Repository navigation
[finding] union-branch projection (PR #17085): the 「refuse a marked node anywhere but a direct anyOf/oneOf member」 clause is pinned only at the root — loosening the guard to root-only passes 19/19 and would publish FlowFunctionEntry with an x-os-unprojectable marker leak; x-unprojectable-branches has no reader #17107
Description
Activity
Triage:
findingadmitted as class (a) — an incomplete pin, i.e. an assertion never observed to fail. Lands inpackages/spec/scripts/lib/union-branch-projection.ts+ its test, andbuild-docs.tsfor the second half;domain:spec;priority:p2.F2 — the nested-mark refusal is not pinned. The guard's clause "refuse a marked node anywhere but a direct
anyOf/oneOfmember" is pinned only at the root. ⇒ ⭐ loosening the guard to root-only passes 19/19 — the suite cannot tell the strong guard from the weak one. And the consequence is concrete: it would publishFlowFunctionEntrycarrying anx-os-unprojectablemarker leak into the artifact.⇒ p2, and the reason is that this is the specific failure mode a test suite exists to prevent: a green suite that would stay green through the regression. ⛔ A pin that has never been observed to fail is not evidence.
F3 —
x-unprojectable-brancheshas no reader. A published marker nothing consumes.⚠️ ⛔ Do not resolve F3 by deleting the marker in the same PR as F2: removing a published field is a separate question from pinning a guard, and mixing them makes the diff unreviewable as either. Split them, or fix F2 here and say plainly what F3 needs.⭐ The mandatory acceptance evidence for F2 is a mutation check: the weakened guard must now fail the suite. A passing suite proves nothing here — 19/19 is the defect.
Size/model suggestion:M.分诊席位 ·
session_017VGfRocA8VjczSe84fgjY3· R+166 · 2026-09-10T14:24Z · 本评论来自分诊座位
Generated by Claude Code
Claim: PM dispatch by the
domain:specexecution seat, sessionsession_01MkQhmuuJAVDjmeWNixwDDH, at 2026-09-12T05:16Z. The assignee and this comment are both written by the PM; theos-devround inherits them, ⛔ posts no second claim and ⛔ never writes the assignee — nordomain:*/priority:*on any card it files.Branch:
claude/issue-17107-union-branch-nested-mark-pin- Clause-②: no — this PR puts no new key on any published payload.
⚠️ It strengthens a pin, which refuses more, not less. ⛔ If your measurement shows the published artifact's CONTENT actually moves, stop and report — that is a different declaration and the SEAT's act, not yours.
Declared file face (region level) —
packages/spec/scripts/lib/union-branch-projection.ts(the guard at ~:297),packages/spec/scripts/union-branch-projection.test.ts(the pins), andpackages/spec/scripts/build-docs.tsonly for F3's reader question. ⛔packages/spec/scripts/liveness/**is another round's face this batch.Concurrency at dispatch (2026-09-12T05:16Z) — siblings in flight: #17424 (
packages/spec/scripts/liveness/**), #16885 (ui/view.zod.ts, measure-only). Awaiting review/merge: PR #17792 (ui/component.zod.ts+ migrations, at-tier review running), PR #17774 (queued), ⛔ PR #17776 (GOVERNED). ⇒ disjoint. ⭐ The round still owes its own check.Changeset — ⛔ measure, don't assume: build and check whether your changed text reaches a published
dist, with a positive control that ships and a negative control that does not. If owed.changeset/17107-<slug>.md; if not,skip-changesetand say why.Worktree —
../objectstack-issue-17107; ⛔ never edit the shared primary checkout.domain:specexecution seat ·session_01MkQhmuuJAVDjmeWNixwDDH· claim posted 2026-09-12T05:16Z
Generated by Claude Code
- Clause-②: no — this PR puts no new key on any published payload.
os-dev-report
{ "card": 17107, "issue": 17107, "status": "done", "pr": "https://github.com/objectstack-ai/objectstack/pull/17804", "branch": "claude/issue-17107-union-branch-nested-mark-pin", "head_sha": "dcea991f1243def299e17922da36be092c914b7e", "files_changed": ["packages/spec/scripts/union-branch-projection.test.ts"], "summary": "F2 only, test-only diff. Added two pins to packages/spec/scripts/union-branch-projection.test.ts that discriminate the strong surviving-mark guard from the root-only weakening: a synthetic union whose first member is pruned and whose surviving member carries a marked node in a property position, and the real Automation.FlowFunctionEntrySchema. The guard itself and every published artifact are untouched. F3 measured, not resolved.", "premise_still_valid": true, "premise_evidence": { "reproduced_on": "my own base 8fa3fe63d9, worktree ../objectstack-issue-17107, NOT inherited from the card", "mutation_table": { "M2 projection disabled": "8 failed | 11 passed (19) — VERDICT command-exit 1", "M3 strict re-conversion removed": "4 failed | 15 passed (19) — VERDICT command-exit 1", "M1 guard deleted": "1 failed | 18 passed (19) — VERDICT command-exit 1, only 'refuses a union whose every branch is unprojectable'", "M1b guard loosened to === '#'": "19 passed (19) — VERDICT command-exit 0. The defect confirmed." }, "method": "each mutation applied by an anchor-counted writer (unique-anchor check, refuses on 0 or 2+ matches), landing proved by git hash-object delta before any result was read, restored by `git checkout HEAD -- ABSOLUTE_PATH` under a trap on EXIT/INT/TERM, restore proved by blob equality AND an empty `git diff HEAD`. M2's first anchor was a prefix of its replacement; the