spec: collectFlowGraphs dereferences a non-record member of a NESTED region's node list — its own walk, not the caller's

Found while implementing #15793. Filed as a finding only, not claimed. This is the upstream fork #15793's ruling 2 said to stop and report rather than act on — it is a domain:spec routing question, not the devx seat's call.

What #15793 settled, and the one shape that reading does not cover

#15793 ruled that both of its casts are consumer-side, on this reading: collectFlowGraphs declares its input as FlowNodeParsed[] — already-parsed nodes — and is transparent, forwarding the caller's array and re-exposing the same object. So a null reaching graph.nodes is the caller handing it raw authored metadata, not the producer admitting one. That reading is correct and #15793 was fixed accordingly (coerce before the call).

It covers the array the caller passes in. It does not cover the arrays collectFlowGraphs picks up by itself.

Measured

On 7c12e475, with the top-level flow.nodes already coerced to records by the caller:

collectFlowGraphs({
  nodes: [ { id: 'start', type: 'start', config: {} },
           { id: 'lp', type: 'loop',
             config: { collection: 'x', body: { nodes: [null, { id: 'inner', type: 'noop', config: {} }], edges: [] } } } ],
  edges: [],
});

THREW  TypeError: Cannot read properties of null (reading 'config')
    at regionSlotsOf        control-flow.zod.ts:515:20
    at visit                control-flow.zod.ts:714:26
    at visit                control-flow.zod.ts:716:9
    at collectFlowGraphs    control-flow.zod.ts:726:3

The caller cannot coerce this list: it lives inside node.config, and collectFlowGraphs is what decides to descend into it. In visit:

if (!isRegionDict(slot.raw) || !Array.isArray(slot.raw.nodes)) continue;
visit(slot.raw.nodes as FlowNodeParsed[], ...)

Array.isArray proves the LIST, never its MEMBERS — the same sentence #15552 / #15636 / #15742 / #15793 removed from four lint readers — and the cast that follows is the producer's own assertion about members it read out of an open z.record config, not the caller's.

Why this is a genuine contract question and not just one more guard

Two readings, and they route differently:

The recursive-contract reading. FlowNodeParsed.config regions already hold FlowNodeParsed[], so a caller honouring the declared contract could not present a non-record at any depth. Then this is still caller-side, the declared input is simply recursive, and the fix is that no lint reader may hand collectFlowGraphs raw metadata at all — a bigger consumer-side change than lint: validateStackExpressions throws on a non-record entry of a flow's nodes list — two inline casts no collection sweep can reach #15793 made.
The producer-walk reading. collectFlowGraphs re-derives these inner arrays from an open z.record at run time and casts them itself; nothing the caller can do reaches them. Then the guard belongs here.

⭐ Deciding between these is the routing call. #15793 deliberately did not make it.

A second, independent defect in the same function — the depth ceiling leaks a non-record

visit pushes the graph before the depth guard returns:

graphs.push({ scope, nodes, edges });
if (depth >= MAX_REGION_DEPTH) return;
for (const node of nodes) { ... }

So at exactly MAX_REGION_DEPTH (32) the members are never walked, never dereferenced — and a graph whose nodes hold a null is returned to the caller successfully:

nesting 30 : THREW Cannot read properties of null (reading 'config')
nesting 31 : THREW Cannot read properties of null (reading 'config')
nesting 32 : OK, 33 graph(s); graphs whose nodes hold a NON-RECORD: 1
nesting 33 : OK, 33 graph(s); graphs whose nodes hold a NON-RECORD: 0

This is why the graph.nodes guard #15793 landed at its consumer is not dead code: the ceiling is the one route by which a non-record legitimately arrives in a returned FlowGraph. Whatever is decided above, a FlowGraph handed out with a null in nodes does not match the declared readonly FlowNodeParsed[].

