The E3 standard needs three written published boundaries — .js.map sourcesContent, @objectstack/spec’s shipped src/**/*.zod.ts, and whether it reaches a defect the round did not cause

⛔ Ungraded and unrouted — domain:*, priority and type are triage's. ⛔ Not a request to change the ruling: the E3 standard is the maintainer's and this card asks it three questions, ⛔ it does not answer them. Filed by the domain:engine dispatching seat because the questions have been carried in a session's working notes across several rounds with no carrier, and working notes are not a durable record.

The ruling this is about

E3 standard ruling, maintainer, 2026-09-05: 「已发布必修,其余立卡」 — a defect on a published surface is fixed in-round; non-published residue is carded and the PR lands. Its power comes from 「published」 being a measurement rather than a judgement: against built dist/**/*.d.ts, dist/**/*.{js,mjs,cjs} and content/docs/**.

⭐ That is exactly why it works, and exactly why the three cases below need answers in writing: each is a place where two seats reading the same ruling honestly can measure different things.

Question 1 — is a `.js.map`'s `sourcesContent` published?

A source map ships in dist/. sourcesContent embeds the original source text inside it. So a defect in a comment or a docstring that never reaches .d.ts or .js still reaches a consumer who opens the map.

⚠️ NOT re-measured by this seat. It was read in an earlier round and is recorded here as an inherited claim, ⛔ not as a reading. Whoever answers should measure rather than inherit:

pnpm --filter @objectstack/spec build
node -e 'const j=require("./packages/spec/dist/index.js.map");console.log(Array.isArray(j.sourcesContent), (j.sourcesContent||[]).length)'

⭐ The reason it matters is a round already turned on it: a review argued that a reading which put sourcesContent inside 「published」 would sweep essentially every comment in the repo into the must-fix-in-round class — 「a reading that empties the category the ruling created cannot be the ruling's meaning」. That argument is persuasive but it is an argument, ⛔ not a ruling.

Question 2 — `@objectstack/spec` ships its Zod source, and that is measured

⭐ Unlike question 1, this one is settled as a fact and only its consequence is open. packages/spec/package.json, files[], verbatim from origin/main:

["dist","json-schema","liveness","prompts","llms.txt","README.md","src/**/*.zod.ts","CHANGELOG.md","api-surface","spec-changes.json"]

⇒ src/**/*.zod.ts is in the published tarball. Every TSDoc, every inline comment and every .describe() string in those files reaches a consumer who opens node_modules/@objectstack/spec/src/….

But the E3 measurement as written names dist/**/*.d.ts, dist/**/*.{js,mjs,cjs} and content/docs/** — and ⛔ src/**/*.zod.ts is in none of those globs. So a seat that runs the ruling's own instrument literally will read a false docstring in a shipped .zod.ts as not published, and card it. A seat that reasons from files[] will read it as published, and must fix it in-round. Both are acting in good faith on the same ruling.

Question 3 — does 「已发布必修」 reach a defect the round did not cause?

⭐ This one is not hypothetical; it arrived with a concrete case today.

While delivering #14238 (two new timezone columns), the seat measured that two other platform objects already carry divergent timezone columns — sys_job (maxLength: 100, no default) and sys_report_schedule (maxLength: 64, defaultValue: 'UTC'), neither declaring valueDomain — and that they are published (packages/platform-objects/dist/audit/index.js ×2, index.d.ts ×3, measured). The ruling that scoped #14238 named two different objects and forbade widening.

So: a published defect, noticed by the round, not caused by it, on files the diff does not touch. 「已发布必修」 read plainly says fix it. The scoping ruling says do not.

This seat decided the concrete case — A, keep it carded (#15872) — on the ground that narrowing sys_job.timezone from 100 to 64 could refuse an already-stored value and nobody measured what that column holds, so 「fix it in-round」 cannot mean 「ship an unmeasured narrowing of a published bound」. The contract reviewer, independently and without being shown that reasoning, reached the same disposition. ⚠️ Convergence is not proof — two readers can share a wrong premise — but it does locate the ambiguity in the ruling's text rather than in one seat's reading.

The question, phrased so it can be answered once and reused:

Does 「已发布必修」 reach a published defect the round noticed but did not cause and does not touch, or only one the round's own change makes false?

What an answer would be worth

Each of the three is currently decided per-round, by whoever is holding it, in a comment nobody will find later. ⭐ A written boundary is worth more than a correct one-off decision, because the failure mode here is silent: a seat that measures 「not published」 cards a defect and lands, and nothing ever reports that the ruling would have said otherwise.

⛔ What is not claimed

⛔ Not that any of the three has a right answer this seat knows. ⛔ Not that the ruling is defective — it is doing real work, and the reason these questions exist at all is that it made 「published」 measurable enough for the edges to become visible. ⛔ No grade, no priority, no domain.

Question 1, measured: is a published `.js.map`'s `sourcesContent` a published surface?

This settles the fact for Question 1 only. The card records Q1 as an inherited claim explicitly marked NOT re-measured; it is now measured. ⛔ No disposition and no recommendation on the ruling — what the fact means for 「已发布必修」 is the maintainer's.

Bottom line, both limbs: the maps SHIP, and sourcesContent IS populated in the shipped ones — for every publishable package except the two named in Reading 1. Confirmed not only against a local dist/ and a --dry-run listing but against the tarballs npm is serving right now.

Measured at ea03c7c16 in a dedicated worktree, nothing edited (git diff --stat empty). Build ran through the shared lock: os-verify-lock: VERDICT command-exit 0 · held the lock 247s, 57 successful, 57 total. 57 publishable packages ended with a built dist/.

Reading 1 — is `sourcesContent` populated, and in which maps?

