validate-expressions has no flow leg for bare identifiers — a bare field reference in a flow condition passes objectstack validate clean

Found while building an ObjectStack application in objectstack-ai/duly against published @objectstack/* 17.2.0. Filed here because the fix lands in packages/lint.

Measured

On a real record_change flow whose START node config binds objectName: 'duly_assignment':

Mutation to the START-node condition	`objectstack validate`
`P\`status == "dispatched"`` — bare identifier	exit 0, clean
`P\`record.needs_colection == true`` — typo'd field, same site	exit 1, `unknown field \`needs_colection` on `duly_assignment` — did you mean `needs_collection`?`

Both mutations were confirmed on disk (injected literal present, removed literal absent, non-empty git diff --stat) before each run, and the tree restored after.

So the validator does resolve the bound object from the START node and does check field existence behind record. — the binding works. It skips only the bare-identifier case, and collectBoundRecordReads says so deliberately:

Deliberately NEVER a bare identifier: in a flattened flow scope a bare name may be a flow variable.

Why the exemption costs more than it saves

The reasoning is sound in isolation — a bare name in a flattened flow scope genuinely may be a flow variable, so a blanket rejection would produce false positives. But the current behaviour makes the documented guidance unenforceable exactly where it matters most:

Flow conditions are the surface where a wrong predicate is least visible. A view filter that matches nothing renders an empty grid someone notices. A flow condition that never fires produces no output at all — no record, no error, no log line. The dispatcher simply does not dispatch.
And in flows the failure is not even the documented one: a bare name does not evaluate to null, it either resolves through record flattening or throws (ADR-0032 §1c). So an author following the rule gets one failure mode, and an author breaking it gets a different, undocumented one.

Suggested direction

The false-positive concern is addressable rather than fatal, because the flow's own variable scope is authored metadata and therefore knowable at validate time:

Collect the flow's declared variables (loop iteratorVariable/indexVariable, assignment targets, input/output variables) — including inside loop and region node bodies, where a hand-written predicate is easiest to miss.
A bare identifier that matches none of them, but does match a field on the bound object, is a near-certain error and can be rejected with a corrective message (did you mean record.status?).
A bare identifier matching neither is the genuinely ambiguous case and can stay a warning.

That keeps every legitimate flow-variable reference passing while catching the actual mistake, which is a field name written without its record. prefix.

Meanwhile

The consuming application is adding a local walk over its own flows as a stopgap. That is a workaround for a gap that belongs here — every ObjectStack application will need the same walk otherwise, which is the argument for fixing it once in packages/lint.

Related, filed separately: #14087 (objectstack generate scaffolds a flow the schema rejects) and #14088 (stripReadonlyFields Object.is provenance).

Unassigned and untriaged, per the single-producer rule for domain:*.

Correct the AGENTS.md predicate rule and add a stopgap flow-predicate…

Narrowing this, with the surface ledger measured. The gap is smaller and more tractable than the original report implied — which makes it more worth fixing, not less.

validate-expressions.ts routes every predicate through one check() helper taking a scope argument, and scope, not surface, decides whether a bare identifier is judged. From the call sites:

Scope	Surfaces	Bare identifier
`'record'` (passed explicitly)	object validation rules (`979`, `981`) · field conditional rules (`1022`, `1045`) · action `visible` / `disabled` (`1193`, `1195`) · sharing rules (`1245`) · hook conditions (`1255`, `1279`, `1288`)	caught
`'flattened'` (the default)	flow node conditions (`863`) · flow edge conditions (`940`)	not judged

Measured on a real object validation rule, for contrast with the flow case in the original report:

condition: P`status == "skipped" && isBlank(record.skip_reason)`

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
  a formula/validation expression binds the record as the `record` namespace,
  not at top level, so `status` resolves to nothing and the expression silently
  evaluates to null. Write `record.status`.

Exit 1, located, corrective — a good message.

So this is not "the bare-reference check is missing"; it is "two surfaces out of seven are on the flattened path and fall through it." The check exists, the message exists, and the object binding demonstrably works on the flow path too (a typo behind record. on a flow condition is caught with the bound object named). What is missing is only the bare-identifier judgement on flattened scope, and the reason it is missing is the legitimate one already quoted in collectBoundRecordReads.

That also makes the suggested direction cheaper than first stated. The flow's declared variables are authored metadata, so the flattened path can distinguish the two cases without new infrastructure:

bare name matches a declared flow variable (loop iteratorVariable / indexVariable, assignment targets, declared inputs) → legitimate, stay silent
bare name matches no declared variable and matches a field on the bound object → the actual mistake, reject with the same corrective message the record path already emits
neither → genuinely ambiguous, warn at most

The failure model differs between the two scopes and the message should too. On record scope the platform's existing wording is exact. On flattened scope a bare name does not evaluate to null — it resolves through record flattening, or to a same-named flow variable that shadows the field, or the engine throws (ADR-0032 §1c). The shadowing case is the one worth naming in a flow-scoped message: it is silent and it means something else.

Consuming application (objectstack-ai/duly) is landing a local stopgap walk over its own flows and jobs, explicitly labelled for deletion when this ships.

Generated by Claude Code

Correct rule 4 by scope, add metadata-first rule, guard flow predicat…

Claim: PM loop round 11 (wave 2)
Session: session_01Q5WBDtaUnoz5XuJ6jk8pQ5
Branch: claude/issue-14089-flattened-scope-bare-identifier
Worktree: objectstack-issue-14089
Domain: domain:engine
File surface: packages/lint/src/validate-expressions.ts + its test file (+ a changeset) · ⛔ packages/formula/** READ-ONLY (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — tier derived this round by node scripts/pm/dispatch-gates.mjs --tier packages/lint/src/validate-expressions.ts, ⛔ not recalled. ⛔ Not the sonnet floor: the three-way classification and its false-positive budget are judgement.
Clause-②: no — R12 re-declaration (2026-09-01, execution PM, same session): the option-C implementation adds one warning and moves the accept set in neither direction. ⛔ The R11 ruling this comment carried (reject the bare form) was STRUCK by the maintainer — director batch #23, 2026-09-01 — and must not be read as standing; the prose that follows is retained only as the record of what was struck.
Serial constraints cleared: #13935 LANDED (PR #14182, origin/main = 1af82861), which is what released this card — it was held serial behind it in the same file. No open PR now touches packages/lint/**. · Sibling in flight: #13821 (packages/formula/src/validate.ts) — a different package, no serial owed, but see the read-only fence.

⚠️ Every line number in this card's triage comment is now STALE — measured

#13935 merged into this same file about an hour ago and added ~187 lines. Re-measured on origin/main @ 1af82861:

Site	Triage said	Actually now
flow node condition `check(...)`	863	1087
flow edge condition `check(...)`	940	1164
the `Deliberately NEVER a bare identifier` comment	—	168
`collectBoundRecordReads`	—	175

File is now 1544 lines. ⛔ Locate by symbol. ⭐ Worth noticing that this rot was caused by this lane's own landing an hour ago — the numbers were honest when triage wrote them.

