[Decision] #1198 and #1199 together empty the inert-field ledger to zero — so #1193's live-vs-inert guard loses its subject, not just its fixture

[os-sales]

Raised by the repo:hotcrm PM seat. #1198 was dispatched to execute its 2026-08-17 deletion ruling and came back blocked with the tree byte-identical — no PR, no commits, nothing edited. The refusal is correct and this card is why.

⛔ This card does not ask whether crm_product.tax_rate should be deleted. That is ruled and the seat is not reopening it. The dev's own reasoning is endorsed: a regression fixture is not a business consumer, and letting a test fixture veto a maintainer ruling inverts the hierarchy. The deletion stands. What is undecided is what happens to the guard on the other side of it.

The measured collision

test/field-consumer-scan.test.ts — #1193's object-aware-resolution guard — uses crm_product.tax_rate as its canonical fixture. Not incidentally: 19 occurrences, and the file's own prose calls it "#1193's headline row" and "the control".

Verified independently by the seat, not taken from the report:

test/field-consumer-scan.test.ts:62   expect(fieldsByObject.get('crm_product')?.has('tax_rate')).toBe(true)
test/field-consumer-scan.test.ts:65   expect(verdictOf('crm_product','tax_rate')).toBe('inert')
test/field-consumer-scan.test.ts:262  expect(output).toContain('crm_product.tax_rate — 4 site(s)')
test/field-consumer-scan.test.ts:304  "'tax_rate' is declared on crm_product, crm_quote_line_item"

scripts/scan-field-consumers.ts:123   CARRIER_ROOTS = new Set(['translations','data','mappings'])
scripts/scan-field-consumers.ts:144   DISPLAY_ROOTS = new Set(['views','pages','apps'])

The ruling's zero-consumers basis was sound and structurally blind at the same time. scan-field-consumers.ts walks the registered metadata stack only — those six roots, never test/. A test fixture therefore cannot appear in the ledger the ruling was read from. The ruling was not careless; the instrument could not see this.

The dev measured the breakage by ablation rather than prediction: removing the field and its four locale rows turns 4 of 19 cases red (Tests 4 failed | 15 passed), with the mutation proved on disk (five blob hashes moved and were restored to their HEAD values, git diff HEAD empty afterwards) and a positive control that pnpm validate really re-read the mutated tree (334 Fields → 333 Fields).

⚠️ And the dependency was deepened after the ruling. Dated through the REST commits endpoint because the local clone is shallow: 5d46177f created the scan and the fixture at 2026-08-17T05:46:24Z, 6h14m before the ruling comment at 12:00:39Z. Then ac02bf15 (#1266) at 2026-08-24T02:45:30Z added the --sites control that pins crm_product.tax_rate by name with exit 0 and a literal output string — seven days after the ruling.

Why re-pointing the fixture does not solve it

The guard needs a field name declared on two objects with different verdicts. Measured from pnpm scan:fields --json, exactly three exist: tax_rate, line_number, description.

#1199 proposes removing line_number and description. So:

	inert rows on the tree	under adjudication
#1198	1 (crm_product.tax_rate)	yes, ruled
#1199	14	yes, queued
remaining if both land as proposed	0	—

⇒ the live-vs-inert pair class is extinguished, not merely reduced. Re-pointing the fixture at line_number today means re-pointing it again when #1199 lands. This is why the dev stopped rather than picking one.

The options

A — Extend #1198's surface to test/field-consumer-scan.test.ts; repair the fixture; land the deletion in one PR. Fastest. ⚠️ Buys a second re-point when #1199 lands, and does authorship inside another card's guard.

B — Re-point to a live-vs-display-only pair. Seven shared names keep that divergence through both cards (billing_address, description, do_not_call, lead_source, notes, title, website). ⚠️ Changes what the guard asserts, and the --sites control — which by its own comment needs "a DECLARED but genuinely inert field" returning exit 0 — has no inert field left to pin and must be re-specified.

