[finding] The strictness ledger's state-machine.zod.ts row still says formatZodError flattens a union branch away — it has not since #4971/#8318, and that stale sentence seeded a false-premise card

Filed unassigned from the #14722 run (PR #14975), which measured the ledger sentence against origin/main and found it stale. Not fixed there — out of that card's scope, and it needs the ledger owner's convention rather than a drive-by prose edit.

The stale sentence

docs/audits/2026-07-unknown-key-strictness-ledger.md, the state-machine.zod.ts row, present tense:

ActionRef / GuardRef are UNIONS: a strict branch's message does not reach the top (zod raises one invalid_union whose message is the literal "Invalid input", with the real prescription nested in issue.errors[]), which formatZodError then flattens away — filed, not fixed here.

The parenthesis is still true: zod does raise a keyless invalid_union and the prescription does sit in issue.errors[]. The clause after it is not. formatZodError no longer flattens anything — formatZodIssue descends invalid_union and ranks the branches through selectUnionBranches (packages/spec/src/shared/union-branch-policy.ts), dropping arms that only complain about the wrong kind and rendering the informative branch verbatim.

The card that sentence points at, #4971, is closed. So are its two siblings on the other doors: #5014 (the wire mapper, zodIssuesToFields) and #5341 (the CLI's own formatter). #8318 then consolidated the policy into the one module both spec-side consumers share. The ledger row was never updated.

Measured

On origin/main 3386493f, through the real defineStack door, an unknown key inside a union arm:

defineStack validation failed (1 issue):

  x devPlugins.0: Invalid input
    x devPlugins.0: Unrecognized key(s) on this package manifest: `namesapce`.
      Did you mean `namesapce` -> `namespace`? ...

The key, the surface and the rename all arrive. The cost of the union is one wrapper line, not a lost message. zodIssuesToFields behaves the same way, emitting a second entry with code: unknown_field.

Why it is worth a card rather than a silent edit

This is not a cosmetic docs nit — the stale sentence has already produced work on a false premise. #14722 was filed reporting that devPlugins[] leaves an author with a keyless message, reproducing this row's reasoning for a third site; triage graded it p3 and dispatched a schema reshape. The measurement above is what the implementer found instead, and the reshape was not performed because every available shape moves either the accept set or the published JSON Schema. The card cost a full dispatch cycle, and the ledger row will keep producing more of them: it explicitly generalises the claim as "a general constraint on every remaining union site in this campaign".

Two other places carry the same present-tense claim and should be read in the same pass (both in the same file, the chart.zod.ts and view.zod.ts rows):

"the named rejection reaches an author only through packages/lint/src/zod-issue-format.ts's arm unpacking" — spec's own renderer now unpacks too;
"the overlay path's rejection surfaces as invalid_union / "Invalid input" — the union 分支里的 unknown-key 处方永远到不了作者:zodIssuesToFields 只映射顶层 issue,失败的 union 只剩 Invalid input #5014 flattening, so the key that caused it is not in the message the author sees" — union 分支里的 unknown-key 处方永远到不了作者:zodIssuesToFields 只映射顶层 issue,失败的 union 只剩 Invalid input #5014 is closed.

What is wanted

A decision by the ledger's owner on how a row records a limitation that was later lifted elsewhere — the rows are deliberately written in the past tense of their own batch, so a blanket rewrite may be wrong. The narrow ask is that the three sentences above stop asserting, in the present tense, a flattening that no longer happens, and that they name union-branch-policy.ts as what lifted it.

pnpm --filter @objectstack/spec check:strictness-ledger is green and stays green either way — it grades row structure and the generated .counts.md, not prose accuracy. The companion .counts.md is os-regen generated and must not be hand-edited.

Not labelled pm:queue: this is an observation for triage to grade, and the fix is a judgement call about ledger convention rather than a mechanical edit.

Claim: PM loop round 1 (wave 2, 2026-09-08T03:40Z)
Session: session_016N6xmWt5hYm94ffVEwGH8x
Branch: claude/issue-14977-strictness-ledger-stale-flattening
Worktree: objectstack-issue-14977
Domain: domain:spec
File surface: docs/audits/2026-07-unknown-key-strictness-ledger.md (stop on breach; explain in the report)
Container & model: S/M, mode:subagent, model: claude-opus-5 = TIER_DEFAULT (dispatch-gates.mjs:10195). --tier run this dispatch over the ledger path returns no path mandate and no Clause-② path hint; the card corrects prose that asserts a behaviour the tree no longer has — the accept set does not move and no public surface widens ⇒ ordinary tier, judged from card CONTENT.
Clause-②: no
Thread-read: none (the card carries zero comments — triage graded it by label with no audit comment; noted as a triage gap in the round report, ⛔ not corrected here, and the labels stand as authoritative)
Serial constraints cleared: docs/audits/2026-07-unknown-key-strictness-ledger.md — no open lane card names it and none is in flight. Wave-2 sibling #15543 lands in packages/spec/src/api/rest-server.zod.ts + liveness rows + docs/qa/** — DISJOINT. #14791 (in flight) lands in packages/spec/src/ui/react-blocks.ts + examples/app-showcase + skills/objectstack-ui — DISJOINT. Lane work by another session: #16510 / PR #16592 — DISJOINT. This seat's PR #16750 (#16685) touches packages/spec/src/data/** + two .changeset files — DISJOINT. ⛔ Fence honoured: PR #16618 / card #16041 not touched.

Assignee note. zhuangjianguo is this AGENT session's presence bit, not a human assignment — this container authenticates as that account. Identity is the session ID above. ⇒ An agent recovering this card ⛔ must NOT treat the field as a human assignment exempt from clearing.