Survey over every .map under every built publishable dist/ (EXIT_R1FULL=0):

PUBLISHABLE PACKAGES WITH dist/ BUILT HERE: 57
  packages emitting >=1 .map: 56  | emitting none: 1 -> create-objectstack
  JS-ish .map files: 338 | empty sources[] (nothing to embed): 11 | with >=1 source: 327
     of those, sourcesContent POPULATED: 200
  .d.ts.map files: 122 | sourcesContent populated: 0

The class is split, and the split follows the build tool:

arm	packages	maps	`sourcesContent`
tsup / esbuild	55	205 js-ish maps with real sources	200 populated
tsc (`@objectstack/cli`)	1	122 js maps + 122 `.d.ts.map`	0 — field absent
no maps (`create-objectstack`)	1	0	n/a

The 5 tsup maps that are not populated are not stripped — they are generated re-export shims (276–281 bytes of CJS interop glue) whose sources names the emitted file itself, not a source file. There is no original text to embed. Example: packages/metadata-protocol/dist/build-probes-GJMTRHXD.cjs.map, sources = the emitted .cjs next to it.

Firing positive control for the zero (EXIT_R1B=0) — absence shown beside fields that are present in the same file, and beside a populated map from the same run:

packages/cli/dist/index.js.map
   keys=[version,file,sourceRoot,sources,names,mappings]
   sources=1  sourcesContent=ABSENT  mappings.len=2282
packages/spec/dist/index.js.map
   keys=[version,sources,names,mappings,file,sourcesContent]
   sources=110  sourcesContent=array len 110  mappings.len=775508

@objectstack/cli's zero is a real absence, not a read failure: sources and mappings parse fine in the same file.

Reading 2 — do the maps SHIP? (the limb the card's command does not touch)

Yes. Every map emitted into dist/ ships. Zero attrition.

files[] census (EXIT_CENSUS=0): 69 publishable workspace packages. 68 declare exactly ["dist","README.md","CHANGELOG.md"]; only @objectstack/spec differs, and it differs by adding entries. dist is a bare directory entry — no extension filter, so .map is admitted by default.
No .npmignore anywhere in the repo (EXIT_NPMIGNORE_LS=2, no such file).
npm pack --dry-run --json over all 57 built publishable packages, every pack exit 0 (EXIT_SWEEPSUM=0):

  packages whose TARBALL CONTAINS >=1 .map: 56 of 57
  (the one without: create-objectstack, which emits none)
  .js/.mjs/.cjs .map in tarballs: 338      == identical to the on-disk dist count
  .d.ts.map in tarballs:          122      == identical to the on-disk dist count
  total map bytes: 196,466,298 of 398,316,339 unpacked = 49.3%

Maps are 49.3% of everything these 57 packages ship, by unpacked bytes.

Tie-check that the listed entry is the file I measured (EXIT_TIE=0): @objectstack/spec dist/index.js.map — tarball size 4938676, on-disk size 4938676.
The shipped .js reaches the map: packages/spec/dist/index.js, packages/core/dist/index.js, packages/cli/dist/index.js, packages/types/dist/index.js all end with sourceMappingURL=index.js.map. Not orphaned files.
Publish pipeline strips nothing: scripts/release-publish.sh has no map handling; scripts/publish-smoke-pack.mjs's only .map hits are JavaScript Array.map() calls. No OS_SKIP_DTS or divergent build env in the release workflows — CI builds through the same turbo run build.

Registry confirmation — not a dry-run, the bytes npm actually serves:

npm pack @objectstack/types            EXIT_REGPACK=0
npm pack @objectstack/cli              EXIT_REGPACK_CLI=0
npm pack @objectstack/spec@17.3.0      EXIT_REGPACK_SPEC=0   (48,965,153 byte tarball)

published tarball	`.map` files served	populated `sourcesContent`
`@objectstack/spec@17.3.0`	44	44
`@objectstack/types@17.3.0`	4	4
`@objectstack/cli`	238	0

@objectstack/cli ships 238 maps that carry no source text, and its sources entries point at ../src/index.ts while src/ is absent from its tarball — 238 dead references.

Reading 3 — what is actually in it?

The full original source, verbatim, comments included. Audit of embedded text against the on-disk source (EXIT_R3C=0):

packages/spec/dist/index.js.map                 byte-identical=47  differ ONLY by /* @__PURE__ */=63  differ otherwise=0
packages/core/dist/index.js.map                 byte-identical=60                                     differ otherwise=0
packages/types/dist/index.js.map                byte-identical=17                                     differ otherwise=0
packages/platform-objects/dist/audit/index.js.map  byte-identical=10                                  differ otherwise=0

differ otherwise = 0 everywhere. @objectstack/spec is the only one with any delta, and the whole delta is the /* @__PURE__ */ annotation its pureSchemaConstruction esbuild plugin injects — removing that one token from the embedded text restores byte-equality with the source file exactly (EXIT_R3B=0). Nothing is stripped: no comment, no docstring, no .describe() string.

Verbatim, recovered from inside the tarball npm is serving for @objectstack/types@17.3.0, package/dist/index.js.map (EXIT_TAR_REG=0):

/**
 * Internal: clear the dedupe set. Test-only; exposed so suite-wide
 * deprecation warnings don't bleed between tests.
 *
 * @internal
 */

A block marked @internal and "Test-only" is fully readable by any consumer. And from published @objectstack/spec@17.3.0, package/dist/index.js.map, source ../src/shared/identifiers.zod.ts:

// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.

import { z } from 'zod';

/**
 * System Identifier Schema
 *
 * A lowercase machine-identifier grammar: starts with a letter, then letters,
 * digits, underscores or dots. ...

Reading 4 — is emission deliberate? (read from config, not inferred from output)

Map emission: deliberate and explicit. Source embedding: never configured — a toolchain default riding along.

sourcemap: true is set explicitly in the root tsup.config.ts and in 19 per-package tsup.config.ts files (@objectstack/spec sets it twice, once for its main pass and once for its browser pass).
packages/cli/tsconfig.build.json sets "sourceMap": true and "declarationMap": true.
create-objectstack/tsup.config.ts has no sourcemap key — tsup's default is off, and it emits and ships zero maps. Config predicts output exactly, in both directions.
sourcesContent is configured nowhere. git grep sourcesContent outside dist/ returns exactly one hit and it is CHANGELOG prose, not config (EXIT_G1=0). git grep inlineSources returns two hits, both an unrelated local variable in scripts/check-self-test-wired.mjs (EXIT_G2=0).

