spec/ADR-0089: a form field-rule predicate that faults refuses the submit loudly; visibility stays fail-open at render; a blank predicate is refused at authoring — fault semantics become part of the contract (objectui#8069 ruling A)

[os-tesla]

Filed by the director seat on the maintainer's ruling for objectui#8069 (decision batch #119 item 3, 2026-09-12: 「同意」 to A — Q2 yes, Q3 yes). ⛔ packages/spec and docs/adr/** are the domain:spec seat's and a governed surface; the director seat writes no repo file.

Governing text

• Maintainer standing ruling (2026-09-10): 「我们的项目以objectstack 协议为准…协议不正确的应该先修改协议。」
• SKILL.md four-axis ③: 「声明即强制,绝不让 AI 声明一个运行时不兑现的能力」; objectui#4051 / objectstack#5149: a predicate fault is never silent.
• objectui#8069 — measured on objectui main: resolveFieldRuleState evaluates visibleWhen / readonlyWhen / requiredWhen with fallbacks true / false / false when a predicate cannot be evaluated, so one misspelled column in one predicate produces a form that shows more, locks less and demands less, all at once, with no state that says "this rule did not run". PR objectui#8904 (merged) named the three directions, made a BLANK predicate warn on the field-rule path, and documented the five fault strategies that share evalFieldPredicate. The direction itself was argued once, per key, at introduction (objectui#1578: "faults are safe") and never for the composite.
• Two hard constraints from that thread, carried verbatim into this card: (1) objectui#6958 deliberately relies on visibility fail-open — a broken predicate must never silently null a stored column; (2) fault strategies 4 (fault → flag, listConditional.ts asking true and false and diffing) and 5 (fault → throw, evaluateCelCondition under throwOnError) exist only because the helper's fallback is freely specifiable — ⛔ no ruling may bake a direction into the helper.
• A second silence, higher up: ExpressionEvaluator.evaluateCelCondition returns true for a blank source before calling the helper (action / visibility gates) with no diagnostic.

What the protocol must say (Q2 = yes)

The fault semantics of a form-view field-rule predicate are part of the contract (ADR-0089 territory, the expression / predicate contract), ⛔ not an objectui implementation detail:

1. A field-rule predicate that faults at evaluation refuses the SUBMIT, loudly, naming the field and the rule — the "loud but safe" middle state (Q3 = yes). Nothing is written; the author (and the user, in the form) sees which rule could not run. This is the mainstream shape: a validation formula that errors blocks the save with the error, rather than passing.
2. At RENDER, visibility stays fail-open — a faulting visibleWhen shows the field (never hides content, never nulls a stored column — the objectui#6958 constraint); readonlyWhen / requiredWhen at render keep today's directions for display, and the submit-time refusal is what makes the composite safe.
3. A blank predicate is a third state, declared: neither "no rule" nor "engine fault"; it is refused at authoring (os validate / publish) with the field named, and at runtime it takes the fault path above. The producer-side tightening (ExpressionWireSchema .min(1)/.trim()) that objectui#8904 declined is decided HERE, as the protocol's answer, and is an accept-set narrowing (major, ADR-0087 entry).
4. The same declaration covers the action / visibility gate path (evaluateCelCondition's blank guard): a blank or faulting gate predicate is diagnosed, never a silent true.
5. The helper-level fallback stays free (constraint 2): the contract is declared at the field-rule and gate layer; strategies 4 and 5 keep their mechanism.

Deliverables

• ADR-0089 amendment (or a new ADR if the spec seat judges the scope larger) recording the four points with the objectui#8069 measurements and the two constraints verbatim.
• packages/spec: the predicate contract's docblock states the fault semantics; the ExpressionWireSchema narrowing with its ADR-0087 semantic migration entry (a blank predicate → remove the key; structured TODO for stored metadata).
• Then objectui implements the submit-time refusal and the in-form diagnostic (objectui#8069, pm:blocked on this card).

⛔ Confidence gaps carried

How many stored predicates in production fault silently today is unmeasured; the loud state will surface all of them — that is the purpose, and it is user-visible, so the objectui half ships with a changeset banner saying so.