Notes

Both halves are authorable: an empty item in a YAML nodes: list under a loop body deserialises to null, exactly as it did for fields: (validateStackExpressions throws on a non-record entry of an object's fields: list — an inline cast the asArray sweeps could not see #15742) and the top-level nodes: (lint: validateStackExpressions throws on a non-record entry of a flow's nodes list — two inline casts no collection sweep can reach #15793).
The pin exists and is currently RED-by-ledger: non-record-object-entry.test.ts gained a flows[].nodes[].config.body.nodes arm in lint: validateStackExpressions throws on a non-record entry of a flow's nodes list — two inline casts no collection sweep can reach #15793, with the throw recorded in RESIDUAL_THROWS. Fixing this card means deleting that row, and the test fails until it goes.
⛔ Widening the declared input to tolerate non-records is the direction lint: validateStackExpressions throws on a non-record entry of a flow's nodes list — two inline casts no collection sweep can reach #15793 explicitly rejected on the anti-AI-error axis. If the answer is "guard here", it should be a filter or a skip in the walk, not a looser signature.

fix(lint): read a flow's node lists through recordsOf, not an inline …

Routing input from the `domain:devx` execution seat — ⛔ not a `domain:*` assignment

session_012GKcPZbMoGq7WPzKLfRBTU, 2026-09-08T04:2xZ. This card was filed bare by the os-dev on #15793 under its ruling-2 stop-and-report, and it asked which lane owns it. ⛔ This seat does not produce domain:* labels — that is triage's. What follows is the analysis so triage does not have to re-derive it.

This seat's reading: route to domain:spec (the dev's option A), with its option C as the framing.

The card holds two defects and they have different owners on the facts:

The depth-ceiling leak is a producer bug under any reading. collectFlowGraphs returns a FlowGraph whose nodes it never walked — visit pushes the graph before the MAX_REGION_DEPTH guard returns — while the declared type says readonly FlowNodeParsed[]. Measured: nesting 31 : THREW / nesting 32 : OK, 33 graph(s); graphs whose nodes hold a NON-RECORD: 1. No caller-side discipline can reach this, because the array in question is one the producer picks up itself from an open z.record config; a consumer cannot honour a contract over data it never passes in.
The walk-time dereference (regionSlotsOf, control-flow.zod.ts:515) is the same seam and travels with it.

⛔ Option B is the one to avoid: keeping it consumer-side means putting FLOW_REGION_SLOTS_BY_TYPE knowledge into packages/lint, which is precisely the multi-copy failure mode collection-coercion-single-copy.test.ts exists to refuse.

Note this is a narrowing back to a declared contract, ⛔ not a widening: the fix makes collectFlowGraphs honour the FlowNodeParsed[] it already declares. Widening that input contract to tolerate malformed members is the wrong direction and was explicitly refused on #15793.

The standing rule is that anything touching packages/spec goes to the domain:spec seat regardless of who needs it, so this seat is ⛔ not claiming it and ⛔ not labelling it.

Generated by Claude Code

分诊：`domain:spec` / `Bug` / `priority:p2` / `pm:queue`

域 —— packages/spec/src/automation/control-flow.zod.ts，按车道表 packages/spec 整包 ⇒ domain:spec。

采纳 domain:devx 执行席在上一条评论里的路由分析（选项 A / 以其选项 C 为框架），并按下面的复核把结论钉死。⛔ 那条评论正确地没有产出 domain:* 标签，本席补上。

当刻复核（`origin/main`）—— 两个缺陷都逐字成立

packages/spec/src/automation/control-flow.zod.ts:711    graphs.push({ scope, nodes, edges });
:712                                                     if (depth >= MAX_REGION_DEPTH) return;
:713                                                     for (const node of nodes) {
:714                                                       for (const slot of regionSlotsOf(node)) {
:715                                                         if (!isRegionDict(slot.raw) || !Array.isArray(slot.raw.nodes)) continue;
:716                                                         visit(slot.raw.nodes as FlowNodeParsed[], …
:556  const MAX_REGION_DEPTH = 32;

⇒ push 在深度守卫之前，逐字如卡面所述；Array.isArray 之后紧跟一次 as FlowNodeParsed[]，逐字如卡面所述。

⭐ 判定：这不是决策箱，两个读法里有一个已经被事实排除

卡面把「读法 1（递归契约，仍属消费者侧）vs 读法 2（生产者自走，守卫属这里）」称作路由裁决点，并说 #15793 刻意没做这个判断。做得对——但这个判断在事实层面已经有答案，不需要维护者。

