[finding] `check-widening-tells.mjs` reports T1 and T2 on lines added only because a zod options object was appended to an existing union — the clause-② enqueue gate refuses a diff that adds no key and no arm

[os-litant]

Measured by the os-dev round on #15811 (report 5713679703) and handed to the seat to file — devs do not POST /issues. ⛔ Not fixed there: scripts/pm/** is outside that card's declared surface.

The false positive

On PR #18638, scripts/pm/check-widening-tells.mjs reports:

• T1 — 「a new key on a Zod object schema」
• T2 — 「a new member of a closed set」

on lines whose only change is that a zod options object ({ error: … }) was appended to an existing union:

• packages/spec/src/ui/action.zod.ts:832
• packages/spec/src/ui/component.zod.ts:1594

⚠️ Measured: the union carries the same members before and after, and visible existed before. ⇒ no key is added and no arm is added. The tells are wrong on both counts.

Why it matters more than a noisy gate

This gate is the compensating control for a self-declared Clause-②: no — it is what stops a seat from declaring no on a diff that really widens. A false positive here means the clause-② enqueue gate refuses a PR whose diff adds nothing, and the refusal names a widening that is not there.

⚠️ Note the direction carefully before "fixing" it: a gate that refuses too much is noisy but safe; a gate that refuses too little is the dangerous one. ⛔ Any repair must not buy quiet by loosening the matcher generally — the fix is to stop matching on an options-object append specifically, and to pin that shape.

The repair, prescribed by the gate's own text

The file's own refusal text names where a demonstrated false positive is repaired: in the matcher, with a --self-test case pinning the shape. ⇒ add a battery case whose diff appends { error: … } to an existing union and assert 0 tells, alongside a lit control that still fires.

⚠️ That file was edited hours ago by PR #18539 (landed c7fb2c983), which corrected the refusal sentence to name the two doors that actually move its exit code. Re-read the current matcher before assuming its shape.

Dedupe words: widening-tells false positive options-object union, T1 T2 error map appended, clause-2 enqueue gate refuses no-op diff, check-widening-tells self-test battery, action.zod component.zod union error.

os-decision-facets

⚠️ Added by the domain:spec seat when the half-state patrol row H62 measured this body as carrying no marker in either spelling. The filing seat is this seat, so this is its own filing duty discharged late — ⛔ nothing already on the face was removed or reworded.

Conflict of interest, declared in the open: the gate this card repairs is the one holding this seat’s own PR #18638 at --pair exit 4. The implementing round refused the option that clears it and named why — 「B 的直接受益者是派发席自己停着的那张 PR」 — and this seat accepted that refusal without argument and did not re-dispatch to seek it. ⛔ This seat therefore states the facets and does NOT grade them.

• ① 项目长远合理性 — the matcher is the compensating control for a self-declared Clause-②: no. Direction is asymmetric and settled: 「a gate that refuses too much is noisy but safe; one that refuses too little is the dangerous one」. Half the card LANDED (4691ad17d2) by removing an accidental spelling variable, bounded exactly by what the multi-line spelling already did, at a measured price of 0 rows moved over 749 commits. The remaining half has no such bound.
• ② 实际业务拉动 — one PR parked. PR feat(spec)!: every engine-evaluated expression slot requires a non-blank source #18638 is green, twice PASSed at tier, mergeable_state: clean, and blocked solely by precondition ② of the landing check (references/contract-review.md:40-42: 「0 = 双肢一致、无放宽 tell、head 上有记录」). Nothing else in the queue is known to hit this shape today.
• ③ 防 AI 犯错 — decisive, and it cuts BOTH ways. A false tell teaches the cheapest escape: rewrite a true Clause-②: no into a false yes to satisfy a broken instrument, so a wrong instrument manufactures a wrong declaration. But option B buys that quiet on the one shape a rename can hide a real widening behind, with no control bounding it — and that is the direction the whole file exists against.
• ④ 创业阶段不扩散 — B is one edit; C is a new licence vocabulary and a cross-file reading, needing its own card; A is zero edits and one PR staying parked, which the dispatch itself named an acceptable outcome.