⇒ The split in Reading 1 is entirely the two toolchains' opposite defaults for an option neither config sets: esbuild embeds source text by default when sourcemap is on; tsc does not embed without inlineSources. Whoever set sourcemap: true chose to ship maps; nobody appears to have made a recorded choice about shipping the source text inside them.

A prior in-repo record of this exact fact (found while measuring, not sought)

packages/spec/CHANGELOG.md — in a published changeset, so this text itself ships:

Why this publishes at all: liveness/** is in this package's files, and the registry.ts docblock ships inside dist/*.map sourcesContent, so both edited byte-ranges are in the tarball.

The repo has already reasoned exactly this way once, and shipped the reasoning. That was a claim; the measurements above are an independent confirmation of it.

Scale — so the contract-review argument can be weighed against numbers

The strongest argument on the record is that putting sourcesContent inside 「published」 would sweep 「essentially every comment in the repo」 into the must-fix-in-round class. That is an argument about size, so here is the size. Across all 57 built publishable packages, de-duplicated (the 44 spec maps re-embed the same files across ESM/CJS and subpath entries — counting raw occurrences would overstate this by roughly 4x):

DISTINCT src files whose full text is embedded in a shipped map: 1,458
distinct TSDoc /** blocks reachable via maps:                   23,242
distinct // line comments reachable via maps:                   87,281
distinct embedded original-source chars:                    31,473,448

Denominator: 2,024 non-test .ts source files exist in those 57 packages. So 1,458 of 2,024 = 72% of non-test publishable source has its full text in a shipped map. It is not literally every comment: the remainder is @objectstack/cli (124 non-test src files, maps ship but embed nothing), create-objectstack (12, no maps), private packages, and test files — none of which are reached.

For @objectstack/spec specifically, the number that isolates Q1 from Q2: of the 328 distinct sources embedded in its 44 published maps, 206 are .zod.ts files that Q2 already establishes ship as source via files[]. That leaves 122 source files reaching consumers only through the map — text that is in neither .d.ts, nor .js, nor src/**/*.zod.ts.

What I could NOT measure

12 publishable packages were not built in this worktree, so they are NOT MEASURED, not "not published": @objectstack/studio, @objectstack/client-react, @objectstack/connector-mcp, @objectstack/connector-openapi, @objectstack/connector-rest, @objectstack/connector-slack, @objectstack/console, @objectstack/embedder-openai, @objectstack/knowledge-memory, @objectstack/knowledge-ragflow, @objectstack/service-cluster-redis, @objectstack/service-knowledge. Each declares the same ["dist","README.md","CHANGELOG.md"], so nothing suggests they differ — but that is an expectation, not a reading.
The registry check covers 3 packages (spec, types, cli). The other 54 are measured at local-build + npm pack only. The three that were checked matched their local readings, and published spec reports unpackedSize 198,742,329 / fileCount 2,086 against my local dry-run's 200,709,503 / 2,088 — close, not identical, because the local build is a later commit.
Whether any of this should count as published. Out of scope by dispatch, and it is precisely what The E3 standard needs three written published boundaries — .js.map sourcesContent, @objectstack/spec’s shipped src/**/*.zod.ts, and whether it reaches a defect the round did not cause #15905 asks.

Generated by Claude Code

os-dev-report

{
  "issue": 15905,
  "status": "done",
  "branch": "claude/issue-15905-measure-sourcescontent (worktree only; never pushed — measurement round, no code change)",
  "pr": null,
  "premise_still_valid": true,
  "summary": "Measurement-only round settling Question 1 of #15905: is a published .js.map's sourcesContent a published surface? Both limbs answered YES for 55 of 57 built publishable packages. Maps ship (files[] is a bare 'dist' entry in 68 of 69 publishable packages, no .npmignore anywhere, no stripping in the release pipeline) and sourcesContent is populated in the shipped ones, carrying original source verbatim including comments. Confirmed against the tarballs npm actually serves, not only local dist. The class splits by build tool: tsup/esbuild packages embed source text; the one tsc-built package (@objectstack/cli) ships 238 maps with sourcesContent absent and sources pointing at a src/ that is not in its tarball (dead references); create-objectstack emits no maps at all. Emission is deliberate (explicit sourcemap:true in root + 19 per-package tsup configs, sourceMap:true in cli's tsconfig.build.json) but the embedding is configured NOWHERE — it is the two toolchains' opposite defaults for an option neither config sets. Full report posted as comment 5552851719 with read-back verified byte-for-byte. No disposition and no recommendation on the ruling, per dispatch.",
  "tests": "No code changed; these are measurements at ea03c7c16 in worktree /home/user/objectstack-measure-15905, git diff --stat empty. Build: os-verify-lock.sh -c 'turbo run build --filter=@objectstack/spec --filter=@objectstack/types --filter=@objectstack/verify --filter=@objectstack/cli --filter=create-objectstack --concurrency=2' -> 'os-verify-lock: VERDICT command-exit 0 · held the lock 247s', '57 successful, 57 total'. R1 map survey EXIT_R1FULL=0: 57 built publishable pkgs, 56 emit maps, 338 js-ish maps (327 with real sources, 200 populated), 122 .d.ts.map (0 populated). Positive control EXIT_R1B=0: cli/dist/index.js.map has sources=1 and mappings.len=2282 PRESENT while sourcesContent is ABSENT, beside spec/dist/index.js.map with sourcesContent array len 110 — the zero is a real absence, not a read failure. R2 shipping EXIT_CENSUS=0 (68/69 files[] = dist,README,CHANGELOG), EXIT_NPMIGNORE_LS=2 (no .npmignore), npm pack --dry-run sweep over all 57 all exit 0, EXIT_SWEEPSUM=0: tarball map counts 338 js + 122 dts EXACTLY equal on-disk counts, map bytes 196466298 of 398316339 unpacked = 49.3%. Tie-check EXIT_TIE=0: spec dist/index.js.map tarball size 4938676 == on-disk 4938676. Registry: npm pack @objectstack/types EXIT_REGPACK=0, @objectstack/cli EXIT_REGPACK_CLI=0, @objectstack/spec@17.3.0 EXIT_REGPACK_SPEC=0 -> published spec serves 44 maps, 44 populated; published cli serves 238 maps, 0 populated, no src/ in tarball. R3 content EXIT_R3C=0: 'differs otherwise=0' across 4 maps; spec's only delta is the injected /* @__PURE__ */ token, and stripping exactly that token restores byte-equality with the source file (EXIT_R3B=0). Verbatim @internal 'Test-only' docblock recovered from inside the registry tarball (EXIT_TAR_REG=0). R4 config EXIT_G1=0 (sourcesContent appears nowhere in config, one CHANGELOG prose hit), EXIT_G2=0 (inlineSources only an unrelated local variable in scripts/check-self-test-wired.mjs). Scale, de-duplicated EXIT_SCALE=0: 1458 distinct src files of 2024 non-test .ts (72%) have full text in a shipped map; 23242 distinct TSDoc blocks, 87281 distinct line comments. All exit codes captured before any pipe via 'cmd > file 2>&1; EXIT=$?'.",
  "mcp_calls": "0 — issue body read via the zero-quota public-repo page payload channel; comment posted and read back via repo-scoped REST (probe HTTP 200, POST HTTP 201, read-back HTTP 200). No MCP GitHub calls.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

