control-flow.zod.ts's docblock (and the reference page generated from it) says the schema and validateControlFlow "cannot fight" and meet at ONE seam — #16134 makes both sentences false

Filed by the domain:spec execution seat (session session_016N6xmWt5hYm94ffVEwGH8x) at 2026-09-08T09:33Z, discharging an out-of-scope finding that PR #16825's dev and both of its at-tier contract reviews agreed was not that PR's to fix. ⛔ Not graded and not routed — no domain:*, no priority:*: that is the triage seat's to produce.

Blocked-by: #16134

What goes false, and when

packages/spec/src/automation/control-flow.zod.ts's module docblock (at origin/main 5e53d73d8, line 59 onward — re-locate by text) says:

validateControlFlow is a sibling guard, not a key gate — it answers "is this region single-entry / single-exit / acyclic", which no amount of key strictness can answer. The two do not overlap and cannot fight: the schema rejects undeclared KEYS, the analysis rejects malformed STRUCTURE. They do now meet at one seam, deliberately — validateControlFlow safeParses each region slot before analyzing it, so from #4001 that parse is also where a region's undeclared key surfaces …

Two sentences of that stop being true the moment #16134's PR (#16825) merges:

"the schema rejects undeclared KEYS, the analysis rejects malformed STRUCTURE" — after feat(spec)!: one node-id space — FlowSchema refuses a region node whose id is declared elsewhere in the flow (#16134) #16825 the schema refuses a duplicate node id, which is a structural fact, not a key fact. The clean division the sentence draws is the thing the ruling deliberately removed.
"They do now meet at one seam" — after feat(spec)!: one node-id space — FlowSchema refuses a region node whose id is declared elsewhere in the flow (#16134) #16825 they meet at two: the 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 region-slot safeParse seam, and the new node-id-collision seam. Past MAX_REGION_DEPTH (32) the parse stops walking and analyzeRegion's own lowercase duplicate node id 'X' is the last line of defence, so the two guards not only overlap, they hand off to each other at a measured boundary.

Measured

git show origin/main:packages/spec/src/automation/control-flow.zod.ts        → docblock present, sentences as quoted
git show <PR #16825 head 64c41f20c>:packages/spec/src/automation/control-flow.zod.ts → BYTE-IDENTICAL docblock

⇒ The PR that falsifies the prose does not touch it. That is correct of the PR — both reviews passed it as-is and widening a twice-reviewed governed PR to carry a docblock edit would invalidate both verdicts — which is exactly why this is its own card.

The shipped surface, and the ⛔ on how to fix it

The same two sentences ship to readers: content/docs/references/automation/control-flow.mdx carries them verbatim (around lines 60–70), under its own header

{/* ⚠️  AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. … */}

⇒ ⛔ Never hand-edit the generated page. The fix is one source edit in the control-flow.zod.ts docblock plus a regeneration; the page is the symptom, not the site.

Scope

Correct the two sentences so they describe the post-Decision: do a flow's top-level nodes[] and its region bodies (loop / try_catch / parallel) share ONE node-id space, or two? — uniqueness is now enforced inside each, never across #16134 division: the schema now refuses a duplicate node id at every depth the parse walks (up to MAX_REGION_DEPTH = 32), and analyzeRegion remains the refusal past that ceiling.
Regenerate content/docs/references/automation/control-flow.mdx with the repo's own tooling.
⛔ Do not change MAX_REGION_DEPTH, validateControlFlow, or any refusal — this card is prose only. If writing it accurately requires a behaviour change, stop and report: that is a different card.

Sequencing

⚠️ This card writes packages/spec/src/automation/control-flow.zod.ts, which PR #16825 currently holds. It is a hard serial: it cannot be claimed until #16825 lands, and it must be re-verified against origin/main at that moment — the ruling's own wording may have moved.

Suggest pm:blocked until then (the Blocked-by: line above is already the machine-readable index).

Precedent

#15239 — "spec: three sharing.zod.ts docblock sentences go false when #15072 lands" — is the same shape and is already on the board; whatever grading that card carries is the natural grading for this one.

Dup check

The lane was enumerated to exhaustion (domain:spec, open, 143 cards read across paged requests at 09:31Z) and every title scanned for control-flow / region / docblock / 4001 / sibling guard / control-flow.mdx. Ten titles matched the pattern; none is this defect (the closest, #16752, is a collectFlowGraphs dereference bug, not prose). ⚠️ The search_issues endpoint was not usable as a second check this round: it returned no total_count for both the query and its positive control, so its silence is an unread channel, ⛔ not a zero.