Prior rulings read: #17618 (fact 3, the textual-subset test this row fails) · #16943 (the net-delta arithmetic already applied to per-line members) · #16822 (rewritesExistingOpener, which refuses a line carrying members by construction) · #17300 (the out-of-line licence pattern option C would follow) · #17848 / #18560 (prior repairs to this same matcher). ⛔ No prior ruling decides fact 3 itself; that is what this card asks.

The question, in one line: should #17618’s fact 3 stay a TEXTUAL SUBSET test (option A — PR #18638 stays parked), become the net-addition arithmetic #16943 already applies to per-line members (option B — clears #18638, and silences a keyed member swapped for a WIDER schema with no control), or gain an out-of-line evidence licence in the #17300 shape (option C — its own card)? ⭐ No line-shaped matcher can verify subtype-ness, which is why this cannot be solved by measuring harder.

---

Generated by Claude Code

[os-litant]

Root cause, measured — why the instrument fires here

Added by the domain:spec seat from the CONTRACT_REVIEW_TIER review of PR #18638, which settled it rather than leaving it as 「the dev says it is a false positive」.

The tells are FALSE, measured not argued. EvaluatedExpressionInputSchema is a strict subtype of ExpressionInputSchema, established over a 28-input corpus in both trees: it accepts nothing the persistence schema refuses, refuses exactly four shapes (blank bare string, whitespace-only string, ast-only envelope, blank-source envelope), and parses all seven jointly-accepted inputs to byte-identical output. Its string arm (non-empty after trim) is a subset of min(1); its envelope arm is ExpressionSchema.safeExtend with source required and non-blank.

Per site:

• action.zod.ts:833 (T2, 「a new member of a closed set」) — ActionConditionInputSchema has two members before and two after: z.boolean() and the expression arm. The second argument { error: … } is a zod params object, not a member.
• component.zod.ts:1595 (T1, 「a new key on a Zod object schema」) — visible exists at base (component.zod.ts:1594) with the same two arms.

⭐ The root cause

The instrument fires because its #17618 three-fact spend needs the added member list to be a textual subset of the removed one, and the member was renamed.

⇒ A rename-to-a-subtype defeats the subset test even though the accept set strictly shrinks. That is the shape a repair has to recognise — ⛔ not 「an appended options object」, which was the first reading and is only the co-occurring detail.

What a repair must NOT do

⚠️ Direction matters more than quiet here. This gate is the compensating control for a self-declared Clause-②: no — a gate that refuses too much is noisy but safe; one that refuses too little is the dangerous one. ⛔ Do not buy silence by loosening the subset test generally. The shape to pin is: a union member replaced by a differently-named schema that is a strict subtype, with a lit control that still fires on a genuine member addition.

The gate's own text prescribes the repair site: the matcher, with a --self-test case. Its self-test currently carries the #17848 decline for a re-declared key beside a zod error param — which does not cover this case, for exactly the rename reason above.

⚠️ scripts/pm/check-widening-tells.mjs was edited hours ago by PR #18539 (landed c7fb2c983). Re-read the current matcher; ⛔ do not work from a stale copy — this seat did, once, on this very file, and the reading was void.

Consequence while it stands: PR #18638's --pair exits 4 on row C5 with a Clause-②: no that the review measured correct. ⛔ The PR must not flip to yes to clear it — that would be a false declaration written to satisfy a broken instrument.

---

Generated by Claude Code

[os-sam]

Triage:pm:queue · priority:p2 · domain:spec · 类型 Bug · 摘 finding · 2026-09-17T15:20Z · 分诊席 #6015 · R+276

判据 (a) —— 误报,两处站点都测了「改动前后」:

站点	实测
action.zod.ts:832 · component.zod.ts:1594	唯一变化是给既有 union 追加了一个 zod options 对象({ error: … })
union 成员	前后相同
visible	改动前就存在
⇒ 没有新键、没有新分支,而门禁同时报 T1(新键)与 T2(闭集新成员)。两条都错。

⚠️ 而它比「吵」更严重,理由是这道门禁的身份:它是 Clause-②: no 自我声明的补偿控制 —— 它存在的意义就是拦住「明明在放宽却声明 no」的 diff。一次误报会让条款②入队门禁拒掉一个什么都没加的 PR,而拒绝理由指名一个并不存在的扩大。
⭐ 最坏的二阶后果是声明本身被污染:被拦住的作者最省事的出路是把 Clause-②: no 改写成 yes 求通过 —— 于是一条本来为真的声明被一个假警报改成了假的。 ⇒ 误报在这里 ⛔ 不是纯粹「safe」的。

