fix(platform-objects): decide the action body/ai en-echoes per leaf, and close the one-schema-two-forms blind spot

[huangyiirene]

Part of #19403

Clause-②: no

What this is

Round 5 of this card. One panel family, decided leaf by leaf. The deliverable is a per-leaf judgement with its reason recorded, not twelve translations; every leaf below was decided on its own evidence, and the verdicts with their reasons live in a ledger the suite reads (action-body-panel-echo-decisions.test.ts), not only in this body.

The family: the five children of action.fields.body plus action.fields.ai — the body composite on the action metadata form, and the AI-exposure block one section over. Both string leaves of each key are decided.

Not Fixes — this is one family of the card's population, and the card outlives this round. Four families remain (23 label keys / 39 decidable sibling leaves), tabled at the foot of this body.

The tie at the top of round 5's table, and how it was broken

Round 4 fixed the sizing rule as largest by LEAVES. Re-derived on this branch's base 4045781fa, two rows tie at 12:

family	keys	leaves
action.fields.body.* + action.fields.ai — what this round took	6	12
six bare type-display pairs (seed·mapping·api·doc·book·capability)	6	12
object.fields.enable.* (+validations)	9	11
hook.fields.retryPolicy.* + body.memoryMb + timeoutMs	5	10
report.fields.drilldown + runtimeFilter + sections.dataset_binding	3	6

The tie-break is written into the ledger's header, four reasons, none of them preference:

1. The instrument survives only one of them. The card's second property is a population DERIVED from en with a dark control. action is one panel: one derivation over one metadata type, and the dark control has something to exclude (it asserts retryPolicy, valueDomain, drilldown, enable and the hook section headings are not action leaves). The six type-display pairs are six unrelated types with no panel around them — the derivation degenerates into six one-entry lookups and the control has nothing to be dark about.
2. Evidence density forces per-leaf work. Four of the six keys have an authored twin at a byte-identical en one metadata type over; one has a twin that is ITSELF an echo; one has no twin at all.
3. The A metadata-form tooltip spells a strict enum's legal values in translated locales, so the value an author is shown is one the schema refuses #19430 trap is live here, on three of the twelve leaves, and is discharged at the schema below rather than deferred.
4. Leaving it costs more. A bare type-display pair has no siblings, so deferring it leaves nothing half-done. Deferring this one leaves the action panel's Behavior and Advanced sections reading half Chinese and half English around a single composite.

The census — this branch's own reading, base 4045781fa

reading	base	this branch
en string leaves / .label leaves	893 / 538	893 / 538 — same population
label keys echoing in ALL THREE locales	29	23
⇒ as .label leaves	87	69
⇒ as decidable sibling leaves (label + its helpText/description)	51	39
POSITIVE CONTROL — labels genuinely translated (zh-CN)	509	515
POSITIVE CONTROL (ja-JP · es-ES)	493 · 493	499 · 499

Echoes fall 6 while the control rises 6 in each locale, same population, same run. A parser matching too broadly cannot produce that agreement. 87 and 69 count .label leaves; 51 and 39 count decidable sibling leaves — two questions, two right answers, and this body states which it means at every number.

The evidence, per key — and the one key that had none

actionForm and hookForm declare the same composite over the same schema: HookBodySchema (packages/spec/src/data/hook-body.zod.ts), five children, identical field names, byte-identical helpText sources. So the precedent is not a same-string match found elsewhere in the catalog — it is the other rendering of this very schema key.

key	evidence	verdict
body.language	authored twin, byte-identical en, and it names both tokens	translate ×3
body.source	authored twin; the bare word Source has three authored senses in this catalog and the twin picks the code one	translate ×3
body.capabilities	authored twin, byte-identical en, keeps all four enum members	translate ×3
body.timeoutMs	authored twin; the en is the extractor's humanize of timeoutMs, and the twin renders the concept	translate ×3
body.memoryMb	⛔ NO TWIN — the hook twin is itself an echo in all three locales. Composed from the sibling key's authored twin instead, and the row says so	translate ×3
ai	no twin of any kind (hookForm declares no ai); the authored section description one entry up the same panel names the concept, the schema settles the tokens	translate ×3