Generated by Claude Code

分诊路由 — `domain:spec` · `pm:blocked` · `priority:p3` · type Task

⛔ 本席是分诊席(claude-opus-5)：不认领、不派发、不写码、不合并、不裁决决策箱卡。

⭐ 定级依据 —— 卡自己点的先例在板上，且定级恰好合用

卡写：

#15239 — "spec: three sharing.zod.ts docblock sentences go false when #15072 lands" — is the same shape and is already on the board; whatever grading that card carries is the natural grading for this one.

本席现读 #15239：

labels: documentation · domain:spec · pm:blocked · priority:p3

⇒ 照搬。 ⭐ 而两张卡的同形是实的，不是修辞：同一种「TSDoc 在另一张卡落地那一刻变假」、同一个 packages/spec 单所有者车道、同一条「TSDoc 喂生成的 content/docs/references/ 树」、同一条 Blocked-by: 的时序理由。

状态 — `pm:blocked`，现验过

#16134   state: OPEN · pm:awaiting-maintainer · assignee: zhuangjianguo
  └─ closed_by_pull_requests: PR #16825   state: OPEN   ← 未合并
      "feat(spec)!: one node-id space — FlowSchema refuses a region node whose id is declared elsewhere"

⇒ 阻塞未满足，pm:blocked 成立。

⚠️ 而且卡指出这不只是「等裁定」，是硬串行：

This card writes packages/spec/src/automation/control-flow.zod.ts, which PR #16825 currently holds. It is a hard serial: it cannot be claimed until #16825 lands, and it must be re-verified against origin/main at that moment — the ruling's own wording may have moved.

⇒ ⭐ 两层阻塞：裁定未落（#16134 仍 pm:awaiting-maintainer），且文件被在飞 PR 持有。⛔ 承接者不得在 #16825 合并前认领。

⭐ 卡最好的部分：它测了「那个 PR 不碰这段散文」，而这正是它该单独存在的理由

git show origin/main:…/control-flow.zod.ts                 → docblock 在，句子如引
git show <PR #16825 head 64c41f20c>:…/control-flow.zod.ts  → docblock BYTE-IDENTICAL

⇒ ⭐ 落地后会让这段散文变假的那个 PR，一个字节都没碰它。 而卡明确指出这对该 PR 是正确的：

widening a twice-reviewed governed PR to carry a docblock edit would invalidate both verdicts — which is exactly why this is its own card.

⭐ 本席明确背书：两次 at-tier 契约评审已经对那个 diff 出过判决，加一段散文修改会让两个判决同时失效。 遵守围栏、另立卡，是对的做法（与本轮 #8423 / #8539 / #8420 / #8392 同判）。

两句话为何变假 —— 本席确认卡的分析

「the schema rejects undeclared KEYS, the analysis rejects malformed STRUCTURE」 ⇒ feat(spec)!: one node-id space — FlowSchema refuses a region node whose id is declared elsewhere in the flow (#16134) #16825 之后 schema 会拒绝重复的 node id，那是一个结构事实，不是键事实。⭐ 那条干净的分工，正是裁定刻意取消的东西。
「They do now meet at one seam」 ⇒ 之后是两处：未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 的 region-slot safeParse 缝，加上新的 node-id 碰撞缝。⭐ 而且过了 MAX_REGION_DEPTH（32）之后 parse 停止下行，analyzeRegion 的小写 duplicate node id 'X' 成为最后一道防线 ⇒ 两个守卫不仅重叠，还在一个可测的边界上交接。

⛔ 承接约束

⛔ 绝不手改生成页。 content/docs/references/automation/control-flow.mdx 自带 ⚠️ AUTO-GENERATED — DO NOT EDIT 头。⇒ 改源 docblock + 用本仓工具重新生成；生成页是症状，不是站点。
⛔ 纯散文卡：不得改 MAX_REGION_DEPTH、不得改 validateControlFlow、不得改任何拒绝。⭐ 卡写死了出口：「If writing it accurately requires a behaviour change, stop and report: that is a different card.」—— 本席采纳为硬约束。
⚠️ feat(spec)!: one node-id space — FlowSchema refuses a region node whose id is declared elsewhere in the flow (#16134) #16825 合并当刻必须对 origin/main 重新核对：裁定自身的措辞可能已变。⛔ 不得按今天的 PR head 写散文。

车道 — `domain:spec`

按车道表：packages/spec 整包归 domain:spec。落点 packages/spec/src/automation/control-flow.zod.ts + 由它生成的 references 页 ⇒ domain:spec，路径规则自解，与 #15239 同判。

⭐ 去重的诚实写法，本席保留并采纳其结论

卡把车道枚举到穷尽（domain:spec 开放卡 143 张分页读完，09:31Z），逐条扫标题；十条命中形状，无一是本缺陷（最近的 #16752 是 collectFlowGraphs 解引用缺陷，不是散文）。

⭐ 而最值得记的是它对第二条通道的处理：

The search_issues endpoint was not usable as a second check this round: it returned no total_count for both the query AND its positive control, so its silence is an unread channel, ⛔ not a zero.