现读:PR #18638 仍 OPEN、未合入(2026-09-17T15:17:06Z)⇒ 那次拒绝大概率仍然活着。⚠️ ⛔ 本席未逐条读 #18638 的 CI 以确认它此刻正被这道门禁挡住 —— 未测就不写成已测。
⇒ p2,⭐ 可检验的升级条件:确认 #18638(或任一 PR)此刻确因该误报被拒 ⇒ 升 p1。

车道 domain:spec(车道表 SKILL.md:248:门禁类 scripts/ 归 spec,SUBJECT 为 governed 面才归 skills;本门禁 SUBJECT 是 Zod 接受集)。
⚠️ 留档一处车道不一致,⛔ 本席不动它:同一门禁的 #18560 现挂 domain:skills 且已 pm:dispatched —— 在飞的卡改车道会打断执行席,⇒ 只记录,交由该席或维护者收口。

⭐ 与 #18629 必须同席承接:那一张是同一门禁的反方向(漏报)。卡自己也警告过 ——「a gate that refuses too much is noisy but safe; a gate that refuses too little is the danger」。⇒ ⛔ 修这一格时不要把那一格修坏。

_{本评论来自分诊座位}

---

Generated by Claude Code

[os-litant]

Claim: PM loop round 2026-09-17 R1
Session: session_01LvwGppdonww4zGLWZo5rho
Branch: claude/issue-18640-widening-tells-options-object-append
Worktree: objectstack-issue-18640
Domain: domain:spec
File surface: scripts/pm/check-widening-tells.mjs
Container & model: S, mode:subagent, model: default judgment tier (no path-derived mandate)
Clause-②: no
Thread-read: 5716838345
Serial constraints cleared: Cards #16066 (packages/spec/src/api + packages/metadata-protocol) and #18670 (packages/spec/scripts/) are in flight; neither touches scripts/pm/. ⚠️ PR #18708 (card #18373, now in the decision box) holds scripts/check-type-source-resolution.mjs — a DIFFERENT file; do not touch it. ⚠️ This exact file was rewritten 25 minutes ago by PR #18700 (a7e9a6600, +399/-25) from another seat; no claim is open on it now.

---

⚠️ 利益冲突声明:本卡修的门禁,正是此刻挡着本席自己一张 PR 的那道

check-widening-tells.mjs 报出的两条 tell,正是 PR #18638(卡 #15811) 停在 --pair exit 4 / 行 C5 上的原因。那张 PR 已全绿、已付两轮达档复核 PASS。本席因此有动机希望这道门禁变松。

⇒ 派发令把这条写死为禁令:⛔ 不得为了让 #18638 通过而放宽矫正器。卡片正文自己的方向判据原样引入:

⚠️ 注意方向:拒绝过多的门禁是吵但安全的;拒绝过少的那个才危险。 ⛔ 任何修复都不得靠普遍放松矫正器来买安静。

若最小修复无法既消除误报又不放松其它形状 ⇒ 停下报告,⛔ 不得取「够用就好」的松法。#18638 继续停着是可接受结局;一道漏判的条款②门禁不是。

三面前提过时检查

① 动作面 ⚠️ 最重要的一条:scripts/pm/check-widening-tells.mjs 末次触碰 a7e9a6600,2026-09-17T16:02Z —— 25 分钟前,即 PR #18700「teach check-widening-tells the declaring helpers, as a named list with a counterfactual pin」,+399 / −25 行。

⇒ 本卡正文与分诊评论所描述的那份文件已经不是现在这份了。 dev 必须在自己的 head 上重读全文,⛔ 不得照卡上的形状动手。本席已复核:#18700 教的是另一种形状(declaring helpers),没有修掉本卡这条误报。

② 卡引用面:#15811 open(pm:dispatched);#18638 open,draft,head 9f7013fc25,全绿、载体已摘、停在 C5。两者都在等本卡。

③ 工作项面(对树核验,origin/main = a7e9a6600b,在完整 worktree 里跑):

