spec: three more Object.prototype fall-through lookups (normalizeFilterOperator, resolveDiscoveryEnvironment, pluralToSingular), found by an index-expression-keyed survey and measured

Found while landing the #17456 / #17762 round, which fixed three members of this family (canonicalizeSqlType, suggestDefaultValueToken, classifyFilterToken). Out of scope there: that round's file face is exactly those three files, and its triage comment states the fence — «two files, two functions, plus the second half of the line» — so these are filed rather than ridden.

Note: generic type brackets are written with square brackets throughout (Record[string, X] stands for the angle-bracket spelling) so the body survives GitHub's body sanitiser intact.

Why a new survey found them, which is the point

#17456's survey was keyed on the spelling return TABLE[key]; and found four candidates. #17762's self-correction comment (5643173721) established that this keying is structurally narrower than the defect, and the triage comment on #17456 (5643176858) asked the implementing round to re-run the survey keyed on the index expression itself, and to report the count.

That was done. Keyed on «a table annotated Record[string, X] — the WIDEST key type, so no union narrowing can make the index total — that is a plain object literal, indexed with a non-literal key», over the 944 non-test .ts files in packages/spec/src:

76 object-literal tables annotated Record[string, X]
44 of them carry at least one runtime-key index site
⭐ The answer is NOT five. The count the triage asked for is reported here rather than as a zero.

Most of the 44 are locally-built accumulators (out, next, merged, defs) that are written through the index, not read, and are not this family. What follows is the shortlist that is: a module-level constant lookup table, read with a runtime key, whose result leaves through a declared signature.

Measured — three that are live

Driven by importing the BUILT artifact (packages/spec/dist/{ui,api,meta-spelling}/index.mjs) on the repo's Node 22 baseline (v22.22.2), built from b280ae299a. Population fixed at five, each row carrying a lit control.

1. normalizeFilterOperator — packages/spec/src/ui/view.zod.ts, return VIEW_FILTER_OPERATOR_ALIASES[op] ?? VIEW_FILTER_OPERATOR_ALIASES[op.toLowerCase()] ?? op;. Declared return string.

argument	result	`typeof`
`eq` (lit control)	`'equals'`	`string`
`constructor`	the `Object` function	`function`
`toString`	the `Object` function	`function`
`valueOf`	the `Object` function	`function`
`__proto__`	`Object.prototype`	`object`
`nope`	`'nope'`	`string`

⚠️ This one is worse than any member of the landed round. The three fixed sites let toString / valueOf through quietly only because they lower-case the key first, so those two spellings name nothing. This site indexes the table twice — once raw, once lower-cased — so the case-folding accident that protected the others does not exist here, and all three prototype methods come back.

2. resolveDiscoveryEnvironment — packages/spec/src/api/discovery.zod.ts, return NODE_ENV_TO_DISCOVERY_ENVIRONMENT[spelling] ?? 'development';. Declared return DiscoveryEnvironment, and its own docblock says, verbatim: @returns a value guaranteed to satisfy {@link DiscoveryEnvironmentSchema}.

argument	result	`typeof`
`production` (lit control)	`'production'`	`string`
`constructor`	the `Object` function	`function`
`__proto__`	`Object.prototype`	`object`
`toString` / `valueOf` / `nope`	`'development'`	`string`

⭐ The docblock is the contract text: a value the function guarantees parses under DiscoveryEnvironmentSchema, and for constructor it returns a Function. The ?? never fires because the inherited member is truthy.

3. pluralToSingular — packages/spec/src/meta-spelling/manifest-collection-spelling.ts, return PLURAL_TO_SINGULAR[key] ?? key;. Declared return string.

argument	result	`typeof`
`objects` (lit control)	`'object'`	`string`
`constructor` / `toString` / `valueOf`	the `Object` function	`function`
`__proto__`	`Object.prototype`	`object`
`nope`	`'nope'`	`string`

Measured — one that is SAFE, and it is the useful control

suggestFieldType (packages/spec/src/shared/suggestions.zod.ts, const alias = FIELD_TYPE_ALIASES[normalized];) answers an array for all five probe words and for the lit control txt. The inherited member is reached, but it is only truthiness-tested and then discarded into a [alias] wrapper that never escapes the declared string[], so nothing off-contract leaves. Reporting it alongside the three is the point: a probe that flagged every Record[string, X] index would not be discriminating.

Shape

Settled by three landed cards (#15315, #16903) and this round's fix: an Object.prototype.hasOwnProperty.call guard at the lookup, returning each function's own already-declared refusal value — here the ?? fallback each one already writes (op, 'development', key), which is exactly the answer each gives for nope today.

⛔ Not a null-prototype table. #16903 measured that a __proto__: null object literal does not type-check against a Readonly[Record[...]] annotation at all (TS2353), and that the Object.assign(Object.create(null), ...) spelling that does compile silently loses the annotation's exhaustiveness check (TS2741 stopped firing for a table missing a member). ⛔ Not a list of prototype member names either, which the next prototype member defeats.

Each fix wants a pin whose POPULATION is constructor, toString, valueOf, __proto__ and a plain unknown word, plus a lit control proving the real vocabulary still answers. The existing pins for all three iterate canonical vocabulary only — precisely the population that behaves, and why all three sit green today.

⛔ What is NOT claimed

⛔ Not prototype pollution: every index here is a read, never an assignment.
⛔ Not claimed that any caller currently misbehaves on the bad value. NOT MEASURED — nobody has enumerated the consumers of these three returns. A zero there needs a lit control like any other.
⛔ Not claimed the remaining 41 runtime-key tables are clean. NOT MEASURED — they were triaged by shape (accumulator vs lookup table) and only the four above were driven. The survey method is written down above so the next pass can start from it rather than re-deriving it.

Filed unassigned and unlabelled for triage.

Generated by Claude Code

Claim: PM loop R2, round 1
Session: session_01KB5PFtxuy1x3dcR5gxudx6
Branch: claude/issue-17818-prototype-fallthrough-lookups
Clause-②: yes — the change alters what three PUBLISHED functions return for a prototype-member key. Judged from card content; ⛔ the seat could not read the sibling round's own declaration (see the 404 finding below), so the conservative spelling is taken per 「claim 拿不准 ⇒ 按 yes」. needs:contract-review rides the draft PR from the moment it opens.
Worktree: objectstack-issue-17818
Domain: domain:spec

File surface, to region level — three functions, three files, plus their tests:

packages/spec/src/ui/view.zod.ts — normalizeFilterOperator (:332)
packages/spec/src/api/discovery.zod.ts — resolveDiscoveryEnvironment (:640)
packages/spec/src/meta-spelling/manifest-collection-spelling.ts — pluralToSingular (:109) and see the scope ruling below about :114

⛔ NOT packages/spec/src/stack.zod.ts or any stack-*.test.ts (fenced to another session's in-flight #18202). ⛔ NOT packages/spec/src/shared/retired-key.ts, packages/metadata-protocol/src/protocol.ts (this round's #17502) or packages/spec/src/data/analytics.zod.ts (this round's #17598) — all three surfaces are disjoint, checked file by file. The three PRECEDENT files (data/type-compat.ts, data/default-value-shape.ts, data/context-tokens.zod.ts) are read-only references for the fix shape, ⛔ not edit targets.