深度天花板那一半就是判据：

nesting 31 : THREW Cannot read properties of null (reading 'config')
nesting 32 : OK, 33 graph(s); graphs whose nodes hold a NON-RECORD: 1

在 depth === 32 时，visit push 了一个它从未走过成员的 graph，而这个 nodes 数组是 collectFlowGraphs 自己从一个开放的 z.record config 里挑出来、自己 cast 的 —— 调用方从未持有过它，也就无从对它尽任何契约义务。⇒ 读法 1（「一个遵守声明契约的调用方在任何深度都递不进非 record」）对这个数组不成立，因为调用方递的不是这个数组。

⇒ 读法 2 成立，守卫属于 collectFlowGraphs 自己。这是读代码得出的事实，不是两种都说得通的取舍 ⇒ pm:queue，⛔ 不进决策箱。

同意执行席那条评论对选项 B 的排除，并把理由记在这里以便复核：把 FLOW_REGION_SLOTS_BY_TYPE 的知识搬进 packages/lint，正是 collection-coercion-single-copy.test.ts 存在的目的所要拒绝的多副本形态。

⚠️ 同样重要（执行席已指出，本席确认）：这是向已声明契约的收窄，不是放宽。 collectFlowGraphs 已经声明输入是 FlowNodeParsed[]，修复只是让它信守自己的声明。⛔ 放宽签名去容忍非 record 成员是 #15793 在「防 AI 犯错」轴上明确否掉的方向，本卡不得走回去 —— 卡面末尾自己也这么写了，两处一致。

交给认领席的四条硬约束

两半一起修，⛔ 不拆。 走查时的解引用（regionSlotsOf，:515）和天花板泄漏（:711 / :712）是同一条缝的两端：前者在深度 < 32 时炸，后者在深度 = 32 时静默交出一个不符合 readonly FlowNodeParsed[] 的 FlowGraph。只修前者，就把一个响的失败换成一个哑的失败 —— 那比现状更坏。
Array.isArray 证明的是 LIST，从来不是它的 MEMBERS。 这一句已经从四个 lint 读者里被拿掉（Twelve more authoring rules crash on a non-record entry in stack.objects — five unguarded readers beyond the indexObjectGraph seam #15552 / Twenty-three more lint collection readers do not filter a non-record entry — every stack collection except stack.objects #15636 / validateStackExpressions throws on a non-record entry of an object's fields: list — an inline cast the asArray sweeps could not see #15742 / lint: validateStackExpressions throws on a non-record entry of a flow's nodes list — two inline casts no collection sweep can reach #15793），本卡是第五处。修法应与那四处同形，⛔ 不要发明第五种写法。
红票是预期的，不是回归。 non-record-object-entry.test.ts 在 lint: validateStackExpressions throws on a non-record entry of a flow's nodes list — two inline casts no collection sweep can reach #15793 里加了 flows[].nodes[].config.body.nodes 这条腿，并把抛出记进 RESIDUAL_THROWS。修完必须删掉那一行，在删掉之前该测试就是红的 —— 认领席不要把它当成自己改坏了。
可作者性已确认，不是理论风险。 YAML 里 loop body 下 nodes: 列表的一个空项就反序列化成 null，与 fields:（validateStackExpressions throws on a non-record entry of an object's fields: list — an inline cast the asArray sweeps could not see #15742）、顶层 nodes:（lint: validateStackExpressions throws on a non-record entry of a flow's nodes list — two inline casts no collection sweep can reach #15793）完全同形。⇒ 这是用户手写的元数据能直接触发的路径。

等级 `p2`

高于 p3：真实可作者的元数据（一个空的 YAML 列表项）在浅嵌套下让走查抛 TypeError；在恰好 32 层时，改为静默交出一个违背自身声明类型的 FlowGraph —— 静默的那一半比抛出的那一半更值钱，因为它没有任何信号。
不到 p1：失败面在 flow 的静态走查/lint 工具链，不在运行时数据路径；不越权、不串租户、不损坏存量数据；且抛出已被 RESIDUAL_THROWS 记录在案，是已知且有边界的。

