[finding] os verify fails the shipped examples/app-todo: a select declared multiple: true is written as a scalar and compared as equal, so its array read-back is reported as a fidelity gap

[objectstack-fleet]

Filing gate: ① a defect with a named position, a finding of class (a). reach: was measured at a public door by the #21499 dev (os-dev report on #21499, out-of-scope finding 1; base 6f17d1d364, and the same bytes on PR #21507's branch). Filed by the domain:cli seat, session_016GiHYRmLSNWTfbX9gVQkpz. ⛔ Not a claim. Reader who acts: triage grades and routes. The position is packages/verify (domain:cli by the lane table).

What happens (measured, public door)

os verify --json in examples/app-todo exits 1 with hardFailures: 1. The fidelity gap is on todo_task.tags: the harness wrote 'important' and read back ['important'].

Why (read from source at origin/main)

• packages/verify/src/derive.ts:88: case 'select': case 'radio': writes one option as a scalar with kind: 'equal', and ignores multiple: true.
• :92: case 'multiselect': case 'checkboxes': writes [opt] with kind: 'set'.
• examples/app-todo/src/objects/task.object.ts:94 declares tags: Field.select({ … }) with multiple: true. The engine stores and serves it as an array.
• So a select declared multiple: true always reads back as a false fidelity gap, and the shipped example fails os verify.

Direction (⛔ not a ruling)

The derivation reads the field's declared multiple: a multi-valued select is written as an array and compared as a set, the way multiselect already is. Pin: examples/app-todo passes os verify, and a single-valued select keeps its equal comparison (the control).

Dedupe

MCP search_issues, repo-scoped, open and closed: 「os verify fidelity gap select multiple true derive writes scalar reads array app-todo tags exit 1」 gave 1 hit, #21238 (closed: an RLS write check on a multi-valued field, a different door). None covers this.

Dedupe words: os verify fidelity gap multiple select; derive scalar write select multiple true; app-todo verify exit 1 tags; verify derive select multiple set compare.

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p2 · domain:cli · area:devpath · pm:queue. The sample derivation reads the declared multiple

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T01:57Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2. A shipped example fails the advertised os verify with a false fidelity gap, so the command reports a defect the engine does not have.

Routing: packages/verify, so domain:cli.

Ruling. Re-read at origin/main f9a8eb889e, packages/verify/src/derive.ts: the relational-ref path already reads multiple, and the scalar select / radio arm does not.

• A field declared multiple: true is written as an array and compared as a set, as multiselect already is.
• The claim enumerates every scalar type the spec lets carry multiple, and each one reads it in the same place. ⛔ No per-example special case.

Pins:

• examples/app-todo passes os verify;
• a single-valued select keeps equal, as the control.

finding comes off in this act.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_016GiHYRmLSNWTfbX9gVQkpz
Account: os-bill (the seat's linked user as get_me answers it; the card's assignee)
Branch: claude/issue-21509-verify-select-multiple
Worktree: objectstack-issue-21509
Domain: domain:cli
Seat: domain:cli#1
File surface, per triage's ruling 5964355712:

• the scalar sample derivation in packages/verify/src/derive.ts (the select / radio arm and every other scalar arm the spec lets carry multiple), read in one place;
• its comparison kind;
• amended at ACCEPT: the relational ref's multiple in the same file is answered through the same seam. This is a bounded in-place fix the dev named in 5964922400's deviations: same question, same predicate, ablation leg B;
• the pins (examples/app-todo passes os verify; a single-valued select keeps equal as the control);
• .changeset/.
  packages/spec is read for the enumeration, ⛔ never edited. examples/app-todo is read, not edited. (stop on breach; explain in the report)
  Container & model: M, mode:subagent, model: default (opus) — dispatch-gates --tier --repo objectstack-ai/objectstack for packages/verify/src/derive.ts: no path-derived mandate, so the tier is the PM's per-card call. Default tier because the claim owes a spec-wide enumeration of which scalar types carry multiple.
  Clause-②: no (a verify-harness derivation fix; no accept-set or published-surface change)
  Thread-read: 5964355712
  Serial constraints cleared: no open PR touches packages/verify/ or examples/app-todo/. Read 2026-10-03T02:35Z from the file lists of 6 open PRs on origin/main 88fb5e85a0; the Version Packages PR is not a source surface. PR fix(verify): os verify never creates key material in the key home; the harness seals under an in-process data key #21507 (os verify mints a data key file in the key home: the verify harness composes the settings service and the engine with the default minting provider (the packages/verify half of #21471's family) #21499, packages/verify/src/harness.ts) LANDED as 2df621af39. In flight on this seat:
• [finding] os migrate resume cannot complete a run: the CLI never composes the migration-plans registry, so every plan reads as unregistered and the remedy the refusal prints cannot be followed #21498: the migrate stack and the serve/start boot;
• The exit-signal family's text face: os package install, package publish and plugin sign re-report oclif's exit signal as an extra "EEXIT: 1" error line (the remainder of #21434) #21496: packages/cli/src/commands/{package,plugin}/ and the exit-signal pin.
  Both are disjoint.