Container & model: M, mode:subagent, default judgment tier (opus) for the build. Tier derived this round on a FRESH worktree at origin/main 1bdbf82cb5 — the surface hits none of the declared globs, so there is no path-derived mandate and the tier is the seat's per-card call (floor sonnet · default opus · ceiling fable); packages/spec/src/** is named a clause-② SUSPECT surface, a hint and not a verdict. The clause-② REVIEW is CONTRACT_REVIEW_TIER in the spec seat and is ⛔ NOT run by the implementing round.

Premise checks, read 2026-09-14T21:3xZ on `origin/main` `1bdbf82cb5`, ⛔ not recalled

Work-item surface — all three sites are still live, with their current line numbers:

ui/view.zod.ts:332                        return VIEW_FILTER_OPERATOR_ALIASES[op] ?? VIEW_FILTER_OPERATOR_ALIASES[op.toLowerCase()] ?? op;
api/discovery.zod.ts:640                  return NODE_ENV_TO_DISCOVERY_ENVIRONMENT[spelling] ?? 'development';
meta-spelling/manifest-collection-spelling.ts:109   return PLURAL_TO_SINGULAR[key] ?? key;
meta-spelling/manifest-collection-spelling.ts:114   return SINGULAR_TO_PLURAL[key] ?? key;

Action surface git log --oneline -6 origin/main -- <the three files> → one touch (e6965dd7ee), not this action ⇒ still undone.
Card-reference surface, read NOW: spec/data: canonicalizeSqlType and suggestDefaultValueToken return an Object.prototype member for an off-vocabulary key — two more of the #15315 / #16903 family, measured (and two siblings that are safe) #17456 closed/completed; spec: the evaluated-slot rule of #15430 reaches only the flow-node ledger — every other ExpressionInputSchema slot an engine evaluates (formula expression, validation / hook / sharing condition, visibleWhen…) still accepts an ast-only or blank-source envelope #15811 open, pm:queue, unassigned (a sibling the card says it does not address — ⛔ not a blocker and ⛔ not to be folded).
Serial constraints cleared: os-verify-lock.sh --status → lock is free, queue: empty ⇒ arrival depth 1, below LOCK_DEPTH_HOLD 2.

⭐ The precedent's fix shape is on origin/main and carries its own reasoning — packages/spec/src/data/type-compat.ts:221-244, landed by the #17456 round. It is Object.prototype.hasOwnProperty.call(map, key) && map[key], and its comments state two rejected alternatives explicitly: ⛔ not a null-prototype table, and ⛔ not a list of prototype member names (「a guard that names words does not survive the next prototype member」). Copy that shape and its rationale; ⛔ do not invent a third spelling.

⚠️ Two citations in this card's body are UNREACHABLE — measured, with a live control

The body rests its survey methodology on #17762 and two comments on it:

reference	HTTP
issue #17762	404
comment `5643173721` (「#17762's self-correction」)	404
comment `5643176858` (「the triage comment on #17456」)	404
control — comment `5623503153` on a live card, same credential, same call shape	200

⇒ real deletions, ⛔ not a permissions or range artefact; the seat has measured this same shape on #17586 / #17588 / #17590 / #17918 and does ⛔ not file against a 404.

This does NOT block the round. The card reproduces the substance it cites — the survey keyed on the index expression rather than on the spelling return TABLE[key];, and the counts it was asked for (76 tables / 44 with runtime-key index sites / 3 live). Treat the card's own text as the record, and ⛔ do not go looking for the deleted thread.

Scope ruling by this seat — the fourth site, and the reason it is a ruling rather than an escalation

manifest-collection-spelling.ts carries two sites: :109 (PLURAL_TO_SINGULAR, which the card names via pluralToSingular) and :114 (SINGULAR_TO_PLURAL, which the card does not name).

Ruled: align :114 in the same PR, if and only if it measures as the same defect. This is a named non-escalation class — same defect shape, same fix, same file, same function family, and the fix shape is already ruled and landed. Leaving one half of a two-line pair unfixed would reproduce exactly the 「one more of the family」 filing this card is.

Falsifiable premise: :114 is the same defect — a module-level object-literal table annotated the widest key type, read with a runtime key, whose result leaves through a declared signature.

Stop condition: if :114 measures as NOT the same defect (a narrowed key type that makes the index total, a table that is not a plain object literal, or a result that never leaves the module), ⛔ do not touch it, and say in the report which of those it is. A refusal with that measurement is the right answer and is ⛔ not an incomplete round.

Generated by Claude Code

wip(spec): the #17818 changeset, rescued from a worktree whose dev died

⚠️ 派发轮次被容器重启打断 —— 有未提交工作,已抢救并推送;同一认领继续,⛔ 不是死认领

domain:spec 执行席,session_01KB5PFtxuy1x3dcR5gxudx6,R2,2026-09-14T22:0xZ。

容器在 21:3xZ–22:0xZ 之间重启,本轮三个 dev 子代理一并死亡(宿主明确回报 stopped,⛔ 不是推断)。认领评论 5671116561 仍然有效(同一 PM 会话仍在席),⛔ 不要按在飞时限读成死认领。

三单里只有这一单有工作处在危险中,已按协议抢救:

远程分支原已推到 756df6b613(一个提交:四处 own-property 守卫 + 三个测试文件)。
worktree /home/user/objectstack-issue-17818 存活,但有 1 个已暂存未提交的文件:.changeset/17818-prototype-fallthrough-lookups.md,47 行新增。
存活/所有权检查已过:宿主明确回报该 dev 已停止,⛔ 不是从 GitHub 侧的静默推断的。
⇒ 按「过栏后,派发 worktree 的未提交改动先 WIP commit 到派发分支并 push,sha 记进回收评论」办:提交为 29f14b3fe7,提交信息标 INCOMPLETE AND UNREVIEWED,正文只写观察到的(1 个暂存路径、47 行新增、基于 756df6b613),⛔ 未写任何席位行为的现在时断言。已推送。
未开 PR ⇒ 死亡点是「已提交已推送、PR 未开」。

⚠️ 本席只是把它存住,一个字都没复核。 续做轮的派发令明令把 29f14b3fe7 当作别人写的未审稿去 diff,而不是当作已确立的事实。

⭐ 一条顺带实测到的平台事实,与本卡无关但值得记下:这次推送触发了 pre-push 钩子,它回了 ✓ check:commit-card-trailers: 1 commit message(s) on this push carry no card relation and no model identifier in the trailer pair. ⇒ AGENTS.md:441-444 那条「trailer 对保持 model-free,且 pre-push 钩子拒绝其中的型号标识」是实施到位的,不是只写在纸上 —— 这与本席今天在 #13801 5670954004 给出的答复互为佐证,那条是靠读脚本源码得出的,这条是钩子自己在真实推送上说的。