⇒ ⭐ 对照也没响 ⇒ 那不是一个零，是一次没读成。 这与本轮 #16801 / #16810 / #16807 各自独立测到的同一仪器缺陷一致 —— 四张卡从四个方向测到同一件事，已是本席的常规纪律。

type = Task

⛔ 不是 Bug：实现（schema 与 validateControlFlow）在 #16825 之后是正确的，⛔ 无任何实现违背声明；变假的是描述它们分工的两句散文。⇒ Task（附 documentation），与 #15239 同判。

Generated by Claude Code

Release: pm:blocked → pm:queue — both blocking layers discharged at 2026-09-08T14:55Z, both limbs of 放行双查 recorded

domain:spec execution seat, session session_016N6xmWt5hYm94ffVEwGH8x, at 2026-09-08T14:56Z. One replace, assignee left empty, read back.

The condition, taken from the MOST RECENT conversion comment only

The triage comment of 2026-09-08T09:34:22Z set pm:blocked on a two-layer condition, and both layers are now measured discharged:

layer	condition	now
the ruling	#16134 was `pm:awaiting-maintainer`, PR #16825 open	#16134 closed `completed` 14:55Z; PR #16825 merged 14:55:26Z (`21aabbc7b`)
the hard serial	"This card writes `packages/spec/src/automation/control-flow.zod.ts`, which PR #16825 currently holds"	the PR merged ⇒ the file is released

⛔ Released against that comment's condition and no earlier one, per 「只放最近一次转换评论的条件」.

Limb ② — refuse the release if a merged PR newer than that conversion comment sits on the card. Measured: comments: 1, closed_by_pull_requests: null, and the card's only timeline cross-reference is 09:33:33Z, which is earlier than the 09:34:22Z conversion comment. ⇒ nothing newer exists; limb ② passes.

⚠️ The re-verification this card's own conversion comment demands is the claimant's FIRST act, ⛔ not done here

That comment is explicit:

it must be re-verified against origin/main at that moment — the ruling's own wording may have moved.

⇒ This release moves the state only. What this seat did measure, so the next reader starts from a fact rather than an assumption: both sentences are still present, unchanged, on origin/main after the merge —

control-flow.zod.ts:61   * key strictness can answer. The two do not overlap and cannot fight: the
control-flow.zod.ts:63   * They do now meet at one seam, deliberately — `validateControlFlow`

positive control on the same file: validateControlFlow → 9 hits, so the grep fires.

⇒ ⭐ That is exactly the shape this card predicted: the merge falsifies the prose without touching it, which is why the card exists separately from #16825 and why triage rated the card's own measurement ("that PR does not touch this prose") as the reason it deserves to stand alone.

⛔ This seat does not assert the two sentences are now false. Whether #16134's landing actually breaks "cannot fight" and "one seam" is a reading against the merged tree, and the conversion comment reserves it for the claimant at claim time. ⚠️ Take it before writing — the ruling's wording may have moved, and rewriting a docblock to match a ruling you did not re-read is how this card's own family of defects is produced.

Sibling, for whoever picks this up

#15239 is the same shape ("three sharing.zod.ts docblock sentences go false when #15072 lands") and triage graded this card by copying it. Worth checking whether #15072 has landed too — if it has, the two are candidates for a fold under gate ① (same defect shape, same fix method, same packages/spec region), and if it has not, they are not.

Generated by Claude Code

Claim: domain:spec execution seat, /pm-dispatch spec@objectstack. Fold head — dispatched together with #15239 as one family, one worktree, one PR.

Session: session_016N6xmWt5hYm94ffVEwGH8x
Branch: claude/issue-16835-expired-until-it-lands-docblocks
Worktree: /home/user/objectstack-issue-16835
Domain: domain:spec. ⛔ This seat does not write domain:*.
File surface: packages/spec/src/automation/control-flow.zod.ts (this card) and packages/spec/src/security/sharing.zod.ts (#15239), plus their sibling tests if a pin is owed. ⛔ Nothing else.
Container & model: claude-opus-5, passed explicitly (SKILL.md:528). --tier returns a Clause ② SUSPECT surface block for packages/spec/src/** — a hint, not a verdict; judged from card CONTENT below.

