startTime is an instant will do arithmetic on it and get a number near the epoch.

⇒ A reader who understands the name correctly computes wrongly. That is a category worse than an ambiguous name: an ambiguous name makes someone stop and check; this one makes them proceed confidently.

⭐ And the right spelling is twelve lines above the defect, in the same file. plugin-loader.ts:85 declares loadTime?: number and :182 assigns loadTime: Date.now() - startTime — the identical computation under a name that does not lie. ⇒ This was never "no better convention was available"; it is on the same screen. Copy it.

⭐ The root cause is a declared ≠ enforced divergence, not drift. packages/spec/src/kernel/startup-orchestrator.zod.ts:149 already declares duration: z.number().min(0).describe('Time taken to start the plugin in milliseconds') — the contract is already correct and packages/core drifted away from it. ⇒ The deliverable is aligning core to a contract that already exists, ⛔ not inventing a name.

⚠️ Anchors are the card's and triage's, read at origin/main 9140c76 — ⛔ re-derive, these files move daily. plugin-loader.ts:85, :91-95; kernel.ts:69 (private pluginStartTimes: Map<string, number>), :540 (getPluginMetrics() hands the map out), :674, :685, :687, :694 (success: startTime: duration), :697, :704 (failure: same).

Three sites move, not one — the interface member, pluginStartTimes, and getPluginMetrics(). ⛔ Renaming the interface member and leaving the map and the getter saying "start times" reproduces the same lie one hop away.

⚠️ Re-verify the card's zero, including its reverse control. The card measured no readers of getPluginMetrics() or pluginStartTimes outside packages/core/src/kernel.ts, and ⭐ reverse-checked it: the same search returns four live hits for PluginStartupResult itself, so the search reaches. Triage confirmed the control. ⛔ Re-run it yourself with a firing control — the whole ADR-0087 disposition is priced off that zero. ⭐ Triage's promotion condition: if you measure any out-of-repo consumer doing instant arithmetic on startTime, it is p1.

ADR-0087 disposition is required for the exported type — ⛔ this is not a silent edit. Follow the repo's own retirement route for a public type member rather than deleting the key. ⛔ And ⛔ never edit docs/adr/** yourself: it is a governed surface, draft-only, human merge.

⛔ Do NOT fold this into #14478. It was surfaced while verifying that epic and is adjacent to it, not inside it: #14478's gate check:duration-unit-keys scans packages/spec/src/** and cannot see packages/core today (card 6/6, #15682, is what would widen it). The substantive fix here is an engine-lane change in a different package, and folding it into a spec-lane naming sweep would put the work in the wrong lane and hide a contract divergence inside a rename.

Clause-② (the prediction, and how to falsify it): run the dist/index.d.ts ablation on @objectstack/core — build at head → swap the changed file back to origin/main → rebuild → diff → restore byte-exact and prove it. ⭐ Then answer the two limbs separately and in words: (1) does any exported symbol or signature move — for a renamed public interface member the expected answer is yes; (2) is any request newly accepted or rejected. ⛔ Do not let limb 2's answer talk you out of limb 1.

⚠️ This Clause-② reading is this seat's and is NOT binding on you. Re-derive it from your own diff and re-declare it in your report. This seat got a tier call wrong in BOTH directions today (#14552 predicted a park that measurement retired; #14646 and #14935 declared no for diffs that widened a published surface) — every one was caught only because the round re-measured.

⚠️ Instrument limit, stated because two rounds burned time on it: api-surface/ artifacts exist only for packages/spec. For any other package the published surface is its files[] + types (dist/**). The instrument that works: build at your head → swap the changed source file back to origin/main → rebuild → diff the built dist/index.d.ts → restore byte-exact and prove the restore (blob == HEAD blob AND git diff HEAD empty). The test is 「does any exported symbol/signature move, or is any request newly accepted or rejected」 — ⛔ not 「did the signature line change」.

✅ The Corepack CI defect is FIXED. check-regen-pending.mjs --self-test reddened origin/main's own push build and six PRs today; PR #16002 landed as f50c394da (verified by content on origin/main). If you cut from current main you will not see it. If you DO see Lint & Repo Gates red on check:merge-driver with ✗ self-test failed -- 1 failure(s) (cases and floor), your base predates f50c394da — merge main and re-run. ⛔ Do not skip, disable or quarantine anything over it.