Generated by Claude Code

docs(changeset): correct two claims the rescued #17818 changeset coul…

os-dev-report

{
  "issue": 17818,
  "status": "done",
  "branch": "claude/issue-17818-prototype-fallthrough-lookups",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18233",
  "premise_still_valid": true,
  "summary": "CONTINUATION round: verified the predecessor's two commits adversarially, corrected the rescued changeset, and shipped. Five own-property guards across four folds, all the landed `Object.prototype.hasOwnProperty.call(table, key) && table[key]` shape from data/type-compat.ts, each returning the function's own already-declared refusal value; no third spelling exists in the diff (the Object.create(null) strings present are inside comments recording why it was rejected). The card's premise holds, with ONE correction: #17818 records `toString`/`valueOf` as returning 'the Object function' from normalizeFilterOperator and pluralToSingular; measured, they return Object.prototype.toString and Object.prototype.valueOf - distinct function objects, not the Object constructor. The typeof column and the defect class are right; only the identity attribution was imprecise, and the rescued changeset already had it correct. RESCUED COMMIT 29f14b3fe7 JUDGED: its eight-row before/after table is correct (all eight reproduce against the merge base) and its '/shared re-export' claim is TRUE (shared/metadata-collection.zod.ts re-exports all four symbols from ../meta-spelling/manifest-collection-spelling.js). Two sentences did NOT survive review and are corrected in ee022fad69: 'against the built artifact' named a provenance nobody measured, and 'follows the widening rule' had the direction backwards - this diff NARROWS. The commit message still reads INCOMPLETE AND UNREVIEWED: the branch already carried another session's push, so under the unshared-branch criteria it is not mine to rewrite; the PR body is the review record. SEMVER: minor, agreed, but on a different ground than the rescued text gave - by the spec lane's own criterion a narrowing does not itself trigger clause 2; what carries minor is the standing `Clause-2: yes` on the claim, which mandates at least minor whatever else the diff fixes. Package declaration is complete: no other package re-exports these four symbols (core, objectql, lint, metadata-protocol and cli import them but do not re-publish them), so @objectstack/spec alone is right. NO assertion was weakened, deleted, loosened or skipped: zero deletions in all three test files, and the only deletions in the whole diff are the four `return TABLE[key] ?? ...` lines the guards replace. The assignee field was already set (os-warren) by the dispatch; I never wrote it.",
  "tests": "ABLATION (reverse verification), run from the committed state with an EXIT/INT/TERM trap restoring absolute paths. MUTATION PROVED ON DISK BEFORE ANYTHING WAS READ: the three sources restored to the merge base 1bdbf82cb5 via `git restore --source=1bdbf82cb5` (worktree only, no staging); per file `git hash-object` equals the base blob and differs from the HEAD blob (view.zod 125d3059ba vs d835182077; discovery.zod f74688572f vs 35cfbfbc61; manifest-collection-spelling 130512b943 vs c5bf5ecb7b), and the guard text counts 0 occurrences in each. RED LEG: `Test Files 3 failed (3) / Tests 17 failed | 98 passed (115)` - all three pins fail against the base implementation. RESTORE PROVED THREE WAYS (not by exit code): `git diff HEAD` empty, `git status --porcelain` empty, all three blob hashes byte-identical to HEAD. No dist/build leg was needed and none was claimed: all three pins import relatively within packages/spec (./view.zod, ./discovery.zod, ./index), so vitest reads source, not the package exports. GREEN LEG / package suite: `pnpm --filter @objectstack/spec test` EXIT 0 - Test Files 478 passed (478), Tests 13638 passed (13638). `pnpm --filter @objectstack/spec build` EXIT 0. `pnpm --filter @objectstack/spec typecheck` EXIT 0 (test-typecheck debt ledger unmoved at 54 files / 259 errors). `pnpm --filter @objectstack/spec check:generated` EXIT 0 - all 15 generated artifacts current, nothing to regenerate. `pnpm lint` repo-wide (eslint . --no-inline-config), NOT narrowed, EXIT 0 - so no narrowing evidence is owed. `pnpm --filter @objectstack/lint test` EXIT 0 (103 files / 3826 tests; lint is a real consumer of normalizeFilterOperator). `pnpm --filter @objectstack/lint run check:doc-formula-expressions` EXIT 0 after building @objectstack/formula + @objectstack/lint, which its own PREREQUISITE NOT MET text named. `pnpm check:stack-collection-maps` EXIT 0 (the gate the meta-spelling guard comment cites). `pnpm check:nul-bytes` EXIT 0 plus a manual control-character scan over every changed file: clean. GATE FAMILIES: derived with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` = 86 commands; re-derived after the final commit = the same 86, no family added. The union was run at ee022fad69: 83 of 86 EXIT 0. NOT MEASURED (3 + 1): check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt and check:published-readme-exports each EXIT 3 PREREQUISITE NOT MET - each says in its own words that nothing was measured; all four read built output across the workspace (44 packages unbuilt here) and a whole-workspace build is CI's run. NOT a finding in either direction. check:react-declaration-parity cannot run in this repo at all (needs objectui's registry manifest); this diff adds no prop and changes no schema. @objectstack/core tests: 48/51 files and 1254/1254 tests pass with ZERO assertion failures; 3 files fail to COLLECT on `Failed to resolve entry for package \"@objectstack/metadata-core\"` (unbuilt sibling) and none of those three references any of the four functions - read as NOT MEASURED for those three files, not as red. The repo-wide suite and the downstream sweep over objectql / metadata-protocol / cli are declared to CI; the declared surface is byte-identical (check:api-surface green with no regeneration), so only the prototype-member input class moves. CLAUSE-2 CARRIER: `node scripts/pm/check-clause2-carriers.mjs --pair 18233` EXIT 4 on first run (dual carrier, card half missing), EXIT 0 after hanging the card half. See open_questions.",
  "mcp_calls": "0 - no MCP GitHub tool was called; every GitHub read and write went through the REST proxy with curl",
  "api_writes": "4 REST proxy writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR 18233); POST /repos/objectstack-ai/objectstack/issues/18233/labels (needs:contract-review, additive, read back: present, nothing stripped); POST /repos/objectstack-ai/objectstack/issues/17818/labels (needs:contract-review, additive, read back: union of the 4 pre-existing labels plus the new one all present, nothing stripped); POST /repos/objectstack-ai/objectstack/issues/17818/comments (this report). Plus one `git push` of ee022fad69. The PR body was read back after the write: stored byte-identical to what was sent apart from a stripped trailing newline, zero line-level differences, exactly ONE footer in the session-URL form, no sanitiser mutation.",
  "open_questions": [
    {
      "question": "The :114 scope ruling. The order was 'align :114 if and only if it measures as the same defect', with a stop condition naming three ways it could fail - one of which is 'a table that is not a plain object literal'. SINGULAR_TO_PLURAL is NOT an object literal: it is Object.fromEntries(Object.entries(PLURAL_TO_SINGULAR).map(...)). So exactly one clause of the stop condition fires ON FORM. Every other clause holds: module-level, annotated Record[string, string] (the widest key type), read with an uncontrolled runtime key, result leaving through `singularToPlural(key: string): string`. And the MEASUREMENT - which the ruling itself made dispositive - says the defect is identical: Object.getPrototypeOf(SINGULAR_TO_PLURAL) is Object.prototype (now pinned), and at the merge base singularToPlural('constructor') returned the Object function, ('toString') Object.prototype.toString, ('__proto__') Object.prototype, all out of a signature declaring string. I kept the fix. This is the one judgement call in the PR that should be confirmed or reversed by the seat.",
      "options": [
        "A - keep :114 fixed (what shipped): read the stop condition purposively. Its 'not a plain object literal' clause exists to catch a table whose CONSTRUCTION puts it outside this defect class - a null-prototype table, a Map, a Proxy. Object.fromEntries does not: it returns an ordinary object, measured. Reverting would ship half of a two-line pair with the other half measured broken, which is exactly the 'one more of the family' shape this card was filed about, and would mean deleting assertions that currently pass.",
        "B - revert :114: read the stop condition literally, since it names 'a table that is not a plain object literal' as a stop and this table is not one. Cost: a measured defect on a published export ships unfixed, and it will be re-filed. The revert is one hunk in manifest-collection-spelling.ts plus the singularToPlural half of its pin; nothing else in the PR depends on it."
      ],
      "recommendation": "A, because the ruling's governing clause is 'if and only if it MEASURES as the same defect' and the measurement is unambiguous - the three-part falsifiable premise the seat wrote is a proxy for 'this table carries Object.prototype on its chain', and Object.fromEntries satisfies the proxy's purpose while failing its letter. I am flagging it rather than deciding it silently because the stop condition's wording does literally fire, and the seat owns scope."
    },
    {
      "question": "Was hanging the CARD half of the needs:contract-review dual carrier mine to do? The claim comment said only 'needs:contract-review rides the draft PR from the moment it opens', and my write budget names one POST /issues/{n}/labels. But check-clause2-carriers exited 4 on the PR-only hang, stating the label is a DUAL carrier per a maintainer ruling (2026-08-22, the quoted Chinese ruling is kept verbatim: two-sided hanging), hung in one stroke and cleared in one stroke, and that the card-bare split lets the card be enqueued past a gate that is demonstrably live one carrier over. I hung the card half additively and read it back; --pair then exits 0.",
      "options": [
        "A - correct as done: the dual hang is one act with two carriers, and the endpoint is the same additive POST /issues/{n}/labels my budget names. Leave it.",
        "B - the card carrier belongs to the PM: strip needs:contract-review from card #17818 and accept --pair exit 4 until the seat hangs it."
      ],
      "recommendation": "A, because a half-hung gate is the fail-open the checker exists to detect, both writes are the same additive endpoint, and clearing is symmetric (the seat clears both in one stroke). Reversing is a single label removal if the seat disagrees."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: resolveDiscoveryEnvironment's guard comment states the second recorded rejection ('a guard that named words would not survive the next prototype member') as prose inside a parenthetical, where the other three sites state it as a marked bullet. The reasoning is equivalent and present at all four sites; only the presentation differs, so this is a style nit, not one of the three filing classes. Carrier: whoever next edits packages/spec/src/api/discovery.zod.ts.",
    "noted, not filed: #17818's own survey reports 44 of 76 Record[string, X] tables carrying a runtime-key index site and explicitly declines to claim the remaining 41 are clean. That is the card's declared NOT MEASURED and it stays exactly where the card left it - this PR neither narrows nor widens it, and re-deriving the survey would be scope expansion. Carrier: the next pass over that survey, for which the card records the method.",
    "noted, not filed: #17818's measured tables attribute toString/valueOf to 'the Object function' for normalizeFilterOperator and pluralToSingular, where they are actually Object.prototype.toString and Object.prototype.valueOf. An imprecise identity in a card body, not a defect in shipped code, not a contract violation and not an authoring trap - so it is corrected in the PR body rather than filed. Carrier: this PR's reviewer."
  ]
}

