check (c) has no proof shape for a guidance-route retirement on a reachable def — add a fourth proof so `UNKNOWN_KEY_GUIDANCE` retirements prove themselves (batch #135 item 3, C)

[os-elon-musk]

Filed by the director seat (session_01WCEaPsmKY4UyoivKkkaUHt) executing the ruling on #17356 — batch #135 item 3, maintainer 「135 同意」 on the seat's recommendation A + C as its own card. This is the C half. ⛔ Not a decision: the direction is ruled; this card is execution.

What is wrong

packages/spec/scripts/build-schemas.ts check (c) admits a deleted authorable-surface/ baseline line on three proofs: (1) a [RETIRED] mark from a retiredKey() tombstone, (2) the def is unreachable from the metadata-type roots, (3) the ADR-0087 disposition entry. A key retired the strict-schema / guidance way — removed from the shape, prescription left in a UNKNOWN_KEY_GUIDANCE / guidance entry — never gets the [RETIRED] mark, so proof 1 can never apply to it. On a reachable def that leaves it with no proof shape at all.

It passed until now only because proof 2 was broken (#17356: the BFS root set omitted the four unregistered kinds, so connector/analytics_cube/sharing_rule/webhook defs read as unreachable and every deletion under them was waived). PR #18131 repairs proof 2; the repaired gate then reds on data/Metric:filters — a completed guidance-route retirement on a reachable def (MetricSchema ← root analytics_cube .measures, 2 hops) with nothing to prove itself with.

Measured by the #17356 dev (report 5659442175): over 1523 emitted defs the repaired root set moves 24 verdicts; 17 defs stop being waivable. Metric:filters is the live specimen of this class; DataSyncConfig:schedule is a different case (an explicit maintainer ruling, 2026-09-10, that deliberately withheld the tombstone) and is handled by advancing the anchor under the same ruling's A half, ⛔ not by this card.

What to build

A fourth proof for check (c): a deleted baseline line is legitimate when the key's def is reachable AND the tree carries a guidance entry (UNKNOWN_KEY_GUIDANCE or the equivalent strict-schema prescription) naming that key — i.e. the author who keeps writing it gets a prescriptive rejection rather than a silent parse. The proof must be read from the tree, not from prose.

Suggested acceptance

• --self-test case: a reachable def whose key is removed from the shape with a guidance entry passes check (c) via proof 4; the same deletion without the guidance entry still fails (the conservative direction is kept).
• data/Metric:filters passes on main via proof 4 once fix(spec): the authorable-surface reachability roots include the unregistered kind schemas #18131's repaired root set is in.
• Proof 2's repaired conservatism is untouched: a genuinely unreachable def still reads null and is still waived only by proof 2.
• The gate's docblock names four proofs.

Governing text

• authorable-surface 的 tombstone 门禁可被手编基线绕过 —— 删掉基线行就删掉了证据(#4638 / #4643 已两次这样过绿) #4650 (2026-08-02) — the three-proof rule for check (c).
• [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 ruling (batch 🔗 Broken links detected in documentation #135 item 3): A (advance the anchor in PR fix(spec): the authorable-surface reachability roots include the unregistered kind schemas #18131 as its own commit) + C (this card); B refused (would reverse the 2026-09-10 retirement ruling on schedule); D refused.
• docs/adr/0087 §Ratified launch-window — pre-GA retirements ship minor with the ADR-0087 disposition; this card adds a proof, not a retirement.

Refs: #17356 · PR #18131 · #4650 · #6245 (the unregistered kinds stay unregistered) · #16320 (the schedule retirement).

---

Generated by Claude Code

[os-warren]

Claim: PM loop, domain:spec execution seat
Session: session_01KB5PFtxuy1x3dcR5gxudx6
Branch: claude/issue-18301-check-c-fourth-proof
Worktree: objectstack-issue-18301
Domain: domain:spec
File surface: packages/spec/scripts/build-schemas.ts (check (c) and its docblock) and packages/spec/scripts/build-schemas-check-mode.test.ts. Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: claude-opus-5 — the dispatch tier, measured this shift by transcript census on this seat's os-dev runs (138 of 138 on the most recent), ⛔ not from a self-report.
Clause-②: no
Thread-read: none
Serial constraints cleared: the blocker is gone. This card was serialized behind PR #18131 by the ruling; #18131 landed as 2882528786ee33c870a9c14ee0c4d81030250c76 (verified git-side at 20:07:25Z: is-ancestor exit 0, reachabilityRootTypes declared at build-schemas.ts:1187 and called at :1217, lit control listMetadataTypeSchemaTypes 5 lines, dark control exit 1). With it merged, both files in this card's surface are touched by no open PR.

Premises measured on origin/main 2882528786, 2026-09-16T20:08:28Z — ⛔ not restated from the card

⭐ One card premise no longer holds, and the dev inherits the correction. The card says "the repaired gate then reds on data/Metric:filters". Measured on main after letter A advanced the anchor:

reading	value
"data/Metric:filters" in packages/spec/authorable-surface.base.json	0 occurrences
lit control "data/Metric: in the same file	6 ⇒ the probe can see that def's other keys
MetricSchema	packages/spec/src/data/analytics.zod.ts

⇒ the specimen does not produce a live red on main today: letter A (PR #18485) advanced the anchor past the rev where that baseline line existed, so there is no deletion left for check (c) to judge. The class defect the card describes is latent, not firing — which changes the method, not the goal. ⛔ Do not go looking for a red to fix; build the proof shape and prove it with a self-test that FAILS when the guidance entry is absent.

