fix(lint): objectstack validate refuses a blank structural condition, the rule registerFlow already applies (#17495)

[claude]

Closes #17495

Clause-②: no

validateStackExpressions — the pass behind objectstack validate — reported
nothing for a structural condition that is blank after trimming, at either
node slot (a start node's trigger gate, a decision node's predicate) and on
an edge. #17322 / PR #17491 rebound AutomationEngine.registerFlow to the edge
door's non-blank rule, so the same value now stops the flow registering at boot
behind a single warn line. An author ran validate, got a clean bill, deployed,
and the trigger was never armed.

checkStructuralCondition gains the second gate the engine's copy already has,
in the same position (after the shape refusal, before the CEL pass), asking the
same imported rule: EvaluatedExpressionInputSchema, which
FlowEdgeSchema.condition has composed since #15807. Not a second hand-written
notion of "blank" — that is the drift the #15662 campaign built one shared
refusal to prevent — so the finding carries the spec's published
EVALUATED_EXPRESSION_SOURCE_REQUIRED sentence verbatim and the three doors
cannot answer differently.

Readings

Re-measured at claim time on d46deba195, ⛔ not taken from the dispatch:

reading	value
#17322	closed (completed) 2026-09-10T18:17:22Z
PR #17491	merged 2026-09-10T18:17:21Z
(#17491) in git log --oneline -400 origin/main	1 (control (#17637): 1)
evaluatedSourceRefusal in engine.ts at the base commit	2 occurrences — the runtime refusal really is on main
EvaluatedExpressionInputSchema.safeParse(' ')	success: false

One probe, both structural node slots at once, before → after:

probe	before	after
condition: ' ' at the start gate and the decision predicate	0	2
condition: '' at both	0	2
⭐ CONTROL — brace trap at both	2	2
⭐ CONTROL — ast-only envelope at both	2	2
⭐ CONTROL — valid CEL at both	0	0
condition: ' ' on an edge	0	1

The control trio is what makes the two zeros mean anything: each drives the same
probe over the same two slots, each is answered by a different pass (the CEL
pass, the shape pass, nothing), and each is unmoved by this change — so the
probe demonstrably reaches both slots and still discriminates. Without them a
0 proves only that nothing was measured. All three are pinned as tests.

The two pins are RE-JUDGED IN PLACE, never deleted

Copying the shape PR #17491 used for its own two stale pins.

1. validate-expressions.test.ts — "a whitespace-only STRING is untouched —
   ruled correct, not a defect". That toHaveLength(0) was deliberate: service-automation: evaluateCondition answers a silent false for a non-string predicate, and a non-string config.condition registers clean #15662
   ruled the blank string correct on the ground that author time and run time
   agreed about it. spec/automation: FlowEdgeSchema.condition still accepts an envelope the engine cannot evaluate (ast-only, whitespace-only source) — the evaluated-slot rule of #15430 has not reached the edge condition #15807 removed that ground at the edge door and A whitespace-only config.condition string is a silent false at the node door, while #15807 made the edge door refuse the same value at parse #17322
   removed it at the node door. The case is flipped in place with the reason
   written into it, and it now also pins that the blank refusal and service-automation: evaluateCondition answers a silent false for a non-string predicate, and a non-string config.condition registers clean #15662's
   shape refusal stayed distinct — exactly what the registration-side pin
   does.
2. lint-flow-patterns.test.ts (the line the card names) — the
   flow-inert-node-condition zero still stands and is kept: that rule is
   about a key nothing reads, and it never had an opinion on blankness. What
   changed is that the pin was readable as "validate says nothing about a blank
   condition", which is now a false record. It is re-judged in place with that
   reasoning, plus a cross-site assertion pinning where the refusal actually
   lives — so the zero can never be read as silence again.

⭐ A pin removed leaves no trace that the behaviour was once deliberate; a pin
re-judged says what changed and why.

Verification

• pnpm --filter @objectstack/lint test — 101 files / 3735 passed, 5 skipped, exit 0.
• pnpm --filter @objectstack/lint typecheck — exit 0 (tsc --noEmit + test-layer check).
• pnpm --filter '@objectstack/lint^...' build — exit 0 (dependency closure).
• Repo-wide eslint . --no-inline-config --format json — 6623 files linted, 0 errors, 0 warnings. Not a narrowed run: the population is eslint's own, read from its config.
• Derived gate families (scripts/pm/dispatch-gates.mjs --commands, 4-path change set): 59 derived, 56 run green, 3 NOT MEASURED (check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt each exit 3 — PREREQUISITE NOT MET, they read a whole-repo dist/; that build is CI's). 0 red. Reconciled with --ran carrying exit codes.
• Reverse verification (fix committed first, git checkout HEAD -- THE_PATH restore under a trap): the gate mutated out on disk — anchor 1 → 0, injected marker 1 — and the two test files went 8 failed / 438 passed; restored byte-identically (git hash-object equals the HEAD blob, git diff HEAD empty) and back to 446 passed.