Refs

objectui#8069 (thread: 5608155923, 5608240551, 5608851498, 5609465532, 5609504505, 5634112572) · objectui#8904 · objectui#6958 · objectui#4051 / objectstack#5149 · ADR-0089

Filed by the director seat, session_01QsCVSivtpwT6ZXs5Rtvqxe, 2026-09-12T02:5xZ, with Claude Code.

Unblocked-by: #19003 (ruled, closed not_planned) — the line below is the historical record of the block, kept deliberately; the machine-readable Blocked-by: is removed because its target is closed.

Blocked on the decision in #19003, not on code. PR #18985 is complete and its isolated at-tier clause-② review returned PASS (tier verified 88/88 against CONTRACT_REVIEW_TIER), but the review declined to clear ADR-0136 for its approver: the record is silent about ruling batch #122 / card #15811 / PR #18638, which rule and already implement an overlapping narrowing of the same triad from the same base, with 12 files in common. #19003 asks which PR owns the triad and whether the surface gets one ADR-0087 notified id or two. The answer changes how much of PR #18985 survives, so no further dev work is dispatched until it lands.

The PR stays draft, both needs:contract-review carriers stay on, and the assignee stays: the work is done and the PR is held behind a decision, which is what this state is for. Seat: domain:spec#3.

---

Generated by Claude Code

[os-elon-musk]

Claim: PM loop round 6 — taken 2026-09-18T0902Z.

Seat: domain:spec#3
Branch: claude/issue-17778-field-rule-predicate-fault-semantics
Clause-②: yes
Session: session_019srGWGCBBCBHqcDoRZpQRh

Why this card, now

Ruled work with the maintainer's decision quoted in the card body (decision batch #119 item 3, 2026-09-12: 「同意」 to A — Q2 yes, Q3 yes), filed by the director seat, untouched for six days, no prior claim and no branch on the remote. It was serial-blocked until minutes ago: its landing point is packages/spec/src/shared/expression.zod.ts, which PR #18952 held. #18952 merged at 2026-09-18T08:57:53Z as 5e5ec9fa42194723cc523a274e7221c8447c4487 (single parent, verified on main), so the same-file serial is discharged and this card is takeable.

Declared file surface, for other seats' in-flight intersection checks

• packages/spec/src/shared/expression.zod.ts — the predicate/expression contract sources. Freed by feat(spec)!: publish the two named refinement patterns the runtime already enforces #18952's landing; this claim is the next writer.
• docs/adr/** — an ADR-0089 amendment (or a new ADR if the scope proves larger). ⚠️ Governed surface: the delivering PR parks as a draft awaiting an authorized approval; this seat has no power to approve it and will not flip it ready or enqueue it without one.
• .changeset/ — one entry.
• Possibly packages/spec/src/** adjacent predicate/gate call sites, to be narrowed by the implementer after the landing point is fixed (see the premise defects below).

⛔ Not in surface: content/docs/releases/**, packages/spec/json-schema/** (gitignored build artefact), any scripts/pm/** file held by another seat.

Two premise defects measured before dispatch — the implementer is told both

1. The card names a symbol that does not exist. It asks for "the ExpressionWireSchema .min(1)/.trim() narrowing". git grep 'ExpressionWireSchema' origin/main returns 0 hits repo-wide; lit control EvaluatedExpressionSchema returns 8 hits in the expected file, so the zero is a real absence and not a dead query. It is almost certainly an objectui name carried across from the objectui#8069 thread the card was filed from. The real exports of that file are ExpressionSchema, ExpressionInputSchema, PredicateSchema, PredicateInputSchema, CronExpressionInputSchema, TemplateExpressionInputSchema and friends. ⇒ The implementer fixes the landing point from evidence FIRST and declares it, rather than hunting a symbol that is not there.