⚠️ The file's structure also changed under you. #13935 gave check() a new trailing parameter (fieldRuleVerdictIssued) and made the field walk compute its verdict before calling check, so that bare-reference errors naming an ambient root can be suppressed. Read that mechanism before you add a second reason for check to judge or not judge a bare identifier — you are extending a function whose signature was just reworked for a neighbouring concern.

ZONE 1 — RULINGS. Not re-adjudicable.

① ⛔ Do NOT blanket-reject bare identifiers on flattened scope. That is precisely what collectBoundRecordReads deliberately avoids, and it avoids it correctly — in a flattened flow scope a bare name genuinely may be a flow variable. This card wants a three-way classification, ⛔ never a two-way one:

bare name matches a declared flow variable → legitimate, stay silent;
bare name matches no declared variable and matches a field on the bound object → the actual mistake, reject with a corrective message;
neither → genuinely ambiguous → warn at most.

② ⚠️ Step 1's completeness DETERMINES step 2's false-positive rate — so measure the collection surface before implementing it. ⛔ Do not enumerate declaration points from an impression of the schema. Collect loop iteratorVariable / indexVariable, assignment targets, and declared inputs/outputs — ⭐ including inside loop and region node bodies, which is exactly where a hand-written predicate is easiest to miss. A variable class you miss becomes a class of legitimate references you falsely reject.

③ The flattened-scope message must NOT reuse the record-scope wording. On record scope the existing sentence is exact: "...resolves to nothing and the expression silently evaluates to null. Write record.status." On flattened scope that is false — a bare name does not evaluate to null. It resolves through record flattening, or resolves to a same-named flow variable that SHADOWS the field, or the engine throws (ADR-0032 §1c). ⭐ The shadowing case is the one worth naming: it is silent and it means something else. Write a message that is true of this scope.

④ ⛔ packages/formula is READ-ONLY. The repair belongs in packages/lint, where the per-surface question is asked. (Same boundary #13935 just established in this file.)

ZONE 2 — What the card already measured. ⛔ Do not re-derive; spend the round on the repair.

The card's evidence is the cleanest this lane has seen and triage accepted it without re-verification. Treat as given:

⭐ The binding WORKS on the flow path. The control proves it: a typo'd field behind record. on a flow condition is caught, with the bound object named (unknown field 'needs_colection' on 'duly_assignment'), while the bare-identifier form on the same site exits 0 clean. ⇒ The validator does resolve the object from the START node. Only the bare-identifier judgement is skipped.
scope, not surface, is the discriminator. 'record' (passed explicitly) covers object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions — bare identifiers caught. 'flattened' (the default) covers flow node and flow edge conditions — not judged. ⇒ This is "two surfaces of seven fall through", not "the check is missing".
Both mutations were confirmed on disk before each run and the tree restored after.

Evidence bar

Pin all three branches of the classification, because a repair that gets branch 2 right and branch 1 wrong is worse than no repair — it breaks working flows:

a bare name that is a declared flow variable (including one declared inside a loop/region body) → silent; this is the false-positive control and it must stay green;
a bare name that is a field on the bound object and not a variable → rejected, with the flow-scoped message;
neither → at most a warning.

Plus a shadowing case if you can construct one, since ③ says that is the interesting failure.

Ablate on the committed tree: revert the classification, show branch 2's assertion red while branch 1's control stays green, restore and prove it (empty git diff HEAD).

⛔ Verify claims about main against origin/main, never the shared working tree. ⛔ A zero-hit is not a reading until a positive control fires.

Gates and deliverable

Derive your gate family at your actual diff (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands) and run it; exit codes captured by redirect before any pipe. A prerequisite-not-met gate is NOT MEASURED, never a pass. ⚠️ This file carries a #5017 receiver-scan meta-test that reads string literals — #13935 tripped it twice on new message text (a page.zod spelling and a record.${...} template literal both registered as read receivers). Expect it, and assemble any record.-prefixed advice with + rather than a template literal.

Draft PR to main, Fixes #14089 in the body, plus a changeset. ⛔ Do not flip ready, enqueue, or enable auto-merge. Post your final report as a comment on #14089 first, then return it — machine-checkable fields plus the measured variable-collection surface and your Clause-② reading with its reasoning.

Generated by Claude Code

Dev claim — implementer seat, dispatched by the domain:engine PM (round 11, wave 2). Separate from the PM's dispatch claim above.

Session: session_01Q5WBDtaUnoz5XuJ6jk8pQ5 (os-dev subagent; the branch below is the identity bit under the shared GitHub identity)
Branch: claude/issue-14089-flattened-scope-bare-identifier
Worktree: objectstack-issue-14089, based at origin/main = 07cced5a
File surface: packages/lint/src/validate-expressions.ts + its tests + a changeset. packages/formula/** is read-only for this card.
Assignee and labels untouched — both already set by the PM.

Note for anyone reading later: origin/main had already moved past the 1af82861 the dispatch measured; this branch is cut from 07cced5a.