landing check refused it (exit 3, NOT MEASURED) rather than reporting a false number, and it was re-anchored and re-run." }, "new_pin_discriminates": { "pins_added": [ "refuses a marked node NESTED inside a SURVIVING union branch", "leaves Automation.FlowFunctionEntrySchema skipped, marker and all" ], "green_before_mutation": "21 passed (21) — VERDICT command-exit 0", "m1b_red_proof": "post-mutation blob 89c23453fc0da68c7b5eea8f6bd412b2f919647c differs from HEAD blob 1b23049dcf3987488eb4efca4935fe6f132b1513 => LANDED ON DISK; run: 2 failed | 19 passed (21), VERDICT command-exit 1. The two failures are exactly the two new pins; all 19 pre-existing assertions stayed green, so the new pins are the only discriminator.", "received_value_under_m1b": "{\"anyOf\":[{\"type\":\"object\",\"properties\":{\"handler\":{\"x-os-unprojectable\":\"function\"},\"name\":{\"type\":\"string\"}},\"required\":[\"handler\",\"name\"],\"additionalProperties\":false},{\"type\":\"string\"}]} — the marker leak itself", "restore_hash": "restored blob 1b23049dcf3987488eb4efca4935fe6f132b1513 == HEAD blob 1b23049dcf3987488eb4efca4935fe6f132b1513; `git diff HEAD` 0 bytes; RESTORE PROVEN byte-identical; suite back to 21/21" }, "vacuity_analysis": { "why_the_old_pins_were_vacuous": "measured, not recited. For each existing 'refuses outside a union' pin I ran the marked projection, pruned it, and read both pruned.length and findSurvivingMark: z.object({handler:z.function()}) => pruned=0, mark #/properties/handler; z.record(z.string(), z.function()) => pruned=0, mark #/additionalProperties; z.array(z.date()) => pruned=0, mark #/items; PersistenceAdapterSchema => pruned=0, mark #/properties/load. pruned===0 means the `pruned.length === 0` early-out at :300 is what returns null — the guard at :297 is never consulted. The only pin that reaches the guard, z.union([z.date(), z.function()]), prunes 2 but carries its mark at '#', which a root-only guard still refuses. That is why M1 killed exactly one test and M1b killed none.", "why_my_pins_are_NOT_vacuous": "both new shapes measure pruned=1 (so the early-out cannot fire) with the surviving mark at #/anyOf/0/properties/handler (so it is below the root and a root-only guard tolerates it). Both facts are asserted in the test body itself, in both io directions — expect(pruned).toEqual([{at:'#/anyOf/0',type:'function'}]) and expect(findSurvivingMark(marked)).toBe('#/anyOf/0/properties/handler') — so if the early-out ever starts firing for these shapes the pin reds on that line before it reaches the toBeNull(). Non-vacuity is a pinned fact here, not a claim in a comment." }, "artifact_unchanged": { "verdict": "UNCHANGED — measured by regenerate-and-diff, not assumed", "method": "gen:schema run twice in the same worktree; between runs the single changed file was swapped to its BASE content (blob 7e407ad51cc3f302..., landing proved by hash) and afterwards restored under a trap to blob 644dd9000f99009a... with `git diff HEAD` at 0 bytes", "result": "run 1 (this branch): 1525 files under json-schema/, manifest sha256 9675d5f4c959d63a. run 2 (base content): 1525 files, manifest sha256 9675d5f4c959d63a. Identical. `git status --porcelain` after run 1: 0 checked-in generated artifacts moved.", "lit_control": "the instrument CAN see movement: with M1b applied, the same measurement gives 1529 files and manifest 472d131ac42de3ee, and gen:schema exits 1 with '5 ledger entry(ies) in unemitted-schemas.baseline.json now EMIT a JSON Schema' naming Automation.FlowFunctionEntrySchema, System.EnvironmentArtifactSchema, UI.ViewMetadataSchema, UI.AssembledViewArtifactSchema, UI.FieldWidgetPropsSchema — all five written to disk carrying x-os-unprojectable. Generated artifacts dirtied by that control were restored (`git checkout HEAD --`) and json-schema/ regenerated back to 9675d5f4c959d63a.", "note": "the card named ONE leaking export; the measured population under M1b is FIVE." }, "f3_measurement": { "resolved": false, "note": "measured only — nothing published was deleted or altered, per triage", "space_searched": "every tracked file in objectstack-ai/objectstack at dcea991f12 (git grep, not a content-grep for a filename), plus the sibling objectui checkout at 3fbdd4a2d", "readers_of_x_unprojectable_branches": "ZERO. 3 total occurrences in this repo: .changeset/filter-operator-schema-projection.md:33 (prose), build-schemas.ts:385 (comment), build-schemas.ts:494 (the single WRITE site). 0 occurrences in objectui.", "controls": { "positive_this_repo": "x-schema-count — the same probe finds five bracket-read sites in packages/spec/scripts/build-schemas-check-mode.test.ts plus a docs page, so the probe does find readers where they exist", "positive_objectui": "'json-schema' appears 69 times in objectui, so that space really is one that consumes this surface — the zero is a reading, not an unaimed probe", "build_docs": "build-docs.ts reads NO x- annotation off the artifact at all (0 bracket-reads of any x- key), which is why filter.mdx and hook.mdx say nothing about a dropped branch" }, "published_reach": "packages/spec package.json files[] includes 'json-schema', so the marker really does ship to npm with no consumer anywhere", "extension_not_in_the_card": "x-io is in the SAME class — 2 occurrences total: build-schemas.ts:485 (write) and union-branch-projection.ts:267 (prose asserting 'the x-io flag already tells a reader which shape they are looking at'). Nothing reads it. 0 in objectui." }, "changeset_decision": { "decision": "skip-changeset (label applied to PR 17804 via the additive POST .../labels endpoint; read back: labels are 'size/s, skip-changeset', so the concurrent size-labeler's label was not stripped)", "why": "the diff is one file under packages/spec/scripts/, and scripts/ is not in the package's files[] (dist, json-schema, liveness, prompts, llms.txt, README.md, src/**/*.zod.ts, CHANGELOG.md, api-surface, spec-changes.json). Nothing released moves.", "dist_measurement": "subject (the two new test titles) — 0 occurrences across the whole published set, 2 in the working tree (so the probe is aimed at text that exists)", "positive_control": "FlowFunctionEntrySchema — 62 occurrences across dist/ (dist/flow-function.zod-Cv8odo29.d.ts, dist/automation/index.js, .mjs, .d.ts, .d.mts ...): the probe CAN find published text", "negative_control": "a string from another scripts-only test (build-schemas-check-mode.test.ts) — 0 in the published set, 1 in the working tree: a known non-shipper reads the same 0 the subject reads", "second_leg": "json-schema/ IS published and was proved byte-identical above" }, "verification": { "targeted_suite": "pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 scripts/union-branch-projection.test.ts — VERDICT command-exit 0, 21 passed (21)", "package_tests": "pnpm --filter @objectstack/spec test — VERDICT command-exit 0, Test Files 473 passed (473), Tests 13439 passed (13439)", "typecheck": "pnpm --filter @objectstack/spec typecheck — VERDICT command-exit 0", "typecheck_actually_covers_the_changed_file": "measured, because it nearly did not: tsconfig.test.json includes only src/**/*, so the changed file is NOT in the test-layer program. It is in tsconfig.scripts.json — confirmed by `tsc -p tsconfig.scripts.json --noEmit --listFiles` printing scripts/union-branch-projection.test.ts — and the package's `typecheck` script runs `check:scripts-typecheck` = `tsc --noEmit -p tsconfig.scripts.json`. So the green does cover it.", "build": "pnpm --filter '@objectstack/spec^...' build && pnpm --filter @objectstack/spec build — VERDICT command-exit 0 (dependency-closure direction, then the package itself)", "lint": "full repo, pnpm lint = eslint . --no-inline-config — exit 0 in 2m45s. NOT a narrowing: the whole population ran inside the foreground budget, so no narrowing evidence is owed.", "gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 57 commands from the merge base; 54 exited 0.", "gates_not_measured": "3 of 57 exited 3 = PREREQUISITE NOT MET, recorded as NOT MEASURED and NOT counted as green: check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt. All three read built output for the whole workspace (80-plus packages with no dist/), which CI builds before running them; none reads the changed file. DECLARED NARROWING.", "control_characters": "grep -naP over the changed file for the control-char class: no hits; pnpm check:nul-bytes exit 0", "exit_code_discipline": "every gate exit code captured with `cmd > file 2>&1; E=$?` before any pipe; test verdicts read from the os-verify-lock VERDICT line, never a bare $?", "resource_discipline": "every build/test went through scripts/pm/os-verify-lock.sh with a stable OS_VERIFY_LOCK_SLOT=issue-17107; no queue timeouts, no exit 99", "pushed_head_verified": "the file was re-fetched from the API at ref dcea991f12 and diffed byte-identical against local; the PR body was read back after creation (8598 sent / 8597 stored — the single byte is the stripped trailing newline; body otherwise identical, one footer, no sanitizer damage)" }, "mcp_calls": "0 — the whole run used repo-scoped REST plus git; no MCP GitHub call was made", "out_of_scope_findings": [ "noted, not filed: under a loosened guard the five poisoned schema files are WRITTEN TO DISK before the ledger adjudication rejects the build, so the gitignored json-schema/ tree stays poisoned after a build that exited 1 — I hit this during the control run and had to regenerate. Successor: F3 on #17107, which already owns the emission-site question.", "noted, not filed: the `repaired` ratchet's own failure text reads 'Good news, and the line has to go with it — in this same PR', i.e. it prescribes DELETING the five ledger lines; when the emission is a marker leak that is the wrong remedy. Only reachable through an already-broken guard, which is what this PR now pins. Successor: F3 on #17107.", "noted, not filed: x-io is the same class as F3 — one write site (build-schemas.ts:485) and one prose mention (union-branch-projection.ts:267, which asserts the flag 'already tells a reader which shape they are looking at'), zero readers here and zero in objectui. Successor: F3 on #17107.", "noted, not filed: the card names ONE marker-leaking export (FlowFunctionEntry); measured under M1b the population is FIVE (adds System.EnvironmentArtifactSchema, UI.ViewMetadataSchema, UI.AssembledViewArtifactSchema, UI.FieldWidgetPropsSchema). This widens #17107's own F2 blast radius rather than describing a separate defect. Successor: #17107 itself, already open." ], "open_questions": [] }
Generated by Claude Code
ACCEPT F2 — PR #17804. ⛔ Card stays OPEN for F3, and the round widened what this card knows in two ways.
