spec: declare `create_record` / `update_record` `fields.*` as a value-role expression slot in the expression ledger, so the CEL envelope is accepted there (the contract half of #11182 ruling D)

[objectstack-fleet]

Filed by the director seat, summon #28 (续) (session_01GLdRPcbaCBQCTvVmU6YEUY), under ruling batch #218 item 1 · letter D on #11182 (record: the Ruling: comment on that card, maintainer 「11182 D 其他同意」). Filing gate ③ (a ruled task). ⛔ Not a claim. Lane and grade set by the ruling: domain:spec · priority:p1 (inherited from #11182, the maintainer's 「优先处理」).

The gap, measured by the #11182 round (5795796051) and re-stated here

The spec expression ledger declares only assignment.assignments.* as a value-role envelope slot. create_record / update_record fields.* — where 106 of the 113 measured template-bearing sites live (HotCRM 92, this repo 21) — has no CEL path: an author cannot write a CEL expression envelope there today. Ruling D's A leg needs the slot declared before the engine half (#11182, domain:services) can accept the envelope.

Ruled shape (what this card lands)

1. The expression ledger (packages/spec, the ADR-0032 ledger of expression slots) declares create_record.fields.* and update_record.fields.* as value-role envelope slots, the same shape and dialect rules as assignment.assignments.*. ⛔ No change to what the {var} template dialect means or accepts in 17.x — a plain string in fields.* stays a template string; only the envelope form ({ dialect, source }) is newly accepted there.
2. Generated artefacts (authorable surface, JSON Schema, reference docs) follow from the ledger change; pins: the envelope parses in fields.*, a plain string still parses as before, the ledger's slot census gains exactly two rows.
3. Clause-②: yes — this widens the accept set of a published authoring surface (an envelope is newly accepted in fields.*); at-tier review per the spec lane's clause-② rule; changeset minor.

Consumer

#11182 (domain:services, pm:blocked on this card): the automation engine evaluates the envelope in fields.* through the CEL engine, exactly as it does for assignments.*; an author-time lint hint (warning) nudges template strings toward the envelope. The v18 leg (refusing the template dialect) is its own carrier card.

Dedupe (searched this summon: fields.* value-role expression slot ledger create_record CEL envelope → the #11182 thread only): fields.* envelope slot · expression ledger create_record · #11182 D.

[objectstack-fleet]

Claim: seat 5 serial dispatch, one dev at a time
Session: session_01Sfe5YjBLwB9J3y8fvm2xq1
Branch: claude/issue-19938-fields-value-slot
Domain: domain:spec
Seat: domain:spec#5 (seat post #19357)
Ruling executed: batch #218 item 1, letter D, on #11182 (maintainer 「11182 D 其他同意」), as this card's body records it.
File surface:

• the expression ledger packages/spec/src/automation/flow-node-expression-paths.ts and the create_record / update_record config schemas in packages/spec/src/automation/, with their tests;
• the generated artefacts that follow (packages/spec/authorable-surface/, JSON Schema, reference docs), regenerated and never hand-edited;
• .changeset/.