Generated by Claude Code

os-dev-report

{
  "issue": 14089,
  "status": "needs_decision",
  "branch": "claude/issue-14089-flattened-scope-bare-identifier",
  "pr": null,
  "premise_still_valid": false,
  "summary": "The card's MEASURED half stands and I reproduced it: a bare identifier on a flow node/edge condition is not judged, while the same predicate on record scope is rejected and the object binding demonstrably works on the flow path. What does not stand is the INFERENCE that this is a gap to close by rejection. Clause 2 was handed back to me to re-declare, and my reading differs from the PM's: this is a WIDENING of a published, canon-taught, twice-pinned accept set, not declared-but-unenforced restored. Measured on origin/main 07cced5a: rejecting branch 2 turns 5 shipped conditions in the repo's own two flagship example apps into build errors (app-todo start condition on bare 'status', a declared select field on todo_task; four app-showcase edge conditions on bare 'budget', a declared currency field on showcase_project). It also contradicts @objectstack/formula's published contract in ExprSchemaHint.scope ('so bare status is correct and is NOT an error') and cel-engine's 'bare references are correct' — a package this card fences as READ-ONLY, so the contradiction cannot be reconciled inside the fence — and requires deleting two pinned tests that exist to assert the opposite, one of them in the very file under repair. Per the dispatch's own instruction ('if your reading differs from mine, say so and stop rather than proceeding on my line') I stopped rather than shipping the rejection. No PR. The variable-collection surface ruling 2 demanded is measured in full below, so whichever way the decision lands the implementation round is short. Branch pushed empty as the claim's landing marker; assignee and labels untouched.",
  "tests": "No implementation, therefore no ablation — stating that rather than fabricating one. What was measured, all on a worktree cut from origin/main 07cced5ab97a2ec34be6c18e15b8956507885005. Build through the shared lock: 'pnpm --filter @objectstack/lint^... build' then 'pnpm --filter @objectstack/lint build', both reporting 'os-verify-lock: VERDICT command-exit 0' (252s and 16s held). Probe: a node script calling validateStackExpressions from the freshly built packages/lint/dist/index.js against the REAL shapes of the two shipped example flows, exit code captured by redirect before any pipe (PROBE_EXIT=0). Results — (1) app-todo task.flow.ts:183 shipped start condition: '(no issues) exit-clean'; (2) app-showcase flows/index.ts:281-282 shipped edge conditions: '(no issues) exit-clean'; (3) POSITIVE CONTROL, identical bare identifier on an object validation rule (record scope): error, 'bare reference `status` — a formula/validation expression binds the record as the `record` namespace...'; (4) POSITIVE CONTROL, the card's own control, a typo behind `record.` on a flow condition: error, 'unknown field `statuss` on `todo_task` — did you mean `status`?'; (5) branch-1 shape, bare name that is a node outputVariable (app-showcase flows/index.ts:1501): '(no issues) exit-clean'. Both controls fired, so the two zero-hits are readings and not silence. One NOT MEASURED to declare honestly: the first probe run exited 1 with ERR_MODULE_NOT_FOUND on a wrong dist filename — a path mistake, never a red gate; the re-run at the correct path is the reading above. No gate family was derived or run: there is no diff to derive it at.",
  "mcp_calls": "0 — the whole run went through unauthenticated REST reads plus authenticated REST comment POSTs; no MCP GitHub call was made.",
  "open_questions": [
    {
      "question": "Is a bare identifier that names a field of the bound object, on a flow node/edge condition, an ERROR the linter must reject? This is Clause 2, and it is a metadata-semantics decision about a shipped public surface, not an implementation choice. Today the form is blessed by the engine (record fields are flattened to top level deliberately, seedRunVariables says so and names 'start conditions and edge predicates' as the purpose), by @objectstack/formula's published contract, by the spec's own FlowSchema JSDoc decision example, and by 5 conditions in the repo's two flagship example apps.",
      "options": [
        "A — Reject it (Zone-1 ruling 1.2 as written): error, flow-scoped message. Measured cost: 5 shipped example-app conditions become build errors; contradicts a published contract in a read-only package; deletes two pinned tests asserting the opposite; every downstream app that copied the spec's own JSDoc example breaks with no migration offered.",
        "B — Warn on it. No accept-set movement, zero migration, and the reporter gets the diagnostic they actually lack. But it fires on the exact form the platform's own canon TEACHES, so it is a warning on correct metadata across both example apps — the trust-killer ADR-0072 D1 names, which is the reason collectBoundRecordReads gives for avoiding this in the first place.",
        "C — Warn only on the genuinely ambiguous case: a bare name that is BOTH a declared flow variable AND a field on the bound object. Closed oracle (both sides are authored metadata). Contradicts no contract, changes no pinned test, touches no example app. This is the case comment 5489028006 itself calls out as 'silent and it means something else', and the mechanism is measured: seedRunVariables seeds declared variables first and flattens record fields only under a not-already-bound guard, so the variable wins and nothing anywhere says so.",
        "D — Deprecate the bare form deliberately: a spec-level decision (ADR amendment under Prime Directive 13), fix the canon first per ADR-0032 decision 4 (FlowSchema JSDoc, both example apps, the published skills), ship a deprecation window, then reject. The only route that reaches A's end state without leaving the platform self-contradictory."
      ],
      "recommendation": "C now; D only if the maintainer wants the bare form gone. Leading with long-term soundness, which carries the majority weight: A makes packages/lint reject what @objectstack/formula's published contract calls correct, and Prime Directive 12's remedy for a contract you believe is wrong is to change the SPEC deliberately, never to have a consumer start refusing what the contract blesses — this is the same 'platform's own linter denying the platform's own contract' shape #5378 already paid down inside this very file. On real business need the downstream pull is real but it is a pull for a DIAGNOSTIC, and the reporter's own measurement shows the form resolves; C delivers a diagnostic on the only sub-case that is actually silent and actually means something else, at zero migration. On making AI-authored metadata hard to get wrong, the dotted spelling is genuinely the shadow-proof one and that argues for D's end state — but ADR-0032 decision 4 is explicit that the canon is fixed FIRST, and today the spec's own JSDoc teaches the bare form, so A hands an AI author a build error for copying the platform's own example: a wasted correction cycle of exactly the kind #13935 removed. On startup scope discipline A is a breaking narrowing of a shipped protocol-17 accept set for a diagnostic that costs nothing under C. If the maintainer picks A or D, the collection surface below is the input and the implementation is one short round; ruling 1.1 would also want revisiting under either, because as ruled the classification rejects the case that WORKS (no shadowing variable) and stays silent on the case that FAILS (a shadowing variable)."
    }
  ],
  "out_of_scope_findings": []
}

The measured variable-collection surface (Zone-1 ruling 2)

Measured against the schemas and the executors, never from an impression. Every row carries both ends: the key an author writes, and the runtime site that binds it.

#	Declaration point	Authored key	Declared by	Runtime binder
1	flow-level declared variables	`flow.variables[].name`	`FlowVariableSchema`, `spec/src/automation/flow.zod.ts:147`, wired at `:655`	`seedDeclaredVariables`, `service-automation/src/engine.ts:7482`
2	loop iterator	`config.iteratorVariable`	`control-flow.zod.ts:205` — the alias `itemVariable` is REJECTED by name at `:177`, so on the parsed path only the canonical spelling can arrive	`builtin/loop-node.ts:88`
3	loop index	`config.indexVariable`	`control-flow.zod.ts:207`	`builtin/loop-node.ts:89`
4	map iterator / index	`config.iteratorVariable`, `config.indexVariable`	`builtin-node-config.zod.ts:500,502`	`builtin/map-node.ts:101,102`
5	try_catch caught error	`config.errorVariable` (defaults to a dollar-prefixed reserved name)	`control-flow.zod.ts:317`	`builtin/try-catch-node.ts:97`
6	node output	`config.outputVariable`	`builtin-node-config.zod.ts:244,265,510`; `schemaless-node-config.zod.ts:247,325`	`crud-nodes.ts:230,294` · `screen-nodes.ts:262` · `map-node.ts:103` · `subflow-node.ts:89`
7	assignment targets — three shapes	`config.assignments` as an object, keys are the names · `config.assignments` as an array of entries keyed `variable` / `name` / `key` · or, with no `assignments` wrapper at all, the top-level config keys ARE the names	deliberately NOT a fixed key set — `builtin-node-config.zod.ts:60-63` states the exemption and its reason	`builtin/logic-nodes.ts:110-137`
8	node ids	`node.id`	`FlowNodeSchema`	`engine.ts:6696` binds each node output under a dotted `nodeId` plus key name, so a node id is a bare CEL root
9	engine reserved	none — engine-owned	none	`record`, `previous`, and the dollar-prefixed run handles seeded at `engine.ts:7556-7566`, plus the loop and error handles

Two properties that decide the false-positive rate, both measured:

Variables are flow-scoped, not graph-scoped. seedRunVariables builds ONE map per run, so a name declared inside a loop body is in scope for the whole flow. Collection must therefore be a single flat set gathered across every region — loop.body, parallel.branches[], try_catch.try, try_catch.catch (spec/src/automation/region-slots.ts, FLOW_REGION_SLOTS) — which collectFlowGraphs already traverses, so the collection walk and the checking walk can be the same one.
Row 7 shape 3 is the class a hand-written predicate misses. An implementer working from an impression of the schema looks for assignments, finds nothing on a legacy assignment node, and silently collects zero names from it — turning every variable that node sets into a falsely-rejected reference. Row 8 is the second most missable: a node id is not a "variable" in any schema sense, but it is a bare CEL root at runtime.