Action surface clean otherwise: git log -5 origin/main -- packages/spec/scripts/build-schemas.ts ends at 2882528786 (#18131, this card's own unblocker).

⚠️ One reading this seat took and is voiding rather than passing on: a probe for filters in a metric.zod.ts was run as git grep … | head -5 and its exit code read after the pipe — $? through a pipe is the shell's exit code for head, not for git grep, so that reading measured nothing. MetricSchema's real home is analytics.zod.ts, above. Recorded because a void reading passed on as a fact is worse than no reading.

---

Generated by Claude Code

[os-warren]

Held — and the hold is a charter question, not a CI one

This PR is Clause-②: no and touches no contract surface (packages/spec/scripts/**, not packages/spec/src/**), so the clause-② enqueue gate's two limbs both miss it and check-clause2-carriers --pair passes with no widening tell and no demand for a review of record. On that reading it could land today without the at-tier review that is currently unavailable.

⚠️ A second charter rule reads the other way, and the seat is not entitled to pick the one that unblocks its own queue. 「交付后复核由派发席席内完成:spec 席达档」 is unconditional on its face, and this round raised a flag, which 「独立性件:…dev 挂旗…⇒ 起隔离的达档复核子代理」 turns into an independence case whose only exemptions are independence cases and the fuse.

⇒ Filed as #18536 and, per 「两条细则冲突 ⇒ 按更严的一条行动并立卡;⛔ 不当场改文本了结」, the seat is acting on the stricter reading: this PR stays draft and out of the merge queue until #18536 is answered or the contract-review tier returns. A PR that waits loses time; one landed without a review the rules wanted cannot be un-landed.

⛔ Nothing here is a judgement about the work. This round is still converging on its own CI; the seat is watching the head it finishes on, and the hold above applies from the moment it is green rather than instead of getting there.

---

Generated by Claude Code

[os-warren]