Premises re-verified on origin/main 5e53d73 at 03:36Z before claiming — all three named sentences are still present and the module that lifted the behaviour exists:

formatZodError occurs exactly 1× in the ledger, at :737 (the state-machine.zod.ts row) — the stale clause 「which formatZodError then flattens away」 stands.
:676 (the chart.zod.ts row) still carries 「The named rejection reaches an author only through packages/lint/src/zod-issue-format.ts's arm unpacking」.
:940 (the view.zod.ts row) still carries 「the overlay path's rejection surfaces as invalid_union / "Invalid input" — the union 分支里的 unknown-key 处方永远到不了作者:zodIssuesToFields 只映射顶层 issue,失败的 union 只剩 Invalid input #5014 flattening」.
packages/spec/src/shared/union-branch-policy.ts exists (blob 53fc1a11) — the module the correction must name.

Generated by Claude Code

os-dev-report

{
  "issue": 14977,
  "status": "done",
  "branch": "claude/issue-14977-strictness-ledger-stale-flattening",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16766",
  "premise_still_valid": true,
  "summary": "The card's premise held on re-measurement: all three named clauses were still present, packages/spec/src/shared/union-branch-policy.ts exists, and #4971 / #5014 / #5341 are all closed-completed. Corrected exactly the three clauses the card names, at ledger lines 676, 737 and 940 — 3 insertions, 3 deletions, file length unchanged at 1870 lines, .counts.md untouched. Provenance changed the edit SHAPE and is the run's own finding: git log -S dates :737 (2026-08-04, batch 10) and :940 (2026-08-04, #5114 hotfix) BEFORE the flatteners landed, so both were true when written and expired 2026-08-05; but :676 was written 2026-08-08 by #5583, three days AFTER #4971/#5014/#5341, so it was already false the day it was written and the row's own 'kept as WRITTEN AT THE TIME' rule cannot rescue it. So :737 and :940 are re-tensed into their own batch plus a LIFTED note naming union-branch-policy.ts, while :676's 'only' is struck outright and the generalisation it grounded is withdrawn. The broader convention question the card raises is NOT settled here and did not have to be: the file already demonstrates the idiom in two rows outside this diff (the chart row's 'That fix landed at #5020, and this row's no gate verdict is spent' and the api/ row's 'correct when written and then silently expired'). PR says 'Part of #14977', not a closing keyword, so merging leaves the card open for the ledger owner's convention ruling. The PM claim comment 5578764440 names this branch; assignee not written, no second claim posted.",
  "tests": "GREEN IS NOT EVIDENCE: check:strictness-ledger grades row structure and the generated counts, not prose, and is green either way — it is reported but proves nothing about this diff. The evidence is a reproduction through the real doors, on this branch at 88717a548 with @objectstack/spec freshly built (build under scripts/pm/os-verify-lock.sh, VERDICT command-exit 0). (A) defineStack on an agent whose lifecycle.states.idle.entry[0] is { type: 'log', parms: { a: 1 } } — the state-machine.zod.ts row's OWN door — prints two lines: 'x agents.0.lifecycle.states.idle.entry.0: Invalid input' then, indented, 'Unrecognized key(s) on this action reference: `parms`. Did you mean `parms` -> `params`? ...'. Nothing is flattened. (B) same body through zodIssuesToFields yields two entries, the second code=unknown_field carrying the same prescription. (C) the raw top-level issue is still code=invalid_union message=\"Invalid input\" branches=2, so the parenthesis each corrected row KEEPS is still true. (D) ChartAggregateSchema.safeParse({field:'amount',function:'sum',groupBy:{field:'stage',dateGranularty:'month'}}) rendered by spec's own formatZodError — no packages/lint in the path — prints 'x groupBy: Invalid input' then 'Unrecognized key(s) on this chart groupBy: `dateGranularty`. Did you mean `dateGranularty` -> `dateGranularity`? ...', which is what falsifies the :676 clause. Mechanism read in source: formatZodIssue (shared/error-map.zod.ts:254) descends invalid_union and calls selectUnionBranches; zod-issues-to-fields.ts:213 calls the same function; one implementation since #8318. Dating legs: git log -S per clause; git merge-base --is-ancestor 546ab3c49 e0f300ba5 exit 0 (self-proving direction, no control leg needed) proves spec's renderer was already unpacking in the tree of the commit that wrote :676; repo is not shallow (git rev-parse --is-shallow-repository = false). The probe was a scratch file inside the worktree, run and deleted; no test file is added or changed by this PR, and no ablation applies — the deliverable is prose, not a guard.",
  "gates": "Derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, then reconciled with --ran: '17 derived famil(ies) accounted for — 17 run, 0 NOT-MEASURED' / 'Run reconciliation — 17 derived, 17 run, 0 NOT-MEASURED, 0 UNRUN'. All 17 exit 0. Exit codes captured before any pipe (cmd > log 2>&1; ex=$?). Gate verdict lines quoted rather than bare $?: 'check strictness ledger: 60 file(s) across 5 triaged director(ies) — every row names a live sited file'; 'docs/audits/2026-07-unknown-key-strictness-ledger.counts.md is current — 444 site(s) measured, 1 authorable strip site(s) left'; 'check-nul-bytes: OK (scanned 8275 text file(s) ... no raw ASCII control bytes)'. One gate, pnpm --filter @objectstack/lint run check:doc-formula-expressions, first returned exit 3 = PREREQUISITE NOT MET (its own words: 'Nothing was measured'); @objectstack/formula and @objectstack/lint were built as it instructed (under the verify lock, exit 0) and it was re-run to exit 0 — only the second run is recorded as measured. The first derivation warned STALE TREE and named scripts/pm/dispatch-gates.mjs itself as changed in the range, so origin/main was fetched and merged (88717a548) and the derivation re-taken; the warning cleared. NOT MEASURED and outside this run by the tool's own accounting: 2 families whose argv takes a value from the workflow (check-shard-attestation, check-test-completeness), 10 families declaring a population too wide to place, 42 artifact-roster families whose silence is a fact about a list, and the always-runs tail. No repo-wide eslint run: pnpm lint is a CI-owned run, not narrowed by these paths.",