Confirmed live in the repo: examples/app-crm/src/flows/convert-lead.flow.ts declares lead_record at BOTH row 1 (:42) and row 6 (:65), and examples/app-showcase/src/automation/flows/index.ts:1501 reads a row-6 name bare (size(closedInquiries) > 0) — that predicate is branch 1 and must stay silent.

The oracle to use, if this is implemented: firstUndeclaredReference(source, declaredNames) from @objectstack/formula, NOT collectCelRootIdentifiers. The former acts only on cel-js's own unknown-variable fault, so comprehension-macro variables and function names cannot false-positive; the latter reports macro variables as roots, and a macro variable sharing a field's name would then be falsely rejected.

Clause 2, re-declared from what the change would actually do

The accept set moves, and the question is whether that is a restoration or a widening. It is a widening. Six independent anchors say the bare form is supported rather than merely tolerated:

@objectstack/formula's ExprSchemaHint.scope docblock: on flattened scope "bare status is correct and is NOT an error".
cel-engine.ts:181-183: the record-scope checker "must NOT be applied to flow / automation conditions, where the record's fields ARE flattened to top-level and bare references are correct".
engine.ts seedRunVariables: fields are flattened "so bare references (status, budget) resolve in start conditions and edge predicates" — a deliberate engine feature with its purpose stated.
formula/src/validate.test.ts:255 pins budget > 100000 as ok on flattened scope.
lint/src/validate-expressions.test.ts:290 pins branch 2 itself — bare amount and bare stage, both declared fields of the bound object — at zero issues, in the file under repair.
The spec's own FlowSchema JSDoc decision example teaches a bare identifier, and ADR-0032 decision 4 makes the canon load-bearing training data.

The PM's two grounds do not carry, and it is worth being precise about why rather than just disagreeing. ADR-0032 decision 1c governs silent runtime FALLBACKS — the "error becomes false or null" swallow — and a bare flow identifier swallows nothing: it resolves. And "the identical predicate on record scope is already rejected" is not the same predicate in the sense that matters, because the two scopes differ in exactly the property that makes the record-scope rejection correct: on record scope the record is not flattened, so the name resolves to nothing; on flattened scope it is, so the name resolves to the field. That difference is why scope exists as a parameter at all.

One structural observation for whoever takes the decision. As ruled, the classification rejects the case that works and stays silent on the case that fails: branch 2 is by construction the case where NO flow variable shadows the field, which is precisely when flattening resolves it correctly, while the shadowing case — a name bound as both — falls under branch 1 and is ruled silent. If the goal is to catch what is invisible, that is the case to name.

Generated by Claude Code

⚖️ 转 `needs-user-decision` —— 本席的 Zone 1 裁定被实测推翻,当众认。 ⛔ 无 PR,这是正确交付。

domain:engine 车道 PM,session session_01Q5WBDtaUnoz5XuJ6jk8pQ5,R11。dev 按派发令自己写的那句停手了("if your reading differs from mine, say so and stop rather than proceeding on my line"),这是派发令在工作,不是失败。

⛔ 我错在哪 —— 两处,都已对树复验

① 我把 Clause-② 读成 no,理由是「declared-but-unenforced 的恢复」。这是错的:它是对一个已发布、被官方教材教、且被 pin 住的 accept set 的 NARROWING。

复验于 origin/main(⛔ 非 dev 自述):

读数	结果
`packages/formula/src/validate.ts:65`	「`status` is correct and is NOT an error」
`packages/formula/src/cel-engine.ts:183`	「and bare references are correct」
`examples/app-todo/src/flows/task.flow.ts:183`	出货的 `condition: 'status == "completed" && previous.status != "completed"'`
`examples/app-showcase/.../flows/index.ts`	5 处同形

⇒ 平台已发布的契约明文祝福这个写法,而本席派发令把那个包围成只读。⭐ 于是矛盾在围栏内无法调和 —— 这本身就说明落点选错了:一个消费者开始拒绝契约所祝福的东西,不是 lint 的修法,是 spec 的裁决。

② 更要紧:我给的三分法是反的。

dev 的原话,复核采信:

branch 2 是按构造没有遮蔽变量的情形 —— 也就是扁平化正确解析的时候;而遮蔽变量的情形落在 branch 1,被我裁为静默。

⇒ 裁定拒绝的是能工作的那一半,对真正会坏的那一半保持沉默。 而「同名流程变量遮蔽字段」恰恰是 5489028006 自己点名的那个 "silent and it means something else"。我把它裁成了唯一不报的分支。

卡的实测半边成立,被推翻的是我的推论

⛔ 不要把本卡读成「报错了」。dev 复现了卡的全部读数:裸标识符在流程条件上不判、同一谓词在 record 域被拒、record. 后的错拼在流程路径上被抓(带绑定对象名)。绑定是工作的,只有裸标识符判断被跳过。 缺的是诊断 —— 有争议的只是「该不该用拒绝来补」。

四个选项

A —— 照裁定拒绝(flow 域消息)。实测代价:两个旗舰示例应用的 5 条出货条件变成构建错误;与只读包里的已发布契约冲突;需删除两条断言相反的 pin(其一就在待修文件里);任何照抄 spec 自身 JSDoc 示例的下游应用直接崩,且不提供迁移。
B —— 降为 warning。accept set 不动、零迁移,报告者要的诊断也拿到了。但它会在平台自己教的写法上对两个示例应用发警告 —— 正是 ADR-0072 D1 点名的信任杀手,也正是 collectBoundRecordReads 当初回避此事的理由。
C —— 只对真正含糊的情形告警:一个裸名既是已声明流程变量又是绑定对象上的字段。判据封闭(两边都是被编写的元数据),不与任何契约冲突,不动任何 pin,不碰示例应用。机制已实测:seedRunVariables 先播声明变量,再在「未绑定」守卫下才扁平化 record 字段 ⇒ 变量胜出,而没有任何地方说出这件事。
D —— 有意废弃裸写法:spec 级裁决(Prime Directive 13 下的 ADR 修订),按 ADR-0032 决策 4 先修正典(FlowSchema JSDoc、两个示例应用、已发布 skills),给废弃窗口,然后再拒绝。这是唯一能到达 A 的终局而不让平台自相矛盾的路。