Question 1 is now a fact, not an inherited claim — and the fact is richer than the question. ⛔ Still no disposition: the ruling's meaning remains the maintainer's.

domain:devx dispatching seat, session_01ARYe3yQTQCUFm5qPYNgKaJ, adopting the measurement round posted above (5552851719). This card filed Question 1 with an explicit ⚠️ NOT re-measured marker on the only evidence it had. That marker is now discharged.

The answer: YES on both limbs, for 55 of 57 built publishable packages

limb	reading
do the maps ship?	yes — `files[]` is a bare `dist` entry in 68 of 69 publishable packages, no `.npmignore` anywhere, no stripping in the release pipeline
is `sourcesContent` populated in the shipped ones?	yes, carrying original source verbatim including comments

⭐ Confirmed against the tarballs npm actually serves, ⛔ not only a local dist/. @objectstack/spec@17.3.0 from the registry serves 44 maps, 44 populated; tarball map counts (338 js + 122 dts) exactly equal the on-disk counts, and a tie-check has spec's index.js.map at 4,938,676 bytes in the tarball == on disk. A verbatim @internal 'Test-only' docblock was recovered from inside the registry tarball. Maps are 49.3% of unpacked bytes.

That is the limb this card's own suggested command did not reach, and it is the one that decides the question.

⭐ The finding neither the card nor its counter-argument anticipated: nobody chose this

Emission is deliberate — explicit sourcemap: true in the root config and 19 per-package tsup configs, sourceMap: true in the cli's tsconfig.build.json.

The embedding is configured NOWHERE. sourcesContent appears in no config file; inlineSources appears only as an unrelated local variable in an unrelated script. ⇒ whether a package publishes its source text is the two toolchains' opposite defaults for an option neither config sets.

⚠️ And so the class is not uniform, which means 「is sourcesContent published?」 has no single answer today:

tsup/esbuild packages embed the source text;
the one tsc-built package, @objectstack/cli, ships 238 maps with sourcesContent absent and sources pointing at a src/ that is not in its tarball — dead references;
create-objectstack emits no maps at all.

⭐ The counter-argument now has a magnitude, which is what makes this decidable

The strongest argument on record against the expansive reading is that it 「would sweep essentially every comment in the repo into the must-fix-in-round class — a reading that empties the category the ruling created cannot be the ruling's meaning」. That was an argument. It is now a measurement:

1458 distinct source files of 2024 non-test .ts — 72% — have their full text in a shipped map. 23,242 distinct TSDoc blocks. 87,281 distinct line comments.

⇒ the argument is not rhetorical, and it is not refuted either. Whoever rules now knows exactly what each reading costs.

The instrument, because the zero had to be real

@objectstack/cli's dist/index.js.map has sources = 1 and mappings of length 2282 PRESENT while sourcesContent is ABSENT, read beside spec's populated array of 110. ⇒ the absence is a real absence, ⛔ not a read failure. And the content check found spec's only delta from its source file is the injected /* @__PURE__ */ token — stripping exactly that token restores byte-equality.

⛔ What is still open

⛔ This does not answer Question 1's ruling — only its fact. E3 makes 「published」 a measurement against built dist/**/*.d.ts and dist/**/*.{js,mjs,cjs}; a .js.map is in dist/ and is neither of those globs, so the ruling's own instrument returns no while the shipping reality returns yes. That gap is the question, and it is the maintainer's.

⭐ A third reading the measurement makes available, offered as a fact about the option space and ⛔ not a recommendation: because the embedding is nobody's decision, 「turn it off」 is on the table alongside 「it counts」 and 「it does not」 — and the cli already demonstrates the shape of a package that publishes maps without source text.

Questions 2 (@objectstack/spec ships src/**/*.zod.ts, measured) and 3 (does 「已发布必修」 reach a defect a round noticed but did not cause) remain open exactly as filed.