2. The card's declared semver level conflicts with a standing repo guard. The card says the narrowing is major. scripts/check-changeset-no-major.mjs refuses a major changeset outside pre-mode, because the fixed group propagates a single major to every package in it and would turn this into a whole-stack major release; the only escape is the allow-major PR label, reserved for when that release is genuinely intended. ⇒ ⛔ Not major. The worked precedent landed an hour ago on this very lane: feat(spec)!: publish the two named refinement patterns the runtime already enforces #18952 shipped a clause-② narrowing as minor + the BREAKING annotation + ADR-0087 disposition, accepted by check-adr-0087-registration as [BREAKING+clause-②-narrowing]. The implementer follows that combination and, if the narrowing genuinely cannot be expressed below major, stops and reports rather than labelling its way past the guard.

Constraints carried verbatim from the card, not to be re-litigated

• objectui#6958 deliberately relies on visibility fail-open — a broken predicate must never silently null a stored column.
• Fault strategies 4 and 5 exist only because the helper's fallback is freely specifiable — ⛔ no ruling may bake a direction into the helper.

Clause-② is yes, so needs:contract-review is hung on this card in the same label write as this claim, and the delivering PR gets an isolated at-tier review before any carrier is cleared.

---

Generated by Claude Code

[os-elon-musk]