四维分析

长远合理性(权重 ≥50%,2026-09-01 裁定)—— 指向 C,并把 A 排除。
A 会让 packages/lint 拒绝 @objectstack/formula 已发布契约称为正确的东西。Prime Directive 12 对「你认为契约错了」的补救是有意地改 spec,⛔ 永远不是让消费者开始拒绝契约所祝福的写法 —— 而「平台自己的 linter 否认平台自己的契约」这个形状,#5378 已经在这同一个文件里付过一次账。若确实要让裸写法消失,D 是唯一自洽的路径,且它的第一步是修正典而不是加拒绝。

实际业务需求 —— 拉动是真的,但拉动的是「诊断」,不是「拒绝」。
下游 objectstack-ai/duly 正在自建遍历作绕行,这是真实拉动,且「每个应用都得写一遍」正是「在 packages/lint 修一次」的标准论据。但报告者自己的实测显示那个写法解析得了。C 在唯一真正静默、且真正意味着别的东西的子情形上给出诊断,迁移成本为零。

防 AI 写代码犯错 —— 这一棱是唯一支持 A 终局的,但它同时否决 A 的路径。
带点号的写法确实是防遮蔽的那个,这支持 D 的终局。但 ADR-0032 决策 4 明写正典先修;而今天 spec 自己的 JSDoc 教的就是裸写法 ⇒ A 会因为作者照抄平台自己的示例而甩给他一个构建错误 —— 正是 #13935 刚刚消除掉的那种白跑的修正循环。

创业阶段不扩散需求 —— 反对 A。
A 是对一个已发货的 protocol-17 accept set 的破坏性收窄,换来的诊断在 C 下零成本即可得到。按 2026-08-27 的分歧推荐序:有实测拉动 ⇒ 荐长远形态一次付清 —— 而此处「长远形态」是 C(封闭判据、零迁移),不是 A(收窄已发布契约)。

本席建议:C 现在做;若维护者要裸写法消失,则 D。

⛔ 本席不代裁:改动已发布契约的接受/拒绝行为属人工地板,D 更是 ADR 类。四棱并非同向(防错棱指向 D 的终局,长远棱否决 A 的路径),置信门不成立。

⚠️ 若裁 A 或 D:ruling ①(三分法)也要重裁 —— 如上,它按现在的写法拒绝能工作的、放过会坏的。dev 已把 ruling ② 要求的变量收集面完整测完并写在报告里,所以无论裁哪个方向,实施轮都很短。

业务需求	长远合理性	防 AI 犯错	不扩散
拉动真实,但要的是诊断而非拒绝;C 零成本满足	⭐ 决定性:A 让 linter 否认已发布契约(#5378 同形)。C ✅ / D ✅ / A ❌	点号写法防遮蔽 ⇒ 支持 D 的终局;但正典未改前 A 会罚照抄示例的作者	A 是已发货 accept set 的破坏性收窄;C 零迁移

⛔ 决策卡落卡即带本块,不待维护者到场再补。被阻塞的执行工作:无(本卡即工作本身,已退出可派发队列)。

Generated by Claude Code

裁决:C —— 只对遮蔽情形告警;A/B/D 均不采(维护者 2026-09-01,总监批 #23)

项目总监席 · session session_01KGtaLpkW1mycWgkbSb3H6t · 维护者对本批逐字:「同意」。

C:新诊断只命中真正含糊且真正会坏的子情形 —— 裸名既匹配已声明流程变量又匹配绑定对象上的字段(遮蔽:seedRunVariables 先播变量、record 字段只在未绑定守卫下扁平化 ⇒ 变量赢且无处声张)。判据封闭(两边都是被编写的元数据),零迁移,不动契约、不动 pin、不碰示例应用;
A 排除:让 packages/lint 拒绝 @objectstack/formula 已发布契约明文祝福的写法 = 平台自己的 linter 否认平台自己的契约(Author-time expression validator is blind to registry-injected system columns — record.owner_id / created_at / organization_id are rejected as unknown fields #5378 同形),5 条出货示例条件变构建错误;
B 排除:对平台正典教的写法发警告 = ADR-0072 D1 信任杀手;
D 不触发:裸写法在无遮蔽时正确解析,无实测伤害支撑破坏性废弃;若日后要废弃,按 ADR 路径先修正典,届时回箱;
原派发令 Zone-1 ruling ①(三分法)就地作废,以本裁决的 C 判据替代 —— dev 的推翻成立并入册:原三分法拒绝能工作的、放过会坏的;
实施输入直接采用 dev 报告:九行变量收集面(含 assignments 三形与 node id 作裸根)、oracle 用 firstUndeclaredReference(⛔ 非 collectCelRootIdentifiers)、packages/formula 只读围栏维持、validate-expressions / validate-security-posture 也有同形的 spec 不声明键的 ?? 别名读法(#5009 建议 3 的核对结果) #5017 receiver-scan 注意事项照旧。Clause-②:C 不动 accept set(新增 warning 诊断)⇒ 预期 no,实施者按实际 diff 复declare。

状态转移(同笔)

needs-user-decision → pm:queue;bug priority:p2 domain:engine 不动。分支 claude/issue-14089-flattened-scope-bare-identifier 已推空标记,实施轮短。

Generated by Claude Code

Claim: domain:engine execution PM · session session_01Q5WBDtaUnoz5XuJ6jk8pQ5 · R12 · branch claude/issue-14089-flattened-scope-bare-identifier (already pushed empty in R11 as the claim marker — resume it, do not cut a new one) · worktree ../objectstack-14089-bare-identifier off origin/main.

pm:queue → pm:dispatched.

Zone 1 — BINDING. ⛔ NOT re-adjudicable.

1.1 — The maintainer's ruling, quoted verbatim. This is the decision; it is not mine to restate or soften.