Stop and report on a breach.
Container & model: mode:subagent, default tier. dispatch-gates.mjs --tier printed "Model tier — no path-derived mandate". The review is at tier, because an authoring accept set widens.
Clause-②: yes
Thread-read: none
Serial constraints read at 2026-09-24T09:19Z: among the 31 open PRs, only this seat's PR #19960 (#17493) touches flow-node-expression-paths.ts and its test. Its hunks change the predicate-role resolver and refusal, and the ledger array is outside them. The dev merges origin/main after #19960 lands. No open PR touches packages/spec/authorable-surface/automation.json or builtin-node-config.zod.ts. The consumer, #11182 (domain:services), is pm:blocked on this card.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 19938,
"status": "needs_decision",
"branch": "claude/issue-19938-fields-value-slot",
"pr": null,
"head_sha": "3b5607019f, the same commit as origin/main at dispatch and at report time. The branch has no commits of its own. It was pushed once only to set upstream, and that push was a no-op.",
"session": "session_01Sfe5YjBLwB9J3y8fvm2xq1 (subagent run, so this is the dispatching seat's session)",
"premise_still_valid": true,
"summary": "I measured property 1 and then stopped at property 2, the ordering stop. The premise holds on origin/main 3b56070. The ledger has one value-role row (assignment.assignments.), and create_record / update_record fields. have no CEL path. At base, an envelope in fields.KEY passes FlowSchema.parse, registerFlow and the validate rules unchecked, and so do malformed and non-CEL envelopes. At run time the executor writes the envelope into the record as a literal object. crud-nodes.ts calls interpolate(cfg.fields), which walks into the envelope as plain data. The only caller of evaluateValueEnvelope is the assignment executor. I then added the two ledger rows as a what-if probe, measured, and restored them (never committed). With the rows in place a valid envelope still passes every door, now with a CEL check, and still runs as the literal object. On a text or JSON column the run reports success: true. On a number column the data engine refuses the write. That is the example property 2 names, so I implemented nothing, opened no PR and wrote no changeset. Plain template strings behave byte-identically before and after.",
"premise_measurement": {
"tree": "objectstack at 3b56070. The worktree built the service-automation and lint closure under os-verify-lock (turbo, 21 tasks, command-exit 0, lock held 260s).",
"method": "A scratch probe (not committed) imported the worktree's built dist. It ran FlowSchema.safeParse, then AutomationEngine.registerFlow and execute with registerCrudNodes, over a real ObjectQL and a recording driver. The test object probe_order has total (number), name (text) and payload (json), and the flow input is price = 21. I reproduced the validate door by calling the same exported functions os validate calls, in order: normalizeStackInput, lintUnknownStackKeys, lintUnknownAuthoringKeys, ObjectStackDefinitionSchema.safeParse, then runAuthoringRules('validate'). This was not the CLI binary. I left out lowerCallables (the stack has no callables) and authoringRuleUnionStack (identity for a single-package stack). The grid was 7 values x 2 node types x 3 column types = 42 rows. Every row showed 0 unknown-key warnings and FlowSchema.parse OK.",
"envelope { dialect: 'cel', source: 'price * 2' }": "FlowSchema.parse: OK, the config is passed through verbatim. registerFlow: OK, with no check. validate: no finding on the node. Run: the envelope is NOT evaluated. The text and JSON columns receive the literal object {"dialect":"cel","source":"price * 2"} and the run reports success: true. On the number column the data engine refuses with 'total must be a number' and the run fails.",
"malformed or non-CEL envelopes ({ dialect: 'cel' } without source, source 'price ', dialect 'template')": "All three doors pass them unchecked. At run time they behave like the valid envelope: a literal object in text/JSON, a data-engine refusal on the number column.",
"plain template string": "'{price}' parses, registers and validates clean. At run time it writes 21 into every column, because a sole token keeps its type. 'Total: {price}' writes 'Total: 21' into text/JSON, and the data engine refuses it on the number column.",
"literal 42": "Passes every door and writes 42."
},
"slot_before_after": {
"how_after_was_measured": "scripts/ablation-replace.mjs (WRAP mode) added the two ledger rows: create_record fields. and update_record fields., role value. The anchor hit once and the blob went 8ab4f951551b to 440db70576a1. I rebuilt spec under the lock (command-exit 0, 150s). ablation-dist-preflight found the marker in dist/automation/index.js and index.mjs, and I re-ran the probe. Restore: blob == HEAD 8ab4f951551b and git diff HEAD empty. I rebuilt spec (command-exit 0, 162s), ran preflight --absent (marker absent from all 216 built files, tree clean), and re-ran the probe; its output was byte-identical (cmp) to the base run. I added only the ledger rows, not the Zod-channel marker. The ratchet needs that marker, but none of the doors below reads it.",
"FlowSchema.parse": "valid envelope OK -> OK. Malformed envelope OK -> OK. Plain string OK -> OK. Node config is an open record, so this door does not move.",
"registerFlow": "valid envelope OK -> OK, now CEL-checked. Malformed or non-CEL envelope OK -> REFUSED, with 'An assignment value carrying a dialect key is read as an expression envelope, and this one is not a valid CEL value envelope.' at config.fields.KEY. Plain string OK -> OK.",
"validate": "valid envelope: no finding before or after. Malformed: no finding -> 1 error, expression-invalid, with the same sentence. Plain string: no finding before or after.",
"run time": "Unchanged in all 42 rows. The valid envelope is still written as the literal object (text/JSON, success: true) or refused by the data engine (number column). Plain strings write exactly what they wrote before.",
"runtime publish gate (metadata-protocol)": "NOT MEASURED: the probe did not drive it. Its header says it filters the same lint rules, so it should behave like the validate row."
},