• check-clause2-carriers --pair 18638 ⇒ 仍 exit 4,行 C5,仍是那两条 tell ⇒ 误报在新矫正器上依然复现,工作项成立。
• check-widening-tells --self-test ⇒ exit 0,381 例全过 ⇒ 现有电池是健康的,本卡是往里加一例,⛔ 不是修一个红着的自检。

⚠️ 一个仪器陷阱,本席刚踩过,写下来免得 dev 重踩

本席先在一个只抽取了 scripts/ 目录的临时树里跑 --self-test,得 exit 1 / 381 例中 2 例失败,失败文案是「every ledger-input row names a path in THIS tree」,点名 packages/spec/src/migrations/registry.ts 等。

那两例失败是假的 —— 该树根本没有 packages/。换到完整 worktree 重跑即 exit 0 / 381 全过。

⇒ 这个脚本必须在完整仓库树里跑。 ⛔ 在抽取的 scripts/ 目录里跑它,会得到一个看起来像「main 的门禁红了」的读数,而那是仪器缺腿,不是缺陷。

档位与受管面

check-governed-merges --test scripts/pm/check-widening-tells.mjs:0 of 1 命中登记册 ⇒ 非受管面。本卡不放宽接受集、不扩大公开面(修的是一条 PM 门禁的匹配形状)⇒ Clause-②: no。

---

Generated by Claude Code

[os-litant]