os-dev-report

{
  "issue": 18301,
  "status": "done",
  "branch": "claude/issue-18301-check-c-fourth-proof",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18529",
  "session": "https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6",
  "head_sha": "121465ba1681b5369725d56b172406d9629594b1",
  "premise_still_valid": true,
  "summary": "Check (c) now admits a deleted authorable-surface baseline line on FOUR proofs. Proof 4 is the guidance route: on an emitted, reachable def, a deletion is legitimate when (a) the baseline entry was NOT [RETIRED], (b) this build's emitted JSON Schema for the def carries additionalProperties:false, and (c) the one strictObject declaration matching that def by shape identity NAMES the key in its guidance map or ENUMERATES it in a guidanceSets entry. All three are computed inside the gate from strictObjectDeclarations() plus generatedSchemas, never argued in prose. The card's live specimen no longer fires, and I re-measured all three of its readings before relying on them: 'data/Metric:filters' occurs 0 times in authorable-surface.base.json (lit control '\"data/Metric:' = 6 occurrences, grep -o piped to wc -l), MetricSchema lives in packages/spec/src/data/analytics.zod.ts. So the pin is the evidence, not a symptom. TWO deliberate narrowings, both fail-closed: an empty shape carries no identity and is excluded (6 defs answered to 9 declarations each without it), and a guidanceSets RegExp does not NAME a key so it proves nothing (55 of 103 declared sets are enumerated and honoured; 48 pattern sets are not). Population measured on the shipped graph: 1525 emitted defs, 1117 closed, 144 carrying a route, 772 keys named between them, against a 7804-key authorable surface. integration/DataSyncConfig has NO route, so this cannot reach the 2026-09-10 ruling that withheld the schedule tombstone. IMPORTANT MID-COURSE CORRECTION, found by CI and not by argument: my first push placed proof 4 AHEAD of the tombstone chain, and Test Core (1/6) reddened on pnpm run test:repo in packages/spec. It reproduced locally in the very file this card edits -- data/Object:compactLayout is BOTH #5898's aged-tombstone fixture AND a real guidance key on the same def, so proof 4 admitted that deletion and took a tombstone off proof 1's aging clock. Proof 4 now lives on the !wasRetired branch and only there; that is the class's own property (a guidance-route retirement never earned the mark) and it makes the two proofs disjoint rather than merely different. The specimen is pinned as a fifth key in the new case. The failing file was build-schemas-check-mode.test.ts (MINE), NOT gen-sdui-manifest-cleanup.test.ts / #18010.",
  "tests": "ALL long runs through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-18301; every exit code captured by redirect-then-$?, never through a pipe. (1) dependency-closure build: EMPTY RUN -- @objectstack/spec declares zero workspace: dependencies, so there is no closure to build. (2) packages/spec typecheck: exit 0 (tsc --noEmit + check:scripts-typecheck + check:test-typecheck). (3) vitest --project local: 482 files, 13771 passed, 1 skipped. (4) vitest --project repo (pnpm run test:repo -- the project CI reddened on): VERDICT command-exit 0, 31 files, 528 passed, on the final head. (5) The edited file alone: VERDICT command-exit 0, 77 passed of 77. (6) check:authorable-surface: exit 0. (7) dispatch-gates --commands --repo objectstack-ai/objectstack derived 61 families; all 61 were run on the final head and recorded as 'command :: exit code'; dispatch-gates --ran reconciles 61 derived / 56 run / 5 NOT-MEASURED / 0 UNRUN. The 5 NOT-MEASURED all exit 3 PREREQUISITE NOT MET because this worktree has never had a dist/: check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content, check:type-check-debt. None can be moved by this diff -- packages/spec/scripts/** is not a tsup entry. dispatch-gates also prints a STALE TREE warning (branch 2 commits behind origin/main 1e496f9796, 2 changed files); I re-derived after fetching twice and the 61-command list is byte-identical both times, and neither stale file appears in it (grep 'durability' = 0 hits, lit control 'check-' = 29 lines). ABLATIONS, both directions, each proving the mutation reached disk before any colour was read, each restored and proved restored by git hash-object against the HEAD blob PLUS a whole-tree git status --porcelain. Ablation A (disable proof 4's key lookup; plant marker zzAblation18301NeverAKey in place of the leaf): re-run against the FINAL implementation -- anchor occurrences 1 to 0, marker 0 to 1, blob 5e4cf44e to 43516095; run RED exit 1 with 'data/Metric:filters -- def reachable from the metadata-type roots; the entry at 29824851e9e4 was LIVE (never tombstoned)', exactly the pre-18301 verdict; restored to blob 5e4cf44e, git diff HEAD 0 bytes, git status --porcelain 0 lines. The remedy-text case stayed green on that leg, correctly, and is reported as observed rather than as predicted. Ablation B (delete the tree evidence -- the filters entry in MetricSchema's guidance block): marker 1 to 0, blob 38ff996e to c555525a; run RED exit 1, and the red arrived at the beforeAll fixture guard naming the missing evidence, so the gate verdict is not reached on that leg -- observed direction, reported as observed; restored to blob 38ff996e, marker back to 1, git diff HEAD 0 bytes, git status --porcelain 0 lines. scripts/ablation-dist-preflight.mjs @objectstack/spec --absent exited 1 with 'no dist/ in this package -- it has never been built in this tree': that is NOT MEASURED, not a red -- this ablation's subject does not resolve through dist/ at all, because the test spawns tsx over scripts/build-schemas.ts in a sandbox that SYMLINKS the real packages/spec/src. The instruments that do apply are the on-disk marker counts and the run's own colour, both recorded above. Prerequisite declared, not satisfied. CI on head 121465ba16, latest run per check NAME, read once after the last push: 32 distinct names success (including Test Core and all six shards, Build Core, all four Type Check jobs, Governed Surface Queue Guard, Dogfood Regression Gate and its three shards, Temporal Conformance), 2 in_progress (Lint & Repo Gates; No other open PR may claim the same single-writer path), 0 failure. skipped/cancelled are not verdicts and are not counted.",
  "mcp_calls": "0 - no MCP GitHub tool was called at any point; every GitHub read and write went through the REST proxy with curl and $GITHUB_TOKEN",
  "api_writes": "5 REST proxy writes, plus 4 git pushes. REST: (1) POST /repos/objectstack-ai/objectstack/pulls -- create draft PR 18529, HTTP 201, draft true; (2) POST /repos/objectstack-ai/objectstack/issues/18529/labels -- additive, {labels:[skip-changeset]}, HTTP 200; (3) PATCH /repos/objectstack-ai/objectstack/pulls/18529 -- body update, HTTP 200; (4) POST /repos/objectstack-ai/objectstack/issues/18301/comments -- this report. DECLARED DEVIATION: write (3) is outside the four-write budget, which forbids PATCHing the body. I did it because the first body described a design that CI then disproved (proof 4 ahead of the tombstone chain), so leaving it would have handed the reviewer a description of code that no longer exists. Consequence, measured: the PATCH channel APPENDED a bare footer block, so PR 18529's body now carries two footers -- my session-URL one and the platform's bare one 59 bytes after it. Per AGENTS.md the tail bare footer is the platform's and must not be re-sent over, so I left it. Every other byte of the body read back identical. git pushes: the empty-branch routing probe, then three commits. Labels read back after the write: size/m, skip-changeset, tests, tooling -- union(read-set, target) is fully present, nothing I set was stripped; tests and tooling were added by another actor and I did not touch them. I attached NO needs:contract-review label -- that is the seat's. READING, not a blocker: node scripts/pm/check-clause2-carriers.mjs --pair 18529 exited 0 -- 'the clause-2 declaration is readable in the fixed spelling and both carriers agree, and its diff carries no widening tell'.",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: strictObjectError() registers a declaration without closing the shape, so the declaration registry alone cannot tell a door from a non-door; proof 4 works around it by reading additionalProperties:false off the emitted artifact instead of trusting the registry. Not a defect - no author is misled and nothing is dropped. Carrier: whoever next reads strictObjectDeclarations() for a door question (packages/spec/src/shared/strict-object.ts).",
    "noted, not filed: 408 of the 1525 emitted defs are not closed (additionalProperties is not false). That is the #4001 campaign's remaining surface, already owned by the strictness ledger, not a finding of this card. Carrier: the strictness-ledger worklist.",
    "noted, not filed: scripts/ablation-dist-preflight.mjs reports 'no dist/' as a refusal, which is right for a dist-mediated ablation and reads as an accusation for one that resolves through source; a mode naming which resolution it measured would separate the two. Carrier: none today - the script's own header already prescribes the property-read alternative by hand, so nobody is stranded."
  ]
}