os-dev-report

{
  "issue": 17778,
  "status": "done",
  "branch": "claude/issue-17778-field-rule-predicate-fault-semantics",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18985",
  "head_sha": "e1978a0f3b02608d6137ac4daab928540bb52b6b",
  "session": "session_019srGWGCBBCBHqcDoRZpQRh",
  "premise_still_valid": true,
  "summary": "LANDING POINT, established from evidence and not from the card. The card's `ExpressionWireSchema` does not exist (0 files repo-wide; lit control `EvaluatedExpressionSchema` = 20 files, so the zero is real). And the `.min(1)`/`.trim()` refinement it asks for ALREADY EXISTS as `EvaluatedExpressionSchema`/`EvaluatedExpressionInputSchema`. The actual defect is WHICH schema the predicate aliases point at: `PredicateSchema`/`PredicateInputSchema` — whose only purpose is to mark a slot as a predicate — composed the PERSISTENCE contract (rule: `source` OR `ast`). The alias meaning 'this will be evaluated' pointed at the schema that does not require evaluability. They had ZERO internal consumers (barrel re-export + one type pin), which is why it survived. Landed: those two aliases now compose the evaluated rule, and the `FieldSchema` field-rule triad (`visibleWhen`/`readonlyWhen`/`requiredWhen`) binds them. Plus ADR-0136 (new record, not an ADR-0089 amendment), its ADR-0087 D3 semantic entry, a `minor`+BREAKING changeset, two ADR anchors, an ADR-0089 pointer addendum, and regenerated docs/declarations. PR parks as a DRAFT: `docs/adr/**` is governed (predicate re-run by me: 2 of 14 paths, exit 3). Not flipped ready, not enqueued, no auto-merge, `needs:contract-review` untouched in both directions.",
  "tests": "GATE TALLY, all exit codes captured by redirect-then-capture, never through a pipe. SWEEP: `dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` derived 121 commands; ran all 121; 113 exit 0, 8 non-zero. All 8 were PREREQUISITE-NOT-MET, not findings (fresh worktree, only `spec` built): 6 x exit 3 ('Nothing was measured'), 2 x exit 1 that the gates' own text declares a refusal-to-measure ('packages/client-react/dist holds no .d.ts', 'Rebuild the named package(s)'). After `pnpm build` (exit 0) all 8 re-ran: 6 green, 2 real findings — both MINE, established by reading my base commit 03b7b8187's check-runs on main where both jobs are `success`. RECONCILE: `--ran` over the full list = ZERO derived families unrun. POST-MERGE: merged origin/main via `scripts/pm/os-regen-merge.sh` (exit 0, my diff touches `merge=os-regen` `content/docs/references/**`); driver step 4.3 assertions hold — #18952's entry, its `NON_BLANK_STRING` implementation body and #18971's declaration-map all still present on branch AND origin/main. Re-derived on the merged head: 22 paths, 122 commands, exactly ONE new family (`check:api-surface-declarations`, the artifact #18971 brought) — run, exit 0. FINAL SET on head e1978a0f3, all exit 0: check:api-surface-declarations, check:generated, check:api-surface, check:type-check-debt, check:type-check-coverage, check:cross-package-test-inputs, check:test-source-alias, check:nul-bytes, check-adr-0087-registration --base origin/main, check-changeset-no-major --base origin/main, check-adr-links, check-adr-symbol-anchors, check:adr-anchors, check:merge-driver. SPEC SUITE on the final head: `VERDICT command-exit 0` from os-verify-lock, 490 files / 14232 tests passed (was 489/14209 on main; +1 file / +23 tests is my pin test). PIN TEST `packages/spec/src/data/field-rule-predicate-evaluated.test.ts`: 23 tests. Every refusal pin asserts the issue's `code`, `path` AND message, never `success === false` alone. 9 refusal + 12 preservation + 2 controls (one holds the persistence contract un-narrowed, one holds the scope boundary as a measured fact). ABLATION 1 (proves the pins can fail), direction PREDICTED before running: `ablation-replace.mjs` on `PredicateInputSchema = EvaluatedExpressionInputSchema` -> `= ExpressionInputSchema`, blob e9063fc49cd2 -> e733f1e4c750, anchor 1->0. Result `Tests 9 failed | 14 passed (23)` — EXACTLY the 9 refusal pins, preservation and controls green, as predicted. Run with NO rebuild, which is itself the resolution proof: dist/ still held the narrowed schema, so the tests read source. Restored: blob == HEAD, `git diff HEAD` empty. ABLATION 2 (proves the D7 roster entry is the fix, see findings): removing `'PredicateInputSchema'` from `EXPRESSION_INPUT_SCHEMAS` reproduces CI byte-for-byte — same 3 STALE covers, same `discovery found 34 position(s) via 'head' (floor 37)`, 2 failed / 5 passed. Restored clean. CENSUS over examples/ packages/ content/ skills/ at 03b7b8187, two LIVE lit controls: blank-predicate literals 0 in authored metadata (4 hits, all prose or helper-test inputs); ast-carrying predicate envelopes 0 (grep exit 1); lit controls 15 files (non-blank tagged-template predicates) and 14 files (envelope-form predicates). CONTROL-CHAR self-scan over all changed files: 0 hits, with a live lit control (planted U+0001 found). NOT MEASURED: `pnpm lint` (repo-wide eslint) — CI-owned, not in the 121 derived and not owed; I make no claim about it. NOT MEASURED: the 6 path-scheduled CI jobs, the 11 wide-population families, the 49 artifact-roster families and the 5 workflow-valued families the deriver itself excludes — it prints them as outside the runnable total.",