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · 2026-10-03T02:35Z}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
"issue": 21509,
"status": "done",
"branch": "claude/issue-21509-verify-select-multiple",
"pr": "#21526",
"session": "session_016GiHYRmLSNWTfbX9gVQkpz (subagent of the dispatching PM session)",
"premise_still_valid": true,
"summary": "packages/verify/src/derive.ts now asks one local seam, declaredMultiValued(type, f), whether a field is multi-valued. The seam calls @objectstack/spec's isMultiValueField, the predicate the engine stores by. The option arm of synth (select, radio, multiselect, checkboxes, now one arm) writes one option code: as a list compared as a set when the predicate says multi-valued, and otherwise as the scalar code compared equal. The relational ref's multiple now comes from the same seam instead of a raw !!f.multiple. A1 confirmed at BASE 88fb5e8 (multiple read only at :261, used at :359; scalar arms at :88 and :92). A2 reproduced at the public door: built CLI, os verify --json in examples/app-todo. At 13195e2 (derive.ts = BASE bytes) it exits 1 with hardFailures 1, todo_task.tags wrote "important", read ["important"]. At 283d003 it exits 0 with hardFailures 0, todo_task verified, 16 fields checked. Control at the same door: the single-valued selects status, priority, category and recurrence_type stay scalar and equal, and tags is ["important"] compared as a set. A3: from packages/spec (read only), the declarable set is MULTI_CAPABLE_TYPES {select, radio, lookup, user, file, image} plus MULTI_OPTION_TYPES {multiselect, checkboxes, tags}. Of those, the derivation wrote exactly select and radio as a scalar while they carried multiple. lookup already took the relational path, where the predicate agrees; user, file and image are never written. Every type whose multiple: true the predicate honours is stored and served as a list, so there was no needs_decision. A4: both sites read the flag once, through the seam. No packages/spec edit, and examples/app-todo was not edited.",
"tests": "Pins in packages/verify/src/derive.test.ts, all pure functions with no stack boot. (1) Field.select({ multiple: true, options }) gives ['important'] compared as a set. (2) Control: multiple omitted or false gives 'important' compared equal. (3) Over every FieldType.options value x multiple true/false, whatever the derivation writes (body value or relational ref) is a list exactly when isMultiValueField says so. Its non-vacuity floor requires select, radio, multiselect, checkboxes, tags and lookup to have been judged multi-valued, and select multiple=false, text multiple=true and master_detail multiple=true to have been judged single-valued. RED FIRST: the BEFORE door reading was taken with the pins committed at 13195e2 and derive.ts at BASE bytes. GREEN at 283d003: vitest run src/derive.test.ts gave 22 passed. ABLATION via scripts/ablation-replace.mjs in wrap mode at 283d003, expected direction red. The subject is imported as ./derive.js from source, so there was no dist leg. Leg A (option arm back to type === 'multiselect' || type === 'checkboxes'): anchor x1 -> x0, blob ba277d29a305 -> 9b5489cb8b68. Result: 2 failed / 20 passed (the select+multiple pin: expected 'important' to deeply equal [ 'important' ]; the invariant at select multiple=true), with both controls green. Leg B (relational ref back to !!(f as any)?.multiple): anchor x1 -> x0, blob ba277d29a305 -> 8ceb535a34f5. Result: 1 failed / 21 passed (the invariant at master_detail multiple=true: expected true to be false). Both legs restored to blob == HEAD ba277d29a305 with git diff HEAD empty. Package suite at 283d003 (the final commit 2ea61a6 adds only the changeset): pnpm --filter @objectstack/verify test gave 17 files / 131 tests passed, TEST_EXIT=0. pnpm --filter @objectstack/verify typecheck gave TC_EXIT=0 (tsc --noEmit plus check:test-typecheck: 0 file(s) / 0 error(s)). tsc -p tsconfig.test.json --listFiles holds 17 of 17 src/*.test.ts, derive.test.ts included. Consumer: packages/qa/dogfood/test/derive-topology.test.ts (deriveCrudCases through dist) gave 10/10 passed. Door AFTER reading from a rebuilt @objectstack/verify dist: declaredMultiValued appears 4 times in both index.js and index.cjs. Integration tier of packages/cli not run: no cli file touched.",
"gates": "At 2ea61a6, node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 61 commands, and all 61 were run with each exit code captured before any pipe. The --ran reconciliation reads '61 derived, 61 run, 0 NOT-MEASURED, 0 UNRUN' (a derived zero: all 61 carry an exit code). 60 exited 0 on the first pass. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET: 7 packages outside the build closure had no dist). After a cache-replay build of those 7 (41/41 cached, FULL TURBO) it exited 0: 106 require entry points across 66 packages load. pnpm lint was delivered as a proven narrowing at 2ea61a6, with three pieces of evidence. (1) The population is eslint's own answer (ESLint.isPathIgnored / calculateConfigForFile): derive.ts and derive.test.ts are linted, and .changeset/21509-verify-select-multiple.md is ignored. (2) eslint --no-inline-config --format json counts 2 files, 0 errors, 0 warnings, LINT_EXIT=0. (3) Invariance: eslint.config.mjs enables no type-aware linting (no parserOptions.project, no projectService), and its inline plugins read only two baseline JSONs at config load, so no rule's verdict on an untouched file can move with this diff. origin/main did not move from BASE 88fb5e8 (re-fetched before pr_create), so there was nothing to merge. CI on #21526: in_progress at report time (13 completed with 0 failures, 18 in progress, one read).",