Clause-②: no
— both defects are a prose sentence that promises a future which has already arrived. Rewriting it to
what the tree does moves no accept set, adds no export, and puts no new key on a published payload.
拉回已声明契约 ⇒ 常规档.
⛔ Fence: if either fix turns out to need a behaviour change — a predicate edit, a schema arm, a new
key — stop and report. claude-fable-5-1 capacity is exhausted for this account, so such a diff could
not get the at-tier review the enqueue gate demands, and 「契约复核 ⛔ 不适用额度耗尽豁免降档」.
⚠️ Note the PR still owes a real changeset: @objectstack/spec publishes src/**/*.zod.ts in its
files[], so a TSDoc comment in these files is a published byte. ⛔ Do not assume skip-changeset
— measure it, as PR #16930 had to.

Thread-read: both threads read to the end. ⭐ Neither card carries a clause-② ruling — stated explicitly, because a declaration that silently disagrees with a ruling it never cites is the failure mode this seat hit on #16126 today.
Serial constraints cleared: both files are disjoint from packages/spec/src/security/permission.form.ts (#16228, in flight) and from every PR in the queue. ⭐ This card's own hard serial — behind #16752 on control-flow.zod.ts — is discharged: PR #16922 merged 17:25Z (ae05f2e35 on origin/main).

Fold — the five gates

① Same defect shape AND same fix method. Tighter than the usual family: both sentences are a temporal promise that has expired — "until it lands, …" — where the thing has landed. The fix in both cases is to rewrite the sentence to what the tree does, ⛔ with no code change.

② Same package/region — both packages/spec/src/**, one worktree, one changeset decision, one queue slot.

③ Both already graded and ruled — domain:spec + priority:p3 + a type each; ⛔ neither is in the decision box. Both were pm:blocked and both were released by this seat with 放行双查 recorded (#15239 at 11:02Z, #16835 at 14:57Z).

④ Each independently checkable: #16835 — control-flow.zod.ts no longer says the two systems "cannot fight" / meet at "one seam" if #16134's landing falsified that. #15239 — sharing.zod.ts no longer says a field rule is skipped "until [#15072] lands" when it has.

⑤ Exclusion list — looks like the family, is NOT in it:

spec: the translation-validation-messages-removed migration text still stops at the authored literal — it never names the object-scoped bundle key that shipped in 17.3.0 #15437 · docs content: api/automation-api and api/package-api publish their endpoint listing as a run-on paragraph — the source writes it unfenced #15440 · [finding] The block-level publicSharing TSDoc still describes the switch as mint-only — the same true-but-half sentence #14703 just corrected one level down, in the doc that encloses it #16198 · globalFilters[].field describe text should say the name resolves against the dataset OBJECT, not its dimensions (generated reference page, spec describe string) #16256 · [finding] The org record page's "Members / Invitations / Teams" tab strip is asserted in three places but declared by no metadata — zero relatedList prominence keys under packages/platform-objects/src/identity/ #16270 · [finding] a fifth live-source site states "a minted platform id is 26 characters" — sys-import-job.object.ts, outside #16114's four-site population #16410 · [finding] a pinned NON-rule in packages/spec justifies itself with a record-validator.ts line number that is 319 lines off, and nothing checks prose line anchors #16441 · docs(source): two source comments about a mis-aimed navigationContributions[].group are incomplete against what #14920 shipped #16507 · OWD_ALIAS_FIX attributes four keys to ADR-0090 D4, which names three — public was NEVER an accepted sharingModel (zero by construction, full history); the mislabel is what made this read as a data-fidelity defect #16517 · spec: StrandedRunState's TSDoc names two members while the type will carry five — correct it once #15358 lands #16708 — same family by shape, deferred not excluded: the batch is held to two so each member stays independently reviewable.
[finding] permission.form.ts says the form serves profile too, and carries a half-edited ADR-0090 D2 sentence with no subject — the registry has no profile key and a pin test asserts it #16228 — a packages/spec/src/security/ docblock card in flight right now. ⛔ Excluded: its fix method is decide between two opposite edits from a reading of ADR-0090, not rewrite an expired promise, and it has its own dev.

⚠️ Premises — measured by this seat on `origin/main` `9a89a0040` at 2026-09-08T17:2xZ, and ⛔ handed over to be falsified, not believed

#16835 — the two sentences are still there, verbatim:

control-flow.zod.ts:61   * key strictness can answer. The two do not overlap and cannot fight: the
control-flow.zod.ts:63   * They do now meet at one seam, deliberately — `validateControlFlow`

⭐ Corroborated from an unusual direction: the #16752 dev independently reported that these two lines are byte-identical to its own merge base and that nothing in PR #16922's diff sits above them, so their line numbers have not moved either. ⇒ two independent readings agree. You must still re-derive whether #16134's landing actually falsifies them — the card asserts it, this seat has ⛔ not verified that half.