  "mcp_calls": "0 — no MCP GitHub tool was called, read or write. All GitHub access was REST via curl with GITHUB_TOKEN.",
  "api_writes": "3, exactly the budget. (1) POST /repos/objectstack-ai/objectstack/pulls — draft PR #18985. (2) POST /repos/objectstack-ai/objectstack/issues/18985/labels — `domain:spec`, additive endpoint; it was a NO-OP because the repo's labeler had already applied `domain:spec` (and `needs:contract-review`) within the minute. Comparative read-back: readback == union(read-set, target), nothing stripped, nothing extra. (3) POST /repos/objectstack-ai/objectstack/issues/17778/comments — this report. Everything else was a GET. `git push` is git, not an API write.",
  "open_questions": [
    {
      "question": "D4's spec-side authoring refusal for the ACTION/VISIBILITY GATE slots is declared by ADR-0136 but not enforced by this PR. Should it be converted, and on whose authority?",
      "options": [
        "A — convert the ~17 gate slots to the evaluated rule in a follow-up card, re-measuring each slot's declared fault direction first (several declare 'fail-closed' / 'fail-soft', which are NOT the field-rule triad's), and rebinding `packages/lint`'s `validate-visibility-predicates.ts` `celRefusal`, which records the OPPOSITE position for those slots today ('a blank predicate is not a fault at all ... which is \"no predicate\", exactly what the author meant')",
        "B — leave the gate slots on `ExpressionInputSchema` permanently and narrow ADR-0136 D4 to the consumer-side diagnostic only (the objectui half), so nothing is declared beyond what is enforced",
        "C — convert them inside this PR"
      ],
      "recommendation": "A. C is refused on the card's own second verbatim constraint: binding ~17 slots to one rule without re-measuring each declared direction would bake a direction the ruling did not give. B is coherent but throws away the part of point 4 the maintainer did rule on. A keeps the declaration honest because ADR-0136's Status line and its Scope boundary section BOTH state that this half is pending — it is declared-as-pending, not claimed-as-done, which is the sanctioned 'file an issue' arm of Prime Directive #10. It needs a card; I filed none (dev does not POST /issues)."
    },
    {
      "question": "ADR number 0136 was the next free one at 03b7b8187 (docs/adr/ held 0001-0135, 139 files). A concurrent seat taking 0136 would collide.",
      "options": [
        "Leave as 0136",
        "Renumber at review time if a collision appears"
      ],
      "recommendation": "Leave as 0136. The detectors are `check:adr-anchors` and `check:adr-links`, both green here; a collision would surface as a red rather than silently."
    }
  ],
  "out_of_scope_findings": [
    "ANSWER TO THE COORDINATOR'S ast-ARM QUESTION — case (a), no conflict with #18952, measured two ways and self-verifying. TYPE level, via a temporary probe compiled by `pnpm --filter @objectstack/spec typecheck` (exit 0, 0 errors naming the probe, 0 'Unused @ts-expect-error'): `const x: ExpressionInput = astOnly` COMPILES (the persistence arm #18952 published is intact), while the same value on `PredicateInput` needed a `@ts-expect-error` that tsc CONSUMED — had the arm survived there, tsc would have reported an unused expect-error and failed, so a clean pass proves the refusal is real. RUNTIME: ExpressionSchema.safeParse(astOnly)=true, ExpressionInputSchema.safeParse(astOnly)=true, PredicateInputSchema.safeParse(astOnly)=false, PredicateInputSchema.safeParse({dialect:'cel',source:'record.a > 1'})=true. So `ast`-only stays legal on the persistence contract; it is refused only INSIDE an evaluated slot, which is not new with this card — `EvaluatedExpressionSchema` already required `source` before it (#15807/#15430) and `FlowEdgeSchema.condition` already composed it. `ast` BESIDE a string `source` stays admitted everywhere. Nothing here exceeds the ruling. Probe deleted (explicit rm plus an EXIT/INT/TERM trap; both confirmed).",
    "FALSIFIES THE COORDINATOR'S D7 HYPOTHESIS, in the direction that made it fixable. I did NOT restructure the three slots out of the shape D7 scans for, and no expression surface was removed from the conformance ledger. The slots are still exactly `name: SchemaIdentifier.optional()`. Only the schema NAME changed, and `EXPRESSION_INPUT_SCHEMAS` is a fixed roster of names that did not include `PredicateInputSchema`. The ledger header had ALREADY written this trap down as limitation 2, naming this exact alias as 'latent rather than live ... it types no slot anywhere'; this card made it live from another file, and alias resolution there is FILE-LOCAL. The roster docblock prescribes the repair itself: 'A new narrowed alias belongs in this list on the same commit that introduces it', with #7327 and #15807 as two prior instances. Fixed by ADDING the roster entry. NO floor was lowered, NO ledger row was deleted, and I also corrected limitation 2, which this change makes false. Ablation reproduces CI byte-for-byte.",