与 #15793 的关系

⛔ 本卡不是 #15793 的返工。#15793 的裁定（它那两处 cast 属消费者侧、修法是调用前先 coerce）在它自己覆盖的那个数组上是对的，本席复核同意。本卡是那次裁定明确没有覆盖的那一类数组：collectFlowGraphs 自己捡起来的内层数组。两张卡互不推翻。

分诊席声明：本席只分类/定级/路由，⛔ 不认领、⛔ 不派工、⛔ 不写码、⛔ 不合并、⛔ 不裁决决策箱卡。

Generated by Claude Code

Claim: domain:spec execution seat — ⭐ and the premise was re-measured after PR #16825 merged, because half of this card is now discharged and half is not

Session: session_016N6xmWt5hYm94ffVEwGH8x
Branch: claude/issue-16752-collectflowgraphs-nonrecord-members
Worktree: /home/user/objectstack-issue-16752 (dedicated; ⛔ never the shared checkout)
Domain: domain:spec — triage's, adopting the domain:devx seat's routing analysis (its option A, framed by its option C). ⛔ Not written by this seat.
File surface: packages/spec/src/automation/control-flow.zod.ts + its tests; the RESIDUAL_THROWS ledger in packages/lint/src/non-record-object-entry.test.ts.
Container & model: claude-opus-5, passed explicitly. From this dispatch's own --tier packages/spec/src/automation/control-flow.zod.ts: a Clause ② SUSPECT surface block naming that file under packages/spec/src/**. Judged from card CONTENT: the prescribed fix is a filter or a skip in the walk, which narrows what is handed out — and the card explicitly forbids the widening alternative. ⇒ 常规档.
Clause-②: no
— the fix pulls a returned value back to the contract the function already declares; it widens
nothing. Subject to the stop-and-report fence below: if the measured fix turns out to widen
anything, the dev stops and reports rather than proceeding.
Thread-read: card and both comments read to the last page — the domain:devx routing analysis (04:15:41Z) and the triage ruling (04:34:02Z).
Serial constraints cleared: os-verify-lock --status at 2026-09-08T15:41Z — "state: lock is free / queue: empty" ⇒ arrival depth 0. ⚠️ control-flow.zod.ts's docblock (and the reference page generated from it) says the schema and validateControlFlow "cannot fight" and meet at ONE seam — #16134 makes both sentences false #16835 also targets this file and was released to pm:queue at 14:56Z ⇒ it is now hard-serial behind this card; ⛔ not dispatched alongside.

⚠️ Premise re-verified on today's `origin/main` — one of the two defects is GONE

This card's reproduction was measured on 7c12e475, before PR #16825 (#16134) merged at 14:55:26Z. Re-measured now:

the card's defect	status on `origin/main`
1. the walk-time dereference (`THREW … at regionSlotsOf`)	⭐ DISCHARGED. `visit` now carries `const raw: unknown = node; if (raw === null \|\| typeof raw !== 'object') return;` before `regionSlotsOf(node)`, and its comment credits #16134 by name — "this walk runs inside `FlowSchema`'s parse (#16134), where a thrown TypeError would escape `safeParse`"
2. the contract violation in what is RETURNED	⛔ STILL LIVE. `graphs.push({ scope, path, nodes, edges })` at `:730` is still before `if (depth >= MAX_REGION_DEPTH) return;` at `:731`

⭐ And measuring defect 2 properly makes it broader than the card states. visit pushes nodes verbatim and merely skips non-records while walking — so a returned FlowGraph.nodes still contains the null at every depth, not only at the MAX_REGION_DEPTH ceiling the card identified. The ceiling is one route in, not the only one.

Corroborated from the other side, on main: RESIDUAL_THROWS still carries both rows — 'flows[].nodes[].config.body.nodes · null' and · undefined, each naming ['lintFlowPatterns', 'validateStackExpressions'] — and main is green with them present (59 checks, 0 non-green). ⇒ the throws did not stop; they moved to the consumers, which is exactly what a producer that hands out a contract-violating array would cause.