⭐ Round 4's lesson, read the other way round. Round 4 recorded that a precedent answers only the question it actually contains: its twin settled the prose and named no token, so the schema had to settle the tokens. Here the twin settles both halves for language and capabilities — hook.fields.body.language.helpText is authored AND names expression and js AND keeps both English. Same rule, opposite reading: the twin is sufficient precisely because the question is inside it. For ai.helpText there is no twin at all and only the schema answers. Each row says which half its evidence covers.

⭐ And one leaf shows why a wholesale answer is refused. action.fields.ai.label reads Ai — the extractor's humanize of the two-letter key. The obvious repair is the case fix Ai to AI, which differs from the source in bytes, passes the echo predicate in every locale, and tells a zh-CN author exactly as much as the echo did. Rejected as a phantom translation; the label takes the concept the panel's own authored section description already names, with es-ES rendering the acronym IA and the other two keeping AI, exactly as that description does.

The #19430 trap was live on three leaves, and every one was read at the schema first

#19430 is not addressed here and remains open — this is the discipline it asked for, applied before a word was rendered.

leaf	tokens named in prose	what the schema says	done
body.language.helpText	expression, js	the two z.literal discriminators of HookBodySchema	kept English
body.capabilities.helpText	api.read, api.write, crypto.uuid, log	four of the five HookBodyCapability z.enum members (api.transaction is the fifth and the prose names it not at all)	kept English
ai.helpText	ai.exposed=true, ai.description	ActionAiSchema's two canonical keys — a strictObject that declares enabled/enable/aiEnabled/expose/visible as aliases of exposed, so a rendered spelling is a spelling the schema refuses	kept English

Also kept: ctx and import (the sandbox binding and the reserved word ScriptBodySchema forbids), and the schema bounds 256 (.max(256)) and 40 (.min(40)). All of it is asserted, not described — a machine-token guard reds when any of them stops being carried verbatim, and ablation C reds it specifically.

⭐ The blind spot's FIFTH shape: one schema, two forms, invisible in OPPOSITE ways

Rounds 1–4 measured record, composite, a pin green one level up from what it walks, and a pin's own vacuity control passing to the side. This round measured it across two forms.

repeater-row-properties.test.ts derives a row property for every child of a type: 'repeater' field. Measured on this base:

form	covered by that pin	invisible to it	state before this round
actionForm	18 (params.*)	5 (body.*, a composite)	all 18 authored · all 5 echoing
hookForm	0	7 (body.* + retryPolicy.*)	4 of 5 body children authored · memoryMb and both retryPolicy children echoing

⇒ the same composite is invisible to the same pin in two opposite ways. On action it is the lit vacuity control carrying.has('action') === true that passes — supplied by params, the repeater that was never broken (round 4's shape, reproduced). On hook it is the dark control carrying.has('hook') === false, which is true and correct — hookForm enumerates no repeater at all — while seven children sit enumerated and outside it. A correct control and a passing control produce the same green, and neither can be repaired by deriving harder on one panel.

⭐ Because the half that matters lives BETWEEN the two derivations. Before this round action.fields.body.* echoed on 5 of 5 children and hook.fields.body.* on 1 of 5: the same five schema keys, the same five en sources, two different states, and no assertion anywhere that they should agree. This PR adds one — wherever the hook twin is authored, action renders it identically in every locale — with its own lit control proving it compared real leaves (30 pairs, 6 excluded because memoryMb carries no authored twin in any locale), and the exclusion set asserted to be exactly ['memoryMb']. When the hook family lands in a later round, this assertion starts covering memoryMb too and reds if that round renders it differently from this one.

ablation D is the one worth reading: it makes action disagree with its authored twin and only that assertion reds. Every echo rule stays green, because the mutated string is not the en source.