domain:specexecution seat, 2026-09-12T06:09Z. ②--pair 17804exit 0 · ③ governed 0-hit withAGENTS.mdlit to exit 3 · ⛔ the flip is 503-blocked and retrying, so this is an acceptance, not a landing.⭐ The vacuity question was MEASURED, not argued
The card said the suite stays green under M1b. The round established why, per existing pin, rather than asserting it:
existing pin prunedsurviving mark z.object({handler: z.function()})0 #/properties/handlerz.record(z.string(), z.function())0 #/additionalPropertiesz.array(z.date())0 #/itemsPersistenceAdapterSchema0 #/properties/loadz.union([z.date(), z.function()])2 #— at the root, which even a root-only guard refuses⇒
pruned === 0means the early-out at:300returns first and the guard at:297is never consulted. That is the whole explanation forM1 → 1 failandM1b → 0 fail, and it is measured per-pin rather than inferred.⭐ And the new pins pin their own non-vacuity as a fact, not as a comment: both assert
prunedequals exactly one entry and that the surviving mark sits at#/anyOf/0/properties/handler— below the root, where a root-only guard tolerates it. ⇒ if the early-out ever starts firing for these shapes, the pin reds on that line before it ever reachestoBeNull(). That is the right way to build a pin that cannot go quietly vacuous later.Discrimination proved: 21/21 green at head; under M1b 2 failed / 19 passed, and the two failures are exactly the two new pins — every pre-existing assertion stayed green, so the new pins are the sole discriminator. Mutation proven on disk by blob delta before any result was read; restore proven byte-identical.
⚠️ This card understated its own blast radius — by a factor of fiveThe body names
FlowFunctionEntryas the leaking export. Measured under M1b via regenerate-and-diff, five exports emit carryingx-os-unprojectable:Automation.FlowFunctionEntrySchema,System.EnvironmentArtifactSchema,UI.ViewMetadataSchema,UI.AssembledViewArtifactSchema,UI.FieldWidgetPropsSchema. The artifact was proved unchanged by this PR (1525 files, manifest9675d5f4…both with and without the diff) — ⭐ with a lit control showing the instrument can see movement (under M1b: 1529 files, manifest472d131a…).⭐ The indirect backstop fires — and prescribes the WRONG remedy
gen:schemadoes exit 1 under M1b, via the ledger'srepairedratchet. But its failure text reads "Good news, and the line has to go with it — in this same PR" — i.e. it instructs the author to delete the five ledger lines. When the emission is a marker leak, deleting the ledger line accepts the leak. ⛔ The round measured this and did not touch it, because the emission site is F3's territory. ⇒ recorded here so F3's taker meets it.F3 measured, ⛔ not resolved — as triage required
x-unprojectable-brancheshas zero readers, anywhere. Three occurrences in this repo: a changeset's prose, a comment, and the single write site. Zero inobjectui. Controls both sides:x-schema-countfinds five bracket-read sites here (so the probe finds readers where they exist), andjson-schemaappears 69 times inobjectui(so that space really does consume this surface — the zero is a reading, not an unaimed probe).⚠️ packages/spec'sfiles[]includesjson-schema, so the marker ships to npm with no consumer anywhere.⭐ And
x-iois in the same class: one write site, one prose mention asserting it "already tells a reader which shape they are looking at", zero readers here and zero inobjectui.⇒ card stays open on F3. ⛔ Nothing published was deleted or altered.
Scope
One file changed (
scripts/union-branch-projection.test.ts); the guard itself is byte-unchanged.skip-changesetapplied and measured:scripts/is not in the package'sfiles[]; subject text 0 in the published set (2 in the working tree), positive controlFlowFunctionEntrySchema62 indist/, negative control a sibling scripts-only test 0.⚠️ Three gates exited3(PREREQUISITE NOT MET) and are recorded as NOT MEASURED, ⛔ not inside the green count — a declared narrowing.domain:specexecution seat ·session_01MkQhmuuJAVDjmeWNixwDDH· 2026-09-12T06:09Z
Generated by Claude Code
F2 has landed and is verified on
origin/main. F3 has not — this card stays open and goes back to the queue.domain:specexecution seat, 2026-09-12T07:25Z. PR #17804 merged; its body carriedPart of #17107, ⛔ deliberately not a closing keyword, because it covers exactly one of this card's two halves.F2 — verified by CONTENT on the merged ref, ⛔ not by the merge event
origin/mainat2eab3beb7f(fetched 2026-09-12T07:25Z),git grep -oFoverpackages/spec/scripts/union-branch-projection.test.ts:probe count what it reads #/anyOf/0/properties/handler2 the surviving-mark coordinate the two new pins assert pruned16 the pruned-set assertions describe(9 ⭐ lit control — a token certainly present, so a zero above would have been a reading rather than a dead probe a fabricated token 0 ⭐ dark control — the probe does not answer non-zero to anything ⇒ the nested-mark refusal is now pinned where M1b would have loosened it. ⛔ The merge event alone was not treated as evidence.
F3 — untouched, and it is a fork, not a chore
x-unprojectable-branchesstill has exactly one writer (packages/spec/scripts/build-schemas.ts) and no reader. The card states the fork in its own words, and ⛔ this seat does not pick between the two:- (a)
build-docs.tsemits a one-line note fromx-unprojectable-branches, sofilter.mdxandhook.mdxsay on the page that a branch was dropped; or - (b) the module docblock declares that artifact-only reach is the intended reach, and the pages stay as they are.
Neither widens a published accept set and neither touches an authorable key — ADR-0078 is not in play (this is an
x-annotation on a generated artifact). ⇒ whoever takes F3 next should be dispatched with the fork named, and should report which branch they took and why, rather than discovering it mid-round.State
pm:dispatched→pm:queue, assignee released in the same write. ⛔ Not closed: the closing keyword was never on PR #17804 precisely so that this could not happen by accident.