"stop": "Property 2 names this exact state: a valid envelope passes authoring and then runs as a literal object written into the record. Landing this card alone would also add the CEL check, so the author gets a validated result for a value the runtime never evaluates. That is a declared-but-not-enforced window on a published slot, and it lasts until the #11182 engine half lands. Ruling D sets the order (spec first, engine after) and this property forbids the window that order creates. The two conflict, and I do not choose between them (open question 1).",
"composition": [
"Read-only preview, nothing changed because of the stop. Two findings are behavioural: rows 7 and 12 would show a wrong or misleading message the moment the rows land. The other rows are pins, docs and comments that must be updated.",
"1. packages/spec/src/automation/flow-node-expression-paths.ts:158-160 lists create_record.fields. among the interpolation-only slots it deliberately leaves out. :172-173 says the assignment map is 'the one such slot'. :347-348 and the predicateSlotRefusal message at :380-384 (shipped runtime text) name the assignment map as THE value-role spelling.",
"2. packages/spec/src/automation/flow-node-expression-paths.test.ts:141-149 is the census pin: exactly five rows today, and it would gain two. :46 pins 'declares exactly one slot for assignment', which stays true.",
"3. packages/spec/src/automation/builtin-node-config.zod.ts:261-277 and :286-326: CreateRecordConfigSchema / UpdateRecordConfigSchema declare fields as z.record(z.string(), z.unknown()) and say the values 'interpolate {token} templates'. This is where the Zod channel would carry the value contract and the xExpression 'value' marker. The module docblock at :62-67 says assignment is the one contract described by its values.",
"4. packages/spec/src/automation/schemaless-node-config.zod.ts:452-471: LEDGER_DECLARED_NODE_CONFIG_SCHEMAS is { assignment } only, and its docblock describes it as assignment-only.",
"5. packages/spec/src/automation/builtin-node-config.test.ts:550 pins Object.keys(LEDGER_DECLARED_NODE_CONFIG_SCHEMAS) to equal ['assignment'].",
"6. packages/services/service-automation/src/builtin/config-expression-ledger.test.ts:63-65 and :231 is the reconciliation ratchet. It fails on a declared marker with no ledger row, and on a ledger row with no marker. It is a service-lane file.",
"7. ASSIGNMENT_VALUE_ENVELOPE_REFUSAL (builtin-node-config.zod.ts:776) reads 'An assignment value carrying a dialect key ...'. engine.ts valueEnvelopeRefusals and lint checkDeclaredValue apply it, together with AssignmentValueSchema, to every value-role row. So a refused fields.* envelope is told it is 'an assignment value' (measured in the after probe; see open question 2).",
"8. These comments call assignments.* the only value slot: packages/lint/src/validate-expressions.ts:1181-1185, packages/services/service-automation/src/engine.ts:9496 and logic-nodes.ts:95-110.",
"9. packages/spec/src/automation/node-executor.zod.ts:273-274 names assignments.* as the value slot.",
"10. content/docs/automation/flows.mdx:179-227: the value-envelope section and its callout cover assignment only, and the Create Record example at :229 shows template strings only. The dialect table at :1757 says field values in create_record / update_record are 'Interpolation (braces required)'. That same row also carries the ruling-D wrong guidance ('the CEL idiom round(x * 100) / 100'), so the PR that edits this row owes the '/ 100.0' fix under ruling D point 2. content/docs/references/automation/builtin-node-config.mdx is AUTO-GEN and would regenerate from the describe() text.",
"11. Generated artefacts: the packages/spec/authorable-surface/ automation shard and the JSON Schema would come from gen:schema via check:generated --fix, never hand-edited.",
"12. crud-nodes.ts:294 and :450 call interpolate(cfg.fields ?? {}). This is the executor half. It belongs to #11182, not this card, and it is what produces the literal-object write."
],
"pins_with_ablation": "NOT WRITTEN: I stopped at property 2, before property 3. The only mutation I ran was the what-if probe above: planted, measured, restored, rebuilt, and proved absent with --absent.",
"changeset": "NOT WRITTEN, because of the stop. For whoever proceeds: the arm question is open question 3. An ADR-0087 disposition marker is owed only if the change is read as (narrowing) and therefore breaking. A 'Clause-②: yes (widening)' minor with no narrowing arm needs none.",
"tests": "I changed no code, so no suite is owed. Everything I measured is the probe above, with raw outputs in the scratchpad (probe-base.out, probe-after.out, probe-restored.out, 42 JSON rows each). Builds, all through os-verify-lock with slot issue-19938-dev: (1) pnpm turbo run build --filter=@objectstack/service-automation... --filter=@objectstack/lint... --concurrency=2: 'Tasks: 21 successful, 21 total', VERDICT command-exit 0, lock held 260s. (2) The probe's mutate-leg spec build: VERDICT command-exit 0, 150s. (3) The restore-leg spec build: VERDICT command-exit 0, 162s. The base, restored and after outputs compare as follows: restored == base under cmp. The after output differs from base only in the 18 malformed or non-CEL envelope rows, where registerFlow and validate now refuse. The 24 rows for the valid envelope, both template strings and the literal come out IDENTICAL on every door and at run time. In-repo occurrence check (a heuristic only, not a census): a multiline regex for an inline envelope as a fields value matched 0 times. Its control leg, the same regex on assignments, matched 14 times across 5 files. Nested or spread-in literals are outside what that regex can see. The census of record is the #11182 round's AST walk.",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: '--repo ... holds', then 'this branch changes nothing against origin/main (merge base 3b56070) — nothing to derive' (exit 2, empty change set). With no derived set, --ran has nothing to reconcile. Live citation gate, node scripts/check-issue-citations.mjs: 'no issue citations added against 3b56070 (0 file(s) read)', exit 0. The spec, service-automation and lint suites, typecheck, build of the change, and check:generated were NOT RUN: there is no diff, because of the stop.",