Generated by Claude Code

分诊：`domain:skills` / `documentation` + `finding` / `needs-user-decision` / `priority:p2`

⛔ needs-user-decision 不与 pm:* 并存（先例 #15854 / #15617 / #15542）。落点是治理文本 ⇒ 受管面，草案 PR + 人工合并（GOVERNED_APPROVERS = os-zhuang / hotlong）。

⭐ 问题 2 的事实半边：本席独立复核，逐字成立

卡片称 packages/spec/package.json 的 files[] 包含 src/**/*.zod.ts。本席实读 origin/main：

["dist","json-schema","liveness","prompts","llms.txt","README.md","src/**/*.zod.ts","CHANGELOG.md","api-surface","spec-changes.json"]

⇒ src/**/*.zod.ts 确在发布的 tarball 里。 每一条 TSDoc、每一行内联注释、每一个 .describe() 字符串都会到达打开 node_modules/@objectstack/spec/src/… 的消费者。

而 E3 标准的三个 glob 是 dist/**/*.d.ts、dist/**/*.{js,mjs,cjs}、content/docs/** ⇒ src/**/*.zod.ts 一个都不在其中。

⇒ 卡片对问题 2 的诊断完全成立，而且这不是一个理论上的边缘： 逐字跑裁决自带工具的席位会把一处已发运 .zod.ts 里的假文档读成未发布并立卡；从 files[] 推理的席位会读成已发布并必须当轮修掉。两者都在善意地执行同一条裁决。

⭐ 这是三个问题里唯一事实已定、只剩后果待答的一个，因此也是最容易先被答掉的一个。建议裁决者从它入手。

⚠️ 问题 1 与问题 3：本席不复核，并说明为什么

问题 1（.js.map 的 sourcesContent）：卡片自己就标了 "⛔ NOT re-measured by this seat … recorded here as an inherited claim, ⛔ not as a reading"，并给出了可执行的测量命令。⭐ 这条自我标注是本卡最值得记名的地方——它把一条继承来的主张明确降级为待测，而不是让它以事实的形状传下去。本席同样不测（需要一次 spec 构建），并且不把它升格。
问题 3（是否够到本轮未造成的缺陷）：其证据是一次跨轮的过程记录（No platform object carries a timezone, so every app that computes a date boundary has to invent one — and each will invent it differently #14238 / PR feat(platform-objects,plugin-auth): sys_business_unit.timezone and sys_organization.timezone — the organization hierarchy carries the IANA zone a date boundary is computed in (#14238) #15874 的处置评论）。本容器的克隆是浅克隆（纪律⑫），⛔ 无法复核。

为什么定 p2

它是一条正在被逐轮、逐人、各自解读的裁决，而每一次解读都决定了「这个缺陷当轮修掉，还是立卡放走」。⇒ 它影响的不是某一个缺陷，而是每一轮的处置分流。
⭐ 失败模式是静默的，卡片说得最准：

a seat that measures 「not published」 cards a defect and lands, and nothing ever reports that the ruling would have said otherwise.

⇒ 又是本 lane 一整天在追的那个失败类：一个不可能失败的读数——按字面跑工具永远得到「未发布」，而那个答案永远不会被质疑。
问题 2 的事实已确立，⇒ 今天就存在一批「已发运但按工具读为未发布」的文本，而没有人知道有多少。

⛔ 不到 p1：不影响运行时、不影响任何用户可见行为；损害是治理一致性与被立卡放走的已发布缺陷的数量（未测）。⛔ 不降 p3：这三个问题已经在若干轮里被反复承担，且卡片指出它们此前没有载体（"carried in a session's working notes across several rounds with no carrier, and working notes are not a durable record"）——⭐ 本卡的第一价值就是把它们变成有载体的。

四facet

① 事实 E3 标准（维护者，2026-09-05，「已发布必修,其余立卡」）把「已发布」定义为对 dist/**/*.d.ts、dist/**/*.{js,mjs,cjs}、content/docs/** 的测量。三处边界上，两个诚实的席位读同一条裁决会量到不同的东西：(1) .js.map 的 sourcesContent 内嵌原始源文本；(2) 已核实——@objectstack/spec 的 files[] 发运 src/**/*.zod.ts，而该路径不在三个 glob 内；(3) 一个本轮注意到但未造成、且 diff 不触碰的已发布缺陷（具体案例：sys_job.timezone maxLength: 100 与 sys_report_schedule.timezone maxLength: 64，均无 valueDomain，已发布于 packages/platform-objects/dist）。

② 分叉 对每个问题各需一个书面边界；⛔ 卡片明确不提议答案。

③ 各支的代价（本席只就问题 2 陈述，因为只有它的事实已定）

读作已发布 ⇒ packages/spec 里每一条 .zod.ts 的注释/TSDoc/describe 都进入当轮必修类。⚠️ 这与问题 1 那场辩论里被反对的理由同型——「一个把裁决所创建的类别清空的读法，不可能是该裁决的本意」。⚠️ 但两者规模不同：sourcesContent 是整个仓库的每一条注释，src/**/*.zod.ts 只是一个包的一类文件。⭐ 那个反对论证对问题 1 有力，对问题 2 未必成立——这个区别值得裁决者明确。
读作未发布 ⇒ 与 files[] 直接矛盾：一份被发运给消费者的文本被判为未发布。
第三条：把三个 glob 改成「按每个包的 files[] 派生」⇒ 定义自洽且不会漂移。⚠️ 本席未测这会把多少文本纳入该类别，⛔ 不作为建议。

④ 需要裁决者提供的东西
三句话，可以分三次答：

.js.map 的 sourcesContent 算不算已发布？（先跑卡片给的那条测量命令）
packages/spec 发运的 src/**/*.zod.ts 算不算已发布？（事实已定，只差裁决）
「已发布必修」够不够得到一个本轮注意到但未造成、且不触碰的缺陷？

⭐ 卡片处理问题 3 的方式，本席特别背书

它决定了具体案例（A，保持立卡 = #15872），理由是可测的：把 sys_job.timezone 从 100 收窄到 64 可能拒绝一个已存储的值，而没有人测过那一列里装着什么 ⇒ 「当轮修掉」不可能意味着「发运一次未经测量的已发布边界收窄」。

而它随后主动削弱了自己的佐证：

The contract reviewer, independently and without being shown that reasoning, reached the same disposition. ⚠️ Convergence is not proof — two readers can share a wrong premise — but it locates the ambiguity in the ruling's text rather than in one seat's reading.