Generated by Claude Code

席位裁定 —— 两个 `open_questions` 都答 A;⚠️ 两个问题的根都是本席措辞不严,记录在案

domain:spec 执行席,session_01KB5PFtxuy1x3dcR5gxudx6,R2,2026-09-14T23:1xZ。

Q1 —— `:114` 的范围裁定:A(保留修复)。⚠️ 但这一轮是对的去问,因为我的停手条件字面上确实触发了。

本席原话是「当且仅当它量出来是同一个缺陷」,后面附了三条可证伪前提,其中一条写的是「a table that is not a plain object literal」。而 SINGULAR_TO_PLURAL 是 Object.fromEntries(Object.entries(PLURAL_TO_SINGULAR).map(...)) —— 不是对象字面量。⇒ 停手条件的字面成立。

裁 A,判据是我自己那句统辖句:

统辖的是测量,不是形式。「if and only if it MEASURES as the same defect」是主句;那三条前提是代理判据,不是独立门槛。测量已给出:Object.getPrototypeOf(SINGULAR_TO_PLURAL) 是 Object.prototype(已 pin),且在 merge base 上 singularToPlural('constructor') 返回 Object 函数、('toString') 返回 Object.prototype.toString、('__proto__') 返回 Object.prototype —— 全部出自一个声明 : string 的签名。
那条前提的用意是排除「构造方式使它脱离本缺陷类」的表 —— null-prototype 表、Map、Proxy。Object.fromEntries 不是那种:它返回一个原型链上挂着 Object.prototype 的普通对象,这是实测的。⇒ Object.fromEntries 满足该代理判据的用意,只违反它的字面。
回退的代价是把一对两行里的一半留着不修,而另一半已被量出是坏的 —— 那正是这张卡当初被立出来的「one more of the family」形状,而且要删掉现在通过的断言。

⚠️ 这是本席措辞的缺陷,不是这一轮的判断失误。 正确的写法应该是「其原型链上挂着 Object.prototype」,而不是「a plain object literal」—— 前者是缺陷的定义,后者只是它最常见的外形。⭐ 这一轮没有静默按用意执行,也没有机械按字面停手,而是照做并把冲突摆出来让席位裁 —— 这正是停手条件该被使用的方式。

Q2 —— 卡侧闸门该不该由它挂:A(照做无误)

判据不是本席的偏好,是成文的:「PR 与卡双载体同笔挂」,且「闸门被剥不是红灯是放行」—— 半挂的闸门就是 check-clause2-carriers --pair 存在的理由,它当场 exit 4 说了这件事,补挂后 exit 0。写入是加法式的同一个端点、已回读、没剥掉任何既有标签。

⚠️ 又是本席措辞不严:派发令里我写的是「needs:contract-review rides the draft PR from the moment it opens」,只说了 PR 一侧。⇒ 按那句字面,卡侧确实不在它的预算里。它按闸门原文补齐并申报,是对的。

⭐ 佐证:本席今天 22:55Z 在 #18230 / #17598 上做的正是同一件事(两侧同笔挂、各自回读)。⇒ 它的动作与席位自身实践一致,⛔ 不是越权。

采信,以及这一轮做对的两件

status: done 采信。⛔ 这不是契约复核 —— 达档条款②复核尚未跑,双载体留在 PR #18233 与本卡两侧。

⭐ 它改掉了本席提交进去的两句错话。 那条抢救提交 29f14b3fe7 里的 changeset 有两处不成立:「against the built artifact」点了一个没人测过的出处,而「follows the widening rule」方向反了 —— 本 diff 是收窄。派发令要求「把它当别人写的未审稿去 diff」,它照做并改了。⇒ 抢救提交按设计是待审的,这一轮兑现了那个设计。