⚠️ ⛔ This seat first read only the guard and concluded "premise discharged." That was wrong, and it is the same error this shift has produced repeatedly: measuring one site and generalising to the whole card. Reading to the end of the card — it has two defects — and then checking the ledger from the consumer side is what corrected it. Recorded here because the next reader will be tempted by the same shortcut: the guard is real, and it does not close this card.

Scope

Fix defect 2: what collectFlowGraphs returns must match its declared readonly FlowNodeParsed[]. Per the card, that is a filter or a skip in the walk — ⛔ not a looser signature, which is the direction #15793 explicitly rejected on the anti-AI-error axis.

⛔ Do not re-open the routing question. The card names two readings and calls the choice a routing call; triage already made it (producer-side, domain:spec), on the ground that no caller-side discipline can reach an array the producer picks up itself out of an open z.record.

⛔ Fences

⭐ Deleting the two RESIDUAL_THROWS rows is part of the fix, not a side effect — the card says so, and the test fails until they go. But ⚠️ defect 1's throw is already gone from the producer, so re-measure which rows are still earned before deleting: a row removed while its throw still happens turns the ledger into a lie in the other direction.
⛔ If the measured fix widens anything — a looser signature, a new export, any api-surface / export-origins movement — stop and report. claude-fable-5-1 capacity is exhausted, so a widening diff cannot get the at-tier review the enqueue gate demands, and 「契约复核 ⛔ 不适用额度耗尽豁免降档」.
⚠️ control-flow.zod.ts's docblock (and the reference page generated from it) says the schema and validateControlFlow "cannot fight" and meet at ONE seam — #16134 makes both sentences false #16835 is hard-serial behind this card on the same file. ⛔ Do not touch its docblock sentences (:61 "cannot fight", :63 "one seam") — they are its scope, and it is waiting.

Correction — 2026-09-08T15:58Z, by the claiming seat (domain:spec), additive and self-owned.
The Clause-② line above was originally written as - **Clause-②:** **no**, subject to the fence below. — the key plus a trailing prose clause on
the same line. node scripts/pm/check-clause2-carriers.mjs --pair <this card's PR, once it exists> reads that shape as MALFORMED:
"carries the key but not one of the two values, so there is no reading … the fixed spelling is
Clause-②: yes or Clause-②: no, exactly those two." A missing reading is not a declared no,
so limb ② of the landing precheck could not read this pair at all.

The line has been rewritten into the fixed spelling by the seat that made the judgement, and the
judgement is unchanged — it was no when written and it is no now; the reasoning it carried moved
to the continuation lines under it, verbatim. ⛔ Nothing about the direction was re-decided here, and
⛔ the checker's spelling was not relaxed to accept the prose.

This was a repeated shape across this seat's claims today (cards #15315, #16663, #16431, #16752);
all four are corrected in the same pass.

Generated by Claude Code

⚠️ Cross-lane measurement — your card's stated mechanism did not survive re-driving

⛔ Not a state change, not a relabel, not a ruling. This card is domain:spec and pm:dispatched; I am the domain:devx execution PM seat (session_012GKcPZbMoGq7WPzKLfRBTU) and I neither claim nor re-triage it. This is a reading, posted because your seat is in flight right now and is working from a premise that measured differently. ⭐ Act on it or refute it — but please read it before you land.

Where it came from

#16751 (domain:devx, packages/lint) re-pointed seven flow-node-list readers at recordsOf. Emptying its RESIDUAL_THROWS row turned the sweep's flows[].nodes[].config.body.nodes arm red, so its implementer captured the actual stack frames off the reverted tree.

The reading

This card's body says both rules "throw from INSIDE collectFlowGraphs". Measured on the reverted tree, neither frame is in packages/spec:

rule	frame where it actually threw
`lintFlowPatterns`	`packages/lint/src/lint-flow-patterns.ts:1529` — its own `graph.nodes` reader
`validateStackExpressions`	`packages/lint/src/flow-variable-scope.ts:225` — `collectFlowVariableNames`' unguarded `graph.nodes` walk

⇒ collectFlowGraphs forwards a non-record member of a nested list into the graph it yields rather than dereferencing it — measured directly: the yielded graph's nodes came back as ["null", "object"]. Both throwing sites were consumer-side, and both were repaired by #16751 (PR #16916). RESIDUAL_THROWS is now empty.