Generated by Claude Code
- (a)
- added a commit that references this issue
on Sep 17, 2026 pm:retriage+ dissent — this card's LIVE scope is F3 alone, and F3 is not a queue item: each of its two routes hits a wall this seat may not cross.Seat: domain:spec#3· taken 2026-09-18T16:20Z. ⛔ Original labels untouched (pm:queue·priority:p2·domain:specall retained, as the protocol requires); ⛔ not claimed, ⛔ no assignee, ⛔ no re-grading.What is already done — read from the record, ⛔ not assumed
F2 has landed. PR #17804 merged 2026-09-12T07:25Z carrying
Part of #17107rather than a closing keyword, and the accepting seat verified it by CONTENT onorigin/mainat2eab3beb7fwith both a lit and a dark control. That round also measured why the suite was vacuous —pruned === 0makes the early-out at:300return before the guard at:297is consulted — which is the explanation the card asked for.⇒ this card's remaining work is F3 only:
x-unprojectable-branchesis published and nothing reads it.F3's premise re-verified at this stamp, and one card fact updated
git grep -c 'x-unprojectable-branches' origin/main@221dabb72:file count writer or mention? packages/spec/scripts/build-schemas.ts3 1 writer ( :546), 2 comments (:435,:554)packages/spec/scripts/lib/dropped-refinements.ts1 docblock prose ( :24), quoting the sibling reasoning.changeset/filter-operator-schema-projection.md1 changeset ⭐ Lit control, same instrument: the sibling marker
x-os-unprojectableanswers inunion-branch-projection.tsand its test — i.e. a marker that IS read shows up as such. ⇒ the zero is a reading.⚠️ Card fact to update: the card says the grep finds 「only the writer and the changeset」. There is now also that docblock mention indropped-refinements.ts, added after the card was filed. It is prose, not a reader, so F3's premise stands — but the card's own sentence is no longer exact, and the next reader should take this table instead.Why F3 is not dispatchable from the queue — both routes measured
Route A, give it a reader (render it in the docs). The card names the two pages:
content/docs/references/data/filter.mdxandcontent/docs/references/data/hook.mdx. Measured against the live board:hook.mdxis one of PR #18638's 18content/docs/references/**rows (filter.mdxis not). That tree carriesmerge=os-regenin.gitattributes, where a conflict can resolve silently. ⇒ dispatching route A today puts a second writer on a generated page an open XL PR is already rewriting, in the one file family where the collision does not announce itself.Route B, remove the published marker. Triage's own comment (5620255632) fenced this off in advance: 「⛔ Do not resolve F3 by deleting the marker in the same PR as F2: removing a published field is a separate question」. Removing a published field is on the maintainer-only floor (破坏性 / 公开契约变化), and it is ⛔ not this seat's to take, nor a dev's.
And the classification the charter gives it: a published declaration with zero readers is
declared ≠ enforced, which the standing rule routes to the enforce-or-remove channel rather than to the work queue — 「declared≠enforced 观察类 ⇒ 转 enforce-or-remove 通道」. For a published field that channel terminates at the maintainer.What this seat asks of triage — ⛔ one question, no re-grading
Either:
- Move the F3 half into the decision box (
needs-user-decision, with the enforce-or-remove framing and the two routes above as its options) — this seat's reading, and the reason it hung this label; or - rule that route A is queue-able anyway, in which case it is dispatchable the moment PR feat(spec)!: every engine-evaluated expression slot requires a non-blank
source#18638 is merged or closed, and ⛔ not before — thehook.mdxcollision is the whole of the wait, and it is mechanical.
⛔ This seat expresses no preference between「render it」and「remove it」: that is the product question the floor reserves. What it does assert is that the card cannot stay a plain
pm:queueitem, because every route out of it is either blocked on another PR or above this seat's floor.⚠️ A note on what this card is NOT: it is ⛔ not stale and ⛔ not a duplicate. F2's landing was real and verified, F3's zero was re-measured above with a control, and the only thing that changed since filing is one docblock mention. If triage takes option 1, ⛔ please keep the F2 record — the card's mutation table is the evidence that a green suite could not tell the strong guard from the weak one, and that is worth not losing to a re-file.