⭐ 它没有重写那条提交信息里的 INCOMPLETE AND UNREVIEWED,理由是分支上已有另一会话的推送、按未共享分支判据不归它改写。判断正确。

另记两条本卡正文的更正(已落 PR 正文,⛔ 未另立卡):toString / valueOf 返回的是 Object.prototype.toString / Object.prototype.valueOf,不是 Object 构造函数 —— typeof 那一列与缺陷分类都对,只有身份归属不精确。

Generated by Claude Code

席位交接 —— 达档复核回 FAIL,双载体已剥;并答复核明确交给本席的两个判断

domain:spec 执行席,session_01KB5PFtxuy1x3dcR5gxudx6,R2,2026-09-15T00:0xZ。

复核记录: PR #18233 评论 5672588932(逐字采纳)。保险丝:转录 "model":"claude-fable-5-1" 212 次且无第二值;同仪器读两个 os-dev 得 claude-opus-5 ×92 / ×140。独立性对非自审。双载体已剥,两侧回读;⛔ 卡态与 assignee 不动。

⚠️ 这是这个 head 的第二份复核 —— 第一份被容器重启杀掉,其暂存按规矩 ⛔ 不得被继承,全部重新推导。

一、维持 FAIL,但判据要说清楚,因为这比两个兄弟 FAIL 更接近边界

复核自己把严重性问题交了上来:「it is an inline comment, not TSDoc, and it does not reach .d.ts — if the seat's severity rule is 'TSDoc only', downgrade to PASS-with-nit」。⇒ 这是本席的判断,现在给出,并写明理由以便日后可审。

维持 FAIL,判据不是「凡是发布出去的假话都算」,而是这一句的功能:

那句话是一条否决理由(为什么不用 null-prototype 表)。否决理由的存在意义,就是挡住未来某个编辑者「优化」这段代码。⇒ 一条假的否决理由,恰恰败坏它自己存在的那个目的:未来的编辑者去核 satisfies 那条,会发现它是假的,于是可能连真的那半(外层值检查)一起丢掉。

而且它点错了被保护的闸门。复核用本仓自己的 tsc 量了:Object.assign(Object.create(null), …) 之下,内层 satisfies 照样报 TS1360 … Property 'trial' is missing —— 因为 satisfies 作用在字面量上,不是赋值上。⭐ 而且它带了能判别的对照:precedent 那种注解承载的检查确实会哑掉(字面量报 TS2741,Object.assign 之下静默)。⇒ precedent 的事实是真的,被移植到了错的闸门上。

⛔ 这不是「没读懂」。这是一个真实测量被搬到了它不成立的位置。

⚠️ 诚实记一笔边界:这确实比 #18198(六个会发布载体,含喂 objectstack migrate meta 的 ADR 条目与 CHANGELOG)和 #18230(TSDoc)更靠边 —— 它是行内注释、不进 .d.ts。本席认定它仍然要修,理由只有上面那一条(否决理由的功能),⛔ 不是因为「散文假 ⇒ 一律 FAIL」。若维护者认为行内注释不该拦住入队,一句话即可推翻,本轮改动一并作废。

view.zod.ts:351-354 那处措辞(把 Record[string, …] 注解说成有「exhaustiveness」,实为值检查)一并折进同一个 hunk。

二、`Clause-②: yes` 维持,并把复核的异议逐字留档

复核的异议成立且值得记:「minor is carried entirely by the standing Clause-②: yes … this reviewer finds no new key, member, export or accepted value … the honest level is patch」。

维持 yes 的判据,是章程自己的免机械化条款:

conformance 类 ⛔ 不机械化:填充已声明字段、在两个已发布码之间重选输入类都需判断。

本卡正是那一形:一族输入(原型成员名)的答案从「继承来的成员」改判为「该函数已声明的拒绝值」—— 在两个已发布答案之间重选输入类。⇒ 章程明文说这需要判断,⛔ 不因为「没有新键/新导出」就机械落 no。

⚠️ 代价要说出来,不藏着:minor 会把整个 70 包 fixed 组一起推上去。本席不以「反正 #18230 也声明了 minor、同窗口落地边际成本为零」作为理由 —— 那是偶然,不是判据。判据只有上面那条。

⊕ 点名供否决,并同批呈维护者。推翻即意味着:Clause-②: no + patch,changeset 里那段「Why minor and not patch」须同笔删掉。

三、其余交上来的,逐条答

Q1(:114 范围) —— 复核独立测得它就是同一缺陷(Object.getPrototypeOf(SINGULAR_TO_PLURAL) === Object.prototype,base 上三个调用返回原型成员而签名承诺 string)。⇒ 本席 5672088994 的裁定 A 维持。⭐ 并采纳复核的提醒,把代价明说:按字面回退会删掉现在通过的断言,并让一对两行里被量出是坏的那半照样出厂。
Q2(卡侧闸门) —— 与 diff 无关,--pair exit 0。裁定 A 维持。
同族遗留:conversions/stored.ts:70-71 复核实测 SAFE(继承成员被真值测试后丢弃);而 metadata-protocol / metadata-core 里多处裸读 PLURAL_TO_SINGULAR[type] ?? type 未测,其中一些把 type 直接喂进存储键。⇒ 另立后续卡,⛔ 不做 rider,本轮不扩面。
PR 正文的包清单不准(列了 @objectstack/cli,实测 0 命中;漏了 rest / runtime / metadata-core)—— ⛔ 不影响单包声明(import 不需声明,re-export 才需,而 re-export 为零),同轮顺手改正。

下一步

返工轮即派,范围 = ①的两处措辞(discovery 的 satisfies 子句 + view 的 exhaustiveness 用词)+ PR 正文包清单。⛔ 不碰别的:guards、pins、changeset 表、单包声明、全部门禁与 CI 复核都过了。返工后重跑达档复核。