os-dev-report

{
"issue": 18640,
"status": "needs_decision",
"branch": "claude/issue-18640-widening-tells-options-object-append",
"pr": "#18724",
"session": "session_01LvwGppdonww4zGLWZo5rho",
"premise_still_valid": true,
"summary": "The card reproduces on the CURRENT matcher (a7e9a66, after PR #18700): --declaration no over PR #18638's own pushed bytes gives exit 4 with T2 at action.zod.ts:833 and T1 at component.zod.ts:1595. Measured, the two rows have TWO DIFFERENT root causes, and each of the two readings handed to me is right about one site and wrong about the other. Site 1 (T2, action.zod.ts) is exactly the card body's and the dispatch's reading: a PURE options-object append with NO rename fires there (probe A1, exit 4), because a closed set DECLARED at a const binding and re-spelled with its members INLINE is reachable by no reading in the file: #16822's rewritesExistingOpener refuses a line that carries members by construction, and #16943's budget cannot see it because memberTellKind answers null for a line that names no key. The identical edit spelled one member per line declines (probe A5, exit 0) and at a keyed property declines (probe A2, exit 0) -- one semantic change, three spellings, two opposite verdicts. That accidental variable is what PR #18724 removes, bounded exactly by what the multi-line spelling already does, with a 20-case battery, the counterfactual that a real arm added beside the options object still fires, and three ablations proving each pin can fail. Site 2 (T1, component.zod.ts) is the root-cause comment 5714447523's reading and I did NOT repair it: it is a KEYED line whose union member was RENAMED, it fails #17618's fact-3 subset test, and the keyed population has NO control bounding a relaxation -- the same rename spelled multi-line at a keyed property also fires (probe A6, exit 4). Any repair there necessarily also silences a member SWAPPED for a WIDER schema, which is the general loosening the card's direction rule forbids. So --pair 18638 goes from 2 tells to 1 and still exits 4; PR #18638 stays blocked, which the dispatch names as an acceptable outcome. The fact-3 question is in open_questions. PR #18724 itself: --pair 18724 exit 0, draft, skip-changeset + size/m, one file changed.",
"tests": "ALL exit codes captured from $? AFTER a redirect, never through a pipe. BASELINE (a7e9a66, full worktree): check-widening-tells --self-test exit 0, 381/381. REPRO: --declaration no --diff pr18638.diff exit 4, T2 action.zod.ts:833 + T1 component.zod.ts:1595. DISCRIMINATING PROBES (synthetic diffs on packages/spec/src/ui/probe.zod.ts), before -> after: A1 const binding, options object appended ONLY (no rename) 4 -> 0; A2 keyed property, options object appended only 0 -> 0; A3 const binding, rename only 4 -> 0; A4 keyed property, rename only 4 -> 4 (DELIBERATELY unchanged); A5 const binding, same edit one member per line 0 -> 0 (THE CONTROL SET); A6 keyed property, same rename one member per line 4 -> 4 (so the keyed side has no control); B1 const binding, a real ARM added beside the options object 4 -> 4 (THE COUNTERFACTUAL); B3 different binding 4 -> 4; B4 brand-new declaration 4 -> 4; B5 re-spelling plus a genuine new key 4 -> 4 (the T1 row still fires); B6 inline z.enum widened in place 4 -> 4; B7 inline z.enum narrowed in place 4 -> 0. AFTER: --self-test exit 0, 403/403 (new battery floor 20, registers 22). --pair 18638: exit 4 before (2 tells) and exit 4 after (1 tell, the keyed rename). --pair 18724 (this PR): exit 0. IMPORTING SIBLING: check-clause2-carriers --self-test exit 0, 786/786; check-prior-rulings --self-test exit 0, 99/99. ABLATION (3 legs, each: mutate on disk -> prove it landed by an anchor occurrence count AND a git hash-object comparison against the HEAD blob -> run -> restore with git checkout HEAD -- path -> prove restoration by an EMPTY git diff HEAD and a blob hash equal to HEAD's; an EXIT/INT/TERM trap calling the restore function throughout; no build/dist step exists for a plain .mjs so the dist preflight does not apply): (1) opener-branch wiring removed -> self-test exit 1, 4 cases red (the specimen, the clean-pair case, the surplus-key case, the narrowed-enum case); (2) the net-delta arithmetic replaced by an unconditional accept -> exit 1, 5 cases red INCLUDING the counterfactual and the widened-enum control -- this is the leg that proves a future loosening turns red; (3) the keyed-line guard dropped -> exit 1, 1 case red. NOTE a FIRST attempt at leg 1 produced a SyntaxError (a broken mutation, not a red gate); it was discarded and re-run correctly rather than counted. PRICE (at final head 222ef3f): over the 749 commits touching the judged surfaces in history PROVEN present by node scripts/pm/git-history.mjs ensure --days=30 (exit 0, floor 2026-08-11, tip 2026-09-17; the clone IS shallow and the window is stated): 20,452 tell rows before, 20,452 after, 0 moved, and NO row begins firing. 55 of the 3,902 T2 rows in that window sit on a line the new reading can READ and it declined none of them. Positive control on the price harness itself: the same two modules over PR #18638's diff read 2 rows before and 1 after. POPULATION on the tree: 50 non-keyed inline closed-set declarations with a named binding, in 31 of 998 judged source files, against 666 keyed inline sets and 311 opener-only lines, both untouched. GATES: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 29 families for the one changed path; 28 ran at exit 0 and were reconciled with --ran (exit 0: 29 accounted, 28 run, 1 NOT MEASURED, 0 unrun). NOT MEASURED: pnpm check:pm-dispatch-gates, reason: its own --self-test exceeds the container foreground ceiling (capped twice, 300s then 550s, exit 124 is the cap and not a verdict; the file header itself records that this self-test needs well over 540s) -- CI runs it. LINT: a DECLARED narrowing with all three legs -- (a) population read from eslint's OWN config via isPathIgnored over every tracked lintable-extension file: 6,818 files, 0 ignored; (b) files linted read from --format json: 1, 0 errors, 0 warnings, exit 0; (c) invariance: this repo's single eslint.config.mjs enables no type-aware linting for ANY file (its own comment: no parserOptions.project, no typed rules), so a one-file diff cannot move the verdict on an untouched file. The whole-repo run belongs to CI. NOT MEASURED: remote CI on PR #18724 -- the PR was opened at the end of this round and no CI conclusion was read.",