Clause-② and the changeset, both measured

Clause-②: no, measured on the delivered diff rather than asserted:

• Path limb — SUSPECT_TIER_GLOBS is packages/spec/src/**; this diff touches packages/lint/src and .changeset only.
• Widening tells — no schema key, no closed-set member, no published export, no registry entry is added. The rule is imported; the contract itself is untouched.
• Accept-set census — 23 authored shapes at all three structural slots, run twice on one tree (once at HEAD, once with the gate ablated). Exactly 6 rows move, every one of them the blank family: ' ', '', '\t', '\n', {dialect:'cel',source:' '}, {dialect:'cel',source:''}. The other 17 are byte-identical, including every accepting shape (bare CEL padded and multiline, all three envelope spellings, absent, null). The narrowing is the ruled shape and nothing else, and the contract that rules it was decided in spec/automation: FlowEdgeSchema.condition still accepts an envelope the engine cannot evaluate (ast-only, whitespace-only source) — the evaluated-slot rule of #15430 has not reached the edge condition #15807 and applied in A whitespace-only config.condition string is a silent false at the node door, while #15807 made the edge door refuse the same value at parse #17322 — this PR is the third door catching up, not a new decision.

Changeset owed, and written (⛔ not skipped): @objectstack/lint publishes files: ["dist", …], and the new refusal is measured in the shipped bundles — evaluatedSourceRefusal appears 2× in dist/index.js and 2× in dist/index.cjs (positive control: validateStackExpressions 4× in dist/index.js). It is a minor with a BREAKING banner and an ADR-0087 disposition, mirroring PR #17491's; check-adr-0087-registration, check-changeset-no-major and check-empty-changeset all pass on it.

验收备注

• Declared deviation from the dispatch's file list. The dispatch said to touch only validate-expressions.ts and lint-flow-patterns.test.ts. The pin that actually recorded this pass's silence is in validate-expressions.test.ts ("a whitespace-only STRING is untouched") — the card cited lint-flow-patterns.test.ts:1279, which pins lintFlowPatterns, a different rule family whose zero this change does not move. Landing without editing validate-expressions.test.ts was impossible: that assertion becomes false. Both pins are re-judged; the new behavioural tests live beside the pass they test. The changeset is the fourth file.
• The #5017 meta-guard needed one entry: the new local blankRefusal is excused as plumbing beside shapeRefusal, with the same argument (its keys are the helper's own { message, source }, never metadata keys).
• Out of scope and untouched, as dispatched: the three packages/spec siblings (spec/automation: three residues of #17322's node-door refusal — a stale on-site ruling, an ADR-0087 entry that names only the edge slot, and two sibling predicate slots still admitting a blank string #17493, which also owns widening that ADR-0087 entry's surface to config.condition), packages/services/service-automation (the reference, not the target), and the three neighbours the card judged not duplicates (lint: lintFlowPatterns throws on a non-record member of a flow's edges list — the sibling list #16751 did not cover #16910 / lint: flow template path rules see neither a variable-rooted token nor a non-record-triggered flow — 6 of 7 real lookup-traversal sites in a downstream app are invisible #17305 / os validate and os lint judge an EMPTY stack when a project declares its metadata only in packages[] — the ADR-0130 D4 union fold (authoringRuleUnionStack) is wired into os build alone #17069).
• The evaluator half of service-automation: evaluateCondition answers a silent false for a non-string predicate, and a non-string config.condition registers clean #15662's ruling is deliberately untouched: a condition already stored blank still answers false. What moved is that it can no longer be authored past validate.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/lint, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via validateStackExpressions (symbol, a top-level function))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e3c4850cbbc209fd2ff769e9e58ed1a4aab249d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from f0fd79e56889c30e77832dab274f040cd6a55064 — the merge of head 8f5d3137ecef6828816f31b3e4450648ac77b1f0 into base 9e3c4850cbbc209fd2ff769e9e58ed1a4aab249d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin f0fd79e56889c30e77832dab274f040cd6a55064 && git checkout f0fd79e56889c30e77832dab274f040cd6a55064
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e3c4850cbbc209fd2ff769e9e58ed1a4aab249d 8f5d3137ecef6828816f31b3e4450648ac77b1f0 && git checkout -B drift-repro 9e3c4850cbbc209fd2ff769e9e58ed1a4aab249d && git merge --no-ff 8f5d3137ecef6828816f31b3e4450648ac77b1f0

node scripts/docs-audit/affected-docs.mjs --json 9e3c4850cbbc209fd2ff769e9e58ed1a4aab249d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 9e3c4850cbbc209fd2ff769e9e58ed1a4aab249d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[baozhoutao]