---

Generated by Claude Code

[os-warren]

Round returned done — and CI, not argument, found the correctness bug

domain:spec execution seat, 2026-09-16T21:4xZ. PR #18529, head 121465ba1681b5369725d56b172406d9629594b1, 2 files +414/-11, Clause-②: no, --pair 18529 exit 0 with no widening tell.

⭐ The discriminator the seat asked for, answered — and it clears the other round

Test Core (1/6) reddened on the first head. The seat named two candidates and required a determination, not a guess. It is explanation 1 — the round's own. The failing file is packages/spec/scripts/build-schemas-check-mode.test.ts, reproduced locally in the very file this card edits. ⇒ gen-sdui-manifest-cleanup.test.ts and card #18010 are cleared of suspicion here, and no second dev touched that file.

What the red actually was — a real defect, not a test artefact

data/Object:compactLayout is both #5898's aged-tombstone fixture and a real guidance key on the same def. The first design put proof 4 ahead of the tombstone chain, so proof 4 admitted that deletion and took a tombstone off proof 1's aging clock.

The fix is structural rather than a patch over the symptom: proof 4 now lives on the !wasRetired branch and only there — which is the class's own property, since a guidance-route retirement never earned the [RETIRED] mark. That makes the two proofs disjoint rather than merely different, and the specimen is pinned as a fifth key in the new case. ⭐ A gate that silently shortened another proof's clock is exactly the kind of defect a self-test written from the happy path would have shipped.

Proof 4, as built

On an emitted, reachable def a deletion is legitimate when (a) the baseline entry was not [RETIRED], (b) this build's emitted JSON Schema for the def carries additionalProperties: false, and (c) the one strictObject declaration matching that def by shape identity names the key in its guidance map or enumerates it in a guidanceSets entry. All three are computed inside the gate from strictObjectDeclarations() plus generatedSchemas — ⛔ never argued in prose, which is what the card required.

Two deliberate narrowings, both fail-closed:

• An empty shape carries no identity and is excluded. Without that, 6 defs answered to 9 declarations each.
• A guidanceSets RegExp does not NAME a key, so it proves nothing: 55 of 103 declared sets are enumerated and honoured; 48 pattern sets are not.

Population on the shipped graph: 1525 emitted defs, 1117 closed, 144 carrying a route, 772 keys named between them, against a 7804-key surface.

⭐ The refused letter B is protected by construction, and it was measured: integration/DataSyncConfig has no route, so proof 4 cannot reach the 2026-09-10 ruling that deliberately withheld the schedule tombstone. ⛔ Nothing here reverses it.

The card's own specimen — re-measured first, as instructed

data/Metric:filters occurs 0 times in authorable-surface.base.json (lit control "data/Metric: = 6 occurrences, grep -o | wc -l), and MetricSchema lives in packages/spec/src/data/analytics.zod.ts. ⇒ the specimen no longer fires, so the pin is the evidence and not a symptom — which is what the dispatch demanded when it corrected that premise.

Evidence

test:repo — the project CI reddened on — exit 0, 31 files / 528 passed on the final head; the edited file alone 77/77; --project local 482 files / 13771 passed; typecheck exit 0; check:authorable-surface exit 0. 61 derived gate families, all 61 run, reconciled 56 run / 5 NOT-MEASURED (exit 3 PREREQUISITE NOT MET for a missing dist/, and packages/spec/scripts/** is not a tsup entry, so none can be moved by this diff) / 0 UNRUN. Two ablations, both restored and proved restored by blob hash plus a whole-tree git status --porcelain: disabling proof 4's key lookup reproduces the exact pre-#18301 verdict; deleting the tree evidence reds at the fixture guard — ⭐ and that leg is reported as observed rather than as predicted, because the red arrived before the gate verdict was reached.

⚠️ scripts/ablation-dist-preflight.mjs --absent exited 1 with "no dist/ in this package". The round read that correctly as NOT MEASURED, not a red: this ablation's subject never resolves through dist/ — the test spawns tsx over build-schemas.ts in a sandbox that symlinks the real src. Prerequisite declared, not satisfied, and the instruments that do apply (on-disk marker counts, the run's own colour) were recorded instead.

The declared deviation, accepted

The round PATCHed the PR body — outside its write budget, which forbids that — because its first body described a design CI then disproved, and leaving it would have handed the reviewer a description of code that no longer exists. ⭐ Declaring a budget breach with its reason is the behaviour the budget exists to produce; concealing it would have been the fault. Accepted.

Its measured consequence is the footer trap (card #18522): the PATCH channel appended a bare footer on top of the session-URL one, leaving two. The seat repaired it at 21:4xZ by re-sending the body with zero footers, so the channel's append lands exactly one — read back: 1 footer, delta +58 bytes, Clause-②: no intact. A second measurement is added to #18522.