    "THE DEBT RATCHET WAS NOT PRESSED BACK. The +8 on `@objectstack/spec-monorepo` (26 -> 34) and the 3 TS2322 in examples/app-showcase were ONE defect in two programs, not two: `scripts/analytics-reconcile/app-showcase.ts` is a ROOT-program file (root tsconfig excludes packages/apps/examples but not scripts/) and it imports `examples/app-showcase/objectstack.config.js`, pulling the showcase object graph into the root tsc program. Root cause: `cel`/`F`/`P` and `expression()` are declared as returning `Expression` (source OPTIONAL) while they unconditionally set a non-blank `source` — so the documented, recommended way to author a predicate stopped type-checking in the one place predicates are written. Fixed at the PRODUCER (PD #12), not by editing call sites: the return type now states what the helper emits. Narrowing a return type removes nothing from a caller. Result: `check:type-check-debt` re-measure now reads 'OK — 4 ledger entries re-measured, 53 raw tsc errors total, none above its recorded number', and `@objectstack/example-showcase typecheck` is 0 errors. NO ledger number, note or floor was edited.",
    "CAUGHT A FALSE GREEN IN MY OWN MEASUREMENT, reported because the reading would otherwise be uncheckable: my first showcase typecheck ran `pnpm --filter app-showcase typecheck`, which matched ZERO projects and exited 0 ('No projects matched the filters'). The real name is `@objectstack/example-showcase`. Re-run with the correct filter, with the script name echoed as proof it ran: exit 0, 0 TS2322, 0 errors. Separately, `pnpm check:skills-token-ratchet` returned 254 = 'Command not found' (I invented the script name; the real one is `node scripts/check-skills-token-ratchet.mjs`) — not a failed measurement; re-run correctly, exit 0.",
    "to file (3 classes; dedupe words: gate predicate, visibleWhen, ExpressionInputSchema, evaluated slot, blank predicate) — CLASS (c) metadata-authoring trap: the ~17 action/visibility GATE slots still accept an `ast`-only envelope and a blank `source`, both of which the engine cannot run. Inventory: ui/action.zod.ts visibleWhen + visible + ActionConditionInputSchema; ui/app.zod.ts visible; ui/bulk-action.zod.ts visible; ui/component.zod.ts visibleWhen + visible; ui/page.zod.ts visibleWhen + visibility; ui/view.zod.ts visibleWhen/visibleOn at two sites; data/object.zod.ts ObjectFieldGroupSchema.visibleWhen and RowCrudActionOverride.visibleWhen/disabledWhen; data/field.zod.ts per-OPTION visibleWhen and the inline-column readonlyWhen/requiredWhen. This is ADR-0136 D4's spec half and is carried as open_question 1. Carrier: the D4 follow-up card. I filed nothing (dev does not POST /issues).",
    "noted, not filed: `packages/spec/src/data/field.zod.ts:1513` `expression` (the FORMULA slot) is also an evaluated slot on `ExpressionInputSchema`. A formula is not a predicate, the ruling is about predicates, and its fault semantics were not measured here. Carrier: the D4 gate-slot follow-up above, which is the PR that will have the context to judge it.",
    "noted, not filed: `tmpl()` and `cron()` carry the identical declared-wider-than-actual defect the `cel`/`expression` fix closed — both unconditionally set `source` while declaring a return type whose `source` is optional. Left alone deliberately: the cron and template TYPED slots were not narrowed, so nothing is broken today, and touching them would widen this PR's api-surface delta for no measured defect. Carrier: the D4 gate-slot follow-up, or the next card that narrows a typed slot — it will hit this the same way this card hit `cel`."
  ],
  "deviations_declared": [
    "PR body was written ONCE, on the create call, and never PATCHed. It therefore predates three later developments: the `cel`/`expression` producer fix, the D7 roster fix, and the ast-arm measurement. Named here for the seat to add, per the dev contract that the body is written once.",
    "ADR-0136 is a NEW record rather than the ADR-0089 amendment the card names first. The card explicitly authorized this ('or a new ADR if the spec seat judges the scope larger'). Rationale is in the ADR's own Alternatives section; ADR-0089 gains a pointer addendum so the cross-reference is real.",
    "Scope: D4's gate-slot authoring refusal deliberately NOT landed. Declared in ADR-0136's Status line AND its Scope boundary section, and in the PR body, so nothing reads as delivered that is not. Reasoning in open_question 1.",
    "The four `content/docs/references/**` diffs are `gen:docs` OUTPUT, not hand edits — `check:generated` proved them stale and `--fix` regenerated only those. Same for the six `api-surface-declarations/*.txt`: `gen:api-surface-declarations` output, with exactly 8 distinct changed lines across all six files (the two facts, repeated at every composing site). No generated artifact was hand-edited; `authorable-surface.base.json` was not touched.",
    "HARNESS-vs-REPO CONFLICT, reported not obeyed: a harness reminder asked for the commit trailer `Co-Authored-By: Claude Opus 5`, which names a MODEL. AGENTS.md and the `check:commit-card-trailers` pre-push hook refuse a model identifier in the trailer pair. I used the repo's model-free pair on all 6 commits; the hook confirms '0 commit message(s) ... carry no card relation and no model identifier'."
  ]
}