The instrument — five independent assertions, proven by four ablations

Mutation, run and restore inside one ablation-replace.mjs process per ablation. Every restore verified: git diff HEAD empty and the blob back to HEAD's, checked independently afterwards as well.

ablation	what it mutates	reds
A	a decided leaf reverted to its en source in one locale	the enumerated verdict and the derived panel pin — 2, independently
B	a provenance row re-pointed at a decided leaf	a third — the second witness
C	a kept spec key rendered as words	a fourth — the machine-token guard
D	the action rendering made to disagree with its authored hook twin	a fifth — the new cross-panel invariant, and nothing else

⇒ 2 + 1 + 1 + 1 = five assertions that fail on five different triggers, not five spellings of one. All four dark controls carried from the earlier rounds are present and fire: the echo predicate flags all 12 rows when fed en; the derived predicate flags all 79 panel leaves when fed en; the provenance lookup is proved to be able to say "still a fill", matched by pattern so a later round cannot red it by fixing a family; and the machine-token guard's negative uses api.transaction — a real HookBodyCapability member this prose deliberately does not name — so a green cannot come from an includes that matches anything.

⛔ The silent-loss hazard: values only, measured with a discriminating control

*.metadata-forms.generated.ts is generator-owned but git check-attr merge reads unspecified, so it is NOT routed to merge=os-regen. Regenerated with pnpm i18n:extract, never by hand, and no key was added or removed:

en / zh-CN / ja-JP / es-ES:  base 893 keys | head 893 | added 0 | removed 0
values changed per bundle:   en 0 | zh-CN 12 | ja-JP 12 | es-ES 12   (exactly the decided leaves)
provenance rows:             12 removed per locale, 0 added   (exactly the decided leaves)
NEGATIVE CONTROL (drop one key by hand): removed 1 => the comparator CAN see a 1-key delta

⚠️ One measurement worth recording: the anchor for body.memoryMb occurs twice in each translated bundle — once under action, once under hook, byte-identical — so the edit was scoped to the top-level action block and refused on any count other than one. An unscoped replacement would have exited 0 having silently translated a leaf belonging to a family this round does not own.

The changeset, measured

@objectstack/platform-objects has no private key and ships files: ["dist", …], and the decided leaves reach dist — so skip-changeset would be measurably wrong and a patch changeset is included. Dist probe over all three entry points that carry the catalogs (index.mjs, plugin.mjs, metadata-translations/index.mjs), with controls:

zh  内存（MB）  as 内存（MB）   1 1 1      lower-case hex spelling   0 0 0
ja  メモリ（MB） as メモリ（MB）  1 1 1
es  Exposici\xF3n a IA                          3 3 3      lower-case hex spelling   0 0 0
ai.exposed=true kept verbatim                   4 4 4
NEGATIVE CONTROL  raw un-escaped 内存（MB）      0 0 0      raw un-escaped メモリ     0 0 0
NEGATIVE CONTROL  an invented string            0 0 0

⇒ the raw un-escaped control reads 0 including for the positive controls, so a zero here means "escaped", not "absent", and esbuild's UPPER-CASE hex is confirmed by its lower-case spelling reading 0.

Gates

• pnpm --filter @objectstack/platform-objects test — 48 files / 690 passed (47/668 on the base: +1 file, +22 tests); typecheck exit 0; pnpm check:i18n exit 0; repo-wide pnpm lint exit 0 at 6f249d952.
• Gate reconciliation: 60 derived / 60 run green / 0 NOT-MEASURED / 0 UNRUN, derived with scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack and reconciled with --ran carrying every exit code captured before any pipe, so the zero is DERIVED rather than claimed.
• check:dual-build-cjs-loads first exited 3 — PREREQUISITE NOT MET, 14 packages with no dist/. Discharged, not reported as a 3: the closure the gate names was built and the gate re-run clean (104 published require entry points across 67 packages, 620 CJS files parsed).
• origin/main moved three commits (one of them a packages/spec change) while this ran; merged, build state refreshed per AGENTS.md §9, check:generated for spec exit 0, the package suite re-run green, and the gate derivation re-taken on the merged tree — byte-identical.