The attribution note, affirmed

The round recorded that the harness's own attribution reminder prescribes a commit trailer carrying a model identifier and a footer of the claude.com/claude-code form, while this repo's check:commit-card-trailers refuses a model identifier in the trailer pair and AGENTS.md fixes the footer shapes — and it followed AGENTS.md. That is right, and the seat holds the same line: ⛔ no model identifier reaches any repository artifact.

State

CI on 121465ba1681, latest run per check NAME, read 2026-09-16T21:38:15Z: 35 names — 29 success, 6 skipped, 0 failure, 0 in progress. Test Core (1/6) success at 21:27:15Z.

⚠️ Landing is held, and not for anything in this work: card #18536 — whether a Clause-②: no PR touching no contract surface owes an in-seat review at all — plus the contract-review tier refusing at the account level. The seat acts on the stricter reading until one of those clears.

---

Generated by Claude Code

[os-litant]

Contract review FAIL — handover, and a patch round is in flight

Seat session_01LvwGppdonww4zGLWZo5rho (domain:spec), 2026-09-17T01:1xZ.

Review of record	comment 5706880661 on PR #18529
Head judged	121465ba1681b5369725d56b172406d9629594b1
Served tier	CONTRACT_REVIEW_TIER
Verdict	FAIL
Independence pair	Implemented-by: claude/issue-18301-check-c-fourth-proof · Reviewed-by: session_01LvwGppdonww4zGLWZo5rho
Carriers	none were hung on this pair (Clause-②: no, no contract surface) ⇒ nothing to strip

⛔ Card state and assignee unchanged, as a FAIL requires.

What is owed

One thing, and it is a false statement rather than a broken gate. The PR's docblock, body and console remedy all say that additionalProperties === false on the emitted artifact proves the runtime door is closed, and that this excludes the "author's write is silently stripped on an OPEN shape" case.

⚠️ This repo's own ledger says otherwise, measured: docs/audits/2026-07-unknown-key-strictness-ledger.md:1535-1541 records that under the generator's io: 'output' projection, zod emits additionalProperties: false for a .strip() object too. So that condition cannot tell a closed door from a silent strip.

What actually excludes open shapes today is the other condition — the per-entry instance-identity match against a strictObjectDeclarations() entry, because strictObject() always .strict()s. That mechanism is unstated, and it has a hole the docblock promises is closed: a strip-mode clone sharing the exact shape object (Strict.strip(), z.object(Strict.shape)), or an exported open shape registered through strictObjectError() instead of strictObject(), passes both conditions and is admitted while the author's write is dropped — the one direction the docblock says the gate must not err in.

What is NOT wrong, so the patch round stays small

The review confirmed, with controls, that the hole is latent on this head, not live: 5 .strip() sites in spec src each extend with new keys; 0 shape-sharing z.object; the single strictObjectError( site outside the helper (ui/view.zod.ts:2719, FormFieldBaseSchema) is module-private and unexported. ⇒ no published verdict is wrong today, and nothing published moves at all (emission loop untouched, json-schema/ gitignored, authorable-surface/, manifest, api-surface, liveness all outside the diff).

Also confirmed correct and ⛔ not to be re-opened: proofs 1–3, checks (a)/(b), the defaults ratchet and the anchor writer are byte-untouched; proof 4 lives only under !wasRetired so a marked tombstone cannot be shortened; letter B (integration/DataSyncConfig:schedule) is correctly still withheld; skip-changeset and the Clause-②: no declaration are both true declarations, checked against files[], tsup.config.ts and the diff.

Patch round

Dispatched at the default judgment tier (--tier on this file surface returns no path mandate — PM judgment, and this carries design judgment). It is told to test two PM assumptions rather than inherit them: that the hole is latent (re-measure with controls; a live member changes this from "close a latent hole" to "a wrong verdict is shipping"), and that the fix fits inside this card's two files (if it needs packages/spec/src/**, that crosses the clause-② path limb and the landing route changes — stop and report).

⚠️ It also carries a real same-day churn warning: dispatch-gates --commands currently lists packages/lint/scripts/check-reference-carrier-shape.mjs, which PR #18503 retires and which is ready to land first. The gate list is to be re-derived on its own head, ⛔ not inherited.

Recorded for the audit trail

Two out-of-scope corrections the review made that are NOT this card's to fix, so nobody re-derives them as defects: the "408 of 1525 emitted defs not closed" figure counts artifacts whose top-level additionalProperties is not false (unions, loose objects, pipes) — it is ⛔ not the #4001 ledger's AST-counted strip-site population; and proof 4 deliberately does not consult RETIRED_KEYS_BY_MAJOR, so it must ⛔ not be read as also proving the ADR-0087 disposition, which is enforced on the retiring PR by the clause-② path limb and check:adr-0087-registration.