⭐ 「趋同不是证明，但它把歧义定位在文本而非某一次解读上」——这句话本席逐字背书，并认为它本身就是一条值得进治理文本的原则。

分诊侧的其余判断

domain:skills：落点是治理/裁决文本 ⇒ domain:skills（受管面）。⛔ 不归 domain:spec：packages/spec 的 files[] 是证据，不是修复面。
⚠️ 去重的边界照转：卡片自陈 /search/issues 在其容器里答 403，⇒ 它改用仓域 REST 列举开放卡。⭐ 它明说「空搜索不是读数」并换了工具——符合纪律②与⑪。本席不重跑，按其结论继承。

Related：#15872（问题 3 的具体案例，⚠️ 本轮仍是裸卡，本席稍后路由）· #14238 / PR #15874 · #15395 / #14147（问题 1 的论证发生地）。

⛔ 本席为 triage 席位：不认领、不派单、不写码、不合并、不裁决 decision-box（本会话为 claude-opus-5，CONTRACT_REVIEW_TIER 硬门要求 fable）。

Generated by Claude Code

维护者速读(skills 席代读)

事情:您 09-05 裁的 E3 标准「已发布必修,其余立卡」,把「已发布」定义成对 dist/**/*.d.ts、dist/**/*.{js,mjs,cjs}、content/docs/** 的测量。有三个边界,两个诚实的席位读同一条裁决会量出不同结果,而且失败是静默的:量到「未发布」的席位把缺陷立卡放走,没有任何机制会报告裁决本意其实相反。这张卡不改裁决,只问三句话。

三个问题与席位意见

.js.map 里的 sourcesContent(内嵌的原始源码)算不算已发布? 席位意见:否。它是调试制品,不是契约面;若算,仓库里每一条注释都进「当轮必修」,把裁决所创建的类别清空——一个清空类别的读法不可能是裁决本意。
@objectstack/spec 的 files[] 发运了 src/**/*.zod.ts,但三个 glob 一个都不包含它,这些 TSDoc / .describe() 算不算已发布? 席位意见:是。发运到消费者 node_modules 里的文本就是已发布;.describe() 更是被 llms.txt / json-schema 机器读取的契约文本。顺带把仪器修对:三个 glob 改为「按每个包的 files[] 派生」,定义自洽、不再漂移——这是一张 skills 卡,您点头我立。
「已发布必修」够不够到本轮注意到、但不是本轮造成、diff 也不碰的已发布缺陷? 席位意见:否——只到本轮改动让它变假的那部分;注意到的其余已发布缺陷必须立卡(不许静默放走),按 p1/p2 下一轮修。理由是那个具体案例:把 sys_job.timezone 从 100 收窄到 64 可能拒绝已存值,没人测过那一列;「当轮修掉」不能等于「发运一次未经测量的收窄」。

四轴:业务——三个边界都在真实轮次里发生过,不是假设;长远——「按 files[] 派生」让「已发布」的定义只有一个来源;防 AI 错——一个永远得到「未发布」的仪器读数正是最危险的那种,修仪器比教人更可靠;创业阶段——三句话答完,零新机制,仪器改动一张小卡。

你要做的:回三个字——Q1 否/是,Q2 是/否,Q3 否/是。

Generated by Claude Code

Ruling recorded — the three E3 boundaries (director seat, decision batch #64, 2026-09-07)

Maintainer reply, verbatim: 「同意」 (all five batch #64 recommendations adopted).

The E3 standard (maintainer, 2026-09-05: 「已发布必修,其余立卡」) gains three written boundaries:

1. .js.map sourcesContent — turned off, so the answer is "not published" by construction. #16469 sets sourcesContent: false across the tsup builds and repairs the cli package's dead sources references. Until it lands, embedded source text is not counted as published (the reading that would empty the category cannot be the ruling's intent); after it lands the question no longer exists. Half the published bytes go away with it.

2. src/**/*.zod.ts shipped by @objectstack/spec's files[] — IS published. The definition of "published" moves from three fixed globs to whatever each package's files[] actually ships, so it cannot drift from reality. A false TSDoc or .describe() in a shipped .zod.ts is a published defect and is fixed in the round that makes or touches it. The "empties the category" objection does not apply here: one package, one file class, and that text is the contract's own documentation.

3. A published defect the round noticed but did not cause and does not touch — NOT reached. E3 covers defects the round's own change makes false or touches. A noticed-but-untouched published defect is carded (as #15872 was, correctly), with the published-surface fact recorded on the card. Rationale: fixing an unmeasured neighbour in-round ships an unmeasured narrowing and widens the PR.

Also recorded as a governance principle, in the card's own words: convergence is not proof, but it locates the ambiguity in the ruling's text rather than in one seat's reading.

Execution (skills seat, one governed PR): three sentences in the E3 text; the files[]-derived definition replaces the glob list. This card stays as the carrier.

Labels: needs-user-decision → pm:queue. Ledger on #12708 (batch #64).

Generated by Claude Code

Claim: PM loop round 9 — flight E3, executing the director's batch #64 ruling on this card (comment 5564373328, maintainer 「同意」): the E3 standard (maintainer 2026-09-05, verbatim 「已发布必修,其余立卡」) has NO carrier in the corpus today — the seat's grep of SKILL.md, every reference, os-dev.md, AGENTS.md and CLAUDE.md finds the words nowhere — so the flight writes it once, rules-only, with its three ruled boundaries and the files[]-derived definition of "published": (1) .js.map sourcesContent is not published (off by construction via #16469); (2) whatever a package's files[] ships is published — @objectstack/spec's src/**/*.zod.ts included — and a false TSDoc or .describe() there is fixed in the round that makes or touches it; (3) a noticed-but-untouched published defect is carded, not reached. One governed PR; this card is the carrier.
Session: session_019RfFHiRCSs3JXLK4cwcfox
Branch: claude/issue-15905-e3-standard-carrier
Worktree: objectstack-issue-15905
Domain: domain:skills
File surface: the dev's in-round obligation line in .claude/agents/os-dev.md (403/403, fold-paid) plus the boundaries where the measurement says they belong — references/review-checklist.md or references/core-rules.md (150/150) — each under its own pin. ⛔ No ceiling raise; no other line.
Container & model: S, mode:subagent, fable — dispatch-gates.mjs --tier: MANDATORY on .claude/agents/os-dev.md; on a fable 429 the seat's exemption applies, opus, recorded here.
Clause-②: no
Serial: os-dev.md is held by flight Y's PR #16460 (governed terminal, head ddb4213508) — branch from origin/main, prove git merge-tree --write-tree clean against that head twice before pushing, and merge origin/main in if it lands first; SKILL.md is held by flight Z (no line there unless the measurement forces one, then the same proof against Z's pushed head). Governed ⇒ draft PR, in-seat contract-tier review, then the seat requests os-zhuang + hotlong, adds needs-user-decision and posts the final 维护者速读; human merge. The PR carries Fixes #15905.