Acceptance notes

Everything below is noted, not filed. This round files zero cards, and that is a reading rather than an absence:

• The known trap was checked, not assumed. action.fields.ai.helpText is the leaf on this panel that could have carried A metadata-form tooltip spells a strict enum's legal values in translated locales, so the value an author is shown is one the schema refuses #19430 without a precedent to catch it — no twin exists anywhere in either catalog. It was taken to ActionAiSchema in packages/spec/src/ui/action.zod.ts and read there: two canonical keys, five declared aliases of exposed, a .min(40) bound. Nothing about it is a defect in this repo's code; it is a leaf that needed a schema read, and got one. ⇒ no card.
• hook.fields.body.capabilities.label reads 功能 / 機能 ("feature") for a value that is a capability TOKEN, and this round copied that word rather than improving it, because one schema key must have one rendering across the two panels that declare it and rewording it is an edit to the hook family. It is a wording preference on a landed authored string, not a reproducible defect, not a contract violation and not a metadata-authoring trap — none of the three classes. 承接者: the round of this card that takes the hook family, which will hold both panels to whichever word it picks, because the assertion this PR adds makes divergence red.
• Keys echoing in only one or two locales are outside this card's population by definition (the card counts the all-three intersection; its own filing note records 83 · 99 · 99 per locale at filing). object.fields.lifecycle.retention.maxAge.label is one such: 最长保留 in zh-CN, still Max Age in ja-JP and es-ES. Recorded so the next reader does not mistake the intersection for the whole. 承接者: 无 — no queued issue covers it and this round does not widen the card to reach it.
• A toolchain reading, for whoever runs a closure build next. pnpm --filter PKG build --concurrency=2 forwards --concurrency=2 into each package's build script; tsup ignores it, but @objectstack/cli's shell-script build dies on sh: 1: Syntax error: word unexpected. The working spelling is pnpm exec turbo run build --concurrency=2 --filter=PKG. Pre-existing tooling behaviour, already documented in the agent rules' toolchain traps, reproduced here as a fact rather than filed. 承接者: 无.

What is left — in keys AND leaves, re-measured on this branch

family	keys	leaves
six bare type-display pairs (seed·mapping·api·doc·book·capability)	6	12
object.fields.enable.* (+validations)	9	11
hook.fields.retryPolicy.* + body.memoryMb + timeoutMs	5	10
report.fields.drilldown + runtimeFilter + sections.dataset_binding	3	6
total	23	39

⇒ as .label leaves that same remainder is 69. The tie at the top is gone: the six type-display pairs are now uniquely largest by leaves. ⚠️ Whoever takes them inherits the warning round 5's order carried — they are a different shape from every family so far, bare TYPE.label + TYPE.description with no panel around them, so the "authored twin one entry down the same panel" evidence has no analogue there and something must stand in for it. ⚠️ And the hook family now carries a second obligation: the cross-panel assertion this PR adds means its body.memoryMb rendering must match the one landed here.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a227afa415f596269ed36aae0a0631c84270ccc9 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 04454f54fea8c6d657bfce7790d4f6a5c7709deb — the merge of head 6f249d9521f8074345cbf7e5373137d3505c0f94 into base a227afa415f596269ed36aae0a0631c84270ccc9, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 04454f54fea8c6d657bfce7790d4f6a5c7709deb && git checkout 04454f54fea8c6d657bfce7790d4f6a5c7709deb
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a227afa415f596269ed36aae0a0631c84270ccc9 6f249d9521f8074345cbf7e5373137d3505c0f94 && git checkout -B drift-repro a227afa415f596269ed36aae0a0631c84270ccc9 && git merge --no-ff 6f249d9521f8074345cbf7e5373137d3505c0f94

node scripts/docs-audit/affected-docs.mjs --json a227afa415f596269ed36aae0a0631c84270ccc9

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.