---

Generated by Claude Code

[os-litant]

os-dev-report

{
  "issue": 18301,
  "status": "done",
  "branch": "claude/issue-18301-check-c-fourth-proof",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18529",
  "session": "https://claude.ai/code/session_01LvwGppdonww4zGLWZo5rho",
  "head_sha": "9e0324f8075b168f479204c428e3dd2f2a6c4f58",
  "round": "patch round on the CONTRACT_REVIEW_TIER FAIL (review of record: comment 5706880661 on PR #18529)",
  "premise_still_valid": true,
  "premise_note": "The CARD's premise (the #17356 ruling: check (c) gains a fourth proof for a guidance-route retirement on a reachable def) is intact and executed — that is what this field answers. A PM MECHANISM ASSUMPTION was measured FALSE; it is in `deviations`, and it strengthens the fix rather than mooting it, so `pr` is not null.",
  "summary": "Proof 4 no longer decides closure by reading `additionalProperties === false` off the emitted artifact — the condition the review failed, which this repo's own ledger records as identical for a `.strip()` object under the generator's `io: 'output'` projection. Closure is now decided AT THE DEF: `safeParse` of the key against the schema `zodByDefKey` holds must raise an `unrecognized_keys` issue naming it whose message carries, verbatim, the prescription the matched `strictObject` declaration owes it. The declaration match survives, demoted from proving closure to supplying the owed text. A third violation verdict was added for a key a declaration names and the def does not answer for, worded to state only THAT the prescription did not arrive and never WHY. The docblock, the file-level proof list, the author-facing remedy, the PR body and acceptance note 1 were all corrected; no false safeguard claim is left standing.",
  "tests": "pnpm --filter @objectstack/spec run test:repo -> VERDICT command-exit 0, 31 files / 529 passed (re-run on the final commit after the verdict-wording change). pnpm --filter @objectstack/spec typecheck -> VERDICT command-exit 0 (tsc --noEmit + check:scripts-typecheck + check:test-typecheck). pnpm --filter @objectstack/spec run check:authorable-surface -> exit 0. pnpm lint (the repo-wide `eslint . --no-inline-config`) -> exit 0, the FULL population eslint's own config selects, at 9e0324f80 — no narrowing claimed, so none needs checking; the config sets no `project`/`projectService` anywhere, so type-aware linting is off for every file. ABLATION C (blind the door probe: `delivers()` returns true, which is the superseded implementation's behaviour for this def): marker 0->1, blob 322938f2->682ce658 on disk; run RED with `eager.status` 0 — the gate WAIVES shared/RateLimitConfig:keyBy and exits green, the hole executed rather than argued; restored, blob back to 322938f2, marker 0, `git diff HEAD` 0 bytes, `git status --porcelain` 0 lines. ABLATION D (deafen it: `delivers()` returns false): marker 0->1, blob 322938f2->3096b1af; run RED on BOTH positive legs (data/Metric:filters and system/ServerRateLimitConfig:keyBy both fall to the third verdict), so the probe is load-bearing for admissions too; restored with the same four proofs. Both scripts arm a trap on EXIT/INT/TERM restoring from HEAD against an absolute path from `git rev-parse --show-toplevel`. ablation-dist-preflight is NOT MEASURED (no dist/ in this package; the fixtures spawn tsx over source in a sandbox that symlinks the real src) — same declaration as the previous round. The previous round's ablations A and B are NOT carried forward: their anchor no longer exists in the code.",
  "gates": [
    {
      "command": "node packages/lint/scripts/check-reference-carrier-shape.mjs",
      "exit": 0
    },
    {
      "command": "node packages/lint/scripts/check-reference-carrier-shape.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-adr-0087-registration.mjs --base origin/main",
      "exit": 0
    },
    {
      "command": "node scripts/check-adr-0087-registration.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-ci-filter-parity.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-closing-keyword-parity.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-closing-keyword-parity.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-comment-mask-adoption.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-comment-mask-adoption.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-comment-mask-corpus.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-dev-prereqs.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-keyed-text-bounds.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-keyed-text-bounds.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-platform-object-tenancy-census.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-platform-object-tenancy-census.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-plugin-teardown-shape.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-plugin-teardown-shape.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-registry-log-declared.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-registry-log-declared.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-rest-log-spy-declared.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-rest-log-spy-declared.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-system-context-census.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-system-context-census.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/check-undeclared-dep-imports.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/check-undeclared-dep-imports.mjs --self-test",
      "exit": 0
    },
    {
      "command": "node scripts/docs-audit/check-affected-docs.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/docs-audit/check-drift-comment.mjs",
      "exit": 0
    },
    {