裁决:C —— 只对遮蔽情形告警;A/B/D 均不采(维护者 2026-09-01,总监批 #23)

C:新诊断只命中真正含糊且真正会坏的子情形 —— 裸名既匹配已声明流程变量又匹配绑定对象上的字段(遮蔽:seedRunVariables 先播变量、record 字段只在未绑定守卫下扁平化 ⇒ 变量赢且无处声张)。判据封闭(两边都是被编写的元数据),零迁移,不动契约、不动 pin、不碰示例应用;

A 排除:让 packages/lint 拒绝 @objectstack/formula 已发布契约明文祝福的写法 = 平台自己的 linter 否认平台自己的契约(Author-time expression validator is blind to registry-injected system columns — record.owner_id / created_at / organization_id are rejected as unknown fields #5378 同形),5 条出货示例条件变构建错误;

B 排除:对平台正典教的写法发警告 = ADR-0072 D1 信任杀手;

D 不触发:裸写法在无遮蔽时正确解析,无实测伤害支撑破坏性废弃;若日后要废弃,按 ADR 路径先修正典,届时回箱;

原派发令 Zone-1 ruling ①(三分法)就地作废,以本裁决的 C 判据替代 —— dev 的推翻成立并入册:原三分法拒绝能工作的、放过会坏的;

实施输入直接采用 dev 报告:九行变量收集面(含 assignments 三形与 node id 作裸根)、oracle 用 firstUndeclaredReference(⛔ 非 collectCelRootIdentifiers)、packages/formula 只读围栏维持、validate-expressions / validate-security-posture 也有同形的 spec 不声明键的 ?? 别名读法(#5009 建议 3 的核对结果) #5017 receiver-scan 注意事项照旧。Clause-②:C 不动 accept set(新增 warning 诊断)⇒ 预期 no,实施者按实际 diff 复declare。

1.2 — ⛔ My R11 three-way ruling is VOID. It rejected the case that works and stayed silent on the case that breaks. It was falsified by the previous seat's measurement and struck by the maintainer at item 5. ⛔ Do not implement it, do not reconstruct it, do not treat any part of it as still standing. The C predicate above replaces it entirely.

1.3 — The predicate, and it is narrow. Warn only when a bare name is BOTH (a) a declared flow variable and (b) a field on the bound object. Both sides are authored metadata, so the oracle is closed. ⛔ A bare name that is only a field ⇒ silent (that is the shipped, canon-taught form). ⛔ A bare name that is only a variable ⇒ silent.

1.4 — ⛔ packages/formula stays READ-ONLY. Its published contract (validate.ts:65, cel-engine.ts:183) is the thing C is designed not to contradict. If your repair needs to change it, you have left C.

1.5 — Severity is warning, not error. No pinned test may be deleted or re-baselined. lint/src/validate-expressions.test.ts:290 (bare amount / bare stage at zero issues) and formula/src/validate.test.ts:255 must both still pass unchanged.

Zone 2 — PM mechanism assumptions. ⚠️ MEASURE THESE. Falsification is a good outcome; ⭐ this card exists because the last round's assumptions were not measured.

2.1 — I assume the file has drifted under you. packages/lint/src/validate-expressions.ts is 1544 lines on origin/main as of 1403d943. ⚠️ The ~224-line growth came from my own landing of #13935, and the triage-era anchors (863 / 940) are stale. Measured current anchors: the flow-node condition check(...) at :1087, the edge at :1164. Re-derive before you edit — if these have moved again, take the tree's number, not mine.

2.2 — I assume the collection walk and the checking walk can be the same traversal. The previous seat measured that collectFlowGraphs already traverses every region slot (loop.body, parallel.branches[], try_catch.try, try_catch.catch — spec/src/automation/region-slots.ts, FLOW_REGION_SLOTS), and that variables are flow-scoped, not graph-scoped (one map per run). ⚠️ If a second pass turns out to be needed, say so — do not silently add one and call it the plan.

2.3 — I assume the nine-row collection surface in the previous report is complete. It is the maintainer's declared implementation input (item 6), so it is the starting point, not a hypothesis to re-derive from scratch. ⭐ But two rows are the ones a hand-written predicate misses, and I want them measured rather than trusted:

row 7 shape 3 — an assignment node with no assignments wrapper at all, where the top-level config keys are the variable names (builtin-node-config.zod.ts:60-63 states the exemption). Miss it ⇒ you collect zero names from a legacy assignment node ⇒ false warnings.
row 8 — a node id is a bare CEL root at runtime (engine.ts:6696), though it is not a "variable" in any schema sense.

2.4 — I assume firstUndeclaredReference is reachable from packages/lint without a new dependency edge. The maintainer pinned the oracle (item 6) but reachability is a build fact. ⚠️ If importing it needs a new edge, STOP and report — a dependency-graph change is not inside this card.

Zone 3 — suggested route. Optional; ⛔ not binding.

Compute the two sets once per flow, intersect, and warn on names in the intersection that appear as bare roots in a condition. The shadowing direction is worth stating in the message, because it is the whole point: the variable wins and nothing says so — so an author reading status on a flow that also declares a status variable is reading the variable, not the field.

STOP conditions

Your reading of the ruling differs from mine ⇒ say so and stop, as the previous seat correctly did. ⛔ Do not proceed on my line. That instruction is the reason this card is now ruled instead of wrongly shipped.
The repair requires touching packages/formula, deleting/re-baselining a pinned test, or changing any example app ⇒ you have left C ⇒ stop.
Clause ② — declare it from what you actually built, not from my expectation. The maintainer's item 6 says expected no; ⚠️ that is a prediction, not a grant. ⛔ Upward only: if your diff widens or narrows the accept set, re-declare yes and say why.

Verification expected

The two pinned tests above passing unchanged; a new test for the shadowing case (warns) and its two negative controls (field-only ⇒ silent, variable-only ⇒ silent); row 7 shape 3 and row 8 each exercised, since those are the false-positive generators; the shipped conditions in examples/app-todo/src/flows/task.flow.ts:183 and examples/app-showcase/.../flows/index.ts still clean. ⛔ Report anything unmeasured as NOT MEASURED, never as a pass. ⛔ Never git stash. ⛔ Never edit content/docs/releases/. Worktree-first.

Clause-②: no — a new warning diagnostic only; the accept set moves in neither direction (maintainer ruling C, director batch #23).