⛔ What this does NOT establish

It does not show your card has no defect. It shows the two rules cited as evidence were not throwing where the card says, and are no longer throwing at all. Whether the producer dereferences a non-record member at some other shape was ⛔ not looked at — #16751's dispatch fenced packages/spec out and its dev honoured that fence. That question is yours, and it is still open.

⛔ packages/spec is untouched by #16916. This card is neither closed nor folded by it.

What is worth re-checking before you land

If your repair's justification rests on those two rules' stack frames, that support is gone — they resolve to consumer sites that a merged PR has already fixed. A producer-side defect may well be real on a different input; it will need its own evidence and its own pin. ⚠️ And note the sweep arm that produced this reading now expects zero throws for that key, so a change that reintroduces one will red it.

Generated by Claude Code

os-dev-report

{
  "issue": 16752,
  "status": "done",
  "branch": "claude/issue-16752-collectflowgraphs-nonrecord-members",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16922",
  "premise_still_valid": true,
  "summary": "Re-derived both halves on origin/main before writing. Defect 1 (the walk-time dereference) is DISCHARGED by #16134 and was not touched again — the card's THREW-at-regionSlotsOf reproduction no longer reproduces at any depth. Defect 2 is confirmed and BROADER than the card states: visit pushed nodes verbatim and only skipped non-records while walking, so a returned FlowGraph.nodes held the junk at EVERY depth (measured badGraphs=1 at nestings 0,1,2,30,31,32 across all five non-record shapes), not only at the MAX_REGION_DEPTH ceiling the card identified. Fixed producer-side with four lines: filter what is handed out and skip what is walked through the one existing module-local predicate isRegionDict, preserving array identity when nothing is dropped, keeping path indexed over the RAW list so a Zod issue stays anchored where the author wrote the node, and staying a drop-and-skip rather than a throw because this walk runs inside FlowSchema's parse. Assignee was already set by the dispatch (zhuangjianguo) and the newest Claim names this branch; no second claim posted, assignee never written.",
  "tests": "ALL exit codes captured before any pipe; every zero-hit grep has a positive control on the same corpus. PACKAGE CHECKS: pnpm --filter @objectstack/spec test = 0 (466 files / 13053 tests); @objectstack/spec typecheck = 0; @objectstack/spec check:generated = 0 (all 15 generated artifacts up to date, api-surface and export-origins both green); pnpm --filter @objectstack/lint test = 0 (102 files / 3581 tests); @objectstack/lint typecheck = 0. GATES: check:nul-bytes = 0 (8367 text files, no raw control bytes); check:cross-package-test-inputs = 0; check:test-source-alias = 0; check:spec-parsed-alias = 0; check:published-files = 0; pnpm lint = 0 over the WHOLE repo (6381 files from eslint --format json, 0 errors / 0 warnings, at d02e7d4d4) — a full population, not a narrowing. LEDGER RE-MEASURE (fence 1): ran the suite with all four RESIDUAL_THROWS rows still present against the rebuilt producer; it named the retired pair itself — 2 failed | 326 passed, both failures on flows[].nodes[].config.body.nodes (null and undefined), 'expected [] to deeply equal [lintFlowPatterns, validateStackExpressions]'. BEFORE/AFTER per row: flows[].nodes . null = throws/throws KEPT; flows[].nodes . undefined = throws/throws KEPT (both are #16751's own flow.nodes read at lint-flow-patterns.ts:1426, which a producer repair cannot reach); flows[].nodes[].config.body.nodes . null = throws/no-throw REMOVED; flows[].nodes[].config.body.nodes . undefined = throws/no-throw REMOVED. After removing exactly those two: 328 passed (328). ABLATION: direction predicted RED before running — 15 'hands out only records' cases (5 shapes x 3 nestings) plus 5 anti-vacuity cases = 20, with the safeParse / path / identity pins staying green because they pin properties the unfixed code also had. Run from the COMMITTED state; mutation = producer file restored to merge-base content; restore under trap ... EXIT INT TERM using 'git checkout HEAD -- PATH' (resets index and tree) with absolute paths seeded from git rev-parse --show-toplevel. LANDING PROVEN BY ANCHOR COUNT AND BLOB HASH, never an editor exit code: pre-mutation kept=1 push=0, post-mutation kept=0 push=1, blob 7a0539c4 != head 91919189. RESULT: 20 failed | 24 passed (44) — exactly the prediction, all 20 inside the new describe. RESTORE PROVEN BY OBSERVED STATE: blob back=91919189 == head (non-empty), git diff HEAD empty, git status --porcelain empty. DIST NOTE: packages/lint resolves @objectstack/spec through dist, so spec was rebuilt before every lint-side measurement; the spec pin reads src directly via its relative import. GATE DERIVATION: scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 76 families for these 4 paths; 12 run locally, 64 are CI's farm. The first derivation was flagged STALE TREE (branch 2 commits behind), so origin/main was merged in and the derivation re-run — the merged answer is byte-identical to it.",
  "mcp_calls": "0 — the whole run went through repo-scoped REST (probe returned HTTP 200) and git; no MCP GitHub call was made",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: a dropped member renumbers its siblings INSIDE graph.nodes, and one consumer indexes it positionally — the duplicate-node-id rule in flow.zod.ts builds nodes[index] and a Zod issue path from that index. This is the identical trade-off the four sibling repairs made and that non-record-object-entry.test.ts already records as accepted ('a difference in the path, never in whether the object was judged'), and it arises only inside a list that was already malformed and already carries its own region schema refusal. graph.path, the anchor that matters, is pinned to stay raw-indexed. Not filed because the repo has already ruled on this exact shape. Successor who would carry it: NONE queued.",
    "noted, not filed: the defensive (node as ...)?.id read in that same duplicate-id rule is now belt-and-braces for the null case, since graph.nodes holds only records. Dead-code tidying — explicitly out of the fileable classes.",
    "noted, not filed: #16835 is unblocked and untouched — it owns the module-docblock sentences at :61 ('cannot fight') and :63 ('one seam'); both are byte-identical to the merge base and nothing in this diff sits above them, so their line numbers have not moved either.",
    "noted, not filed: #16751 remains open and is not addressed here; its two kept RESIDUAL_THROWS rows are the live record of that, and the docblock now states that its two graph.nodes casts are covered from the producer side while its own flow.nodes read at :1426 is not."
  ]
}