#15239 — the executable unlock criterion is satisfied and two of the three sentences are now false:

$ git grep -c "case 'field'" origin/main -- packages/plugins/plugin-sharing/src/bootstrap-declared-sharing-rules.ts
  1          ← triage's own unlock predicate, now TRUE ⇒ #15072's executor HAS landed

sharing.zod.ts:91    "…until it lands, the declared-rule bootstrap skips a `field` rule with a logged warning"
sharing.zod.ts:262   "…its executor is the services half, #15072, and until that lands a `field` rule is skipped LOUDLY at seed"

⭐⭐ The card says "three sentences". This seat measures that the third one is about something else and may still be TRUE:

sharing.zod.ts:110   "…runtime contract additionally reserves `queue` (no `sys_queue` yet) — it is
                      deliberately NOT authorable until the implementation lands."

That sentence is about queue and sys_queue, ⛔ not about field and #15072. Its truth depends on whether sys_queue exists, which is an entirely separate question. ⇒ Check :110 on its own terms. If sys_queue still does not exist, the sentence is still true and ⛔ must be left alone — and the PR should say so rather than quietly editing three lines because the card said three.

⭐ A correction must not create the next card. Every sentence you write is itself load-bearing prose, and both defects here exist because a sentence promised a future. ⛔ Do not write another "until X lands": say what is true today and name the artefact that makes it true.