Generated by Claude Code

os-dev-report

{
  "issue": 14089,
  "status": "done",
  "branch": "claude/issue-14089-flattened-scope-bare-identifier",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14263",
  "premise_still_valid": true,
  "summary": "Option C implemented as ruled: validateStackExpressions now emits one WARNING when a bare identifier in a flow node/edge condition is BOTH a declared flow variable AND a field on the bound object. Field-only and variable-only bare names stay silent, no error is added, packages/formula is untouched, no pinned test was deleted or re-baselined, and no example app was edited. New module packages/lint/src/flow-variable-scope.ts carries the nine-row collection surface and the firstUndeclaredReference oracle; validate-expressions.ts gains one collection pass and two emission call sites (node condition, edge condition). My reading of the ruling matches the PM's Zone 1.3 exactly, so no STOP condition fired. Two gate findings were repaired rather than routed around: the new test file's private comment-stripper (check:comment-mask-adoption reds on a new one) was replaced by assertions over exported constants, and ASSIGNMENT_NODE_TYPE was made module-private after rule-id-barrel-exports correctly read a slug-shaped exported const as a rule id owing a barrel line. Clause 2: no. Zone 2.2 is FALSIFIED and that is the one deviation from the PM's route, declared rather than done silently: the collection walk CANNOT be the same traversal as the checking walk, because seedRunVariables builds one variable map per run, so a name declared by the last node is in scope for a condition on the first; collecting as the checking walk goes would make the verdict depend on traversal order. collectFlowGraphs returns a materialized array and is still called ONCE; the second pass is over that array. A test pins the case that forces it (a loop-body iteratorVariable seen from a top-level edge condition).",
  "tests": "All readings at final head d142c49b unless stated; every exit code captured by redirect BEFORE any pipe. (1) pnpm --filter @objectstack/lint test: 89 files, 2505 tests passed, LINT_TEST_EXIT=0. (2) pnpm --filter @objectstack/lint typecheck: TYPECHECK_EXIT=0. NOTE: packages/lint/tsconfig.json excludes **/*.test.ts, so that command alone says NOTHING about my test files (confirmed with tsc --listFiles: 1 hit for flow-variable-scope.ts, zero for either .test.ts). The test layer IS measured, by the ratchet in (6): @objectstack/lint carries a 16-error TEST_DEBT ledger entry whose re-measure compiles src/*.test.ts, and it came back at its recorded number with my new test file present. (3) ABLATION, direction predicted RED and observed RED. Fix committed first. Mutation = delete both warnShadowedFieldReads call sites, nothing else. Confirmed on disk before the run, not from the editor's exit code: HEAD blob 300918c1 equal to the pre-mutation hash of the file (so the tree really was at HEAD), call-site count 2 to 0 by grep -c, post-mutation hash a3795f81 different. Result: Tests 6 failed | 271 passed - exactly the 6 positive tests, every negative control green. Restore leg: git checkout HEAD -- ABSOLUTE_PATH inside a trap, proved by git diff HEAD --stat printing nothing, then git status --porcelain empty. NO REBUILD LEG, and none is claimed: the test imports './validate-expressions.js' RELATIVELY so vitest reads this package's source; nothing resolves it through packages/lint/dist. (4) SHIPPED EXAMPLE APPS, with a positive control so the three clean runs are readings and not silence. objectstack validate exits 0 on app-todo, app-showcase and app-crm with no shadowing warning anywhere in the output. Control: injecting a 'status' flow variable into app-todo's REAL task_completion flow (whose start condition at task.flow.ts:183 reads bare status) makes the diagnostic appear through that same channel - \"flow 'task_completion' node 'start' (start) condition: bare reference `status` is BOTH a declared flow variable and a field on `todo_task`\" - with validate still exiting 0, confirming it is advisory. Mutation confirmed on disk (anchor hits 1, injected marker present, hash changed); both legs restored, git diff HEAD empty. (5) PINNED TESTS PASS UNCHANGED. validate-expressions.test.ts 'does NOT flag bare references in a flow condition (flattened scope)' (bare amount / bare stage at zero issues) and formula/src/validate.test.ts's flattened-scope pin: neither file's pinned assertions appear in this diff, and both ran green inside (1) and inside the formula package's own suite reached by the lint dependency build. (6) GATE FAMILIES: 33, derived from the ACTUAL diff by scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no hand-written list; the --commands harvest so neither spelling nor the convention block can be dropped). 30 GREEN. 3 NOT MEASURED, none a red: check-test-completeness exit 3 PREREQUISITE NOT MET (it grades a saved turbo test log; none exists locally, and its own text says record it as NOT MEASURED); check:dual-build-cjs-loads first exit 3 on an unbuilt tree, then GREEN after building the closure (102 require entry points across 66 packages load, 610 CJS files parse); scripts/pm/check-half-states.mjs is a network-bound GitHub patrol that does not terminate in this container (two attempts, 280s each, exit 124 with and without --use-env-proxy) - a timeout, not a finding, and nothing in my diff can move it. (7) RATCHETS RE-RUN ON THE FINAL HEAD after the last commit: check-type-check-coverage --re-measure OK, 27 ledger entries re-measured in 320.5s, 1217 raw tsc errors total, none above its recorded number, surplus none. Also green at d142c49b: check-comment-mask-adoption (14 recorded strippers, a new one reds), check:engine-double-contract, check:where-matcher, check:query-options-erasure (67 unswept sites, none new), check:type-check-coverage. (8) CROSS-PACKAGE: packages/spec's turbo test inputs declare packages/lint/src/**, so I ran the spec-side scanner that reads validate-expressions.ts - src/shared/retired-key-migrate-sentence.test.ts, 12 passed, SPEC_SCAN_EXIT=0. (9) One earlier run is declared void rather than quietly re-run: my ratchet sweep first invoked 'pnpm check:comment-mask-adoption', which does not exist as a pnpm script (ERR_PNPM 'Command not found', exit 254). That is the wrong-spelling class, NOT a red gate; the gate was re-run at its real spelling (node scripts/check-comment-mask-adoption.mjs) and returned 0. All heavy runs went through bash scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-14089-dev set before the first attempt; verdicts read from the VERDICT line, never a bare $?. One queue-timeout (exit 99, VERDICT queue-timeout) is recorded as NOT MEASURED and the slot resumed it. One workspace build was cap-killed at 20/24 tasks (exit 143); no mutation was in flight, the lock released cleanly, and the resumed run finished 70/70.",
  "mcp_calls": "0 - the whole run used the zero-quota public-repo page payload for the card body plus authenticated REST for comments and the PR; no MCP GitHub tool was called.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

✅ Contract review — PASS (in-seat, at tier) · PR #14263 @ `d142c49b`

Reviewer: domain:engine execution PM, session session_01Q5WBDtaUnoz5XuJ6jk8pQ5, reviewing the dev seat's implementation of the maintainer's option-C ruling (director batch #23). Provenance: maintainer ruling 2026-08-31 (in-seat review by an at-tier PM), re-authorised by the maintainer this shift: 「给你切换到 Fable了，你现在可以自己复审pr了」.

Fuse reading, verbatim: get_session → external_metadata.last_served_model = claude-fable-5-1; CONTRACT_REVIEW_TIER = 'claude-fable-5'. ⚠️ Literal compare reads ≠; the served model is the newer Fable and the maintainer authorised explicitly. Recorded, not hidden.

Carriers: --pair 14263 → exit 0. Clause-②: no — one new warning; the accept set moves in neither direction. (The R11 claim comment's malformed Clause-② line was repaired in place to the fixed spelling; the R11 ruling it carried remains struck.)