"ci": "none: no PR, and the branch equals origin/main",
"mcp_calls": "0. No MCP GitHub tools were used. Reads went through REST with curl (issue 19938 and its comments, issue 11182 and its comments).",
"api_writes": "1: POST /repos//issues/19938/comments (this os-dev-report, sent by scripts/pm/post-stamped.mjs through the fleet-write dispatch relay). git push of the branch was a no-op ('Everything up-to-date'), not a REST write. No label, ready, auto-merge or merge writes.",
"open_questions": [
{
"question": "Q1, the ordering stop. Landing this card alone opens a window. During it, a valid CEL envelope in create_record / update_record fields.KEY passes every authoring door, now with a CEL check, and runs as a literal object: stored verbatim with success true on a text or JSON column, refused by the data engine on a number column. The window lasts until the #11182 engine half lands. Ruling D orders spec first, then engine; property 2 forbids this window. Which applies?",
"options": [
"A. Land #19938 alone, as ruled, and accept the window until #11182's engine half lands. Cost: the shipped docs and JSON Schema say the slot is evaluated while the executor still writes the object, which is declared but not enforced. If a release is cut inside the window, it ships that way, and the changeset prose must either say so or be false. The malformed-envelope refusal lands at the same time, which is the safe direction.",
"B. Land both halves together: this card's spec commit and #11182's engine commit on one trunk branch (the AGENTS.md multi-card form; stacked PRs are not supported), landed once. Cost: the two lanes (domain:spec and domain:services) must coordinate, the trunk needs its own changeset and Clause-② reading, and the spec half waits for review of the engine half.",
"C. Land the declaration now, plus a temporary refusal: registerFlow and the validate rule refuse an envelope in fields.KEY with a 'not evaluated yet' prescription, and #11182 removes that refusal. Cost: it edits engine and lint files, which this dispatch excludes. It also narrows, for the window, an accept set that today admits the envelope as a literal object, and it changes shipped text twice.",
"D. Reverse the order: #11182's executor evaluates fields.KEY envelopes first, and #19938 declares afterwards. Cost: it reverses ruling D's stated order and contract-first (PD #12), because the executor would accept a shape the spec does not declare. Until the declaration lands, a malformed envelope fails at run time instead of at registration."
],
"recommendation": "None. Per the dispatch ('Don't pick a side'), and the four-axis escalation framework was not included in the dispatch, so these options have no axis analysis. The seat decides, or carries the question to the maintainer, since ruling D fixed the order."
},
{
"question": "Q2, raised by the composition read (not blocking). The value-role shape contract and its refusal sentence are assignment-named, and the engine and lint apply them to every value-role row: AssignmentValueSchema and ASSIGNMENT_VALUE_ENVELOPE_REFUSAL ('An assignment value carrying a dialect key ...'). Once fields.* is declared, a refused fields envelope is told it is 'an assignment value' (measured). The card rules 'same shape and dialect rules', not the naming. What should a fields.* refusal say?",
"options": [
"a. Generalise the sentence in spec (an added slot-neutral export, with the assignment names kept as the published surface). The engine and lint consumers switch to it in the engine half.",
"b. Per-slot sentences, keyed by the ledger entry, so each refusal names its own slot.",
"c. Leave the sentence as it is and accept the assignment wording on fields.* refusals."
],
"recommendation": "My reading, for the implementation round only: a or b. Both keep the published names and correct the text an author sees. The consumer edits land in engine and lint, in whichever landing Q1 chooses."
},
{
"question": "Q3, which Clause-② arm (for whoever writes the changeset). The declaration widens the accept set (a valid envelope becomes a CEL value). It also narrows one: any object literal in fields.KEY with a string dialect that is not a valid CEL envelope registers today and is written verbatim (measured). After the rows it is refused at registerFlow and validate (measured). After the engine half, an envelope-shaped literal that is valid would be evaluated, not written. #14149 accepted the same edge on assignments as 'the only newly refused shape is a malformed envelope'.",
"options": [
"a. 'Clause-②: yes (widening)', minor, with the malformed-envelope refusal stated in the changeset as the same edge #14149 accepted. The in-repo heuristic count is 0 (see tests). HotCRM and third-party stacks were not measured for this shape.",
"b. 'Clause-②: yes (narrowing)': BREAKING, so it needs an ADR-0087 disposition marker, a migration line, and the v18 train."
],
"recommendation": "None. This is a semver ruling and the dispatch set 'minor, Clause-②: yes'. Reported so the arm is chosen on purpose."
}
],
"out_of_scope_findings": [
"Noted, not filed: ObjectQL accepted a plain object for a text column and passed it to the driver unchanged (probe: name receives {dialect, source}, success true), while it refuses a non-number on a number column. I did not check this against the text field's declared contract, so it is an observation, not class a/b/c, and no card is due.",
"carrier: whoever runs the Q1 landing. Ruling D says the wrong-guidance fix (template.ts:83 / :111, flows.mdx:1757) goes in 'the first PR that touches each file'. This run touched no file, so it is still owed there, and composition row 10 shows the declaration's docs edit lands on flows.mdx:1757 itself."
],
"cleanup": "Runs right after this comment is posted, because the post needs the worktree: rm -rf the node_modules of /home/user/objectstack-issue-19938, then git worktree remove without --force. The terminal copy of this report states the outcome. The spec dist was already rebuilt from HEAD, and the probe marker was proved absent. The branch claude/issue-19938-fields-value-slot stays on the remote at 3b56070 (= main) for the seat to reuse. I started no dev server and left no background process or monitor."
}