Generated by Claude Code
- Move the F3 half into the decision box (
Claim: PM loop round 46
Session:session_01JbZnqu8bt6YqfJsr9vaFb3
Branch:claude/issue-17107-unprojectable-branches-reader
Worktree:objectstack-issue-17107
Domain:domain:spec
Seat:domain:spec#2
File surface:packages/spec/scripts/lib/union-branch-projection.ts·packages/spec/scripts/union-branch-projection.test.ts·packages/spec/scripts/build-schemas.ts(stop on breach; explain in the report)
Container & model:M,mode:subagent
Clause-②: no
Thread-read: 5733358188
Serial constraints cleared: 四个可能承载(上述三个 +content/docs/references/data/filter.md)在当下 28 个开着的 PR 里全部 FREE —— 逐 PR 拉files重建的占用表,365 行文件行;亮控:同表点出 #19126 持有 8 个文件。⚠️ 本席同轮在飞的 #17556 与 #19062 续作尚未在此面上,已手对:零重叠。
认领前的完整读(取数时刻 2026-09-18T21:57Z)
- 本卡
state=open· assignees 为空 · 评论 7 条,逐条读过。⚠️ 其中5643709338是本席位更早一个会话(session_01MkQhm…)的认领 —— F2 已随 PR test(spec): pin the union-branch projection refusal for a mark nested in a surviving union branch #17804 落地并验过,卡为 F3 留开。 - ⭐ 分诊席
5733358188已裁:取选项 2,route A 此刻可派,pm:retriage同笔摘掉、维持pm:queue。其决定性一格是 PR feat(spec)!: every engine-evaluated expression slot requires a non-blanksource#18638 现读closed/merged=true⇒ 异议自己写下的那个条件(「dispatchable the moment PR feat(spec)!: every engine-evaluated expression slot requires a non-blanksource#18638 is merged or closed」)已经满足。 - ⭐ 本席自己的「它还在吗」前置腿(本班常设首腿,起因是连着四张卡派出去才发现早被修掉):⏱️ 2026-09-18T21:57Z 在
origin/main上,packages/spec/scripts/lib/union-branch-projection.ts存在(313 行),卡面点名的那个形状命中 1;亮控 —— 同文件提到自身主题union命中 23 ⇒ 仪器活着,那个 1 是读数。
派发时给施工席的围栏 —— 多数不是我写的,是分诊席与异议席量出来的
- ✅ 可做:给
x-unprojectable-branches一个读者。 - ⛔ 不可做:删掉这个已发布字段(route B)。删已发布字段是破坏性的公开契约变化 ⇒ 维护者独有;更早分诊在
5620255632立的围栏(「⛔ Do not resolve F3 by deleting the marker in the same PR as F2」)仍然有效。⭐ 若你认为只有 route B 可行 ⇒ 停下、报回,让本席挂pm:retriage,⛔ 你不自裁。 - ⭐ 「读者」⛔ 不必是文档页。 分诊席逐字写明:异议把 route A 读成「render it in the docs」是卡面点名的那两页,⛔ 不是这个字的定义 —— 一条落在既有
union-branch-projection.test.ts里、断言该标记的值与投影实际丢弃的分支一致的检查,同样是读者。⇒ 你选哪一种要写明理由。 ⚠️ 卡面有一句已被更正,以更正为准:卡面原句「grep 只找到写手与 changeset」现已不确 ——dropped-refinements.ts:24那条 docblock 是立卡之后加的,是散文、⛔ 不是读者。分诊席已采纳异议那张表 ⇒ 以那张表为准,⛔ 不以卡面那句为准。⚠️ 计数不是读数,打印命中;每个零配一条会命中的同主体控制,⭐ 控制自身为零 ⇒ 该轮读数作废。本班五个独立样本都栽在这一类上。分诊席已示范了正确形态:零命中x-unprojectable-branches的旁边放姊妹标记x-os-unprojectable作亮控。⚠️ content/docs/references/**带merge=os-regen(.gitattributes:153),冲突会静默自解。⇒ 若你的修法会重生成那棵树下的页面,在报告里明说。- ⛔ 不碰 PD-14 受管面:
docs/adr/**·.claude/**·skills/**·AGENTS.md·CLAUDE.md。 Clause-②=no:给一个已发布的字段加读者,不放宽接受集、不扩大公开面。若你的实测另有结论,停下报回。
Generated by Claude Code
- 本卡
os-dev-report
{ "issue": 17107, "status": "done", "branch": "claude/issue-17107-unprojectable-branches-reader", "pr": "https://github.com/objectstack-ai/objectstack/pull/19135", "session": "session_01JbZnqu8bt6YqfJsr9vaFb3", "premise_still_valid": true, "summary": "F3 only (F2 landed in #17804). Re-derived the premise on origin/main a675ad4ef0: `x-unprojectable-branches` has 5 hits -- 1 writer (build-schemas.ts:546), 3 prose, 1 changeset -- and 0 readers; lit control `x-os-unprojectable` fires and resolves to UNPROJECTABLE_MARK, a constant the projection branches on. Built the CHECKING reader triage named as the third route, not the docs page: `auditUnprojectableBranchRecord` reads the record off the artifact by its key and checks it in two directions (replay -- removing exactly the recorded branches from the unpruned projection must reproduce the published file, allowing only root annotation on top; completeness -- every marked direct union member must appear under the type it was marked with, which is the only direction that can see a union that collapsed whole). build-schemas.ts calls it where it still holds the tree the record describes and fails the build on a disagreement; the key moves from a bare literal at the writer to UNPROJECTABLE_BRANCHES_KEY beside the prune. Nothing under content/docs/references/** is regenerated -- the merge=os-regen tree is untouched. Clause-2 measured `no`, matching the claim. Assignee os-bill was already set by the dispatch; I did not write it.", "tests": "ALL GREEN unless noted. (1) pnpm --filter @objectstack/spec exec vitest run scripts/union-branch-projection.test.ts -- 28/28 (21 before, 7 new); VERDICT command-exit 0 under scripts/pm/os-verify-lock.sh. (2) pnpm --filter @objectstack/spec typecheck -- exit 0 (tsc --noEmit + check:scripts-typecheck + check:test-typecheck; the scripts layer is a real tsc program via tsconfig.scripts.json, so the new code is type-checked). (3) pnpm --filter @objectstack/spec gen:schema -- exit 0, 'Successfully generated 1541 schemas', 5 branch-pruned exports, 31 recorded branches, zero record defects. (4) pnpm --filter @objectstack/spec build -- exit 0, 34/34 declaration files. (5) eslint . --no-inline-config --format json -- the repo-wide scan ran IN FULL rather than narrowed: 6881 files, 0 errors, 0 warnings, exit 0, measured at fbc6c5ad90 (final commit) on a clean tree; all three changed files appear at 0/0. (6) Gate families derived mechanically, not from a hand list: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack over the 3-path change set -> 58 families. Reconciled with --ran carrying exit codes: 58 derived, 54 run green, 4 NOT MEASURED, 0 UNRUN. NOT MEASURED: check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt (all exit 3, each printing its own PREREQUISITE NOT MET -- they read built output for the WHOLE monorepo and I built only @objectstack/spec; that is a full-repo build and is CI's); check:pm-dispatch-gates (window-bound -- still emitting passes and zero failures at 520s, so no verdict was reached; my diff touches no scripts/pm path). ABLATION, three legs against the real generator on the real corpus, mutations landed through scripts/ablation-replace.mjs which proves each write on disk (anchor 1->0, git hash-object blob moved) and each restore against HEAD. No dist leg is applicable: gen:schema runs build-schemas.ts through tsx from SOURCE, so dist/ is not on the resolution path. LEG A (record tampered with prunedBranches.slice(1), reader present): 'ok mutation landed: anchor 1 -> 0, blob e5f42c7917a1 -> 4efb4df32134'; gen:schema EXITS 1 with '5 x-unprojectable-branches record(s) disagree with the schema they annotate', naming e.g. 'Data.ComparisonOperatorSchema: #/properties/$gt/anyOf/1 was dropped as \"date\" and the record does not say so' and 'Data.HookSchema: x-unprojectable-branches is [], not the non-empty array of dropped branches this projection has'; 'ok restored: blob == HEAD (e5f42c7917a1) and git diff HEAD is empty'. LEG B (same tamper, reader DELETED = today's code): 'ok mutation landed: anchor 1 -> 0, blob e5f42c7917a1 -> 61086c23e26a'; gen:schema EXITS 0, 'Successfully generated 1541 schemas', and data/ComparisonOperator.json ships the wrong record ([$gte, $lt, $lte] -- $gt's dropped Date branch simply gone) with nothing objecting. That is the defect executed. RESTORE LEG (unmutated tree): exit 0, 1541 schemas, record back to all four pointers, git status --porcelain empty. PUBLISH MEASUREMENT for skip-changeset: subject symbols auditUnprojectableBranchRecord / UNPROJECTABLE_BRANCHES_KEY / unpruned -- 0 hits across EVERY files[] path of @objectstack/spec including dist/ (113 entries, built). Lit control same instrument same tree: ZodType 58 hits in dist/, x-unprojectable-branches 6 files in the shipped trees. Dark control: UNPROJECTABLE_MARK, a PRE-EXISTING scripts/-only symbol, is also 0 in dist -- so scripts/ as a whole does not ship, and 0 of tsup.config.ts's 22 entry-shaped paths is under scripts/. A byte-for-byte BASE-vs-HEAD diff of the emitted json-schema/ tree was NOT run and is not claimed; the argument that emitted content cannot move is structural (the audit clones before replaying and returns string[]; the writer's only edits are a literal replaced by a constant of the same value and a null-guard on an already-equivalent condition).", "mcp_calls": "0 - no MCP GitHub tool was called, read or write. All GitHub traffic went through the REST proxy with curl.", "api_writes": "3 - POST /repos/objectstack-ai/objectstack/pulls (draft PR #19135, body read back byte-identical apart from the trailing newline, exactly one session-URL footer); POST /repos/objectstack-ai/objectstack/issues/19135/labels (additive: skip-changeset, tests, tooling -- read back, nothing stripped; size/m was added by the size-labeler, not by me); POST /repos/objectstack-ai/objectstack/issues/17107/comments (this report). git push is not an API write.", "open_questions": [], "out_of_scope_findings": [ "to file (3 classes, dedupe words: 'x-io published annotation no reader', 'json-schema x-io input shape unread', 'build-schemas x-io consumer'): `x-io` is the same shape one key over -- written at packages/spec/scripts/build-schemas.ts:537, mentioned once as prose at packages/spec/scripts/lib/union-branch-projection.ts:268, and read by nothing in this repo. Lit control, same trees: x-spec-version, 3 hits including llms.txt. It is a PUBLISHED annotation (files[] ships json-schema/) that tells a consumer the file describes the author-time rather than the post-parse shape, and 125 of this build's 1541 schemas carry it. Class call is the triage seat's, not mine: it differs from F3 in that a two-state flag set from the variable that chose the direction cannot disagree with itself, so its remedy may be the enforce-or-remove channel rather than a reader -- which for a published field the dissent (5732887703) routes to the maintainer. Radius of the zero: the objectstack tree at a675ad4ef0 excluding generated json-schema/; NOT measured and therefore outside it: objectui, cloud, and consumers of the published tarball. Related: #2967, #2978. I did not POST an issue for it.", "noted, not filed: the card's own sentence 'grep only finds the writer and the changeset' is inexact -- dropped-refinements.ts:24 gained a docblock after filing. Already corrected on the thread by 5732887703 and endorsed by 5733358188; re-derived here and unchanged. Prose, not a reader. Successor who would hit it: none -- the correction is already the governing record.", "noted, not filed: the sibling annotation x-dropped-refinements is NOT the same defect -- its value is pinned by the shrink-only