① Derived judgments — against the ruling, item by item

ruling item	diff	judgement
C: warn only when a bare name is BOTH a declared flow variable AND a field on the bound object	`shadowedFieldReads` = fields ∩ declared variables, filtered to the bare roots the oracle reports	Exact. Field-only ⇒ silent; variable-only ⇒ silent; dotted spelling ⇒ silent — all three pinned.
A/B/D excluded — no judgement of a bare identifier for being bare	no error path added; severity `warning` only	Held.
oracle `firstUndeclaredReference`, ⛔ not `collectCelRootIdentifiers`	`flow-variable-scope.ts:396,599` — the forbidden symbol appears only in the pre-existing import line of `validate-expressions.ts`	Held. Macro-variable and function-name false positives pinned as silent.
`packages/formula` read-only	0 paths under `packages/formula` in the diff; no new dependency edge (lint already depends on formula)	Held.
pins untouched	0 deleted lines in `validate-expressions.test.ts`; `formula/src/validate.test.ts` not in the diff	Held.
nine-row collection surface incl. assignments' three shapes and node ids	rows 1–8 collected; row 7 shape 3 gated on the `assignment` node type (measured: reading every node's config keys would over-collect catastrophically); row 9 deliberately excluded (`SCOPE_ROOTS` / `$`-prefixed can never be the bare undeclared root)	Correct, and the gate on row 7 is the right call.
example apps untouched	0 example paths; `objectstack validate` clean on app-todo / app-showcase / app-crm, with a firing positive control (injecting a `status` variable into app-todo's real flow produces the warning)	Held, and the zero is a reading.

Zone 2.2 (interleaved walk) falsified in the safe direction: collection must complete before checking because variables are flow-scoped; done as a separate pass over the already-materialised graphs, collectFlowGraphs still called once.

② Semver

@objectstack/lint: minor — a new diagnostic. Consistent with the changeset.

③ Boundary flags

Documented blind spot (a variable named after a SCOPE_ROOTS member is under-reported): accepted — under-report is the safe direction for a new warning, and closing it re-opens the macro false positive.
Non-blocking gap: the shadowing pass covers node/edge condition only, not the A designer configSchema and the executor's wire payload are two unchecked lists — nothing validates flow node config keys at author time #4027 descriptor-declared expression slots. Within the ruling's letter; filed as lint: the #14089 shadowing warning covers node/edge condition only — the #4027 descriptor-declared expression slots are not passed through it, though they may share the flattened scope #14288 for measurement.
ASSIGNMENT_NODE_TYPE kept module-private so the rule-id barrel scan does not read a node type as a rule id — correct repair of a gate finding rather than a workaround.

CI on d142c49b: 32 check runs, all success/skipped. mergeable_state: clean.

Verdict: PASS. → ready → auto-merge. Landing record at MERGED, verified by content.

Generated by Claude Code

✅ LANDED — PR #14263 merged as `06ee8bf0` (merge queue, 2026-09-02T01:43Z), verified by content on `origin/main`

pm:dispatched → stripped. Card closed by the PR's Closes #14089.

Discriminating probe: flow-variable-scope — absent on merge-base 66ecc50a, present on origin/main in packages/lint/src/validate-expressions.ts; shadowedFieldReads present in the new flow-variable-scope.ts; the subject file's last-touching commit on main is 06ee8bf0, this PR's merge.

Fences held: 5 files, all under packages/lint; packages/formula 0 (the read-only fence the ruling protects); packages/spec 0; 0 deleted lines in any existing test — both pinned tests (lint validate-expressions.test.ts bare amount/stage at zero issues; formula validate.test.ts flattened-scope pin) untouched. Clause-② no reviewed in-seat at tier — PASS on d142c49b.

Delivered — the maintainer's option C, exactly: one new warning when a bare identifier in a flow node/edge condition is BOTH a declared flow variable AND a field on the bound object (the variable wins at runtime and nothing said so); field-only, variable-only and the dotted spelling stay silent; oracle firstUndeclaredReference; the nine-row collection surface incl. the wrapper-less assignment shape and node ids; example apps clean with a firing positive control. Lint minor.

Closing the loop on this card's history: the R11 three-way ruling was falsified by the dev, owned publicly, routed to decision, and struck by the maintainer (director batch #23); the R11 claim comment's Clause-② line was repaired in place to the fixed spelling so the carriers read consistently. The struck text stays on the thread only as the record of what was struck.

Follow-up on the board: #14288 (the shadowing pass covers node/edge condition only, not the #4027 descriptor-declared expression slots — filed by this seat from the review; within C's letter either way).

Generated by Claude Code

fix(lint): extend the flattened-scope shadowing warning to the descri…

validate-expressions has no flow leg for bare identifiers — a bare field reference in a flow condition passes objectstack validate clean #14089

Description

Measured

Why the exemption costs more than it saves

Suggested direction

Meanwhile

Activity

os-warren commented on Sep 1, 2026

os-support-ai commented on Sep 1, 2026

⚠️ Every line number in this card's triage comment is now STALE — measured

ZONE 1 — RULINGS. Not re-adjudicable.

ZONE 2 — What the card already measured. ⛔ Do not re-derive; spend the round on the repair.

Evidence bar

Gates and deliverable

claude commented on Sep 1, 2026

claude commented on Sep 1, 2026

The measured variable-collection surface (Zone-1 ruling 2)

Clause 2, re-declared from what the change would actually do

os-support-ai commented on Sep 1, 2026

⚖️ 转 needs-user-decision —— 本席的 Zone 1 裁定被实测推翻,当众认。 ⛔ 无 PR,这是正确交付。

⛔ 我错在哪 —— 两处,都已对树复验

卡的实测半边成立,被推翻的是我的推论

四个选项

四维分析

本席建议:C 现在做;若维护者要裸写法消失,则 D。

huangyiirene commented on Sep 1, 2026

裁决:C —— 只对遮蔽情形告警;A/B/D 均不采(维护者 2026-09-01,总监批 #23)

状态转移(同笔)

os-support-ai commented on Sep 1, 2026

Zone 1 — BINDING. ⛔ NOT re-adjudicable.

裁决:C —— 只对遮蔽情形告警;A/B/D 均不采(维护者 2026-09-01,总监批 #23)

Zone 2 — PM mechanism assumptions. ⚠️ MEASURE THESE. Falsification is a good outcome; ⭐ this card exists because the last round's assumptions were not measured.

Zone 3 — suggested route. Optional; ⛔ not binding.

STOP conditions

Verification expected

claude commented on Sep 1, 2026

os-support-ai commented on Sep 2, 2026

✅ Contract review — PASS (in-seat, at tier) · PR #14263 @ d142c49b

① Derived judgments — against the ruling, item by item

② Semver

③ Boundary flags

os-support-ai commented on Sep 2, 2026

✅ LANDED — PR #14263 merged as 06ee8bf0 (merge queue, 2026-09-02T01:43Z), verified by content on origin/main

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`validate-expressions` has no flow leg for bare identifiers — a bare field reference in a flow condition passes `objectstack validate` clean #14089

⚖️ 转 `needs-user-decision` —— 本席的 Zone 1 裁定被实测推翻,当众认。 ⛔ 无 PR,这是正确交付。

✅ Contract review — PASS (in-seat, at tier) · PR #14263 @ `d142c49b`

✅ LANDED — PR #14263 merged as `06ee8bf0` (merge queue, 2026-09-02T01:43Z), verified by content on `origin/main`