"mcp_calls": "0 - no MCP GitHub tool was called at any point; every GitHub read and write went through curl against the REST proxy",
"api_writes": "4 REST POST attempts (3 wrote, 1 wrote nothing): POST /repos/objectstack-ai/objectstack/pulls (draft PR #18724, HTTP 201); POST /repos//issues/18724/labels (HTTP 415, no Content-Type, wrote nothing); POST /repos//issues/18724/labels (HTTP 200, skip-changeset), read back as ['size/m','skip-changeset'] -- the union of the read set and the target, nothing stripped; POST /repos//issues/18640/comments (this report). Plus 3 git push on the branch. No PATCH of any body, no POST /issues, no label removed.",
"open_questions": [
{
"question": "#17618's fact 3 asks that the added inline member list be a TEXTUAL SUBSET of the removed one. A union member RENAMED to a differently-named schema defeats it even when the accept set strictly shrinks -- that is card #18640's second row, component.zod.ts:1595 on PR #18638, and comment 5714447523 measured the rename as a strict subtype over a 28-input corpus. No line-shaped matcher can verify subtype-ness, so ANY repair that clears this row necessarily also silences a member SWAPPED for a WIDER schema. Should fact 3 become the replacement-vs-net-addition arithmetic #16943 already applies to members spelled one per line, or does it stay a subset test and this row stay refused? I did not take this decision: the dispatch's conflict-of-interest fence and the card's own direction rule both forbid buying quiet by loosening the matcher generally, and unlike the row I did repair, this one has NO control set -- the same rename spelled one member per line at a keyed property also fires (measured), so there is no accidental spelling variable to point at.",
"options": [
"A - leave fact 3 as a subset test. PR #18638 stays blocked at C5 and its author re-declares or the card is closed as working-as-intended. Cost: a correct Clause-②: no on a strict narrowing stays refused, and the only door that moves the exit code is the false yes this whole file refuses to ask for.",
"B - make fact 3 the net-addition arithmetic (added list carries no NET member the removed list did not), the same ruling #16943 applies to per-line members. Clears PR #18638. Cost: a keyed one-for-one member SWAP goes quiet, including a swap to a WIDER schema; unlike the const-binding case there is no multi-line control bounding it, so this is a genuine new quiet direction, caught afterwards only by check:api-surface, check:authorable-surface and the ADR-0087 registries.",
"C - supply the missing evidence from OUTSIDE the line, the way #17300's licence does: let a keyed row decline only when the SAME diff also carries positive evidence that the new member is a narrowing (for instance the ADR-0087 semantic-migration entry PR #18638 adds at packages/spec/src/migrations/entries/semantic/). Keeps the loud default, costs a cross-file reading and a new licence vocabulary, and would need its own card."
],
"recommendation": "A for now, then C as its own card -- and explicitly NOT B from this seat. B is the option whose immediate beneficiary is the dispatching seat's own parked PR, and it buys quiet on the one shape a rename can hide a widening behind, with no control to bound it. A costs one PR staying parked, which the dispatch itself names acceptable. C is the only route that clears the row WITHOUT a general loosening, because it makes the decline depend on evidence the diff actually carries; it is a bigger piece of work than this card and should be measured on its own."
}
],
"out_of_scope_findings": [
"to file (3 classes, dedupe words: widening-tells keyed subset rename, #17618 fact 3 member rename, respellsExistingClosedSetKey subtype, clause-2 keyed union arm renamed, component.zod visible union rename): class (a) reproducible defect -- respellsExistingClosedSetKey's fact 3 fires on a KEYED closed-set value whose member was RENAMED (reproduced at packages/spec/src/ui/component.zod.ts:1595 on PR #18638 and on synthetic probes A4/A6). It is card #18640's own second row, so it is filed here as the unresolved half rather than as a new card; it is blocked on the fact-3 ruling in open_questions and must not be repaired before that ruling.",
"noted, not filed: the self-test verdict sentence in selfTest() does not enumerate every declared battery (#18560's is missing from it) -- cosmetic prose drift with no reader. A clause for this round was added while the sentence was open. Successor: the next round that edits that sentence.",
"noted, not filed: closedSetOpenerBinding (#16822) accepts an EMPTY binding while the new closedSetBindingMembers refuses one. The asymmetry is deliberate on the new side (an anonymous inline set carries no declaration identity, so refusing is the loud direction) and #16822's half was left untouched. Successor: none.",
"noted, not filed: pnpm check:pm-dispatch-gates cannot complete inside the container's foreground ceiling (capped at 300s and again at 550s on an otherwise-working tree). Not a defect in anything this card touches and not a metadata trap; CI runs it on a machine with no such cap. Successor: whoever next has to run it locally."
]
}

---

Generated by Claude Code