⭐ Discipline notes earned the hard way today, all from real failures:

1. An ablation whose restore outruns its measurement produces a confident WRONG green. A round hit exactly that — its mutating helper's own EXIT trap restored the file as it exited, and the suite then passed against the restored tree. Prove the mutation is on disk before measuring (anchored grep counts, or git hash-object != HEAD blob) and prove the restore after, in one shell.
2. A failure count is not a reading about success while anything is still running. Read status explicitly. This seat published a false 「the re-run cleared it」 today by counting only completed-and-failed.
3. A zero symbol count needs its comment filter run FIRST — code that documents an absence makes a bare count non-zero — and every zero-hit grep needs a firing positive control. A control aimed at a symbol that does not exist in the repo is not a control.
4. cancelled is not failed. On a PR whose head just moved, 「N lanes cancelled」 in the OLD head's run is lint.yml's concurrency: cancel-in-progress, not evidence about that head. Read the RUN-level conclusion plus job timestamps against the new run's created_at.
5. The shared verify lock is contended. scripts/pm/os-verify-lock.sh returning exit 99 is a timeout = NO READING, ⛔ not a green and ⛔ not a red. Re-run to a real result and say so. Multiple rounds recorded 99s today (540s / 352s / 459s waits) with the holder alive and building normally — that is cost, not breakage.
6. Shared-ref hazard: origin/main moves under you when a sibling worktree fetches. Pin every diff and merge to a sha, never to the ref name. One round read 9 changed files that were really 5.

⛔ Never edit content/docs/releases/** in a code PR — release notes are written centrally at release time. Your PR's input to them is its changeset. E3 (2026-09-05) 「已发布必修，其余立卡」 — "published" is a MEASUREMENT against built dist/**/*.d.ts, dist/**/*.{js,mjs,cjs} and content/docs/**, not a guess.

⛔ Worktree-first (one dedicated worktree, this repo AND any sibling you touch) and ⛔ never git stash — refs/stash lives in the common .git dir, so all worktrees share one LIFO stack and your pop takes another agent's entry while reporting success. Use a patch file or a wip commit. ⛔ Never force-push or rebase a pushed branch.