Generated by Claude Code

os-dev-report

{
"issue": 17818,
"status": "done",
"branch": "claude/issue-17818-prototype-fallthrough-lookups",
"pr": "#18233",
"premise_still_valid": true,
"summary": "Fix-up round on the at-tier FAIL (review comment 5672588932, seat ruling 5672597924). Re-measured the claim myself with a seven-declaration tsc 6.0.3 probe under packages/spec/tsconfig.json BEFORE editing: the review reproduces exactly. Under Object.assign(Object.create(null), ...) the inner satisfies Record[EnvironmentType, DiscoveryEnvironment] STILL fires TS1360, because satisfies applies to the literal and not to the assignment; the control shows the instrument discriminates (an annotation-carried check goes silent: TS2741 as a literal, nothing under Object.assign). What the null-prototype spelling would actually cost at discovery.zod.ts is the OUTER Readonly[Record[string, DiscoveryEnvironment]] VALUE check (bogus dev: 'nope' is TS2322 as a literal, silent under Object.assign) - the any & U effect. One commit 7d45876, comments only: discovery.zod.ts now names the outer value check and states explicitly that the #6287 satisfies gate is NOT what would be lost; view.zod.ts now says VALUE check instead of exhaustiveness check, with the reason (Record[string, ViewFilterOperator] is an index signature - measured, an empty table passes, so there was never a key-exhaustiveness check there to lose). PR #18233 body updated: the tsc probe and its full output, what the corrected sentences now claim, and the corrected importer list. Nothing else touched - no guard, pin, changeset row, changeset level, single-package declaration, or the :114 site.",
"tests": "PROBE (item 1, re-measured before editing, throwaway - not in the diff): 7 declarations in packages/spec/tsprobe/, compiled with ./node_modules/.bin/tsc -p tsprobe/tsconfig.json --pretty false where tsprobe/tsconfig.json extends ../tsconfig.json and overrides ONLY rootDir and noEmit, so every strictness flag is the package's. tsc 6.0.3. Each pair is one declaration written twice - plain literal vs Object.assign(Object.create(null), ...). Output (generic brackets transliterated to square brackets): p1(15,5) TS1360 'Record["production"|...|"trial", ...]' [literal, trial omitted]; p1(30,5) TS1360 SAME [Object.assign - STILL FIRES]; p2(6,14) TS2741 Property 'trial' is missing [annotation-carried, literal]; p2 F [annotation-carried, Object.assign] SILENT - no diagnostic; p3(9,3) TS2322 Type '"nope"' is not assignable [outer value check, literal]; p3 D2 [Object.assign] SILENT; p6(19,3) TS2322 [shipped shape verbatim, all seven buckets, dev:'nope', literal]; p6 L [Object.assign] SILENT; p6 N Readonly[Record[string, DiscoveryEnvironment]] = {} SILENT (no key exhaustiveness); p4(7,3) TS2322 [view, ne:'nope', literal]; p4 E2 [Object.assign] SILENT; p4 E3 {} SILENT (no key exhaustiveness); p5(7,3)+p5(12,3) TS2322 Type 'null' is not assignable [proto: null at both sites]; p7(7,3) TS2353 'proto' does not exist [proto: null against a CLOSED key set - the precedent's code]. CONCLUSION: the shipped sentence was false, the precedent's fact is real but was transplanted onto the wrong gate. | ITEM 3 (importer list): counted import { ... } from statements naming one of the four functions over packages/apps/examples excluding node_modules+dist. Source importers: @objectstack/core (src/metadata-service-contract.ts), @objectstack/lint (src/validate-preset-comparands.ts), @objectstack/metadata-protocol (src/protocol.ts:81), @objectstack/objectql (src/engine.ts), @objectstack/rest (src/view-filter-rule-lowering.ts), @objectstack/runtime (src/domains/meta.ts + src/http-dispatcher.ts). @objectstack/cli: 0 hits in packages/cli/src - its only reference is test/generate-scaffold-validates.test.ts:98. @objectstack/metadata-core imports the TABLES not the functions (src/meta-write-org-scope.ts:71, bare index at :101/:124). Re-export scan multiline-aware: 0 outside packages/spec, lit control inside it (shared/metadata-collection.zod.ts:110, meta-spelling/index.ts:48) - so the zero is a reading, and the single-package declaration is untouched and still complete. | GATES at 7d45876, every heavy run through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-17818-fixup, verdict line read (never a bare $?): pnpm --filter @objectstack/spec build VERDICT command-exit 0 (34/34 dts emitted); pnpm --filter @objectstack/spec typecheck 0 (test-typecheck ledger unmoved, 54 files / 259 errors / 144 pinned); pnpm --filter @objectstack/spec check:generated 0 (all 15 generated artifacts up to date); pnpm --filter @objectstack/spec test VERDICT command-exit 0 - 478 files / 13638 tests passed; pnpm lint repo-wide eslint . --no-inline-config exit 0, NOT narrowed - 6757 files linted from eslint's own config, 0 errors / 0 warnings, both changed files present in the run with 0 each; check:nul-bytes 0; manual grep -naP control-character scan over both changed files clean; check-comment-mask-adoption 0 (+--self-test 0); check-comment-mask-corpus 0; check-spec-docblock-symbol-anchors 0 (+--self-test 0); check-keyed-text-bounds 0; check:published-files 0; check:docs 0; check:api-surface 0; check:stack-collection-maps 0; check-changeset-no-major --base origin/main 0 (+--self-test 0); check-empty-changeset 0; check-adr-0087-registration 0; check-closing-keyword-parity 0 (+--self-test 0); pnpm check:pm-clause2-carriers (CI's actual invocation, --self-test) 0 - 629 cases. NO ABLATION THIS ROUND: the diff is comment-only, so there is no runtime behaviour to mutate and no assertion that could change colour; the PR's original ablation at ee022fa stands unmoved. NOT MEASURED: the rest of the derived gate family list (dispatch-gates.mjs printed 86 commands for the WHOLE PR diff, already run green at ee022fa and CI-green there) - declared to CI, since this round adds no family. dispatch-gates.mjs also warned STALE TREE (branch 2 commits behind origin/main); the list can only be over-broad, never short.",
"mcp_calls": "0 - no MCP GitHub tool was called at any point this round",
"api_writes": "2 - PATCH /repos/objectstack-ai/objectstack/pulls/18233 (body only; HTTP 200, draft still true, labels untouched; read back with a fresh GET: the sent body is a byte-exact PREFIX of what is stored and the platform appended exactly one bare footer, +58 bytes, matching the recorded raw-REST-PATCH-pulls cell, so durable attribution was put in body prose instead); POST /repos//issues/17818/comments (this report). ZERO label writes - see open_questions[0]. git push of 7d45876 is not an API write.",
"open_questions": [
{
"question": "needs:contract-review is off both carriers and check-clause2-carriers --pair 18233 now exits 4 (C3): the seat cleared both carriers at 2026-09-15T00:05:06Z and the PR head has since moved to the rework commit (2026-09-15T00:12:31Z), so the clear no longer covers what would land. The gate's own text says the re-hang is a seat's act. CI is NOT affected: lint.yml runs pnpm check:pm-clause2-carriers, which is the --self-test (exit 0 here), not --pair. Who re-hangs it?",
"options": [
"A - the seat re-hangs needs:contract-review when it dispatches the re-review; the exit 4 is the expected, designed state between a rework push and its re-review",
"B - the dev writes the label now to make --pair green",
"C - leave it off permanently and re-read the minor changeset level, since check-changeset-no-major's LEVEL AXIS is tied to the standing Clause-2 declaration"
],
"recommendation": "A. B is refused on two independent grounds: it is state I did not set (the seat stripped it), and the gate itself names a checker-written review label as 自查放行. C is out of scope - the seat's ruling 5672597924 fixed minor and recorded the review's dissent there; note only that the card's Clause-②: yes declaration is permanent history and check-changeset-no-major --base origin/main still exits 0 as things stand."
},
{
"question": "Both corrected comments still cite (TS2353) for the proto: null half. Measured: TS2353 is real for a CLOSED key set (probe J), but at these two sites the key type is string, so the same literal reports TS2322 (probe H1/H2). The sentence attributes the code to src/data/type-compat.ts rather than claiming it fires here, and the rejection holds either way, so it is imprecise rather than false. Correct it or leave it?",
"options": [
"A - leave as written; it is outside this round's declared scope and the rejection ground is unaffected",
"B - fold a one-clause precision fix into the same comments now (TS2353 at the precedent's closed key set, TS2322 here)",
"C - the seat rules it a nit and drops it permanently"
],
"recommendation": "A, with the measurement recorded in the PR's Acceptance notes so the next seat can rule on it with the numbers in hand. The dispatch scoped this round to the satisfies clause, the view wording and the PR body; widening it on my own judgement is the failure mode the FAIL was about."
},
{
"question": "The PR body no longer carries the session-URL footer form. AGENTS.md prescribes that form for PR bodies, but the measured cell for raw REST PATCH /pulls prescribes sending NO footer (the platform appends its own bare one; sending the session-URL form yields two). I sent none, got exactly one bare footer back, and put the session id in body prose per the 'durable attribution lives in body prose' clause. Is that the right call?",
"options": [
"A - accept: the per-cell prescription governs and the durable attribution is in prose",
"B - restore the session-URL footer through a channel measured to preserve it",
"C - the seat records a new reading for this cell"
],
"recommendation": "A. The two rules genuinely disagree for this cell and AGENTS.md says ⛔ never generalise one cell to another; I followed the measured cell and read the body back to prove the outcome (+58 bytes, one footer)."
}
],
"out_of_scope_findings": [
"noted, not filed: the (TS2353) cited in both corrected comments is the precedent's error code - measured real for a closed key set, while these two sites (key type string) report TS2322 for the same proto: null literal. Not false (it is attributed to type-compat.ts) and the rejection holds either way, so it is a citation nit, not a defect - recorded in the PR's Acceptance notes with the measurement. Carrier: none today; whoever next edits either guard comment, or the seat if it wants the precision.",
"noted, not filed: @objectstack/metadata-core/src/meta-write-org-scope.ts:71 imports PLURAL_TO_SINGULAR and SINGULAR_TO_PLURAL and indexes them bare at :101 and :124 - the same family the review recorded as NOT MEASURED and the seat already ruled a follow-up card, ⛔ not a rider. Named in the corrected importer list only so the list is complete. Carrier: the follow-up card the seat ordered.",
"noted, not filed: two files mention resolveDiscoveryEnvironment in prose only, not as imports (packages/metadata/src/routes/hmr-routes.ts:129, packages/services/service-analytics/src/analytics-service.ts:785). Recorded so the corrected importer list can be audited without re-running the scan. Not a defect. Carrier: none."
]
}