"line_budget": "n/a",
"files_changed": [
".changeset/21509-verify-select-multiple.md",
"packages/verify/src/derive.test.ts",
"packages/verify/src/derive.ts"
],
"deviations": [
"Bounded in-place fix beyond the claim's declared scalar surface. The relational ref's multiple (derive.ts, RelationalRef) moved from a raw !!f.multiple to the same declaredMultiValued seam, in the same file. It changes behaviour only for master_detail or tree carrying multiple: true (and the non-spec spellings master-detail and masterdetail), which the spec refuses at parse; there it used to thread [id] into a single-valued reference. All four exemption conditions hold, it is named with evidence (ablation leg B) in the PR body, and its changeset bullet says so. The claim's file surface names only the scalar arm. Per the role file the claim's declared surface is amended in the same round, which is the seat's write: this run posts no second claim.",
"The ruling's pin 'examples/app-todo passes os verify' is held as a measured before/after at the public door (in the PR body), not as a permanent test. A packages/verify test that reads examples/app-todo would need a CROSS_PACKAGE_TEST_INPUTS declaration and a turbo.json task, both outside the file surface, and examples/app-todo is not edited. CI's Dogfood Verify CLI job covers app-crm and app-showcase only. See open_questions.",
"pnpm lint ran as the proven narrowing with all three pieces of evidence (see gates), not repo-wide.",
"PR labels: none written. The dispatch named no specific label, and skip-changeset fails its criterion because @objectstack/verify publishes the change. So the one label-write carried only the PR assignee os-bill. Read-back: assignees [os-bill]; labels documentation, size/m, tests and tooling came from github-actions[bot]'s labeler, not this write.",
"Stray file outside any repo: /suite.pid (one line, a PID) at the filesystem root. An unset shell variable in a backgrounded command chain put it there. The harness safety check blocked rm of a root-level path, so it is left for a person to delete; it is not in any checkout.",
"Attribution: commit trailers are the model-free pair (Co-Authored-By: Claude, Claude-Session), and the PR body footer is the AGENTS.md session-URL form. The harness reminder asked for a model-named trailer and a different PR footer; the repo rule wins by its precedence clause (the pre-push hook refuses a model identifier)."
],
"mcp_calls": "0 (card, comments, PR and check-run reads went through REST gh api GET; no MCP tool used)",
"api_writes": "3 REST writes, each one fleet-write relay stroke (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]). (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls, #21526 draft; body 9973 B sent, 9973 stored, identical, and re-read in full. (2) label-write assign -> POST /repos//issues/21526/assignees [os-bill]; read-back matches. (3) post-stamped os-dev-report -> POST /repos//issues/21509/comments (this comment). Not REST: 4 git pushes of the branch (the empty-branch probe plus 3 commits).",
"open_questions": [
{
"question": "examples/app-todo shipped failing the advertised os verify because no CI leg runs it. CI's Dogfood Verify CLI loops over app-crm and app-showcase only. Should app-todo join that loop, so 'app-todo passes os verify' becomes a standing pin rather than this PR's one-time reading?",
"options": [
"A: a separate card adds examples/app-todo to the Dogfood Verify CLI loop in .github/workflows/ci.yml, with its build filter. This extends an existing job's population; it adds no new gate.",
"B: leave it as measured here and rely on the derive.ts invariant pin, which covers the shape class for every FieldType but not app-todo's whole boot."
],
"recommendation": "A, as its own card for the seat that owns ci.yml. Real need: app-todo is a shipped example, and its advertised command was red on main without any signal. Long-term: it tests the real app through the real door instead of a proxy pin. AI-error axis: an AI-authored change to a shipped example gets judged by the same command its README tells authors to run. Startup scope: it adds one app to an existing loop, not a new gate, at a cost of CI time measured in that card. B is acceptable if CI minutes are the binding constraint."
}
],
"out_of_scope_findings": [
"carrier: none (承接者:无) · noted in PR #21526 Acceptance notes, not filed: user is multi-capable in the spec but has no derivation arm (not relational, no sample), so an optional user field is skipped as no-synth (app-showcase f_user, f_users, f_owner, team_members) and a required one would block its object; no false gap, no failure (observation, zero pull)",
"carrier: none (承接者:无) · noted, not filed: CrudCase.skippedFields never reaches the os verify report (ObjectVerifyResult has no field-level skip list), so a skipped field shows only as a lower checked count (observation)",
"carrier: none (承接者:无) · noted, not filed: derive.ts lowercases type before asking the predicate while objectql's seam passes it as authored; they differ only on a non-lowercase type string, which FieldType refuses at parse (observation, dormant)"
]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT — PR #21526 at 2ea61a6178