  "line_budget": "No skills/** path in the diff, so no published-skill line or token ratchet applies. Ledger file: 1870 lines before and after; git numstat 3 insertions / 3 deletions on one file, net 0 lines. The three edits rewrite three existing table-row lines in place; no row added, no row removed, no Class cell touched, so no generated count moves (check:strictness-ledger confirms .counts.md is still current at 444 sites).",
  "deviations": [
    "PR body opens 'Part of #14977', NOT 'Fixes #14977' — deliberate. The card asks for two things and one of them, the ledger owner's convention decision, was explicitly excluded from this dispatch; a closing keyword would silently close the card on that open half.",
    "A fourth site in the same file carries the same false claim and is NOT corrected — see out_of_scope_findings. The do-not-widen instruction was honoured over completeness; flagged instead.",
    "origin/main was merged into the branch (88717a548) because dispatch-gates refused the first derivation as STALE TREE and named its own script as the changed file. gen:schema was NOT run in merge state; nothing needed regenerating.",
    "One locked build exceeded the 600s foreground cap and the harness moved it to the background. It was waited out IN-TURN with tail --pid on the lock holder, then its os-verify-lock VERDICT line was read; no turn ended in a waiting posture and no polling loop was used.",
    "GitHub channel for this run was repo-scoped REST (probed 200 on the first read, 201 on the PR create), so mcp_calls is 0. The skip-changeset label was written with the additive POST endpoint and read back: labels are now size/xs (set by the size labeler, another actor, left alone) and skip-changeset. Nothing was stripped.",
    "PR body read back after creation and compared byte-for-byte against what was sent: identical except one collapsed blank line and the trailing newline; the session-URL attribution footer survived verbatim, footer count 1, all fenced blocks intact, no sanitizer loss."
  ],
  "files_changed": ["docs/audits/2026-07-unknown-key-strictness-ledger.md"],
  "mcp_calls": "0 — every GitHub read and write in this run went through repo-scoped REST; no MCP GitHub tool was called.",
  "open_questions": [
    {
      "question": "The card's other half is still open: how should a ledger row record a limitation that was later lifted elsewhere? This PR did not settle it — it applied the idiom the file already demonstrates in two rows outside the diff. The ledger owner still owes a rule, and it decides the fourth site below.",
      "options": [
        "A. Ratify the applied idiom as the convention — a row keeps its batch-tense text and gains an inline LIFTED/spent note naming the module or card that lifted it, with the exception that a clause which was FALSE AT ITS OWN BATCH is corrected outright rather than re-tensed.",
        "B. Rule that batch-tense rows are immutable records and every expiry is recorded once, centrally, in a new 'expired claims' section, leaving the rows alone.",
        "C. Blanket-rewrite the ledger into a uniform past tense — the option the card itself warns may be wrong, since rows are deliberately written in the past tense of their own batch."
      ],
      "recommendation": "A, because it is the only option already evidenced in the file (two rows use it unprompted), it needs no new section and no sweep, and it is the only one that handles the case this run actually found — a clause that was false on the day its own batch wrote it, which B records in the wrong place and C would silently launder into a plausible-sounding past-tense sentence."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: docs/audits/2026-07-unknown-key-strictness-ledger.md lines 973-978 carry a FOURTH instance of the same false claim — 'The zod-4 union collapse is now load-bearing on this file ... What carries the named surface and the rename to the author is packages/lint/src/zod-issue-format.ts arm unpacking ... a general fact about this campaign's remaining union sites'. Same commit as the :676 clause (e0f300ba5, 2026-08-08), therefore also already false when written. Left alone because it is framed as 'Two things #5583 recorded that a later batch will need' — a record of its own batch, the exact shape this dispatch said not to touch — and because card and dispatch both name three sentences. Consequence to accept knowingly: after this PR the file carries a corrected chart row and an uncorrected restatement of it 300 lines below. Successor is real, not none: this card stays open for the ledger owner's convention ruling and this site is decided by that same ruling.",
    "noted, not filed: the ledger never names #4971 anywhere — the state-machine row filed the flattening with the words 'filed, not fixed here' and no number, which is part of why the filing was hard to follow to its fix. The corrected clause now names it. Successor: the same ledger-owner pass.",
    "noted, not filed: the dashboard.zod.ts row at :673 mentions the #5014 flattening too, but is already framed as 'batch 14 recorded that ...' and already carries its own RESOLVED note. Correct as written; verified and deliberately not touched. Successor: none needed."
  ]
}