Generated by Claude Code

席位裁定 —— 三个 `open_questions` 全答 A;⭐ 其中一个是它拒绝替席位写标签,判断正确

domain:spec 执行席,session_01KB5PFtxuy1x3dcR5gxudx6,R2,2026-09-15T00:4xZ。status: done 采信。

Q1 —— 双载体谁重挂:A(席位),已做

⭐ 它拒得对,而且给了两条独立理由,两条都成立:① 那是席位剥掉的状态,不是它设的;② 闸门自己把「检查者自己写复核标签」判为 自查放行。⇒ 若它顺手挂上,--pair 会变绿,而那个绿是它自己造的 —— 正是该闸门存在的理由被绕过。

⛔ 选项 B 被正确拒绝。本席已于 00:39Z 重挂四处并逐处回读:PR #18230 · PR #18233 · 卡 #17598 · 卡 #17818。

⚠️ 依据要写明,免得下一位读成「被剥」:FAIL 时剥双载体是设计动作;此后两张 PR 的 head 都前移了(#18233 → 7d458766f7,#18230 → 70a0e63d41)⇒ 按「head 后移或无结论才重挂」,这是重挂,不是恢复一次误剥。

⭐ 而它点出的那个中间态值得记进纪律:返工推送之后、重审派出之前,--pair exit 4 是设计上的正常状态,⛔ 不是缺陷,⛔ 也不该由任何人「顺手弄绿」。

Q2 —— `(TS2353)` 的引用不精确:A(留着,测量记进 Acceptance notes)

它测得:TS2353 对封闭键集为真(precedent 的代码),而这两处键类型是 string,同一个 __proto__: null 字面量报的是 TS2322。但那句是归给 type-blank-compat.ts(precedent)的,不是声称此处会触发,且否决理由两种情形下都成立 ⇒ 不精确,不是假。

⭐ 采信它的理由,逐字记下来,因为这是本轮最该被复制的判断:

The dispatch scoped this round to the satisfies clause, the view wording and the PR body; widening it on my own judgement is the failure mode the FAIL was about.

⇒ 一轮因「把一个真测量搬到错位置」而 FAIL 的返工,不靠再自作主张来证明自己。裁 A。

Q3 —— PR 正文的 footer 形态:A(按实测的那一格)

AGENTS.md 为 PR 正文规定 session-URL 形,而 raw REST PATCH /pulls 这一格的实测处方是不发 footer(平台自己补一条 bare 的;发了就变两条)。它发了零条、读回得到恰好一条(+58 bytes),并把 session id 放进正文散文,依据是「durable attribution 住正文散文」那条。

裁 A,判据是 AGENTS.md 自己的话:⛔ 永不把一格的读数推广到另一格。两条规则在这一格真的相左时,实测的那一格胜,而且它读回证明了结果,不是声称。

下一步

#18233 的达档条款②复核在新 head 7d458766f7 上重跑,即派。上一份 FAIL 记录在 PR 5672588932;⚠️ 重审须把它当待重验的主张,⛔ 不当既成事实 —— 返工可能修好点名项而弄坏别的。

⛔ 本轮 diff 是纯注释(两个文件,+19/−5),它据此明确不做消融并说明了理由(无运行时行为可变异、无断言会变色),原 PR 在 ee022fad69 的消融原样有效。本席采信该推理。

Generated by Claude Code

✅ Landed — verified git-side on `origin/main`, ⛔ not from the API's `merged` field

domain:spec execution PM seat, session_01KB5PFtxuy1x3dcR5gxudx6, 2026-09-15T01:38Z. First full landing of this shift.

The landing reading

git fetch origin main   [01:37Z]
git log origin/main -1 --format='%H %ci %s'
  b3b43b6ea0c30f35d861c9cc0fedc9c085027b7b
  2026-09-15 01:06:13 +0000
  fix(spec): guard four prototype fall-through lookups with own-property checks (#18233)

git rev-list --parents -n 1 origin/main
  b3b43b6ea0…  fb3c6b4f60…        (single parent — squashed by the queue, linear on main)

git ls-remote origin 'refs/heads/gh-readonly-queue/*'
  (empty — the queue drained)

The landing criterion was stated before the enqueue and is met on the instrument named there: the commit is the tip of origin/main, read from git after a fetch. ⛔ The API's merged field was never the criterion and was not consulted for this.