Generated by Claude Code

os-dev-report

{
  "issue": 15905,
  "status": "done",
  "branch": "claude/issue-15905-e3-standard-carrier",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16487",
  "premise_still_valid": true,
  "summary": "Step 1 measured at origin/main 00d54940eb: grep over .claude/skills/pm-dispatch/**, .claude/agents/os-dev.md, AGENTS.md, CLAUDE.md finds 0 hits for 已发布必修 / 其余立卡 / E3 / published surface / dist/**/*.d.ts / sourcesContent / files[] (each exit 1); the 16 hits for 已发布 are unrelated rows — no carrier, so the standard was written, not folded. core-rules.md is excluded by its own line 3 (本文不新增规则). Four rules-only lines, each fold-paid under an unchanged pin: (1) os-dev.md rule 3, after the 就地修 block — 本轮改动令其变假或触碰的已发布缺陷必修;其余立卡并记明已发布面,PR 照常落地。 (115 B), paid by deleting the rationale tail 返回消息是加速器…随你的进程一起死 (the two rules it explained stay); (2)–(4) review-checklist.md 范围与 changeset, between the 就地修 review items and the private:false ⇒ changeset item — 已发布 = 各包 files[] 实际发运的内容;spec 发运 src/**/*.zod.ts,假 TSDoc/.describe() 即缺陷。 (119 B); .js.map 的 sourcesContent 不算已发布:构建关闭其内嵌源码,关闭前也不计。 (98 B); 本轮令其变假或触碰的已发布缺陷必修;只注意到、未触碰的立卡不修,记明已发布面。 (115 B) — paid by deleting two rationale tails (否则合并静默关掉决策箱里的卡… and 只写 toThrow()…恒绿, both facts kept in os-dev.md lines 274/226) and merging ⛔ 不接受结论散文 into its neighbour 亲核证据再 ACCEPT (103 B), rule kept, rationale dropped. Nothing in SKILL.md or core-rules.md, no ceiling raise, no new section. Serial proof vs flight Y head ddb4213508 from HEAD a17f1a4064: git merge-tree --write-tree exit 0 (tree d14bbd16d7) and again with -c merge.os-regen.driver=false exit 0 (same tree); vs flight Z head 93907021e7 exit 0 (informational). Draft PR #16487 opened via REST (draft=true, body read back byte-identical), skip-changeset via the additive labels endpoint with a comparison read-back (pre-read [], post [skip-changeset], union-vs-readback missing none). No reviewer request, no ready flip, no labels beyond skip-changeset, assignees untouched. Claim verified: newest Claim: (5564679310) names this branch and session; no second claim posted. Commit trailers use AGENTS.md's model-free pair (Co-authored-by: Claude + Claude-Session) rather than the harness's model-bearing form, per the brief's no-model-identifiers line; noted in the PR body.",
  "tests": "All at HEAD a17f1a4064 (git rev-parse --short HEAD), every exit captured before any pipe (cmd > log 2>&1; EXIT=$?). Consistency: pnpm check:skill-frame-sync exit 0 — ✓ 2 copies of the decision frame are structurally isomorphic across 2 files … 75 markdown files scanned; node scripts/pm/check-clause2-carriers.mjs --self-test exit 0 — ✓ 190 cases pass; pnpm check:pm-skill-id-lint exit 0 — ✓ 26 file(s) clean; pnpm check:pm-skill-ratchet exit 0 — ✓ self-test 157 cases pass, live ✓ .claude/agents/os-dev.md is 403 lines (ceiling 403; headroom 0), ✓ review-checklist.md is 77 lines (ceiling 77; headroom 0), max line bytes 120/119; node scripts/pm/check-governed-merges.mjs --test on the two touched paths exit 3 — ⛔ GOVERNED … .claude/** ×2. Derived: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; stderr names objectstack-ai/objectstack at commit a17f1a4064, change set 2 paths vs merge base 00d54940e) → 17 commands, all run: closing-keyword-parity + --self-test (24 assertions), comment-mask-corpus (6251 files, 0 disagree), governed-queue-guard --self-test (144), agent-model-declared, agent-test-spelling (0 violations), doc-authoring, driver-memory-census, nul-bytes (8085 files, no raw control bytes), pm-governed-merges (274 assertions), pm-skill-id-lint, pm-skill-ratchet, refd-timer-probe, required-contexts, skill-frame-sync, watch-hint-literal — all exit 0; pnpm --filter @objectstack/lint run check:doc-formula-expressions first read exit 3 = the gate's own PREREQUISITE NOT MET (@objectstack/formula / @objectstack/lint unbuilt — NOT MEASURED, not red), then turbo run build --filter=@objectstack/formula --filter=@objectstack/lint under the lock (VERDICT command-exit 0, 4 successful, 4 total) and re-measured exit 0 — ✓ 22 record-scoped formula example(s) across 430 files / 1371 TS blocks judged clean. Reconciliation: dispatch-gates.mjs --ran exit 0 — Run reconciliation — 17 derived, 17 run, 0 NOT-MEASURED, 0 UNRUN. Whole-repo lint through the lock, slot issue-15905, one acquisition: bash scripts/pm/os-verify-lock.sh -c 'NODE_OPTIONS=--max-old-space-size=4096 pnpm lint' — os-verify-lock: VERDICT command-exit 0 · held the lock 97s (1m37s) · waited 47s (shared-box seconds). On-disk proof of the edit: anchored grep -c on each inserted phrase = 1 and each removed phrase = 0, line counts 403/77, control-byte self-scan grep -naP on both files → no hits. CI on head a17f1a4064, polled in the foreground until every run completed: 29 check runs, all completed 04:22Z — 16 success (Lint & Repo Gates, TypeScript Type Check, Type Check · source gates / consumer gates / debt ledger / workspace, Test Core, Dogfood Regression Gate, Governed Surface Queue Guard, Check Documentation Links, Check PR Size, Auto Label, filter, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card), 13 skipped (Build Core, Build Docs, Check Changeset ×2 — skip-changeset honoured —, Console Pin Gate, Dogfood shards, Dogfood Verify CLI, Temporal Conformance, Test Core shards, Packed-tarball smoke ×2, Auto Label/PR Size path-filtered duplicates); NON-GREEN: none. PR read-back after CI: draft=true, requested_reviewers=[], auto_merge=null; labels after CI: ['documentation', 'size/s', 'skip-changeset'].",
  "mcp_calls": "0 — card body and the 15 payload-carried timeline items via the zero-quota public-page payload channel; the 8 items it did not carry (the director's ruling 5564373328 and the Claim: 5564679310) plus all writes (PR create, label add, label/body read-backs, check-run polling, report comment) via repo-scoped REST after a same-container probe answered HTTP 200. No MCP GitHub calls.",
  "open_questions": [
    {
      "question": "The dev side now carries the E3 obligation but not the files[]-derived definition of 已发布 (it lives only in the PM-side review checklist, as ruled for this card: os-dev.md at 403/403, one fold). Should a second dev-side line carry the definition?",
      "options": [
        "A keep as landed — the PM catches an under-read at review, the dev line stays one fold",
        "B add one dev-side definition line in os-dev.md, paid by a second fold (candidates measured: line 101 等锁…锁脚本自己会等 is a restatement of lines 76/88/94/340; line 347 报告不违反此条… is a clarification)"
      ],
      "recommendation": "A for this PR, because the brief ruled one fold for os-dev.md; B is a one-line follow-up the seat can rule without a maintainer round, since both fold candidates are restatements, not rules."
    },
    {
      "question": "Attribution forms conflict: the harness-injected guidance asks for a model-bearing Co-Authored-By trailer and a 🤖 Generated with PR footer; AGENTS.md prescribes the model-free trailer pair and the session-URL footer, and the brief says no model identifiers anywhere.",
      "options": [
        "A AGENTS.md forms (used here)",
        "B harness forms"
      ],
      "recommendation": "A, because AGENTS.md is the binding repo rule and matches the brief; recorded here only because os-dev.md asks for a conflict note in open_questions."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: the dev-side definition gap above (observation, not a defect; carried as open question 1).",
    "noted, not filed: harness vs AGENTS.md attribution-form conflict (observation; open question 2)."
  ]
}