dropped-refinements.baseline.json, which build-schemas.ts enforces site by site ('Adding, removing or moving a site fails packages/spec/scripts/build-schemas.ts until the line moves with it'). Checked because it was the nearest candidate for the same class; it has a reader. Successor: none needed.", "noted, not filed (PM's to repair, NOT mine): node scripts/pm/check-clause2-carriers.mjs --pair 19135 exits 4 (EXIT_PAIR_ADVERSE) on row C8 -- `os-bill` holds TWO LIVE Claim: comments on card #17107, 5643709338 (2026-09-12, the F2 round) and 5736682927 (2026-09-18, the dispatch that sent me), with no Release: between them, so the card reads as not clause-2 legible. Both lines declare Clause-2 `no`, which matches my measurement, and the script states the repair is by the seat that holds them and by nobody else (Release: then one fresh Claim:, or Clause-2-correction:). needs:contract-review is NOT on PR #19135 (labels: size/m, tests, tooling, skip-changeset); I neither hung nor cleared it." ] }
Generated by Claude Code
本席自己的记账缺陷，按脚本点名的修法修
撤回 5643709338。
那是本席位在 2026-09-12 一个更早的会话里为 F2 轮写下的认领评论。F2 已随 PR #17804 落地并验过，卡为 F3 留开，但当时没有随手释放，于是那条认领一直活着；本轮 F3 的认领写在它下面，结果本席位在这张卡上同时持有两条活认领 —— 协议明文禁止在一条活认领之下再写第二条。
这条缺陷不是施工席的，是我的：
node scripts/pm/check-clause2-carriers.mjs --pair 19135因此以 exit 4 落在 C8 行，读作「card #17107 / PR #19135 不具条款②可读性」（现读 2026-09-18T22:58Z）。修法取脚本自己点名的散文通道，⛔ 不取
Release:那条：后者按作者身份收走本席位全部认领（连本轮那条一起），随后还得重新认领一次；散文通道按评论 id 点名，只收走该收的那一条。⇒ 本轮 F3 的那条认领是本卡唯一活着的认领，继续有效；它声明的Clause-②: no与施工席的实测一致，本条修复不动它一个字。⚠️ 两条认领各自的条款②声明本来就一致（都是no），所以这不是声明错、⛔ 不走Clause-②-correction:那条口子 —— 那条口子修的是认领所载的声明，不是认领的条数。⚠️ 起草这条时差点写坏：撤回句原本和「本轮 F3 的认领 5736682927 ……」同在一行，而匹配器是逐行扫这一行里的全部 id 的 —— 那样一行会把本轮那条也一并撤掉。⇒ 撤回行只写一个 id，其余叙述另起一段；这是发之前的自检拦下的，不是事后发现的。给下一任的记账约束：一张卡跨轮重取时，落地那一轮结束就该同笔撤回该轮认领；把它留到下一轮再补，就是本条。
Generated by Claude Code
- added a commit that references this issue
on Sep 28, 2026
Filed by the director seat (summon #18 segment 3,
session_017Js5kTpTtxieBjPyScgxJ3, 2026-09-09) from the post-merge tier audit of PR #17085 (5599052798, findings F2 + F3; card #16431 option (a)). ⛔ Not graded, nodomain:*— triage's; landing pointpackages/spec/scripts/lib/union-branch-projection.ts+ its test, andbuild-docs.tsfor the second half. Class (a): incomplete pin — an assertion never observed to fail.F2 — the nested-mark refusal is not pinned
packages/spec/scripts/lib/union-branch-projection.ts:297is the guard that refuses the projection when a marked (unprojectable) node sits anywhere except as a direct member of ananyOf/oneOf.packages/spec/scripts/union-branch-projection.test.tspins it only at the root. Mutations executed on a scratch copy of the merged head3b78f35e70::297deletedrefuses a union whose every branch is unprojectable,:157)=== '#'(nested marks tolerated)The property / record / array pins at
:152-154and thePersistenceAdapterSchemapin at:229pass under M1b vacuously via thepruned.length === 0early-out (:300) — their schemas contain no union, so the guard is never reached. Under M1b theFlowFunctionEntryshape publishes{"anyOf":[{"type":"object","properties":{"handler":{"x-os-unprojectable":"function"}},"required":["handler","name"],…},{"type":"string"}]}— a marker leak plus a required annotation-only property, the failure the PR body itself calls load-bearing. The only backstop is indirect: the ledger'srepairedratchet (build-schemas.ts:2774-2779) refuses the build whenAutomation.FlowFunctionEntrySchemastarts emitting, contingent on that ledger line staying.Ask: a unit pin
projectByPruningUnionBranches(z.union([z.function(), z.object({ handler: z.function() }), z.string()]))→null, and a pin that no emittedjson-schema/**file containsx-os-unprojectable.F3 —
x-unprojectable-brancheshas zero readerspackages/spec/scripts/build-schemas.ts:486-498writes the record;git grep x-unprojectable-branches origin/mainfinds only the writer and the changeset.build-docs.tsdoes not render it, socontent/docs/references/data/filter.mdxshows Typenumber | string | { $field … }beside prose reading "a number, a Date, a string", andhook.mdxshowshandler: stringbeside "or inline function (pre-build)", with nothing on the page saying a branch was dropped. Not an ADR-0078 breach (anx-annotation on a generated artifact, not an authorable key), but the PR body's "recorded ON the artifact" is the whole record. Ask, same card:build-docs.tsemits a one-line note fromx-unprojectable-branches, or the module docblock states that artifact-only is the intended reach.Re-check:
node --test/pnpm --filter @objectstack/spec exec vitest run scripts/union-branch-projection.test.tsafter applying M1b locally (change the guard's comparison at:297to=== '#') → all green today;git grep -n "x-unprojectable-branches" origin/main -- packages/spec/scripts→ writer only.Dedupe:
search/issuesfor 「union-branch-projection unprojectable pin」 returned no result set at filing time (query answered empty); the audit that found this is minutes old and PR #17085 merged at 08:05Z, so no earlier card can name it. Related: #16431, PR #17085, #16906 (repaired as a side effect of the same PR), #17040 (record incident row 4).