C — Sequence #1198 behind #1199 so the fixture is re-pointed once, after the whole inert ledger is adjudicated. The dev's recommendation (C then A).

D — ⭐ Retire the live-vs-inert half of the guard, rather than re-point it. ⛔ Neither the dev nor the ruling considered this, and the seat thinks it is the reading that fits the repo's own rule: a guard retires because its subject retired, never because it went quiet. If zero inert fields is the intended steady state — and #1198 + #1199 together say it is — then a guard proving the resolver can distinguish live from inert is guarding a category the repo has decided not to have. Option B keeps the guard alive by quietly redefining what it proves; D says so out loud and deletes it. ⚠️ D is only correct if "zero inert fields" is intended rather than incidental. That is the question underneath all four options, and it is the one the seat cannot answer.

What the seat has done meanwhile

• [Decision] crm_product.tax_rate: enforcing it is measurably wrong, so the remaining option is removal — which needs a ruling #1198 → pm:blocked, claim released, tree untouched, branch pushed empty at f0a05613.
• The object-aware scan surfaces 14 more inert fields, 5 of them masked by a shared name — a second enforce-or-remove ledger #1199 → pm:blocked on this same card. ⛔ It is not independently dispatchable: it removes the two replacement fixtures, so dispatching it first hits this identical wall from the other side.
• The src/translations/** serial fence [Decision] crm_product.tax_rate: enforcing it is measurably wrong, so the remaining option is removal — which needs a ruling #1198 was holding is released; Orphaned locale keys are invisible to every i18n check — the gate only looks surface→translation #1262 and All four locale files translate a crm_case form section sla_overview that was deleted with the SLA/Resolution sections — 4 objectstack validate warnings, heading stays in the source locale #1511 are free again.

Three scope items in the 2026-08-17 ruling are stale — measured, not inferred

Recorded so the ruling is not re-executed verbatim once this unblocks:

• docs/feature-inventory.md row — does not exist. Nothing to delete.
• docs/developers/api_reference.md field list — already removed by docs/developers/api_reference.md is the fourth copy of the drifted crm_* roster — 15 names against 18 on disk #1488; the file now says field lists are "deliberately not restated here". ⇒ the docs/README.md still orders maintainers to hand-copy object fields into docs/developers/api_reference.md #1494 fence has nothing to protect on this card.
• src/data/revenue.seed.ts — seeds no product tax rate. Its one tax_rate is a comment at :223 about crm_quote_line_item. ⛔ Must not be touched.
• The doc surface is 12 sites across 3 faces, not "three doc rows" — the table row, plus a whole prose paragraph, the frontmatter description, and the Pricing field-group summary row, on each of products.mdx / .zh-Hans / .zh-Hant.

⚠️ Also for whoever executes: src/objects/quote_line_item.object.ts:60 says "crm_product keeps tax_rate there too" — one comment clause that goes false the moment the deletion lands. Fix it in the same PR; it is not worth its own card.

[os-zhuang]

Maintainer ruling recorded — F: retire this repo's field-consumer scanner and its guard outright; the detection moves to the platform

Director seat, summon #15, session_01TezFG8ZMrNH6n5VTNpPpdH (os-zhuang), 2026-09-05T11:2xZ.

Provenance (who / verbatim / where): maintainer, live director chat, 2026-09-05, after asking why a metadata app writes its own test tooling instead of relying on objectstack's checks. Verbatim: 「1543 选 F，普查卡同意开，你现在就派发处理。」

Freshness re-read before recording: card body unchanged since filing (0 comments before this one); #1198 and #1199 both still pm:blocked (labels re-read 11:1xZ).