PM 裁决,两个 open question 都判了,并且两条都是本席的错,不是你的。

1. 四文件 —— 采纳方案 A。⭐ 那道两文件围栏是我画错的

你量出来的东西我自己复验了一遍(对着 origin/main,⛔ 不引你的报告):

读数	值
lint-flow-patterns.test.ts:1277 那条钉子断言的函数	lintFlowPatterns
lint-flow-patterns.ts 里对 validate-expressions 的调用	0 处(只有 :90 一句注释提到它)
真正记录这次沉默的钉子	validate-expressions.test.ts:3946 'a whitespace-only STRING is untouched — ruled correct, not a defect',在 CONTROLS — the shapes that must stay accepted 块里,断言 condIssues({ decisionCondition: ' ' }) 与 condIssues({ edgeCondition: ' ' }) 皆为 0

⇒ 卡面(以及照抄卡面的我的派单)把那条沉默记到了一个不同规则族的钉子上。condIssues 才是跑在被改代码上的探针,而那条断言被这次修改变成假的 ⇒ 改它不可避免,两文件围栏根本落不了地。方案 B 不成立,方案 C 只是把覆盖归错文件。A 是唯一能落的,你判对了。

⭐ 而你做的比卡面要求的更多:卡面只要求把那一个钉子就地重判,你把两个都重判了 —— validate-expressions.test.ts 那条翻面并写明「#15662 当初判它正确的依据是作者期与运行期一致,#15807/#17322 抽掉了那个依据」,lint-flow-patterns.test.ts 那条保留、改标题、再加一条跨站断言把那个零钉死成「这个族对空白没有意见」而不是「validate 没话说」。⭐ 一个零被明确写成「这不是关于那件事的陈述」,以后就再也不会被读成沉默 —— 这正是这张卡最要紧的那条纪律,你把它执行到了卡面没点名的地方。

生产改动我也逐行读过:规则是 import { EvaluatedExpressionInputSchema, EVALUATED_EXPRESSION_SOURCE_REQUIRED },引用而非重述(验收第 2 条);作用在 source 而不是整个值,并写明理由(无 dialect 的信封在这个槽是被 #4336 裁决允许的,交整个值会把这次收窄扩过裁决范围)—— 这一步是对的,⛔ 过度拒绝会比漏拒绝更难发现。

2. Clause-② 卡面载体 —— 采纳方案 A,已由本席补上

check-clause2-carriers.mjs:946 自己写死:「⛔ Do not fill the line in on the claiming seat's behalf; the declaration IS the judgement.」⇒ 缺的是本席的字,⛔ 不是你的。你拒绝代填是对的。

已把 claim 评论 5631744370 改成第二行 Clause-②: no,并用从 checker 源码里读出来的那条 CLAUSE2_KEY_LINE 正则验过:全评论恰好 1 行命中,取值 no(原来那条 - ⚠️ **\Clause-②` 你自己判**:…` 的 bullet 不命中,所以之前是「载体缺失」而不是「格式错误」——和你量到的 exit 4 一致)。

判 no 的依据是本席自己量的,不是抄你的:交付 diff 路径为 .changeset/ + packages/lint/src/,无 packages/spec/src/**;validate-expressions.ts 新增行里 ^export 命中 0;规则系导入而非新造。⇒ 变的是 lint 这道门追上了另外两道门已有的契约,不是新增或加宽契约条款。

3. 两条 out-of-scope,判如你所报

• ADR-0087 条目只写 edges[].condition,该扩到 config.condition —— 承接者 spec/automation: three residues of #17322's node-door refusal — a stale on-site ruling, an ADR-0087 entry that names only the edge slot, and two sibling predicate slots still admitting a blank string #17493,卡面本来就把 packages/spec 那部分残留圈给它了。⛔ 不折进本 PR。你把它记进 changeset 的 ADR-0087 disposition,让重放这条链的消费者也读得到 —— 这个处置比只写在 PR 正文里好。
• 卡面对钉子位置的归属不精确 —— 你判它「不是可复现缺陷、不是契约违反、不是作者陷阱,三类都不沾」⇒ 不立卡,只在 PR 正文里把更正写在下一个读卡的人会撞到的地方。同意,⛔ 不为一句写歪的卡面话立卡。

处置

已 undraft + 武装 auto-merge。changeset 在树上(.changeset/validate-refuses-blank-structural-condition.md),⇒ ⛔ 不打 skip-changeset,你没有默认 skip,这是对的 —— packages/lint 是发布包,而这是它开始报出一类新 finding 的行为变更。

---

Generated by Claude Code