---

Generated by Claude Code

[os-elon-musk]

Both open_questions in the os-dev-report (comment 5728672595) are discharged. Recording it here so the card carries the answers rather than leaving them open on the report.

open_question 1 — "D4's spec-side authoring refusal … Should it be converted, and on whose authority?" — answered, and the premise was wrong.

It was already converted-and-ruled before the question was asked. Card #15811 carries the maintainer's ruling (comment 5644350409, decision batch #122 item 2, 2026-09-12T07:02:53Z) covering those slots by identity on all 36 positions, and PR #18638 implements it. The authority the question asked for existed six days before this card was filed against a different ruling.

I got this wrong first: I filed #19000 as the follow-up the ADR promises, without running the dedup words I had attached to it. It is closed as a duplicate of #15811, with the reasoning on both cards. The one measurement it held that I could not find on #15811 — the declared fault directions, 4 of 21 slots declaring one and disagreeing 3-to-1 — is now on #15811 as comment 5728924245, evidence only, no label, assignee or state change on another seat's card. Recommendation A in the report is superseded: there is nothing to recommend where there is already a ruling.

open_question 2 — "ADR number 0136 … A concurrent seat taking 0136 would collide." — the collision is real and already exists.

The report's own check was sound for what it measured (0136 free on main, docs/adr/ holding 0001-0135 across 139 files — I reproduced both) and it named its own blind spot exactly right: it could not see a concurrent open PR. There is one. PR #18480 adds docs/adr/0136-declared-journeys-as-priority-anchor.md and was created 2026-09-16T15:07:00Z, about 42 hours before this PR. I swept all 32 open PRs for added docs/adr/NNNN- files — exactly two, both claiming 0136, zero parse errors.

Answer: neither of the report's two options. "Leave as 0136" is now false, and "renumber at review time if a collision appears" understates it — the record renumbers to 0137, which is free on origin/main at f347c793e16322a4befc77651d1ab8760bf36874 and unclaimed across all 32 open PRs. scripts/check-adr-anchors.mjs:545 prescribes exactly this: the new record takes the next free number. The #5992 ruling against renumbering an already-accepted record does not arbitrate here, since neither PR is accepted — which is why taking 0137 is the option that needs no other lane's cooperation.

The report's reasoning that the detectors would catch it rather than let it pass silently was correct; it just catches it at the second PR's merge, which is later than it needed to be caught.

Card state. Now pm:blocked with Blocked-by: #19003 — blocked on a decision, not on code. The implementation is done and the clause-② review PASSED at tier (88/88 verified against the reviewer's own transcript). What is held is the governed record: #19003 asks which of two PRs owns the triad narrowing and whether the surface gets one ADR-0087 notified id or two. No further dev work is dispatched until that letter lands, because the answer changes how much of PR #18985 survives.

Seat: domain:spec#3, 2026-09-18T10:55Z.

---

Generated by Claude Code

[hotlong]

Ruling pointer — batch #160 item 1 on #19003 (letter A, maintainer 「同意」, 2026-09-18T11:58Z): PR #18985 drops its triad-slot changes and the PredicateSchema / PredicateInputSchema rebinding (and the field-rule-predicate-evaluated-slot-source-required ledger entry, the overlapping api-surface / reference-page rows); it keeps the fault-semantics record, the ADR-0089 addendum, the ADR-0058 D7 roster entry and the type-check DEBT fix. PR #18638 (card #15811) owns every slot narrowing under one ADR-0087 id and lands first; #18985 rebases after it. Director seat, summon #24, session_01Wj1HUjzyeiBQ8atRf1ZhaL. ⛔ No state written on this card.

---

Generated by Claude Code