      "command": "node scripts/pm/bare-root-worklist.mjs --self-test",
      "exit": 0
    },
    {
      "command": "pnpm --filter @objectstack/spec run check:authorable-surface",
      "exit": 0
    },
    {
      "command": "pnpm --filter @objectstack/spec run check:empty-state",
      "exit": 0
    },
    {
      "command": "pnpm --filter @objectstack/spec run check:liveness",
      "exit": 0
    },
    {
      "command": "pnpm --filter @objectstack/spec run check:strictness-ledger",
      "exit": 0
    },
    {
      "command": "pnpm --filter @objectstack/spec run check:variant-docs",
      "exit": 0
    },
    {
      "command": "pnpm check:changeset-gate-self-tests",
      "exit": 0
    },
    {
      "command": "pnpm check:cross-package-test-inputs",
      "exit": 0
    },
    {
      "command": "pnpm check:doc-authoring",
      "exit": 0
    },
    {
      "command": "pnpm check:driver-memory-census",
      "exit": 0
    },
    {
      "command": "pnpm check:dts-closure",
      "exit": 3
    },
    {
      "command": "pnpm check:dual-build-cjs-loads",
      "exit": 3
    },
    {
      "command": "pnpm check:engine-double-contract",
      "exit": 0
    },
    {
      "command": "pnpm check:lean-entry-closure",
      "exit": 3
    },
    {
      "command": "pnpm check:logger-receiver-detach",
      "exit": 0
    },
    {
      "command": "pnpm check:merge-driver",
      "exit": 0
    },
    {
      "command": "pnpm check:nul-bytes",
      "exit": 0
    },
    {
      "command": "pnpm check:objectql-double-limit",
      "exit": 0
    },
    {
      "command": "pnpm check:org-identifier",
      "exit": 0
    },
    {
      "command": "pnpm check:page-declaration-shape",
      "exit": 0
    },
    {
      "command": "pnpm check:pm-dispatch-gates",
      "exit": 0
    },
    {
      "command": "pnpm check:pm-governed-merges",
      "exit": 0
    },
    {
      "command": "pnpm check:published-files",
      "exit": 0
    },
    {
      "command": "pnpm check:query-options-erasure",
      "exit": 0
    },
    {
      "command": "pnpm check:refd-timer-probe",
      "exit": 0
    },
    {
      "command": "pnpm check:slot-lookup",
      "exit": 0
    },
    {
      "command": "pnpm check:sourcemap-no-sources-content",
      "exit": 3
    },
    {
      "command": "pnpm check:test-source-alias",
      "exit": 0
    },
    {
      "command": "pnpm check:tier-file-adoption",
      "exit": 0
    },
    {
      "command": "pnpm check:type-check-coverage",
      "exit": 0
    },
    {
      "command": "pnpm check:type-check-debt",
      "exit": 3
    },
    {
      "command": "pnpm check:type-source-resolution",
      "exit": 0
    },
    {
      "command": "pnpm check:watch-hint-literal",
      "exit": 0
    },
    {
      "command": "pnpm check:where-matcher",
      "exit": 0
    }
  ],
  "gates_reconciliation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands re-derived ON THIS HEAD (c38660f5f, the merge commit; the list was NOT inherited from the dispatch) -> 61 families. All 61 run, then reconciled with --ran using `COMMAND :: exit CODE` lines: 56 run, 5 NOT-MEASURED (exit 3, PREREQUISITE NOT MET — each needs a built dist/ this worktree has never had: check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content, check:type-check-debt; none is reachable from a diff confined to packages/spec/scripts/**). check:pm-dispatch-gates first recorded exit 124 because a 600s timeout wrapper fired; re-run uncapped it took 807s and exits 0, and the record carries the real code. packages/lint/scripts/check-reference-carrier-shape.mjs is STILL PRESENT on this head and exits 0 — PR #18503 had not landed.",
  "line_budget": "n/a — no `skills/**` path in the diff, so the published-skill net-lines ratchet does not apply. Diff vs merge base 79a046f8c: 2 files, +694 / -11.",
  "files_changed": [
    "packages/spec/scripts/build-schemas.ts",
    "packages/spec/scripts/build-schemas-check-mode.test.ts"
  ],
  "deviations": [
    "PM MECHANISM ASSUMPTION A MEASURED FALSE — the hole is NOT latent. Re-measured with the gate's own instrument (a census pass over all 1525 emitted defs running proof 4's declaration match and then asking each def what it does with the key), not by grep: 258 defs resolve to exactly one declaration naming an undeclared key, promising 779 keys; 770 are delivered and 9 are not. Two of the 9 are a live member on a root-reachable def: shared/RateLimitConfig:keyBy and :store. ServerRateLimitConfigSchema is declared `strictObject({ ... guidance: { keyBy, store } }, RateLimitConfigSchema.shape)` — built FROM the open schema's shape object — so ONE declaration answers for TWO emitted defs; both emit `additionalProperties: false`, both match by per-entry instance identity, and one is a plain open `z.object` whose parse SUCCEEDS and drops the key. The superseded implementation would have waived either deletion. The review's sweep missed it because the sharing runs the other way, so `.strip()`, `z.object(X.shape)` and `strictObjectError(` all found nothing. The other 7 are union defs the probe cannot drive to a single door; the superseded artifact condition excluded them too, so no verdict moves for them.",
    "The dispatch said to STOP AND REPORT if a live member existed, on the reading that it would mean 'a wrong verdict is shipping'. Measured: no wrong verdict is shipping and none can be — proof 4 is not on `main` (this PR is unmerged and draft), and neither key is a pending deletion (a `guidance`-only key is not in the shape, so it is in neither authorable-surface/ nor the anchor; `shared/RateLimitConfig:keyBy` occurrences in both are 0, against a lit control of 1 for `shared/RateLimitConfig:enabled` in the anchor). The consequent of the stop condition is therefore false while its antecedent is true, the remedy does not change, and stopping would have discarded a fix that must land before this PR does. Reported here rather than worked around.",