Generated by Claude Code

ACCEPT — PR #16766, head `88717a548`

domain:spec seat, session session_016N6xmWt5hYm94ffVEwGH8x, R1, reading taken 2026-09-08T04:18Z. Clause-②: no (prose only; no accept set moves) ⇒ ordinary tier, reviewed in-seat. ⛔ Verified against the tree and GitHub, ⛔ not against the report's self-description.

Checklist conclusions, each with the reading I took

item	reading
PR form	draft, base `main`, first line `Part of #14977` — and the `Part-of PR must not also close its card` check is green, so the card correctly stays open for its unsettled half
Path face (`get_files`, ⛔ not the body)	1 file, `docs/audits/2026-07-unknown-key-strictness-ledger.md`, +3/−3. Zero governed-surface hits (`docs/adr/`, `.claude/`, `skills/`, `AGENTS.md`, `CLAUDE.md`) ⇒ ordinary path**, not the terminal four-step
Scope held	`git diff --name-only` off the merge base returns that one file; the os-regen `.counts.md` is untouched, as the card required
Changeset	`skip-changeset`, and `Check Changeset` is skipped accordingly — consistent, not silently absent
Gates	`--ran` reconciles 17 derived / 17 run / 0 NOT-MEASURED / 0 UNRUN
CI at 04:18Z	33 checks, 0 failures; `Governed Surface Queue Guard`, single-writer-path, `Spec property liveness`, `Dogfood Regression Gate`, Test Core 3/4/5/6 green; Test Core 1–2 and the Type Check jobs still `in_progress` — an honest reading, ⛔ not a pass

⭐ The load-bearing claim, re-measured by me rather than accepted

The PR's edit shape rests on a novel finding: that the three sentences are not the same case, because :676 was already false on the day it was written, so re-tensing it into "at the time, X" would have written a new false sentence. I verified that independently:

546ab3c49 (formatZodError lift)  2026-08-05 00:23:55
e0f300ba5 (wrote the :676 clause) 2026-08-08 09:30:53
git merge-base --is-ancestor 546ab3c49 e0f300ba5  → exit 0

⇒ Confirmed. The lift was in the tree three days before the clause was written. So striking the only and withdrawing the generalisation — rather than re-tensing — is the correct treatment, and the two genuinely-expired clauses (:737, :940) correctly get the file's own ✅ … LIFTED idiom instead.

⭐ The dev also found the file's existing idiom for an expired verdict (two instances outside this diff) and applied it per clause. That is why the card's open convention question did not have to be settled to deliver the narrow ask — the right call, and it is why this PR is 3 lines instead of a ledger rewrite.

⚠️ A correction to my own reading, recorded because it nearly became a false finding

I first checked the PR's 验收备注 claim about a fourth stale site by slicing lines 973-978 and grepping for the sentence — 0 matches, which read as an unsupported claim. That zero was false: the sentence wraps across lines, so a single-line pattern over a line slice cannot match it. Grepping the whole file finds it at :976, exactly as the PR says (control: zod-issue-format.ts occurs 2× in the file, so the file was being read). The dev's flag is correct and mine was the error — 「零命中必须用确定存在的邻近词反查,否则零命中不成立」, and this is why.

That fourth site is correctly left alone: it is framed as "what #5583's batch recorded", which is precisely the WRITTEN-AT-THE-TIME shape the card told the dev not to touch, and the card names three sentences. ⚠️ But it means the file now carries a corrected chart row and an uncorrected restatement of the same claim ~300 lines below. That belongs with the convention ruling, and is noted on the card rather than filed — a stale prose sentence is not a reproducible defect, a declared-contract violation, or a metadata-authoring trap.

Disposition

⛔ Not enqueued yet: 「入队资格 = PR 上每一个 check 全绿」, not the required subset, and several checks are still in_progress. PR flipped to ready; it enters the merge queue once every check is green and I have re-read them.

⚠️ This card stays OPEN after the PR merges — it is Part of, not Fixes. What lands is the narrow ask; what remains is the ledger-convention question (「how does a row record a limitation later lifted elsewhere」), plus the fourth site above. On merge this seat will release the card in one write — assignee cleared, Release: line naming the landed item and the remainder — and route the remainder rather than leaving it wearing pm:dispatched.

Generated by Claude Code

Seat ruling — the ledger's convention is A: keep batch tense, add a `LIFTED` note; correct outright only a clause that was false at its own batch

domain:spec seat, session session_016N6xmWt5hYm94ffVEwGH8x, R1, 2026-09-08T04:24Z. This settles the card's remaining half. ⚠️ Ruled in seat, not escalated — reasoning below, and a maintainer veto reverses it at the cost of one comment.

Why this is not the maintainer's to answer

Escalation gate: 「明显的问题直接修,大多数感觉像决定的不是决定」, and escalation needs a real divergence in product semantics or public contract shape, or a destructive / hard-to-reverse action. This is neither. docs/audits/** is an internal audit document in this lane's own package family: it ships in no package's files[] (checked across all 70 that declare one) and the root package is private: true. Nothing here touches a published contract, a security or permission boundary, a product capability, or gate strength — the four manual floors. The card asked for "the ledger owner's convention"; on a packages/spec artifact that owner is this seat.

The ruling

A — ratify the idiom the file already practises. A row keeps its own batch-tense text and gains an inline ✅ … LIFTED / "verdict is spent" note naming the module or card that lifted it. Exception: a clause that was already false on the day its own batch wrote it is corrected outright — the WRITTEN AT THE TIME rule cannot rescue a sentence that was never true at that time.

⛔ B (immutable rows plus a central "expired claims" section) and ⛔ C (blanket rewrite into uniform past tense) are refused.

📋 四棱 — four axes aligned, which is why the confidence bar is met

实际业务需求 — 拉动已实测，不是「读起来有用」：这条陈旧断言已经真金白银地花掉了一个完整派发周期（stack.devPlugins[] hides ManifestSchema's named unknown-key refusal under invalid_union — an author sees a keyless "Invalid input" at that one door #14722 依据本行推理立卡，实测行为后无修改关闭）。台账的读者就是做严格性工作的 agent，而它正在教错东西。
项目长远合理性（权重 ≥50%） — 指向 A，且这是唯一文件自己已经在用的写法：chart 行的「✅ That fix landed at ChartAggregateSchema 有活的承载键却没有任何 parse:react 页发布闸门手写重推了它的规则,未知键从不检查(#4001 批 15 的 no gate 首例) #5020, and this row's no gate verdict is spent」与 api/ 行的「correct when written and then silently expired」，两处都在本次 diff 之外、无人指使地这么写。⇒ A 是记录既有实践，B/C 是发明新流程。
防 AI 写错 — 指向 A，而且 C 是主动有害的：把 :676 洗成「当时如此」会生成一句从来没有真过的过去时陈述 —— 比现状更糟，因为它读起来可信。A 把更正留在断言旁边，也就是下一个读者所在的位置；B 把它放到几百行外的另一个小节，读者读到假话时看不到更正。
创业阶段不扩散 — 指向 A：零新增。B 要新开一个小节并配一次 sweep，C 要重写整份台账。A 不加小节、不加门禁、不加维护面。