The ruling, and why options A–E are all set aside

The standing 2026-08-31 ruling in this repo's AGENTS.md (§ "Scope — a pure metadata application", rule 3) already decides the frame: "Lint, validation, gates and diagnostics belong to the platform, uniformly. A drift-class or validation-class gap you find is a platform problem and goes upstream. Tests in this repo pin this repo's own business facts and nothing else … ⛔ Do not grow a gate farm." "Does a declared field have any consumer" is a property of every metadata app, not a HotCRM business fact. scripts/scan-field-consumers.ts (573 lines, created 2026-08-17) and test/field-consumer-scan.test.ts (318 lines) predate that ruling and were never reconciled with it. Options A–E all assumed the guard keeps living here; F is the option consistent with the ruling.

Measured on origin/main b1599507 (2026-09-05T11:1xZ): the repo carries 169 test files / 69,419 lines against 172 metadata files / 39,734 lines; the platform already ships objectstack validate, objectstack lint (whose flow-inert-node-condition rule was itself measured on HotCRM), and @objectstack/verify.

What F executes (this card becomes the work card)

1. hotcrm (this card, Fixes #1543): delete scripts/scan-field-consumers.ts, test/field-consumer-scan.test.ts, the scan:fields script in package.json; update the two rosters that name them (test/script-main-guard.test.ts — its scan-field-consumers entry; test/verify-log-decoy-pin.test.ts — row 6) and the comment in scripts/lib/main-module.d.mts. Existing .changeset/*.md and CHANGELOG.md are history and stay untouched. Empty-frontmatter changeset. Clause-②: no.
2. objectstack: a plain platform card (filed by this seat, unlabelled, triage's to route) for a "declared field with zero consumers" diagnostic in os lint / os validate, with HotCRM as the measured corpus and the retired scanner as design input. Precedent: objectstack#4698 landed only the sharing-rule instance of the "declared but never read" class (PR #4985); the general field-consumer diagnostic was not built there.
3. [Decision] crm_product.tax_rate: enforcing it is measurably wrong, so the remaining option is removal — which needs a ruling #1198 and The object-aware scan surfaces 14 more inert fields, 5 of them masked by a shared name — a second enforce-or-remove ledger #1199 stay pm:blocked on this card until the retirement PR is MERGED (landing them first would turn the guard red), then are released in the same stroke and dispatched under their existing rulings; [Decision] crm_product.tax_rate: enforcing it is measurably wrong, so the remaining option is removal — which needs a ruling #1198's dispatch carries the four stale scope items recorded on this card.

Not decided here

Whether the platform diagnostic distinguishes display-only from carrier-only consumers the way the retired scanner did is a lint-design question for triage and the devx lane, not part of this ruling.

State transition, same stroke: needs-user-decision → pm:dispatched (maintainer's direct-dispatch instruction above; the repo:hotcrm seat #1353 is vacant since 2026-09-03T17:18Z). Ledger: director seat post objectstack#12708, summon #15.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round — director seat summon #15, maintainer direct dispatch (verbatim 「你现在就派发处理」, 2026-09-05, director chat); the repo:hotcrm seat #1353 is vacant
Session: session_01TezFG8ZMrNH6n5VTNpPpdH
Branch: claude/issue-1543-retire-field-consumer-scanner
Worktree: hotcrm-issue-1543
Domain: repo:hotcrm (single-lane repo; no domain:*)
File surface: scripts/scan-field-consumers.ts (delete) · test/field-consumer-scan.test.ts (delete) · package.json (drop scan:fields) · test/script-main-guard.test.ts and test/verify-log-decoy-pin.test.ts (roster entries naming the deleted files) · scripts/lib/main-module.d.mts (comment) · one empty-frontmatter .changeset/*.md (stop on breach; explain in the report). ⛔ src/**, content/docs/**, CHANGELOG.md, existing .changeset/*.md, governed surfaces untouched.
Container & model: S deletion with roster reconciliation, handled as M; mode:subagent; model: opus — node scripts/pm/dispatch-gates.mjs --tier (objectstack, 11:1xZ) reads "no path-derived mandate … floor sonnet · default opus · ceiling fable"; default tier chosen because the hotcrm verify chain (changeset gate, hygiene, token ratchet) needs judgment, not because of any contract content.
Clause-②: no
Serial constraints cleared: open hotcrm PRs at 11:1xZ are two dependabot bumps (#1264, #1058) touching lockfile/manifest only; no in-flight claim on test/** or scripts/**; #1198 and #1199 are pm:blocked on this card and stay so until this PR is MERGED (landing them first turns the guard red); none.

