fix(spec): the liveness governance denominator is the authorable set, not the registered set - #18581

…e first of objectstack-ai#18582's three debts (objectstack-ai#18587)

Part of objectstack-ai#18582

Clause-②: no

Seeds `packages/spec/liveness/sharing_rule.json` and moves
`sharing_rule` out of `PENDING_GOVERNANCE` into `GOVERNED`. This is
**one of the three debts** on that card; `connector` and
`analytics_cube` stay on it, which is why the first line is `Part of`
and not a closing keyword.

## What the coverage line says, before and after

PR objectstack-ai#18581 made this line print on **every** run precisely so a change
like this is visible. Measured on this branch:

```
before (origin/main @ bb9794a)
  governance denominator: 30 authorable type(s) — 26 registered kind(s) + 4 unregistered-kind
  stack collection(s) (analytics_cube, connector, sharing_rule, webhook); 27 governed,
  3 awaiting a ledger (analytics_cube, connector, sharing_rule) — a worklist, not a merge gate.
    (+ 9 type(s) governed from OUTSIDE the denominator via SPEC_ONLY_SCHEMAS … 36 governed in total.)

after (this branch)
  governance denominator: 30 authorable type(s) — 26 registered kind(s) + 4 unregistered-kind
  stack collection(s) (analytics_cube, connector, sharing_rule, webhook); 28 governed,
  2 awaiting a ledger (analytics_cube, connector) — a worklist, not a merge gate.
    (+ 9 type(s) governed from OUTSIDE the denominator via SPEC_ONLY_SCHEMAS … 37 governed in total.)
```

The other counters move the way a seeded type should move them, and one
of them deliberately does not:

| counter | before | after |
|---|---|---|
| classified properties | (no `sharing_rule` row) | `sharing_rule 17
classified (live 16, planned 1)` |
| repo-local evidence paths resolved | 505 / 505 | 524 / 524 |
| `path#symbol` anchors resolved | 583 / 583 | 617 / 617 |
| key-mention pairs anchored | 504 of 505 asked, 1 exempt | 523 of 524
asked, 1 exempt |
| live entries citing a PRODUCER | 39 | 48 |
| **container coverage (undrilled child keys)** | **113 containers / 578
keys** | **113 containers / 578 keys** |

The last row is the point of drilling `sharedWith`: the new type adds
**zero** rows to `undrilled-containers.baseline.json`.

## The classification, and the one row that is not `live`

Ten authored keys (plus the seven ADR-0010 envelope fields the gate
auto-classifies). Nine are `live`; `type` is `planned`.

**Every row carries a `producer`, and that is the substance of the
work.** The authoring shape is not the enforced shape: ADR-0057 D6 makes
the `sys_sharing_rule` row canonical and `bootstrapDeclaredSharingRules`
translates each authored key into it at boot — nothing re-parses
`SharingRuleSchema` at enforcement time. So a consumer pointer alone
would prove only that a **column** is read, never that the authored
value reaches it. That is the `seed.env` shape (objectstack-ai#4837) applied to a
whole type rather than to one key.

**`type` is `planned`, deliberately neither `live` nor `dead`.**
`SharingRuleType` has exactly one member and `CriteriaSharingRuleSchema`
pins the key as `z.literal('criteria')`, so every value an author can
write is the same value. Its only reader in this repo is a defensive `if
(r.type === 'owner')` in the seeder, unreachable for anything the schema
admits (`owner` rules left the authoring surface with ADR-0078).

- not `live` — nothing dispatches on it; a comparison against a value
the schema rejects is Prime Directive objectstack-ai#10's `case` label with no
reachable call site;
- not `dead` — the key is **required**, so it is not a silent no-op an
author can get wrong, and the schema header records the intent (kept as
the discriminant so a future enforced rule type re-joins as a union
member). Marking it `dead` would put a required literal on the ADR-0049
enforce-or-remove worklist, where removing it breaks every authored rule
to delete nothing.
- precedent: `action.operation`, the same shape — a one-member
discriminator held `planned` until a runtime half dispatched on it, then
flipped to `live` (objectstack-ai#15080).

The negative rests on a census with a lit control, not a bare grep: the
population that reads a declared rule **item** is the seeder, four
`packages/lint` validators and objectui's create-door client validation;
searching that population for `r.type` / `rule.type` returns the one
defensive comparison and nothing else, while the same search for
`r.condition` / `rule.condition` returns hits in three of them.

**Preview read points enumerated, per the objectstack-ai#7131 mechanical rule** —
`registerBuiltinPreviews()` (objectui @dda8f381) registers twenty types
and `sharing_rule` is **not** one of them. Recorded in the ledger rather
than skipped, because "the type has no registered preview" is the
sentence a later sweep needs. What objectui does consume is the whole
shape, on the CREATE door only (`AUTHOR_SHAPE_ONLY_TYPES`).

**One decoy named so the next census does not trip on it:** objectui's
own `SharingRuleConfig` (`packages/types/src/permissions.ts`) is a
different shape entirely, re-exported twice and read by nothing. It
matches this type by name only.