四棱四条同向，且不在任何人工地板上 ⇒ 席位可裁。

What this ruling decides, concretely

PR docs(audits): the strictness ledger stops asserting a union flattening the tree no longer does #16766 is correct as written — it applied exactly this convention, and its treatment of :676 (strike the only, withdraw the generalisation, rather than re-tense) is what the exception clause requires. Already ACCEPTed.
The fourth site is now decided. docs/audits/2026-07-unknown-key-strictness-ledger.md:976 carries the same claim from the same commit (e0f300ba5, 2026-08-08) and is therefore also false at its own batch ⇒ under the exception it is corrected outright, not preserved. That is the card's only remaining work.
⛔ No other row is touched. Rows whose text was true when written keep it and get a LIFTED note if and when their limitation lifts — including dashboard.zod.ts:673, which the dev verified is already correctly framed and already carries its own RESOLVED note.

Disposition of this card

Once PR #16766 merges, this card is released in one write — assignee cleared, Release: line — and returns to pm:queue carrying item 2 above as its whole remaining scope: apply this convention to :976. It is small, mechanical against a now-written rule, and independently verifiable, so it is ordinary queue work rather than a decision.

⚠️ Veto window, not a permission gate. This is reversible (one revert of a prose diff) and has a stated recommendation, so it is declared-and-executed rather than held for approval. If the maintainer prefers B or C, say so and this seat rewrites :676, :737, :940 and :976 to whichever shape is chosen — the cost is one PR either way.

Generated by Claude Code

Partial landing — PR #16766 MERGED; card RELEASED back to `pm:queue` with its scope narrowed

Release: session session_016N6xmWt5hYm94ffVEwGH8x · cause = partial landing (Part of, ⛔ not Fixes, so the card does not close) · destination = pm:queue, remaining scope narrowed to one item. assignee cleared in the same write; labels read back as documentation, priority:p2, pm:queue, domain:spec, finding.

MERGED — confirmed on two readings, ⛔ not on the event alone

The merge event for PR docs(audits): the strictness ledger stops asserting a union flattening the tree no longer does #16766.
The tree itself, origin/main 941232040: union-branch-policy now occurs 3× in the ledger (the three corrected clauses), and the stale 「formatZodError then flattens away」 occurs 0×. Control: strictness occurs 64× in the same file, so the zero is a real zero and not an unreadable path.

What landed

The card's narrow ask, and only that: the three present-tense clauses at the state-machine.zod.ts, chart.zod.ts and view.zod.ts rows stop asserting a union flattening the tree no longer performs, and each now names packages/spec/src/shared/union-branch-policy.ts as what lifted it. 1 file, +3/−3; the os-regen .counts.md untouched.

⭐ The delivery's own finding, which changed the edit shape and which I re-measured myself before accepting: :676 was already false on the day it was written (git merge-base --is-ancestor 546ab3c49 e0f300ba5 → exit 0; the lift landed 2026-08-05, the clause was written 2026-08-08). So it could not be re-tensed into "true at the time" — that would have written a new false sentence. Its only was struck and the generalisation it grounded withdrawn, while the two genuinely-expired clauses got the file's own LIFTED idiom.

What remains — the whole of this card's open scope

One item: docs/audits/2026-07-unknown-key-strictness-ledger.md :976 carries a fourth instance of the same claim (「a strict object arm inside a union is only as loud as its consumer's unpacking … a general fact about this campaign's remaining union sites」), from the same commit e0f300ba5 as :676 and therefore also false at its own batch. Verified still present on origin/main 941232040 as this is written.

Under the convention ruled on this card (comment 5579112979, seat ruling A), a clause false at its own batch is corrected outright rather than preserved as a WRITTEN-AT-THE-TIME record — so this site is now decided, not open. That makes the remainder small, mechanical against a written rule, and independently verifiable ⇒ ordinary queue work, ⛔ not a decision.

⚠️ Until it lands, the file carries a corrected chart row and an uncorrected restatement of it ~300 lines below. That is a knowingly-accepted interim state, recorded here so the next reader does not mistake it for an oversight.

⛔ Not done here

The convention question itself is settled (ruling A, with a maintainer veto window that remains open). ⛔ No other row was touched; rows whose text was true when written keep it — including dashboard.zod.ts:673, verified as already correctly framed with its own RESOLVED note.

Generated by Claude Code

Claim: PM loop round 1 (wave 3 — the card's REMAINING scope, 2026-09-08T05:12Z)
Session: session_016N6xmWt5hYm94ffVEwGH8x
Branch: claude/issue-14977-fourth-site-anchor
Worktree: objectstack-issue-14977b
Domain: domain:spec
File surface: docs/audits/2026-07-unknown-key-strictness-ledger.md (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: claude-opus-5 = TIER_DEFAULT. Clause-②: no — prose in a repo-internal audit document; no accept set moves and no published surface widens. The enqueue gate's PATH limb (packages/spec/src/**) is not reached.
Clause-②: no
Thread-read: 5579532017
Serial constraints cleared: docs/audits/2026-07-unknown-key-strictness-ledger.md — the only prior writer was PR #16766, MERGED 05:01Z, so the file is free and the branch starts from a main that already carries it. No open lane card names it. In-flight siblings: #15080 (packages/spec/liveness/action.json), #15618 (packages/spec/scripts/check-objectui-pin-citations.ts) — DISJOINT. Under review: PR #16775 (#15543, packages/spec/src/api/** + endpoint ledgers) and PR #16777 (#14791, packages/spec/src/ui/** + examples + skills + content/docs) — DISJOINT from docs/audits/. ⛔ Fence honoured: PR #16618 / card #16041 not touched.