---

Generated by Claude Code

[os-zhuang]

Dev claim (identity is the branch; mode:subagent, dispatched by the PM seat under the F ruling recorded above).

Branch: claude/issue-1543-retire-field-consumer-scanner (pushed empty at base b1599507 before any edit)
Worktree: /home/user/hotcrm-issue-1543
Base: b15995073eca00f123a7a3e5d109c4d626d067cc
Session: session_01TezFG8ZMrNH6n5VTNpPpdH

File surface I intend to touch: scripts/scan-field-consumers.ts (delete) · test/field-consumer-scan.test.ts (delete) · package.json (drop scan:fields) · test/script-main-guard.test.ts and test/verify-log-decoy-pin.test.ts (roster entries) · scripts/lib/main-module.d.mts (comment) · one new .changeset/*.md. Untouched: src/**, content/docs/**, CHANGELOG.md, existing .changeset/*.md, governed surfaces, and all metadata (no field deletion here — #1198 / #1199 stay separate).

---

Generated by Claude Code

[os-zhuang]

os-dev-report
{
"issue": 1543,
"status": "done",
"branch": "claude/issue-1543-retire-field-consumer-scanner",
"pr": "#1580",
"premise_still_valid": true,
"summary": "Ruling F executed as ruled: scripts/scan-field-consumers.ts (573 lines) and test/field-consumer-scan.test.ts (318 lines) deleted outright, the scan:fields script dropped from package.json, and the two rosters that name them reconciled (test/script-main-guard.test.ts drops its GUARDED entry; test/verify-log-decoy-pin.test.ts drops the suite from KNOWN_SPAWNING_FILES). No metadata touched: crm_product.tax_rate and every other field are exactly as on origin/main, so #1198 and #1199 remain untouched separate cards. Guard was not re-pointed, redesigned or partially kept. One empty-frontmatter changeset added, which .github/workflows/changeset-check.yml documents as the sanctioned 'releases nothing' declaration, so no skip-changeset label was applied. Base b159950, two commits: fd7f2b9 (deletion only) and 93044cf (roster reconciliation).",
"tests": "Reverse verification, three legs, all on committed trees, command 'pnpm exec vitest run test/script-main-guard.test.ts test/verify-log-decoy-pin.test.ts' (pnpm test -- FILES avoided: the second word becomes an argument). (1) BEFORE at base b159950: exit 0, 'Test Files 2 passed (2) / Tests 14 passed (14)'. (2) ABLATION at fd7f2b9, files deleted and rosters deliberately untouched: exit 1, 'Tests 4 failed | 10 passed (14)' — script-main-guard 'exercises every guarded script found on disk' (expected 3 to deeply equal 2), both symlinked spawn legs for the deleted script, and decoy-pin rule C (expected [ 'test/field-consumer-scan.test.ts' ] to deeply equal []). Both rosters are therefore genuinely enforced; NOT the 'stays green without the roster edit' finding. (3) AFTER at 93044cf: exit 0, 'Test Files 2 passed (2) / Tests 12 passed (12)' — 12 not 14 because the two spawn cases belonged to the retired script. Full chain below in gates. Token-ratchet control: the gate was also run read-only against the shared base checkout (/home/user/hotcrm at b159950) and printed byte-identical figures, which is the evidence for the falsified assumption.",
"mcp_calls": "10",
"gates": [
{ "command": "pnpm validate", "exit": 0, "verdict": "validation passed; only the pre-existing loop/try_catch advisories, unchanged" },
{ "command": "pnpm typecheck", "exit": 0, "verdict": "tsc --noEmit, no output" },
{ "command": "pnpm lint", "exit": 0, "verdict": "90 warning(s), 12 suggestion(s) (1006ms) — pre-existing, unchanged" },
{ "command": "pnpm lint:i18n-gate", "exit": 0, "verdict": "OK i18n lint gate: 0 i18n/missing-* issues (102 total lint issue(s) reported, unaffected by this gate)" },
{ "command": "pnpm hygiene", "exit": 0, "verdict": "OK source hygiene clean" },
{ "command": "pnpm hygiene:tokens", "exit": 0, "verdict": "OK source token ratchet clean — business semantics ~84,060 / interaction layer ~37,429 / authored total ~135,830; identical to the same gate run at base" },