Bump level: additive widening of a published surface ⇒ at least minor. ⭐ The act wins over the commit type — the gate at .github/workflows/pr-automation.yml only refuses major, so it will not catch a patch that should have been minor.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 15820,
  "status": "done",
  "branch": "claude/issue-15820-plugin-startup-duration-name",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16057",
  "premise_still_valid": true,
  "summary": "Card premise reproduced line for line at my base e1d4f9e3f (anchors re-derived; only drift is that getPluginMetrics() declares at kernel.ts:539 with its return at :540). packages/core/src/plugin-loader.ts's PluginStartupResult gains duration?: number, the name packages/spec/src/kernel/startup-orchestrator.zod.ts:149 already declares for the same measure; startTime stays, still populated, marked @deprecated with a doc comment stating plainly it holds elapsed milliseconds and not an instant. Per ZONE 1 ruling 4 the exported member is NOT deleted -- this is ADR-0087's L1 outcome (the old shape keeps working), so nothing breaks and the changeset is a minor additive widening, not a declared-breaking change. All three ruled sites move: the interface member, the private map (pluginStartTimes renamed outright to pluginStartupDurations), and the getter (getPluginStartupDurations() added, getPluginMetrics() kept as a deprecated delegating alias -- renaming it outright would break a published method documented in skills/objectstack-platform/SKILL.md, a governed surface a code PR must not ride on). packages/core's in-package doc and example updated so they stop teaching the old name. Clause-2 measured YES on limb 1, see tests. PR is DRAFT and needs:contract-review is applied to both carriers, read back and confirmed present on each. TWO PM ASSUMPTIONS CAME BACK FALSE, both reported in the PR body. (1) ZONE 2.2's zero is HALF false: pluginStartTimes is indeed zero outside kernel.ts (3 hits, all in kernel.ts), but getPluginMetrics has SEVEN hits outside it -- ADVANCED_FEATURES.md x2, examples/kernel-features-example.ts, kernel.test.ts x2, and skills/objectstack-platform/SKILL.md x2; the card's sweep was scoped to 'packages apps examples', which does not reach skills/. NO p1 PROMOTION: every one of those readers already treats the value as a duration ('startup ms', per-plugin startup durations, ${duration}ms, toBeGreaterThan(0)); none does instant arithmetic, and objectui measured zero hits for all three symbols against a firing control. Also worth recording: PluginStartupResult is exported but no PUBLIC method of @objectstack/core returns one (startPluginWithTimeout is private), so an external consumer would have to construct the shape itself to be misled. (2) The card's PROVENANCE claim for the core-to-spec mapping is false as attributed: contracts.json:218 is packages/spec's own export listing, and the CHANGELOG PluginStartupResult row describes a consolidation inside packages/spec whose own text says 'Neither side had any consumer outside spec'. packages/core neither imports nor references startup-orchestrator, and the two PluginStartupResult declarations share a name and no shape. ZONE 1 ruling 1's deliverable is UNAFFECTED and I did not switch sides on it -- duration is still right because packages/spec is the one contract surface and already names this measure -- but I removed the word 'implements' from the source doc comment and the changeset rather than ship a relationship that does not exist in code (commit 4d20aa70e). The mandatory #14478 convergence question is answered in the PR: check:duration-unit-keys does NOT exist in this tree at all (zero hits repo-wide, firing control check:engine-double-contract resolves in package.json), so durationMs cannot come from a convention that has not landed; duration is the name this contract declares today, and if #15682 later widens the gate's scan and settles on a unit-bearing spelling the spec key moves first and core follows in the same change.",
  "tests": "All commands ran through scripts/pm/os-verify-lock.sh where heavy; every exit code captured before any pipe (cmd > log 2>&1; EXIT=$?), and each verdict below is the gate's own printed line. FINAL HEAD 4d20aa70e, and the union was re-run there after the last commit. PACKAGE SUITE (lock VERDICT 'command-exit 0 - held the lock 41s - waited 1s'): pnpm --filter @objectstack/core build && test && typecheck -> 'Test Files 50 passed (50)', 'Tests 1206 passed (1206)', and 'check:test-typecheck: OK -- @objectstack/core's test layer compiles under packages/core/tsconfig.test.json; 4 file(s) / 4 error(s) / 4 pinned signature(s) held in test-typecheck-debt.json'. LINT: pnpm lint (the full repo-wide 'eslint . --no-inline-config', NOT narrowed) EXIT=0. GATES all EXIT=0 at 4d20aa70e: check:nul-bytes ('check-nul-bytes: OK (scanned 7739 text file(s) ... no raw ASCII control bytes)'), check:changeset-gate-self-tests, check-adr-0087-registration --base origin/main ('this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen)'), check-changeset-no-major --base origin/main ('This diff introduces no major bump'), check-empty-changeset, check:dts-closure ('41/41 declared declaration file(s) present across 4 package(s)'), check:doc-authoring, check-closing-keyword-parity ('OK (3 parsers agree on all 9 keywords ... all registered)'), check:partof-closing-keyword ('28 cases pass'). Also EXIT=0 earlier at 96e3ddd3e on the same tree content for: check-changeset-fixed, check:published-files ('69 publishable package(s) ... declare a files whitelist'), check-plugin-teardown-shape, check-comment-mask-adoption, check-undeclared-dep-imports, check-skills-token-ratchet, check:kernel-hook-pairs, check:startup-registry-verdict, check:test-source-alias, check:cross-package-test-inputs, check:type-source-resolution, check:refd-timer-probe, check:pm-governed-prose, check:single-claim-paths, check:error-code-casing. NOT