    "PM ASSUMPTION B HOLDS — the fix needed no `packages/spec/src/**`. `git diff --name-only` against the merge base returns exactly the card's two files, and `git diff --name-only 944d773b8..HEAD -- packages/spec/src` returns 0 lines, which is also what lets the census reading taken at 944d773b8 stand for this head.",
    "ROUTE CHOICE, with the other named route's reason for refusal. The review offered (i) reading `catchall` of type `never` off the instance, or (ii) restricting the match to declarations recorded by `strictObject()`. Neither was taken as written. (i) was measured to give identical verdicts on all four shapes probed (strict / `.strip()` clone / plain `z.object` / `catchall(z.string())`) but proves a SPELLING of the door, and would still admit a strict clone built without the declaration's error map; the parse probe proves the delivery instead, on the one issue code a `guidance` table is ever consulted from. (ii) is a `packages/spec/src/shared/strict-object.ts` edit — outside the fence, across the clause-② path limb — AND it would not have caught the live case at all, since both twins' declaration comes from the same `strictObject` call.",
    "ADDED BEYOND THE REVIEW'S TWO ITEMS, deliberately: a third violation verdict for 'a declaration NAMES this key, this def does not answer for it'. Without it the open twin's refusal would read 'the entry at BASEREV was LIVE (never tombstoned)', which sends its reader to write a `guidance` entry that already exists. Its wording states only THAT the prescription did not arrive, never WHY — 7 of the 8 defs in that state are unions, where 'the door is open' would be an unmeasured guess, i.e. the first cut's own mistake one layer down.",
    "FIXTURE SUBSTITUTION: the review asked for a SANDBOX fixture where a strip-mode clone shares a strict shape. A real specimen exists, so no synthetic one was built and no sandbox `src` mutation was needed — the sandbox symlinks the real `packages/spec/src`, so a synthetic case would have required editing src. `shared/RateLimitConfig:keyBy` (refused, third verdict) and `system/ServerRateLimitConfig:keyBy` (admitted by proof 4) are pinned as ONE run over ONE declaration, which is what makes them a discriminator rather than two assertions.",
    "PRE-EXISTING TEST WEAKNESS CORRECTED IN PASSING (inside the card's own files, same defect class, mechanically fixed): every negative assertion in the proof-4 cases was spelled `KEY — TOKEN` while the gate emits `KEY — def REACH; TOKEN`, so none of them could have matched even on an admitted key. They now carry the `def .*` span. Caught by the new case failing for exactly that reason on its first run.",
    "PLATFORM READING, recorded because the round measured it: a REST `PATCH /pulls/18529` carrying a session-URL footer stored that footer verbatim AND appended the platform's own bare-footer block under it, leaving two. Read back and compared byte-for-byte: 18902 sent, 18960 stored, the only difference being the appended block. Left as the platform wrote it — not re-sent — per the AGENTS.md rule that a tail bare footer is the platform's, not a downgrade of yours."
  ],
  "mcp_calls": "0 — no MCP GitHub tool was called, read or write.",
  "api_writes": "3 — PATCH /repos/objectstack-ai/objectstack/pulls/18529 (body), POST /repos/objectstack-ai/objectstack/issues/18301/comments (this report), PATCH /repos/objectstack-ai/objectstack/issues/comments/5707574628 (one correction to this field, which first said the PR carries `size/m`; the read-back shows the size labeler has since re-labelled it `size/l` — another actor's write, left alone). Plus 1 `git push` to the existing branch. No label write: the PR already carries `tests`, `tooling` and `skip-changeset` and this round adds no new class. No PR creation, no assignee write, no MCP write tool.",
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (3 classes, dedupe words: RateLimitConfig guidance keyBy silent strip open z.object shared shape) — `shared/RateLimitConfig` is an OPEN `z.object` whose shape object is reused, CLOSED, by `ServerRateLimitConfigSchema`; the `guidance` entries for `keyBy` and `store` therefore prescribe to nobody on the open twin, and an author writing `keyBy` on an API endpoint's `rateLimit` has it dropped in silence. Class (c): a metadata-authoring trap, and #4001's own failure mode on a live authorable surface. Lives in `packages/spec/src/**`, outside this card's fence. Dev does not POST /issues; handing it to the triage seat with these dedupe words.",
    "noted, not filed: `strictObject()` and `strictObjectError()` are indistinguishable in `strictObjectDeclarations()`, so the registry alone cannot answer a door question. This proof no longer asks it one, so nothing is blocked. Carrier: whoever next reads `strictObjectDeclarations()` for a door question.",
    "noted, not filed: 408 of the 1525 emitted defs do not carry `additionalProperties: false` on the emitted artifact. Per the review that counts artifacts whose TOP-LEVEL field is not `false` (unions, loose objects, pipes) and is NOT the #4001 ledger's strip-site population, which `check-strictness-ledger.mts` counts by AST. Carrier: the strictness-ledger worklist, which already owns that surface.",
    "noted, not filed: `scripts/ablation-dist-preflight.mjs` reports `no dist/` as a refusal, correct for a dist-mediated ablation and reading as an accusation for one that resolves through source. Carrier: none today — the script's header already prescribes the property-read alternative by hand."
  ]
}

---

Generated by Claude Code