{ "command": "pnpm build", "exit": 0, "verdict": "Artifact: dist/objectstack.json (2012.2 KB)" },
{ "command": "pnpm test", "exit": 0, "verdict": "Test Files 159 passed (159) / Tests 3380 passed, 1 skipped (3381)" },
{ "command": "CI on 93044cf (snapshot at report time, not waited on)", "exit": null, "verdict": "success: Check Changeset, Quality Checks, link-check, Label Pull Request, Vercel; in_progress: Build and Test (22.x), Playwright, Analyze Code (javascript)" }
],
"line_budget": { "deleted": 916, "added": 41, "net": -875, "files": 7 },
"files_changed": [
"scripts/scan-field-consumers.ts (deleted, 573)",
"test/field-consumer-scan.test.ts (deleted, 318)",
"package.json (scan:fields line removed; pnpm verify never referenced it)",
"test/script-main-guard.test.ts (-24/+5: GUARDED entry removed, tombstone added to the three-spellings record)",
"test/verify-log-decoy-pin.test.ts (-2/+1: KNOWN_SPAWNING_FILES entry removed, dated table row tombstoned)",
"scripts/lib/main-module.d.mts (-3/+7 comment only)",
".changeset/retire-the-field-consumer-scanner.md (new, empty frontmatter)"
],
"deviations": [
"FALSIFIED dispatch assumption (suggested route): 'deleting ~900 lines should only lower pnpm hygiene:tokens'. It cannot move at all — the ratchet's surface is src//*.ts minus src/translations and src/data, so nothing under scripts/ or test/ is measured. Verified by running the gate at base and on the branch: identical to the token. No ceiling touched.",
"Ran pnpm build in addition to the dispatched seven commands, because package.json (AGENTS.md's stated source of truth for the chain) puts build inside pnpm verify. Exit 0.",
"Went two lines beyond a pure roster-line removal, in two doc comments, and kept every dated figure: test/verify-log-decoy-pin.test.ts's failure-marker table is a measurement of tree ec4c5ac whose 64-line total is asserted in prose to reconcile, and test/script-main-guard.test.ts's three-spellings table is the record of why the shared entry-point helper exists. Deleting a row from either would falsify a dated measurement, so both rows stay and each gained a short tombstone naming #1543. Only the live rosters (GUARDED, KNOWN_SPAWNING_FILES) were changed.",
"scripts/lib/main-module.d.mts: its comment justified the declaration by the deleted .ts script, so the sentence was replaced rather than trimmed. The replacement claim is measured, not asserted: tsc --noEmit --listFiles still lists the declaration after the deletion (line 1055 of 1307), because tsc resolves it while typing scripts/check-source-token-ratchet.mjs, which test/source-token-ratchet.test.ts imports under allowJs. So the file is not dead code and was not deleted.",
"No skip-changeset label applied (the empty-frontmatter changeset is the route the workflow itself documents, and Check Changeset is green on it)."
],
"premise_notes": [
"Assumption 1 CONFIRMED by re-grep of 'scan-field-consumers|scan:fields|field-consumer-scan' on b159950: package.json, test/script-main-guard.test.ts (lines 30/49/130/212/302 as stated), test/verify-log-decoy-pin.test.ts (row 6 and line 86), scripts/lib/main-module.d.mts. No reader outside that set. Roster minimum populations stay meaningful with no invention: KNOWN_SPAWNING_FILES 8 to 7 with rule C's floor derived from the list itself, and script-main-guard's 'SCRIPTS.length at least 8' is unaffected (13 executable scripts to 12).",
"Assumption 2 CONFIRMED: CHANGELOG.md line 5457 and two existing changesets (.changeset/scan-fields-sites-rejects-unknown-names.md, .changeset/script-main-guard-scan-fields-red-leg.md) mention the scanner as history. All three left byte-untouched.",
"Assumption 3 CONFIRMED: zero references to scan:fields or the scanner anywhere under content/docs/. No doc edit needed, no fenced-surface finding.",
"Assumption 4 CONFIRMED and measured: the rosters do assert, and they are enforced (ablation leg 2 above)."
],
"open_questions": [],
"out_of_scope_findings": []
}

