Found while implementing #13904 (PR #14250). Recorded for triage; no severity asserted and no wire consequence measurable today.
Blocked-by: #13906 (sequencing, not scope — see below). DISCHARGED — #13906 closed completed 2026-09-04T05:38:57Z via PR #15020 (MERGED).
Restart-when: a consumer-half repair lands for any slot in the phase-1 census (comment 5542086636) — i.e. when that slot's consumers stop re-collapsing a rejection into the undefined path.
⚠️ Phase 1 measured ZERO of 12 slots ripe. Every consumer of every unrepaired provider converts a rejection into exactly the value its undefined path produces, so a provider-side repair is unobservable today at all 12 — the card's own prediction, now measured per slot. ⛔ Phase 2 is not authorised until the restart condition above is met.
⭐ The decidable test is not "a distinguishing seam exists" but "no consumer re-collapses" — the engine slot has a distinguishing seam and is still re-collapsed at a second consumer (#15405).
⭐ Roster corrections from phase 1: the file's 14 catch { return undefined; } sites are 12 unrepaired slots plus 2 documented sync legs of the two already-repaired providers, so 14 is not a slot count; tenancyServiceProvider post-dates this card and is already repaired; and serviceExistsProvider is a 13th absorbing closure this body never named, invisible to a shape-grep because it catches to false.
⚠️ Structural finding: on both repaired slots the consumer half landed first, and for all 12 remaining neither half is landed — so each slot is a ruling + a consumer edit + a provider edit + a pin, ⛔ not the "one bounded edit per slot" the note at the foot of this body promises.
⛔ The tenancy slot's wire consequence is #15256 (p0 · security · needs-user-decision). This card is not a route into it.
The shape
#13904 repaired ONE of the twelve provider closures rest-api-plugin.ts hands to RestServer: objectQLProvider now absorbs only the branded "never registered" rejection (#13905's discriminator) and re-raises everything else, so the transport's wiredEngineOrLoud seam finally sees a wired-and-broken engine.
The other shipped providers — authServiceProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider, securityServiceProvider, metadataServiceProvider, and the default-project reader — all keep the superseded shape: sync ctx.getService(slot) under a catch-all returning undefined. Each therefore still collapses the same three registry facts (never registered / registered as a factory / registration failed to build) into the one value its consumer reads as "not wired".
⚠️ Phase 1 correction: this list is stale — tenancyServiceProvider has since been repaired, and serviceExistsProvider belongs on it. Use the census table, not this paragraph.
Why this is a recorded observation and not a defect today
The collapse currently has NO observable wire consequence for these slots: their transport seams absorb anyway (computeExecCtx reaches them through seamOrUndefined, and the per-route call sites carry their own catches). Repairing the providers before those seams distinguish would be a signal-less change — the same reasoning that held #13904 behind the #13476/#13910 transport repair, recorded in its routing comment.
⭐ Phase 1 upgraded this paragraph from a reading to a measurement, per slot, with every consumer call site enumerated and read in full.
Why it will become the #13904 shape one seam over
#13906 (held behind #13095 at the time of this filing) pins computeExecCtx seams that these providers feed. When that family's repairs make a seam take the wiring fact from provider presence — as wiredEngineOrLoud now does for the engine — the shipped provider for that slot will absorb one layer earlier and the repair will not reach the shipped single-kernel wiring. That is precisely the defect class #13904 recorded against the engine slot, reproduced per slot.
Not folded into PR #14250, deliberately
Bounded-in-place fails on the first condition: these are different consumers with different downstream contracts (auth feeds identity resolution; settings feeds localization; email feeds a 501-style route guard), and "which conditions should re-raise" is a per-consumer judgement — the same reason #13904 was filed rather than folded into #13476. A mechanical sed of eleven catches into the engine slot's shape would assert eleven consumer contracts nobody measured.
Note for whoever takes it
The engine slot's repaired shape (async accessor + branded absorb + sync leg for KernelBase hosts) is directly copyable as a MECHANISM, but each slot owes its own consumer-side reading first: what does the seam or route do with a rejection versus an undefined, and is that seam's distinguishing repair landed yet? Doing them before their seams distinguish buys nothing observable; doing them after is one bounded edit per slot with a pin each.
⚠️ Phase 1 refuted the last clause: it is not one bounded edit per slot. See the Restart-when block above.
Related, and distinct
Found while implementing #13904 (PR #14250). Recorded for triage; no severity asserted and no wire consequence measurable today.