Assignee note. zhuangjianguo is this AGENT session's presence bit, not a human assignment; identity is the session ID above.

This is a re-claim of the card's narrowed remainder, not a re-open of what landed. PR #16766 delivered the narrow ask and merged; this card was released back to pm:queue with exactly one item left, and the convention that decides it is already ruled on this card (comment 5579112979, seat ruling A). The remaining work is therefore mechanical against a written rule, ⛔ not a decision.

Generated by Claude Code

docs(audits): correct the strictness ledger's fourth union-flattening…

os-dev-report

{
  "issue": 14977,
  "status": "done",
  "branch": "claude/issue-14977-fourth-site-anchor",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16792",
  "premise_still_valid": true,
  "summary": "Delivered the card's whole remaining scope: the fourth instance of the union-flattening claim, in the ui/ batch narrative's clause (a). Location re-derived rather than trusted -- the pre-merge :976 reading is now :969-989 on origin/main ed7243d52, and the sentence wraps across lines, so it was found with a wrap-aware block search, not a line grep. Corrected outright per ruling A's exception, whose precondition I re-measured myself: the clause was written by e0f300ba5 (2026-08-08), the SAME commit as the already-corrected :676, and git merge-base --is-ancestor 546ab3c49 e0f300ba5 exits 0 (self-proving direction; repo not shallow), so the #4971 lift was in the tree three days before the clause was written. The edit strikes the cleft that made packages/lint the author's only route, strikes the trailing generalisation, turns 'only as loud as' into 'exactly as loud as', and names packages/spec/src/shared/union-branch-policy.ts -- the same treatment :676 received. Both statements of the mechanism now read identically, which was the consistency requirement. The kept parenthesis (zod still raises a keyless invalid_union / 'Invalid input') is untouched and re-verified true. .counts.md not hand-edited; no other row touched; :673 not touched. The PM claim comment 5579621256 names this branch; assignee not written, no second claim posted.",
  "tests": "GREEN IS NOT EVIDENCE, and it is not presented as any: check:strictness-ledger grades row structure and generated counts, not prose, and is green either way. The evidence is a reproduction through the door the paragraph itself names, on this branch with @objectstack/spec freshly built (build under scripts/pm/os-verify-lock.sh, VERDICT command-exit 0, slot issue-14977b-dev). ChartAggregateSchema.safeParse({field:'amount',function:'sum',groupBy:{field:'stage',dateGranularty:'month'}}) rendered by SPEC's own formatZodError -- no packages/lint in the path -- prints 'x groupBy: Invalid input' and, indented beneath it, 'Unrecognized key(s) on this chart groupBy: `dateGranularty`. Did you mean `dateGranularty` -> `dateGranularity`?'. The surface, the offending key and the rename all arrive, which is exactly what the corrected clause asserts. The raw top-level issue is still code=invalid_union path=[\"groupBy\"] message=\"Invalid input\" branches=2, so the parenthesis the paragraph KEEPS is independently re-verified. Mechanism read in source: formatZodIssue (packages/spec/src/shared/error-map.zod.ts:221) descends invalid_union and calls selectUnionBranches; packages/spec/src/api/zod-issues-to-fields.ts:51 imports the same function -- one policy since #8318; union-branch-policy.ts present (10648 bytes). Dating legs, both with exit codes: is-ancestor 546ab3c49 e0f300ba5 = 0 (target, self-proving); is-ancestor 546ab3c49 d17df8017 = 1 (the :673 candidate, negative reading) with control leg is-ancestor d17df8017^ d17df8017 = 0, and git rev-parse --is-shallow-repository = false. The probe was a scratch .mjs inside the worktree, run under a restore trap on EXIT INT TERM and deleted; absence verified on disk and git status is clean. No test file added or changed; no ablation applies -- the deliverable is prose, not a guard, so there is no guard to make fail.",
  "gates": "Derived, never guessed: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack docs/audits/2026-07-unknown-key-strictness-ledger.md (stderr attests repo objectstack-ai/objectstack at commit 553f98d36, --repo checked against this checkout's origin and it holds). 17 families. Reconciled with --ran: 'Run reconciliation - 17 derived, 17 run, 0 NOT-MEASURED, 0 UNRUN' / '17 derived famil(ies) accounted for - 17 run, 0 NOT-MEASURED'. All 17 exit 0, every code captured before any pipe (cmd > log 2>&1; ex=$?), logs on disk. Gate verdict lines quoted rather than bare $?: 'strictness ledger: 60 file(s) across 5 triaged director(ies) - every row names a live sited file'; 'docs/audits/2026-07-unknown-key-strictness-ledger.counts.md is current - 444 site(s) measured, 1 authorable strip site(s) left'; 'check-nul-bytes: OK (scanned 8282 text file(s) ... no raw ASCII control bytes)'; 'doc authoring guard: 46 published skill files clean'. One family, pnpm --filter @objectstack/lint run check:doc-formula-expressions, first returned exit 3 = PREREQUISITE NOT MET in its own words ('Nothing was measured: this gate exited before running a single check'); @objectstack/formula and @objectstack/lint were built exactly as it instructed, under the verify lock (VERDICT command-exit 0), and it was re-run to exit 0 -- only the re-run is recorded as measured, and the exit 3 is NOT recorded as a failed measurement. NOT MEASURED and outside this run by the tool's own accounting: 2 families taking a value from the workflow (check-shard-attestation, check-test-completeness), 10 declaring a population too wide to place, 43 artifact-roster families whose silence is a fact about a list (9 of them --self-test checker-health only), and the always-runs tail. No repo-wide eslint run: pnpm lint is a CI-owned run, not narrowed by this path.",
  "line_budget": "No skills/** path in the diff, so no published-skill line or token ratchet applies. Ledger file 1870 -> 1893 lines (+23); git numstat 27 insertions / 4 deletions, one file. The +23 is the inline CORRECTED note, matching the shape :676 received. No table row added or removed and no Class cell touched, so no generated count moves -- check:strictness-ledger confirms .counts.md is still current at 444 sites. 4 deletions rather than 3 because the (b) sentence's wrap joint was re-wrapped INSIDE my own inserted text, so the untouched (b) prose keeps byte-identical wrapping and contributes zero churn; max line length in the edited region is 81 chars, matching the file's prose convention.",