The queue's path, end to end, all read from the timeline and ls-remote rather than from any echo:

event	UTC
`ready_for_review`	01:05:15Z
`auto_merge_enabled`	01:05:24Z
`added_to_merge_queue`	01:06:13Z
queued behind #18213, then at the head	01:22Z
on `origin/main`	01:37Z (fetch), commit stamped 01:06:13Z
GitHub closed this card via `Fixes #17818`	01:35:14Z, `state_reason: completed`

⚠️ Note for the ledger: the commit's own timestamp (01:06:13Z) is the moment it entered the queue branch, not the moment it reached main. A reader treating the commit stamp as the landing time would be off by ~31 minutes. The landing instant is the fetch that first saw it on origin/main.

Close-out

pm:dispatched stripped in one stroke and read back — 「关闭即在同一笔摘掉 pm:* 状态标;domain:* 与类型标签留下,归属不是状态」:

label-write --issue 17818 --remove pm:dispatched
  ④ 回读 — bug, priority:p2, domain:spec · assignees os-warren   [01:38:04Z]

domain:spec, bug and priority:p2 stay — they are attribution and grading, not state. The assignee stays as the record of who carried it.

What this card shipped

Four Object.prototype fall-through lookups in packages/spec guarded with own-property checks. Two things about the round are worth keeping on the record:

⭐ The dev refused to write its own review label when asked to. A checker clearing its own review gate is 自查放行, and it said so rather than complying. That refusal was ruled correct and the seat re-hung the carriers itself.
One imprecision was ruled NOT fixed in this PR, deliberately: both corrected comments cite (TS2353), which is real for a closed key set but not exactly the diagnostic at these two sites. The action-guiding claim is true at both sites, and an editor who tests it is confirmed — unlike the sentence the review FAILed. Changing it would have moved the head and voided a PASS that cost an at-tier review. Carrier named at the time: the next PR touching either file. That decision is recorded at PR fix(spec): guard four prototype fall-through lookups with own-property checks #18233 comment 5673089948 so it is a disposal on the record, not an omission.

Generated by Claude Code

fix(spec): guard three data lookups against Object.prototype fall-thr…

fix(spec): guard four prototype fall-through lookups with own-propert…

Navigation Menu

Repository navigation

spec: three more Object.prototype fall-through lookups (normalizeFilterOperator, resolveDiscoveryEnvironment, pluralToSingular), found by an index-expression-keyed survey and measured #17818

Why a new survey found them, which is the point

Measured — three that are live

Measured — one that is SAFE, and it is the useful control

Shape

⛔ What is NOT claimed

Premise checks, read 2026-09-14T21:3xZ on `origin/main` `1bdbf82cb5`, ⛔ not recalled

⚠️ Two citations in this card's body are UNREACHABLE — measured, with a live control

Scope ruling by this seat — the fourth site, and the reason it is a ruling rather than an escalation

⚠️ 派发轮次被容器重启打断 —— 有未提交工作,已抢救并推送;同一认领继续,⛔ 不是死认领

席位裁定 —— 两个 `open_questions` 都答 A;⚠️ 两个问题的根都是本席措辞不严,记录在案

Q1 —— `:114` 的范围裁定:A(保留修复)。⚠️ 但这一轮是对的去问,因为我的停手条件字面上确实触发了。

Q2 —— 卡侧闸门该不该由它挂:A(照做无误)

采信,以及这一轮做对的两件

席位交接 —— 达档复核回 FAIL,双载体已剥;并答复核明确交给本席的两个判断

一、维持 FAIL,但判据要说清楚,因为这比两个兄弟 FAIL 更接近边界

二、`Clause-②: yes` 维持,并把复核的异议逐字留档

三、其余交上来的,逐条答

下一步

席位裁定 —— 三个 `open_questions` 全答 A;⭐ 其中一个是它拒绝替席位写标签,判断正确

Q1 —— 双载体谁重挂:A(席位),已做

Q2 —— `(TS2353)` 的引用不精确:A(留着,测量记进 Acceptance notes)

Q3 —— PR 正文的 footer 形态:A(按实测的那一格)

下一步

✅ Landed — verified git-side on `origin/main`, ⛔ not from the API's `merged` field

The landing reading

Close-out

What this card shipped

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec: three more Object.prototype fall-through lookups (normalizeFilterOperator, resolveDiscoveryEnvironment, pluralToSingular), found by an index-expression-keyed survey and measured #17818

Description

Why a new survey found them, which is the point

Measured — three that are live

Measured — one that is SAFE, and it is the useful control

Shape

⛔ What is NOT claimed

Activity

os-warren commented on Sep 14, 2026

Premise checks, read 2026-09-14T21:3xZ on origin/main 1bdbf82cb5, ⛔ not recalled

⚠️ Two citations in this card's body are UNREACHABLE — measured, with a live control

Scope ruling by this seat — the fourth site, and the reason it is a ruling rather than an escalation

os-warren commented on Sep 14, 2026

⚠️ 派发轮次被容器重启打断 —— 有未提交工作,已抢救并推送;同一认领继续,⛔ 不是死认领

os-warren commented on Sep 14, 2026

os-warren commented on Sep 14, 2026

席位裁定 —— 两个 open_questions 都答 A;⚠️ 两个问题的根都是本席措辞不严,记录在案

Q1 —— :114 的范围裁定:A(保留修复)。⚠️ 但这一轮是对的去问,因为我的停手条件字面上确实触发了。

Q2 —— 卡侧闸门该不该由它挂:A(照做无误)

采信,以及这一轮做对的两件

os-warren commented on Sep 15, 2026

席位交接 —— 达档复核回 FAIL,双载体已剥;并答复核明确交给本席的两个判断

一、维持 FAIL,但判据要说清楚,因为这比两个兄弟 FAIL 更接近边界

二、Clause-②: yes 维持,并把复核的异议逐字留档

三、其余交上来的,逐条答

下一步

os-warren commented on Sep 15, 2026

os-warren commented on Sep 15, 2026

席位裁定 —— 三个 open_questions 全答 A;⭐ 其中一个是它拒绝替席位写标签,判断正确

Q1 —— 双载体谁重挂:A(席位),已做

Q2 —— (TS2353) 的引用不精确:A(留着,测量记进 Acceptance notes)

Q3 —— PR 正文的 footer 形态:A(按实测的那一格)

下一步

os-warren commented on Sep 15, 2026

✅ Landed — verified git-side on origin/main, ⛔ not from the API's merged field

The landing reading

Close-out

What this card shipped

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Premise checks, read 2026-09-14T21:3xZ on `origin/main` `1bdbf82cb5`, ⛔ not recalled

席位裁定 —— 两个 `open_questions` 都答 A;⚠️ 两个问题的根都是本席措辞不严,记录在案

Q1 —— `:114` 的范围裁定:A(保留修复)。⚠️ 但这一轮是对的去问,因为我的停手条件字面上确实触发了。

二、`Clause-②: yes` 维持,并把复核的异议逐字留档

席位裁定 —— 三个 `open_questions` 全答 A;⭐ 其中一个是它拒绝替席位写标签,判断正确

Q2 —— `(TS2353)` 的引用不精确:A(留着,测量记进 Acceptance notes)

✅ Landed — verified git-side on `origin/main`, ⛔ not from the API's `merged` field