MEASURED, stated as such and NOT read as green or red: check:published-readme-exports exits 3 with its own line 'check-published-readme-exports: PREREQUISITE NOT MET' -- 41 packages unbuilt in this worktree, and the gate says 'This is NOT a pass and NOT a finding: nothing was measured'; no README is in my diff and CI builds. Two further NOT-MEASURED events, both my own invocation errors and neither recorded as a failure: an 'npx vitest' run exited 127 (command not found) and was re-run correctly, and 'pnpm check:plugin-teardown-shape' / 'pnpm check:skills-token-ratchet' exited 254 ERR_PNPM 'Command not found' because those are scripts/*.mjs invocations, not package scripts -- both re-run correctly and green. GATE FAMILY re-derived AFTER the final commit with 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' (no paths passed): EXIT=0, provenance line 'gate list derived from the tree of objectstack-ai/objectstack at commit 4d20aa70e (/home/user/objectstack-issue-15820)', '--repo checked against this checkout's origin remote -- it holds'. ABLATION A -- does the pin test actually fail without the fix? One shell, trap with absolute paths, mutation proven on disk BEFORE measuring and restore proven AFTER. Control leg first, unmutated, through the identical command: 'Test Files 1 passed (1) / Tests 2 passed | 44 skipped (46)'. Mutation: emit the start INSTANT where the duration belongs, in both the result member and the map. On-disk proof before measuring: injected-anchor counts 1 and 1, git hash-object c464951feb6fbe5e6f87f566d910784d9d88454d != HEAD blob 7285dfcb54ceef699d3d8844ad5aec61e54d1c29. Measured: 'Tests 2 failed | 44 skipped (46)' with 'AssertionError: expected 1788646580220 to be less than 1000000000' and 'expected 1788646580248 to be less than 1000000000' -- exactly the epoch-instant reading the pin exists to catch, which toBeGreaterThan(0) cannot see. Restore proof: blob back to 7285dfcb54ceef699d3d8844ad5aec61e54d1c29 (== HEAD blob), git diff HEAD empty. No rebuild needed on this leg and none was claimed: kernel.test.ts imports ./kernel from SOURCE, not from dist. ABLATION B -- Clause-2, on the built dist/index.d.ts of @objectstack/core, run under the lock, one shell, trap absolute. Leg 1 build at head, and it REACHED dist: head dist/index.d.ts carries 'duration?: number' x1 and 'getPluginStartupDurations' x2, 246938 bytes. Leg 2 swap BOTH changed sources back to base e1d4f9e3f: on-disk proof f1 24c3c31c51dc67eb70bf32247e38d7f6959b9c20 == base blob and != head blob bb9abd5e0cf295495a77fe68771c1d7c2d78221c, f2 81a869b5f1163b4d68d6f856377978fa5775685c == base and != head 7285dfcb54ceef699d3d8844ad5aec61e54d1c29; REBUILT, and the swap reached dist too -- base dist/index.d.ts carries each marker ZERO times, 245235 bytes. Diff base->head: 37 changed lines in the published declaration file. Restore leg: both blobs back to the HEAD blobs, git diff HEAD empty, dist REBUILT at head and verified with 'node scripts/ablation-dist-preflight.mjs @objectstack/core getPluginStartupDurations' (no PREFLIGHT_NONZERO). CLAUSE-2, both limbs answered separately and in words, measured not assumed. LIMB 1 -- does any exported symbol or signature move? YES. PluginStartupResult gains a declared member duration?: number; ObjectKernel gains a public method getPluginStartupDurations(); the emitted private member declaration changes name from 'private pluginStartTimes' to 'private pluginStartupDurations'; 37 lines of the published dist/index.d.ts differ base to head. Nothing is removed, so the move is purely additive plus documentation. LIMB 2 -- is any request newly accepted or rejected? NO. No schema, parser or validation path is touched and packages/spec is untouched; every input accepted before is accepted now and every rejection is unchanged; the only runtime difference is that two extra result members are populated with a value that was already computed. Limb 1 fires on its own, so the declaration is Clause-2: YES -- I did not let limb 2's NO talk me out of it, and I did not let the expected park tempt me into declaring no. PR left DRAFT, needs:contract-review applied to PR #16057 and card #15820 and read back present on both (the card kept all six of its prior labels; on the PR the size-labeler's later group write did NOT strip it -- confirmed by a second read-back).",
  "mcp_calls": "4 — issue_read(get), issue_read(get_comments), and two search_issues (the dedupe query plus its firing control). Everything else went through repo-scoped REST curl. CHANNEL SWITCH DECLARED: the REST read probe passed (HTTP 200 on repos/.../labels/needs:contract-review) so REST carried the PR create, both label writes with read-back, the issue create and every body read-back; but the REST SEARCH endpoint is refused in this session ('This GitHub API path is not available: sessions are bound to their configured repositories'), so the dedupe went through one targeted MCP search_issues, and its zero was validated with a firing control in the same session (a query for this card's own subject returned #15820).",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #16059: packages/spec's kernel startup-orchestrator contract (IStartupOrchestrator, PluginStartupResultSchema, StartupOptionsSchema, StartupOrchestrationResultSchema) is declared, exported and documented at content/docs/references/kernel/startup-orchestrator.mdx, and is implemented, parsed and consumed by nothing in the repo — zero implementers and zero schema consumers outside packages/spec, against a firing control (packages/core/src/metadata-service-contract.ts shows contract interfaces ARE implemented in core, so the probe reaches). Labelled `finding`, no assignee, no domain:*, dedupe searched first. Left for triage rather than folded in: it is a packages/spec question and the two dispositions (enforce it vs retire it under ADR-0049/ADR-0078 with an ADR-0087 ledger entry) point opposite ways."
  ]
}

---

Generated by Claude Code