  "deviations": [
    "PR body opens 'Fixes #14977', NOT 'Part of'. Deliberate and grounded in the seat's own release comment 5579532017, which narrowed this card to exactly one remaining item ('What remains -- the whole of this card's open scope: One item: :976') and recorded the convention question as settled by ruling A. Delivering that item empties the scope, so a closing keyword is correct here where it was wrong for PR #16766. The card carries no needs-user-decision label and is not in a decision box.",
    "A FIFTH claim-bearing clause exists at :673 and is deliberately NOT corrected -- it is out of ruling A's exception (measured true when written) AND explicitly fenced by this dispatch. See out_of_scope_findings; it is the sweep's real result and is reported, not filed.",
    "GitHub channel for this run was repo-scoped REST throughout (probe 200 on the first read, 201 on the PR create), so mcp_calls is 0. skip-changeset was written with the additive POST endpoint and read back: labels are now size/s (set by the size labeler, another actor, left alone) and skip-changeset. Nothing was stripped.",
    "PR body read back in full after creation and compared against what was sent: identical apart from the trailing newline (8807 -> 8806 chars). Footer count 1, session-URL form survived verbatim, 12 fence markers (even), no HTML comment anywhere, first line still 'Fixes #14977'.",
    "No changeset written. skip-changeset was measured, not assumed: root package private: true, docs/audits/ is a repo-root path outside every package directory so no package-relative files[] can reach it, and 0 of the 23 files[] declarations name it. The derivation's '13 families apply once this card's changeset exists' is therefore correctly not reached.",
    "Both heavy builds went through scripts/pm/os-verify-lock.sh with a stable OS_VERIFY_LOCK_SLOT (issue-14977b-dev); lock was free on both takes (waited 0s), so no queueing occurred and no turn ended in a waiting posture."
  ],
  "files_changed": [
    "docs/audits/2026-07-unknown-key-strictness-ledger.md"
  ],
  "mcp_calls": "0 -- every GitHub read and write in this run went through repo-scoped REST; no MCP GitHub tool was called.",
  "fifth_site_sweep": {
    "result": "No fifth site to correct. One adjacent claim found, reported not filed.",
    "method": "Two independent passes plus a positive control, because a single-line grep over a line slice already produced one false zero on this card. (1) Wrap-aware pass: the file was normalised into 243 blank-line-separated blocks with newlines folded to spaces -- necessary because the target sentence itself wraps -- and matched against 11 pattern families (flatten*, collaps*, 'as loud as', invalid_union, 'Invalid input', zod-issue-format, formatZodError|formatZodIssue|zodIssuesToFields|selectUnionBranches, unpack*, 'never reaches|does not reach|not in the message', #4971|#5014|#5341, and the LIFTED/RESOLVED/CORRECTED note vocabulary): 7 candidate blocks. (2) Orthogonal completeness pass: any statement of this claim must name a union, so a second pass enumerated on the word 'union' ALONE, with no formatter or flattening vocabulary at all: 15 blocks, and it surfaced no claim-bearing block the first pass had missed. (3) Positive control: both passes return all four known sites (:676, :737, :940, :976), so the zero elsewhere is a real zero and not an unread file.",
    "classification": "3 of the 7 candidates are word-sense false positives (a COLLAPSED accordion group at :215-237, a 'flattened' Studio overlay data shape at :437-443, 'Collapsing' two ledger rows at :1199-1209) -- none is about error flattening. 3 are the sites PR #16766 already corrected (:676, :737 LIFTED, :940 LIFTED). 1 is this PR's target (:969-989). The remaining finding is a SECOND clause inside the :665-681 block, on the dashboard.zod.ts row at :673, which no prior pass on this card examined."
  },
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: docs/audits/2026-07-unknown-key-strictness-ledger.md :673 carries a SECOND, distinct clause beside the batch record that two prior readings on this card verified as correctly framed -- 'a #5014 still binds every OTHER curated message this campaign has put inside a union arm b this row is one slot's correction, not the finding's retraction'. It is present tense and no longer describes the tree. Crucially it is NOT ruling A's correct-outright case, and I measured that rather than assuming: git log -S dates it to d17df8017 (2026-08-04, #5011), and git merge-base --is-ancestor 546ab3c49 d17df8017 exits 1 with control leg d17df8017^ exiting 0, so the lift was NOT in the tree when it was written -- it was TRUE when written and expired the next day, which under ruling A is the LIFTED-note case, a different edit from this PR's. Also explicitly fenced by this dispatch ('do not touch :673'). Not filed because a stale prose sentence is not a reproducible defect, a declared-contract violation, or a metadata-authoring trap -- the same grading the seat applied to the fourth site. Successor: this seat, on the ledger-convention pass ruling A opened; the prior readings looked at :673's batch-record clause and its RESOLVED note, not at this sentence. Worth noting it is the most consequential surviving phrasing, since 'every OTHER curated message ... inside a union arm' is the same generalisation that seeded the false-premise card.",
    "noted, not filed: the ui/ narrative paragraph corrected here is framed 'Two things #5583 recorded that a later batch will need', which reads as a WRITTEN AT THE TIME record and is exactly why the first pass on this card left it alone. Ruling A's exception overrides the framing, but the framing itself now sits above a CORRECTED note, which is slightly odd to read. Left as-is deliberately: rewriting the paragraph's opening would be the blanket-rewrite the card and Zone 2 forbid. Successor: this seat, same convention pass."
  ]
}

Generated by Claude Code

Closed by PR #16792 — whole scope delivered; `pm:dispatched` and the assignee released in one write

domain:spec execution seat, session session_016N6xmWt5hYm94ffVEwGH8x, 2026-09-08T06:08Z (clock read).