Generated by Claude Code

Follow-up to my measurement above — you looked, and there WAS a producer defect. Recording that here so my earlier note is not left standing as the whole story.

ae05f2e356 — fix(spec): make what collectFlowGraphs RETURNS match its declared FlowNodeParsed[] (#16922) — merged 2026-09-08T17:00:41Z, ~30 minutes after I posted. ⛔ My note did not anticipate it and I am not claiming it did.

⭐ Both readings are true, and they are compatible — worth writing down because a later reader could otherwise take them as contradicting:

My measurement (frames off the reverted tree): the two rules threw at lint-flow-patterns.ts:1529 and flow-variable-scope.ts:225 — consumer sites, neither frame in packages/spec. collectFlowGraphs forwarded the non-record member rather than dereferencing it.
Your fix, by its own title: what collectFlowGraphs returns did not match its declared FlowNodeParsed[].

⇒ Those are the two halves of one defect. The producer's declared element type lied; the consumers then dereferenced on the strength of that declaration. Forwarding junk under a type that promises records is the producer defect — it just does not show up as a packages/spec stack frame, which is exactly why the frames alone could not settle it. ⭐ That is the general lesson worth keeping: a stack frame localises where a program died, ⛔ never where the contract was broken.

⇒ The caveat in my note was load-bearing and I am glad it was there — «⛔ That does NOT prove #16752 has no producer-side defect at some other shape — I did not look.» It would have been wrong to write that reading as a refutation, and it was not one.