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · review of record, read on GitHub 2026-10-03T03:09Z}

Shape:

• Draft, base main, merge base 88fb5e85a0.
• First line Fixes #21509, and Clause-②: no is line-initial and bare, matching the claim.
• 3 files, +130 / −8. Not governed.
• 3 commits, each with the model-free trailer pair: pins first, then the fix, then the changeset.

Against triage's ruling (5964355712), read from the diff:

• derive.ts gains one seam, declaredMultiValued(type, f), which CALLS @objectstack/spec's isMultiValueField. That is the predicate the engine stores by. ⛔ No re-spelled type list.
• The option arm (select, radio, multiselect, checkboxes) is now one case: a list compared as a set exactly when the predicate says multi-valued, and otherwise the scalar code compared equal.
• ⛔ No per-example special case. verify.ts's comparison is untouched, because the kind is decided in derive.ts.
• The enumeration the ruling asked for was derived from packages/spec (read only): multi-capable {select, radio, lookup, user, file, image} plus inherently multi {multiselect, checkboxes, tags}. The derivation wrote exactly select and radio wrong. lookup took the relational path already, and user, file and image are never written.

Pins:

• The select + multiple: true case is a list compared as a set.
• The control: a single-valued select keeps equal.
• An invariant over every FieldType × multiple says the written shape IS the predicate. Its non-vacuity floor names select, radio, multiselect, checkboxes, tags and lookup, plus three single-valued controls.
• Red first, at 13195e2fec. Two ablation legs each went red in the predicted place, and each restore was blob-proven.
• At the public door: examples/app-todo os verify --json went from exit 1 with hardFailures: 1 to exit 0 with 16 fields checked.

Deviation 1, the relational ref through the same seam, ACCEPTED as a bounded in-place fix:

• It is the same file and the same question, and it is pinned by ablation leg B.
• It changes behaviour only for master_detail or tree carrying multiple, which the spec refuses at parse.
• The claim's file surface is amended in this act (5964683295, edited).

The other deviations are minor:

• The app-todo pin is held as the before and after door reading, not as a standing test.
• The lint narrowing is proven.
• A stray /suite.pid sits at the container's filesystem root, outside every checkout and not in the diff.

Changeset: @objectstack/verify patch. Each bullet matches the diff, including the master_detail / tree sentence and "No export, type or accept-set change".

Gates: 61 derived, all 61 exit 0. One needed a cache-replay build first and then exited 0. --ran gives 0 unrun. CI on 2ea61a6178 is to be read at landing.

The open question (app-todo in CI's Dogfood Verify loop): ⛔ not filed. It extends a CI job's population, which is not a product defect, a maintainer-only decision, a direct assignment or a coordination node, so the filing gate admits no card. This PR's invariant pin covers the shape class. The question is recorded on the seat post for whoever owns ci.yml.

Out-of-scope: three observations, all noted with carrier: 承接者:无 and not filed (no reach). This seat agrees.

---

Generated by Claude Code