## File surface — three deviations, all mechanically forced, none
discretionary

The dispatch scoped this to the ledger, the two `check-liveness.mts`
rows and a changeset, with `liveness/README.md` **read-only**. Three
files outside that surface had to move, because the gates read them off
`GOVERNED` and off the ledger set:

1. **`packages/spec/liveness/README.md`** — `reconcileReadmeTable` fails
on a `GOVERNED` type with no row in the "Current state" table, and the
heading's `N governed types` is checked three ways against the rows and
against `GOVERNED.length`. A `check:liveness` that exits 0 and a
read-only README are not both reachable. Row written by measurement;
heading 36 → 37; the tail paragraph that described the map as holding
three debts now says which one is paid.
2. **`packages/spec/liveness/state-counts.md`** — generated,
`merge=os-regen`, proved fresh by the same gate. Regenerated with `pnpm
--filter @objectstack/spec gen:liveness-counts`, never hand-edited.
3. **`docs/qa/platform-checklist/coverage.json`** — this ratchet
**derives its universe from `packages/spec/liveness/*.json`**, so
seeding a ledger is exactly what makes the kind `UNCLASSIFIED` there
(`check:platform-checklist` exit 1, reproduced before and after). Mapped
to the three items that already exercise the surface —
`access-security.sharing-rules-widen`,
`access-security.sharing-rule-authoring-ui`,
`access-security.record-share-grant-revoke` — rather than waived. **No
checklist item is authored here**, and a waiver would have been false.

A changeset **is** owed and is not `skip-changeset`: `packages/spec`'s
`files[]` includes `liveness`, so the new ledger ships inside the
tarball. `patch`.

## Gates

Derived with `node scripts/pm/dispatch-gates.mjs --repo
objectstack-ai/objectstack --commands`, run with each exit code landed
on disk before being read, then reconciled with `--ran`:

```
dispatch-gates --ran: 65 derived famil(ies) accounted for — 63 run, 2 NOT-MEASURED
  (2 DERIVED from a recorded exit 3), 0 UNRUN.
```

- **`check:liveness` exits 0**, with the coverage line above.
- `check:generated` — **exit 0 on a built tree** (15 of 15 artifacts
current). It exits 1 on an unbuilt one and says so itself;
`packages/spec` was built under the shared verify lock before the
verdict was read.
- `check:platform-checklist` — exit 1 before the coverage entry, exit 0
after: `36 kinds mapped, 1 waived`.
- `check:pm-dispatch-gates` exit 0 (1746 self-test cases; the battery
takes ~520s on this box).
- `packages/spec` — `typecheck` exit 0, `test` exit 0 (483 files / 13780
tests). The liveness script suites the edited gate owns, plus every test
whose text names `check-liveness`, run as their own slice: 13 files /
378 tests, exit 0.
- **NOT MEASURED (2)** — `check:dual-build-cjs-loads` and
`check:lean-entry-closure`, both `exit 3 · PREREQUISITE NOT MET`: they
read a whole-repo `dist/` this container has not built. Neither pass nor
finding. CI builds the closure.
- **Known and already filed, not a finding here** —
`check:cross-package-test-inputs` exits 1 once `packages/spec` has been
built and 0 when it has not (objectstack-ai#18353 / objectstack-ai#18440). Recorded in both states;
its message names `packages/spec/dist/` and
`packages/cli/test/init-created-files-summary.e2e.test.ts`, neither of
which this diff touches.
- **`pnpm lint` is CI's whole-repo run.** The narrowing here is a
measurement, not a skip: eslint's own `files` declaration is
`**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}`, so five of the six changed files
(`.md`, `.json`) are outside its universe by that declaration; the
sixth, `packages/spec/scripts/liveness/check-liveness.mts`, linted clean
— `--format json` reports **1 file, 0 errors, 0 warnings**.
`eslint.config.mjs` states in its own prose that this repo "never
enables type-aware linting (no `parserOptions.project`, no typed
`@typescript-eslint` rules) for ANY file", so nothing in this diff can
move the verdict on a file it does not touch. Gate numbers are quoted
from runs at `2f932b09`.

## Acceptance notes

Noted, not filed, and one to file:

- **To file** — the four sharing-related entries in
`packages/spec/scripts/liveness/proof-registry.mts` record a
`blockedReason` whose premise this PR falsifies: `bu-hierarchy-sharing`,
`sharing-rule-criteria-required`, `declarative-rbac-seeding` and
`sharing-rule-org-scoped-listing` each say sharing rules are "authored
at STACK level, which is not a governed metadata type … so there is no
ledger entry to ratchet". There is one now.
`showcase-declarative-rbac-seeding` in particular authors
`sharingRules[]` on the showcase stack and asserts the seeded row's
`object_name`, `recipient_type`, `recipient_id` and translated
`criteria_json` — i.e. it exercises five of these keys end to end and is
a genuine ADR-0054 binding candidate. ⛔ Deliberately **not** done here:
binding a high-risk class is a separate ADR-0054 §3 act, one class at a
time, and `sharing-rule-criteria-required` is the counter-example that
makes it a judgement rather than a sweep — it POSTs the runtime body to
`/sharing/rules` and never authors the spec key, so it must **not** bind
`condition`.
- Noted, not filed — `packages/spec/liveness/README.md`'s "Adding a
type" recipe lists four steps and none of them is the README row, the
heading count, the generated `state-counts.md` or the platform-checklist
coverage entry, all four of which the gates now require. The recipe
predates those three checks. Whoever seeds `connector` or
`analytics_cube` next will walk into the same three red gates this PR
did; that seat is the one that will carry it.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01JbZnqu8bt6YqfJsr9vaFb3)_

---------

Co-authored-by: Claude <[email protected]>