---

Generated by Claude Code

[os-zhuang]

Review — ACCEPT (director seat, summon #15, session_01TezFG8ZMrNH6n5VTNpPpdH, 2026-09-05T14:5xZ) · PR #1580, head 93044cfe

Checked against references/review-checklist.md on GitHub, not on the report's say-so:

item	reading
PR shape	draft ✓ · base main ✓ · first line Fixes #1543 ✓ — correct: F makes this card the work card, and the PR retires the whole subject; body scanned, no other closing keyword next to an open card number
Scope (get_files, 7 files)	exactly the claimed surface: 2 deletions (573 + 318 lines), package.json −1 (scan:fields), test/script-main-guard.test.ts −19/+5 (GUARDED entry removed, dated three-spellings record kept + tombstone), test/verify-log-decoy-pin.test.ts −2/+1 (KNOWN_SPAWNING_FILES entry removed, dated table row tombstoned), scripts/lib/main-module.d.mts comment only, one new changeset. No src/**, content/docs/**, CHANGELOG.md, existing changesets or governed surface touched ✓
Changeset	empty frontmatter — one of the two exemptions this repo's changeset-check.yml accepts (lane charter); Check Changeset green on this head ✓
Deletion reference face	this seat's own grep on origin/main b1599507 (11:1xZ, before dispatch) found the same reader set the dev re-measured: package.json, the two rosters, the .d.mts comment, plus history-only CHANGELOG.md / two old changesets. Nothing else reads the scanner ✓
Test evidence	real commands with outputs: three-leg reverse verification on committed trees (14/14 → 4 failed / 10 passed with rosters untouched → 12/12), full chain validate · typecheck · lint · lint:i18n-gate · hygiene · hygiene:tokens · build · test all exit 0, 159 files / 3380 passed ✓
Falsified dispatch assumption	"token ratchet should fall": measured false — the ratchet's surface is src/** only; identical figures at base and branch, ceiling untouched. Recorded, correct behaviour ✓
CI on 93044cfe at 14:5xZ	8 of 9 checks success (CodeQL, Analyze Code, Playwright, Quality Checks, Check Changeset, link-check, Label PR, Vercel); Build and Test (22.x) in_progress — convergence is the review side's; ready-flip waits for it

Governed-surface path test: none of the seven paths is AGENTS.md / CLAUDE.md / .claude/** / docs/adr/** / root skills/** ⇒ ordinary landing path (ready → auto-merge / queue), no human-merge diversion.

Landing plan: when Build and Test (22.x) reads success on this head, flip ready, arm auto-merge (squash, this repo's convention), follow to MERGED; on MERGED, in the same stroke release #1198 and #1199 from pm:blocked on this card and dispatch them under their existing rulings. Implemented-by: branch claude/issue-1543-retire-field-consumer-scanner (mode:subagent) · Reviewed-by: this session — same session, so this is a PM review of a subagent's diff, not an independent contract review; none was owed (Clause-②: no).

---

Generated by Claude Code