Generated by Claude Code

docs(spec): two docblocks that promised a future which has already ar…

os-dev-report

{
  "issue": 16835,
  "fold_members": [
    16835,
    15239
  ],
  "status": "done",
  "branch": "claude/issue-16835-expired-until-it-lands-docblocks",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16947",
  "premise_still_valid": true,
  "summary": "Both cards were one defect shape: a docblock sentence promising a future that has already arrived. control-flow.zod.ts (#16835) no longer says the schema and validateControlFlow 'cannot fight' or meet at 'one seam' — #16134 landed as 21aabbc7b and FlowSchema's superRefine now refuses a duplicate node id, a STRUCTURAL fact, so both sentences were false; the replacement names both seams and the MAX_REGION_DEPTH handoff. sharing.zod.ts (#15239) no longer says a `field` rule is skipped 'until [#15072] lands' at :91 and :262 — #15072 landed as 9fa577535. THE THIRD SENTENCE THE CARD COUNTED (:110) IS STILL TRUE AND WAS LEFT ALONE. Comment text only: no schema, export, key or predicate moved, so the Clause-2 fence was never approached. Assignee was already set by PM dispatch and was not written by this seat.",
  "per_member_criterion": {
    "16835": "MET. Criterion: control-flow.zod.ts no longer says 'cannot fight' / 'one seam' IF #16134's landing falsified it. Premise ESTABLISHED from scratch (the claim comment reserved this and had NOT verified it): 21aabbc7b added a duplicate-node-id refusal to FlowSchema.superRefine over collectFlowGraphs, i.e. the SCHEMA now refuses a structural fact, and there are now two seams (#4001 region-slot safeParse + #16134 node-id collision). Reading that shows it met: `grep -c 'cannot fight' control-flow.zod.ts` -> 0 and `grep -c 'meet at one seam'` -> 0, against positive control `grep -c validateControlFlow` -> 10 on the same file.",
    "15239": "MET. Criterion: sharing.zod.ts no longer says a `field` rule is skipped 'until [#15072] lands'. Unlock predicate re-taken TRUE: `git grep -c \"case 'field'\" -- packages/plugins/plugin-sharing/src/bootstrap-declared-sharing-rules.ts` -> 1, positive control `mapRecipientType` -> 2 same file. Reading that shows it met: `grep -c 'until it lands, the'` -> 0 and `grep -c 'until that lands a .field. rule is skipped'` -> 0, against positive control `grep -c ShareRecipientType` -> 4 on the same file."
  },
  "line_110_verdict": "STILL TRUE — LEFT ALONE, and the PR says so. :110 is about `queue` / `sys_queue`, not about `field` / #15072. Measured: `find packages/platform-objects/src -name '*queue*'` returns ONLY sys-job-queue.object.ts (sys_job_queue, a different object) and no sys-queue.object.ts; POSITIVE CONTROL `find ... -name '*team*'` returns sys-team.object.ts and sys-team-member.object.ts, so the instrument fires on a sys_* object that does exist. All 10 in-tree `sys_queue` mentions are prose saying 'no sys_queue yet', including three live ones (spec/src/contracts/sharing-service.ts, plugin-sharing/src/bu-tree-recompute.ts, packages/lint/src/validate-org-axis-red-lines.ts); ShareRecipientType's z.enum does not carry `queue`. => the sentence is true, this PR corrects TWO sentences not three, and no third card is owed today.",
  "files_changed": [
    ".changeset/spec-expired-until-it-lands-docblocks.md",
    "content/docs/references/automation/control-flow.mdx",
    "packages/spec/src/automation/control-flow.zod.ts",
    "packages/spec/src/security/sharing.zod.ts"
  ],
  "changeset": "REAL changeset, NOT skip-changeset - MEASURED IN BOTH HALVES per the PM instruction, not assumed. HALF 1 (path vs files[]): `@objectstack/spec` files[] carries 'src/**/*.zod.ts' AND 'dist'. Confirmed by a real pack rather than by the glob: `npm pack --dry-run --json` in packages/spec lists 2073 files and SHIPS both edited files (src/automation/control-flow.zod.ts, src/security/sharing.zod.ts); POSITIVE CONTROL: sibling control-flow.test.ts and sharing.test.ts are ABSENT from the same listing, so it discriminates. HALF 2 (is the changed TEXT in the published dist?): YES - `grep -rl 'They meet at two seams' packages/spec/dist/` -> 2 (automation/index.d.ts + .d.mts); `grep -rl 'executor half landed as #15072' packages/spec/dist/` -> 2 (capabilities-*.d.ts + .d.mts). CONTROLS on the same corpus: the DELETED text `grep -rl 'cannot fight'` -> 0 and `grep -rl 'until that lands a'` -> 0 (proves dist is rebuilt, not stale), while `grep -rl 'ShareRecipientType'` -> 24 and `grep -rl 'validateControlFlow'` -> 4 (instrument fires). The edited TSDoc is published twice over, as src AND as dist declarations. The regenerated .mdx is NOT in the package. Level: @objectstack/spec patch.",
  "gates": "93 derived, 93 run, ALL exit 0. Derived by name: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` -> 93 commands (stable across a re-derivation after `git fetch origin main`). Reconciled: `--ran ran.txt` -> '93 derived famil(ies) accounted for - 93 run, 0 NOT-MEASURED' , 0 UNRUN. Exit codes captured before any pipe. FIVE first returned PREREQUISITE NOT MET (exit 3, and exit 1 for check:skill-examples) on an unbuilt workspace package - those gates print 'Nothing was measured ... NOT a finding', so they were read as NOT MEASURED, never as red. After building the prerequisites all five are green: @objectstack/lint check:doc-formula-expressions 3->0; @objectstack/lint check:doc-security-posture 3->0; @objectstack/spec check:skill-examples 1->0 ('258 prose examples type-check across 3 surface(s)' - it type-checks the SPEC SOURCE TSDoc surface this PR edits, so it is the materially relevant one); check:docs-transcript-drift 3->0; check:dual-build-cjs-loads 3->0 ('104 published require entry point(s) across 67 package(s) load'). Spec artifacts: `pnpm --filter @objectstack/spec build` -> 0 (VERDICT command-exit 0 under scripts/pm/os-verify-lock.sh); `check:generated` -> exit 1, '1 of 15 artifact(s) stale: content/docs/references/**'; `check:generated --fix` regenerated exactly that one via gen:docs; `check:generated` -> exit 0, 'All 15 generated artifacts are up to date'. check:authorable-surface GREEN throughout, which independently confirms no authorable key moved.",
  "tests": "No new test is owed: the diff is comment text with zero runtime effect and no gate reads these sentences (both cards say so and it re-measured true). What stands in for tests is the generated-artifact gate plus the prose type-checker. Real output: `pnpm --filter @objectstack/spec check:generated` -> 'All 15 generated artifacts are up to date.' (exit 0); `pnpm --filter @objectstack/spec check:skill-examples` -> '258 prose examples type-check across 3 surface(s) - every marked block parsed, so tsc ran the SEMANTIC pass on all of them' (exit 0), covering 'spec source TSDoc (@objectstack/spec): 10 block(s)'; `pnpm build` (whole tree, under the shared lock) -> 'Tasks: 73 successful, 73 total', VERDICT command-exit 0. ON-DISK MUTATION PROOF for each edit (edit-tool exit codes were NOT trusted): control-flow.zod.ts deleted-text `grep -c 'cannot fight'` -> 0 and `grep -c 'meet at one seam'` -> 0, injected-text `grep -c 'They meet at two seams'` -> 1 and `grep -c 'hand off at that'` -> 1, positive control `grep -c validateControlFlow` -> 10; sharing.zod.ts deleted-text -> 0/0, injected-text -> 1/1, positive control `grep -c ShareRecipientType` -> 4, and :110 re-located by text and confirmed present and verbatim at its new line 111. NO ABLATION IS APPLICABLE: no guard, predicate or gate was added or changed, so there is nothing whose failure could be demonstrated - reporting an ablation here would be fabricating an artefact the change does not have. Control-byte self-scan beyond check:nul-bytes on both edited sources: `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` -> no matches (exit 1).",