Generated by Claude Code

os-closed-card-sweep — machine-findable marker for this generated comment.

Removed the pm-loop state label(s) this closed card no longer claims: pm:dispatched.

Closing pull request: agents(os-dev), pm(references): carry the E3 standard and its three ruled boundaries #16487, merged.
Closing commit 04fd395998, merged into main.
Left untouched: documentation, priority:p2, finding, domain:skills — ownership, priority and outcome are not state claims.
The label set was read back after the write and matched.

A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.

posted by half-state-patrol run 34097314575 · trigger schedule

Generated by Claude Code

The E3 standard needs three written published boundaries — .js.map sourcesContent, @objectstack/spec’s shipped src/**/*.zod.ts, and whether it reaches a defect the round did not cause #15905

Description

The ruling this is about

Question 1 — is a .js.map's sourcesContent published?

Question 2 — @objectstack/spec ships its Zod source, and that is measured

Question 3 — does 「已发布必修」 reach a defect the round did not cause?

What an answer would be worth

⛔ What is not claimed

Related

Activity

claude commented on Sep 5, 2026

Question 1, measured: is a published .js.map's sourcesContent a published surface?

Reading 1 — is sourcesContent populated, and in which maps?

Reading 2 — do the maps SHIP? (the limb the card's command does not touch)

Reading 3 — what is actually in it?

Reading 4 — is emission deliberate? (read from config, not inferred from output)

A prior in-repo record of this exact fact (found while measuring, not sought)

Scale — so the contract-review argument can be weighed against numbers

What I could NOT measure

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

Question 1 is now a fact, not an inherited claim — and the fact is richer than the question. ⛔ Still no disposition: the ruling's meaning remains the maintainer's.

The answer: YES on both limbs, for 55 of 57 built publishable packages

⭐ The finding neither the card nor its counter-argument anticipated: nobody chose this

⭐ The counter-argument now has a magnitude, which is what makes this decidable

The instrument, because the zero had to be real

⛔ What is still open

os-zhuang commented on Sep 6, 2026

分诊：domain:skills / documentation + finding / needs-user-decision / priority:p2

⭐ 问题 2 的事实半边：本席独立复核，逐字成立

⚠️ 问题 1 与问题 3：本席不复核，并说明为什么

为什么定 p2

四facet

⭐ 卡片处理问题 3 的方式，本席特别背书

分诊侧的其余判断

claude commented on Sep 6, 2026

维护者速读(skills 席代读)

os-zhuang commented on Sep 7, 2026

Ruling recorded — the three E3 boundaries (director seat, decision batch #64, 2026-09-07)

claude commented on Sep 7, 2026

claude commented on Sep 7, 2026

github-actions commented on Sep 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The E3 standard needs three written `published` boundaries — `.js.map` sourcesContent, `@objectstack/spec`’s shipped `src/**/*.zod.ts`, and whether it reaches a defect the round did not cause #15905

Question 1 — is a `.js.map`'s `sourcesContent` published?

Question 2 — `@objectstack/spec` ships its Zod source, and that is measured

Question 1, measured: is a published `.js.map`'s `sourcesContent` a published surface?

Reading 1 — is `sourcesContent` populated, and in which maps?

分诊：`domain:skills` / `documentation` + `finding` / `needs-user-decision` / `priority:p2`