Blocked-by: #13906 (sequencing, not scope — see below).DISCHARGED — #13906 closedcompleted2026-09-04T05:38:57Z via PR #15020 (MERGED).Restart-when: a consumer-half repair lands for any slot in the phase-1 census (comment 5542086636) — i.e. when that slot's consumers stop re-collapsing a rejection into the
undefinedpath.The shape
#13904 repaired ONE of the twelve provider closures
rest-api-plugin.tshands toRestServer:objectQLProvidernow absorbs only the branded "never registered" rejection (#13905's discriminator) and re-raises everything else, so the transport'swiredEngineOrLoudseam finally sees a wired-and-broken engine.The other shipped providers —
authServiceProvider,emailServiceProvider,sharingServiceProvider,reportsServiceProvider,approvalsServiceProvider,sharingRulesServiceProvider,i18nServiceProvider,analyticsServiceProvider,settingsServiceProvider,securityServiceProvider,metadataServiceProvider, and thedefault-projectreader — all keep the superseded shape: syncctx.getService(slot)under a catch-all returningundefined. Each therefore still collapses the same three registry facts (never registered / registered as a factory / registration failed to build) into the one value its consumer reads as "not wired".tenancyServiceProviderhas since been repaired, andserviceExistsProviderbelongs on it. Use the census table, not this paragraph.Why this is a recorded observation and not a defect today
The collapse currently has NO observable wire consequence for these slots: their transport seams absorb anyway (
computeExecCtxreaches them throughseamOrUndefined, and the per-route call sites carry their own catches). Repairing the providers before those seams distinguish would be a signal-less change — the same reasoning that held #13904 behind the #13476/#13910 transport repair, recorded in its routing comment.⭐ Phase 1 upgraded this paragraph from a reading to a measurement, per slot, with every consumer call site enumerated and read in full.
Why it will become the #13904 shape one seam over
#13906 (held behind #13095 at the time of this filing) pins
computeExecCtxseams that these providers feed. When that family's repairs make a seam take the wiring fact from provider presence — aswiredEngineOrLoudnow does for the engine — the shipped provider for that slot will absorb one layer earlier and the repair will not reach the shipped single-kernel wiring. That is precisely the defect class #13904 recorded against the engine slot, reproduced per slot.Not folded into PR #14250, deliberately
Bounded-in-place fails on the first condition: these are different consumers with different downstream contracts (auth feeds identity resolution; settings feeds localization; email feeds a 501-style route guard), and "which conditions should re-raise" is a per-consumer judgement — the same reason #13904 was filed rather than folded into #13476. A mechanical sed of eleven catches into the engine slot's shape would assert eleven consumer contracts nobody measured.
Note for whoever takes it
The engine slot's repaired shape (async accessor + branded absorb + sync leg for KernelBase hosts) is directly copyable as a MECHANISM, but each slot owes its own consumer-side reading first: what does the seam or route do with a rejection versus an
undefined, and is that seam's distinguishing repair landed yet? Doing them before their seams distinguish buys nothing observable; doing them after is one bounded edit per slot with a pin each.Related, and distinct
objectQLProviderinrest-api-plugin.tsabsorbs before the transport sees it — the #13476 repair does not reach the single-kernel wiring #13904 — the engine slot, repaired (PR fix(rest): the shipped objectQLProvider absorbs only the branded never-registered rejection #14250).getServiceAsyncrejects identically for "service never registered" and "service failed to construct" — so a transport cannot tell an unwired embedder from a broken one #13905 — the registry discriminator both this and [finding] the shippedobjectQLProviderinrest-api-plugin.tsabsorbs before the transport sees it — the #13476 repair does not reach the single-kernel wiring #13904 depend on; landed.computeExecCtxseams read "failed" and "not wired" as one value, and both feed authorization inputs — tenancy posture and the ADR-0069 auth gate #13906 — the transport seams these providers feed; its landing is what gives this card a measurable consequence. Landed 2026-09-04 (PR fix(rest): keep "failed" and "not wired" apart at the two computeExecCtx authorization-input seams #15020).objectQLProvider's SECOND consumer —GET /meta/object/:name/state/:fieldanswers 404 for a wired-and-failing engine #15405 — the engine slot's SECOND consumer, which re-collapses the repair; found by this card's phase-1 census.isolated— the wall compares against the caller's own unvetted claim #15256 —p0·security·needs-user-decision; the tenancy slot's wire consequence. ⛔ Not reachable from this card.