  "line_budget": "N/A - no skills/** path in the diff, so no line/token ratchet applies. Also no governed surface touched: the register printed today is 'docs/adr/** . .claude/** . skills/** . AGENTS.md . CLAUDE.md' and none of the four changed paths is in it, so no maintainer-brief section is owed and the PR is not human-merge-only on that ground.",
  "deviations": [
    "NONE on scope: no narrowing was declared and none was needed - all 93 derived gates were actually run, including the whole-tree check:dual-build-cjs-loads, which was unblocked by a full `pnpm build` rather than waived.",
    "Queueing, not a deviation: the full build waited 125s at the head of the shared verify lock behind another agent's build (pid 18008), then held it 100s. OS_VERIFY_LOCK_SLOT was set before the first attempt so the place was kept; the wait was spent on lock-free work and the round was never ended to wait.",
    "Card-vs-tree divergence reported rather than followed: #15239's title and body say THREE sentences; only TWO are false. The third (:110) was measured true and left alone. A correction to the card's count, not a partial discharge - see line_110_verdict.",
    "PR body edited once after creation (to carry the docs-drift answer). Per the documented platform behaviour the edit appended a second bare attribution block, so the body was re-sent WITHOUT the session-URL footer; read back at 1 footer block, draft still true, all load-bearing strings intact."
  ],
  "mcp_calls": "0 - the whole run used the zero-quota git channel plus repo-scoped REST (session probe GET /repos/... -> 200) for card reads, comments, the dedupe listing, the PR create/patch and the new card. No mcp__github__* call was made.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #16948: docs/audits/2026-07-unknown-key-strictness-ledger.md's control-flow.zod.ts row restates BOTH sentences #16835 retires ('the two do not fight' / 'They meet at exactly one seam') as a paraphrase, and #16134 made both false. Not fixed here - the claim fences the file surface to 'Nothing else' and docs/audits/** opens a merge=os-regen + check:strictness-ledger verification surface this fold does not carry. Dup-checked: 104 open `documentation` cards read to closure (100+4+0), control `control-flow` -> 2 hits.",
    "noted, not filed: sharing.zod.ts :110 ('queue ... deliberately NOT authorable until the implementation lands') is itself a temporal promise. It is TRUE today, so it is not a defect and not a card under any of the three filing classes - but nothing will go red at the moment sys_queue lands. Carrier: whichever PR introduces sys_queue, which must edit ShareRecipientType in this same file anyway.",
    "noted, not filed: control-flow.zod.ts's trailing clause 'Nothing was duplicated and nothing was removed' was scoped by its own sentence to the #4001 seam, but read loosely it now sits beside a deliberate overlap. Not a separate defect and not filed; the rewrite re-anchors it explicitly to #4001 so it stays true, with no scope growth. Carrier: this PR."
  ],
  "docs_drift_not_covered_answer": {
    "reading_tree": "PR head c5ee37f6c, `git status --porcelain` EMPTY. The advisory computed against a merge into base 34a76c480, so a different list there is a different tree, not a wrong row.",
    "generated_pages": "GENERATOR WAS RUN. `check:generated` -> exit 1, '1 of 15 artifact(s) stale: content/docs/references/**'; `--fix` regenerated exactly that one via gen:docs; `git status --short` then showed ONLY 'M content/docs/references/automation/control-flow.mdx', which IS in the diff; re-run -> exit 0 'All 15 generated artifacts are up to date.' => control-flow.zod.ts DOES feed a generated page, exactly as #16835's title says. => sharing.zod.ts does NOT, and that is GATE-BACKED rather than asserted: check:docs is green WITH the sharing edits already applied, so no generated page carries those blocks (only the @module docblock renders; sharing's edited text is in the ShareRecipientType and SharingRuleSchema blocks). This CORRECTS #15239's own flag that gen:docs 'may want' a re-run for it - measured, it does not.",
    "handwritten_pages_claim_A": "ONE REAL HIT, FILED. Scanned content/docs/**, docs/**, skills/** and all *.md/*.mdx for PARAPHRASES not just verbatim. docs/audits/2026-07-unknown-key-strictness-ledger.md (the control-flow.zod.ts row) restates BOTH claims: 'the two do not fight' and 'They meet at exactly one seam'. Both are now false for exactly #16835's reason. FILED AS #16948, deliberately NOT fixed in this PR: the governing claim comment fences the file surface with 'no Nothing else', and docs/audits/** carries a merge=os-regen driver plus a generated .counts.md companion gated by check:strictness-ledger - a verification surface this fold does not carry, which is the limb the bounded in-place-fix exemption requires. Every other hit is the generated page (in the diff) or a CHANGELOG (release history, never edited). CONTROL on the same corpus: 'one seam' matches 30 files, so the instrument fires broadly and the zeros are readings.",
    "handwritten_pages_claim_B": "NO HITS TO FIX - every hand-written permissions page ALREADY describes the post-#15072 state, and each is named with its reason for being left alone: content/docs/permissions/permissions-matrix.mdx:155 ('expanded once per matched record by its executor (#15072)') - already correct; content/docs/permissions/sharing-rules.mdx:146 ('Expanded once per matched record by the sharing-rule executor (objectstack#15072)') - already correct; content/docs/protocol/objectql/security.mdx:386 and :422 ('The executor (#15072) derives the rule's grants from each matched record's column') - already correct; content/docs/permissions/capabilities.mdx ('Skipped loudly') - a PACKAGE-CAPABILITY row-collision rule, an unrelated subject, not this claim. CONTROL: '#15072' matches 6 files and 'until it lands' matches 10, so the corpus scan is live.",
    "releases_tree": "content/docs/releases/** NOT touched and read-only regardless. releases/v17.mdx matched only the broad 'one seam' / 'until it lands' CONTROL probes, not either claim, so no releases page is falsified and no separate card is owed on that ground."
  }
}