PR #16792 merged at 06:07:17Z and closed this card via Fixes (state_reason: completed). Together with PR #16766 this discharges the card's full scope: all four instances of the union-flattening claim are corrected — :676, :737, :940 in the first PR, and the ui/ batch narrative's clause (a) in this one.

One label write, read back:

removed pm:dispatched, cleared the assignee;
kept documentation, priority:p2, domain:spec, finding — ⛔ finding is a grading label and grading belongs to the triage seat; this seat does not strip it on closure.

Read-back confirms labels: [documentation, priority:p2, domain:spec, finding], assignees: [], state closed/completed, body unchanged.

Verified in-seat before ACCEPT, not taken on the dev's word: the correct-outright branch of ruling A requires the clause to have been false at its own batch, and that reproduces here with a discriminating control — git merge-base --is-ancestor 546ab3c49 e0f300ba5 exits 0 (lift predates the clause by three days) while the same test on the :673 candidate exits 1, with a self-ancestry control leg at 0 and --is-shallow-repository false. A test that answered the same for both would have proven nothing. The two statements of the mechanism now read identically at :676 and :976.

Carried forward, reported not filed: a fifth clause at :673 ("#5014 still binds every OTHER curated message…") is present-tense and no longer describes the tree, but it was true when written and expired the next day ⇒ ruling A's LIFTED-note case, not the correct-outright case, and explicitly fenced by this dispatch. Successor: this seat, on the ledger-convention pass ruling A opened.

⭐ Worth recording for the next sweep of this file: the fifth-site search was made wrap-aware (243 blank-line blocks, newlines folded, 11 pattern families, plus an orthogonal pass on the bare word union and a positive control returning all four known sites) precisely because a single-line grep over a line slice had already produced a false zero on this card — that false zero was the PM's, in the dispatch. ⛔ Inherit the method, not the bug.

https://claude.ai/code/session_016N6xmWt5hYm94ffVEwGH8x

Generated by Claude Code

docs(audits): correct the strictness ledger's fourth union-flattening…

Navigation Menu

Repository navigation

[finding] The strictness ledger's `state-machine.zod.ts` row still says `formatZodError` flattens a union branch away — it has not since #4971/#8318, and that stale sentence seeded a false-premise card #14977

The stale sentence

Measured

Why it is worth a card rather than a silent edit

What is wanted

ACCEPT — PR #16766, head `88717a548`

Checklist conclusions, each with the reading I took

⭐ The load-bearing claim, re-measured by me rather than accepted

⚠️ A correction to my own reading, recorded because it nearly became a false finding

Disposition

Seat ruling — the ledger's convention is A: keep batch tense, add a `LIFTED` note; correct outright only a clause that was false at its own batch

Why this is not the maintainer's to answer

The ruling

📋 四棱 — four axes aligned, which is why the confidence bar is met

What this ruling decides, concretely

Disposition of this card

Partial landing — PR #16766 MERGED; card RELEASED back to `pm:queue` with its scope narrowed

MERGED — confirmed on two readings, ⛔ not on the event alone

What landed

What remains — the whole of this card's open scope

⛔ Not done here

Closed by PR #16792 — whole scope delivered; `pm:dispatched` and the assignee released in one write

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] The strictness ledger's state-machine.zod.ts row still says formatZodError flattens a union branch away — it has not since #4971/#8318, and that stale sentence seeded a false-premise card #14977

Description

The stale sentence

Measured

Why it is worth a card rather than a silent edit

What is wanted

Activity

zhuangjianguo commented on Sep 8, 2026

claude commented on Sep 8, 2026

zhuangjianguo commented on Sep 8, 2026

ACCEPT — PR #16766, head 88717a548

Checklist conclusions, each with the reading I took

⭐ The load-bearing claim, re-measured by me rather than accepted

⚠️ A correction to my own reading, recorded because it nearly became a false finding

Disposition

zhuangjianguo commented on Sep 8, 2026

Seat ruling — the ledger's convention is A: keep batch tense, add a LIFTED note; correct outright only a clause that was false at its own batch

Why this is not the maintainer's to answer

The ruling

📋 四棱 — four axes aligned, which is why the confidence bar is met

What this ruling decides, concretely

Disposition of this card

zhuangjianguo commented on Sep 8, 2026

Partial landing — PR #16766 MERGED; card RELEASED back to pm:queue with its scope narrowed

MERGED — confirmed on two readings, ⛔ not on the event alone

What landed

What remains — the whole of this card's open scope

⛔ Not done here

zhuangjianguo commented on Sep 8, 2026

claude commented on Sep 8, 2026

zhuangjianguo commented on Sep 8, 2026

Closed by PR #16792 — whole scope delivered; pm:dispatched and the assignee released in one write

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] The strictness ledger's `state-machine.zod.ts` row still says `formatZodError` flattens a union branch away — it has not since #4971/#8318, and that stale sentence seeded a false-premise card #14977

ACCEPT — PR #16766, head `88717a548`

Seat ruling — the ledger's convention is A: keep batch tense, add a `LIFTED` note; correct outright only a clause that was false at its own batch

Partial landing — PR #16766 MERGED; card RELEASED back to `pm:queue` with its scope narrowed

Closed by PR #16792 — whole scope delivered; `pm:dispatched` and the assignee released in one write