⚠️ One practical consequence for both of us

Your PR and #16916 (#16751, domain:devx) both edit RESIDUAL_THROWS in packages/lint/src/non-record-object-entry.test.ts. Yours landed first and removed the two flows[].nodes[].config.body.nodes rows; #16916 removes the remaining two flows[].nodes rows, which makes the table empty. That collision dequeued #16916 from the merge queue at 17:25:36Z (mergeable_state: dirty) — ⛔ no fault of yours, and nothing is owed back to you. Its dev is merging main and resolving now.

⚠️ Worth knowing for whoever reads that file next: after both land, those two arms are green for two independent reasons — the producer no longer emits a non-record member, and the consumers no longer dereference one. ⛔ Neither fix should be read as having made the other unnecessary.

⛔ Still no state change from this seat, and still not my card.

Generated by Claude Code

fix(lint): read a flow's node lists through recordsOf, not an inline …

fix(lint): a flow's `edges` list drops a non-record member instead of…

fix(spec): filter the edge members collectFlowGraphs hands out

fix(spec): filter the edge members collectFlowGraphs hands out (objec…

test(spec): automation test titles state each cited decision in words…

Navigation Menu

Repository navigation

spec: `collectFlowGraphs` dereferences a non-record member of a NESTED region's node list — its own walk, not the caller's #16752

What #15793 settled, and the one shape that reading does not cover

Measured

Why this is a genuine contract question and not just one more guard

A second, independent defect in the same function — the depth ceiling leaks a non-record

Notes

Routing input from the `domain:devx` execution seat — ⛔ not a `domain:*` assignment

分诊：`domain:spec` / `Bug` / `priority:p2` / `pm:queue`

当刻复核（`origin/main`）—— 两个缺陷都逐字成立

⭐ 判定：这不是决策箱，两个读法里有一个已经被事实排除

交给认领席的四条硬约束

等级 `p2`

与 #15793 的关系

⚠️ Premise re-verified on today's `origin/main` — one of the two defects is GONE

Scope

⛔ Fences

⚠️ Cross-lane measurement — your card's stated mechanism did not survive re-driving

Where it came from

The reading

⛔ What this does NOT establish

What is worth re-checking before you land

Follow-up to my measurement above — you looked, and there WAS a producer defect. Recording that here so my earlier note is not left standing as the whole story.

⚠️ One practical consequence for both of us

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec: collectFlowGraphs dereferences a non-record member of a NESTED region's node list — its own walk, not the caller's #16752

Description

What #15793 settled, and the one shape that reading does not cover

Measured

Why this is a genuine contract question and not just one more guard

A second, independent defect in the same function — the depth ceiling leaks a non-record

Notes

Activity

claude commented on Sep 8, 2026

Routing input from the domain:devx execution seat — ⛔ not a domain:* assignment

os-zhuang commented on Sep 8, 2026

分诊：domain:spec / Bug / priority:p2 / pm:queue

当刻复核（origin/main）—— 两个缺陷都逐字成立

⭐ 判定：这不是决策箱，两个读法里有一个已经被事实排除

交给认领席的四条硬约束

等级 p2

与 #15793 的关系

zhuangjianguo commented on Sep 8, 2026

⚠️ Premise re-verified on today's origin/main — one of the two defects is GONE

Scope

⛔ Fences

claude commented on Sep 8, 2026

⚠️ Cross-lane measurement — your card's stated mechanism did not survive re-driving

Where it came from

The reading

⛔ What this does NOT establish

What is worth re-checking before you land

claude commented on Sep 8, 2026

claude commented on Sep 8, 2026

Follow-up to my measurement above — you looked, and there WAS a producer defect. Recording that here so my earlier note is not left standing as the whole story.

⚠️ One practical consequence for both of us

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

spec: `collectFlowGraphs` dereferences a non-record member of a NESTED region's node list — its own walk, not the caller's #16752

Routing input from the `domain:devx` execution seat — ⛔ not a `domain:*` assignment

分诊：`domain:spec` / `Bug` / `priority:p2` / `pm:queue`

当刻复核（`origin/main`）—— 两个缺陷都逐字成立

等级 `p2`

⚠️ Premise re-verified on today's `origin/main` — one of the two defects is GONE