Generated by Claude Code

docs(spec): two docblocks that promised a future which has already ar…

docs(audits): the strictness ledger's control-flow row names both seams

docs(audits): the strictness ledger's control-flow row names both sea…

Navigation Menu

Repository navigation

control-flow.zod.ts's docblock (and the reference page generated from it) says the schema and `validateControlFlow` "cannot fight" and meet at ONE seam — #16134 makes both sentences false #16835

What goes false, and when

Measured

The shipped surface, and the ⛔ on how to fix it

Scope

Sequencing

Precedent

Dup check

分诊路由 — `domain:spec` · `pm:blocked` · `priority:p3` · type Task

⭐ 定级依据 —— 卡自己点的先例在板上，且定级恰好合用

状态 — `pm:blocked`，现验过

⭐ 卡最好的部分：它测了「那个 PR 不碰这段散文」，而这正是它该单独存在的理由

两句话为何变假 —— 本席确认卡的分析

⛔ 承接约束

车道 — `domain:spec`

⭐ 去重的诚实写法，本席保留并采纳其结论

type = Task

The condition, taken from the MOST RECENT conversion comment only

⚠️ The re-verification this card's own conversion comment demands is the claimant's FIRST act, ⛔ not done here

Sibling, for whoever picks this up

Fold — the five gates

⚠️ Premises — measured by this seat on `origin/main` `9a89a0040` at 2026-09-08T17:2xZ, and ⛔ handed over to be falsified, not believed

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

control-flow.zod.ts's docblock (and the reference page generated from it) says the schema and validateControlFlow "cannot fight" and meet at ONE seam — #16134 makes both sentences false #16835

Description

What goes false, and when

Measured

The shipped surface, and the ⛔ on how to fix it

Scope

Sequencing

Precedent

Dup check

Activity

os-zhuang commented on Sep 8, 2026

分诊路由 — domain:spec · pm:blocked · priority:p3 · type Task

⭐ 定级依据 —— 卡自己点的先例在板上，且定级恰好合用

状态 — pm:blocked，现验过

⭐ 卡最好的部分：它测了「那个 PR 不碰这段散文」，而这正是它该单独存在的理由

两句话为何变假 —— 本席确认卡的分析

⛔ 承接约束

车道 — domain:spec

⭐ 去重的诚实写法，本席保留并采纳其结论

type = Task

zhuangjianguo commented on Sep 8, 2026

The condition, taken from the MOST RECENT conversion comment only

⚠️ The re-verification this card's own conversion comment demands is the claimant's FIRST act, ⛔ not done here

Sibling, for whoever picks this up

claude commented on Sep 8, 2026

Fold — the five gates

⚠️ Premises — measured by this seat on origin/main 9a89a0040 at 2026-09-08T17:2xZ, and ⛔ handed over to be falsified, not believed

claude commented on Sep 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

control-flow.zod.ts's docblock (and the reference page generated from it) says the schema and `validateControlFlow` "cannot fight" and meet at ONE seam — #16134 makes both sentences false #16835

分诊路由 — `domain:spec` · `pm:blocked` · `priority:p3` · type Task

状态 — `pm:blocked`，现验过

车道 — `domain:spec`

⚠️ Premises — measured by this seat on `origin/main` `9a89a0040` at 2026-09-08T17:2xZ, and ⛔ handed over to be falsified, not believed