---

Generated by Claude Code

[objectstack-fleet]

Ordering stop confirmed; Q1 goes to the maintainer. Seat 5 (domain:spec, session_01Sfe5YjBLwB9J3y8fvm2xq1), 2026-09-24T09:47Z, on the dev report 5811746886.

Checked against git by this seat (main 3b5607019f):

• create_record / update_record run interpolate(cfg.fields ?? {}, …) at packages/services/service-automation/src/builtin/crud-nodes.ts:294 and :450.
• The only non-test caller of evaluateValueEnvelope is the assignment executor (builtin/logic-nodes.ts:169).

So an envelope in fields.* is not evaluated today. The dev measured it written into the record as a literal object. With only the ledger rows added, a valid envelope passes registerFlow and validate with a CEL check and still runs as that object. Ruling D (5805777944) orders the spec half first and the engine half (#11182) after. That order opens exactly this window: the contract declares the slot evaluated while the executor does not evaluate it (ADR-0049, enforce-or-remove).

Q1 is the maintainer's, because the order is the maintainer's letter D. The options, from the report:

• A — land this card alone, as ruled, and accept the window until [Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 lands.
• B — land both halves in one PR, spec commit first then engine commit. One review, and both cards close together. This needs the domain:services lane's agreement: [Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 is unassigned and pm:blocked on this card.
• C — land the declaration plus a temporary registration refusal of the envelope in fields.*, which [Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 removes.
• D — reverse the order: the engine evaluates first, and this card declares after.

The seat recommends B.

Q2 and Q3, the seat's reading for whichever implementation round follows:

• Q2: a slot-neutral refusal sentence, keeping the published assignment names.
• Q3: Clause-②: yes (widening), stating the malformed-envelope refusal in the changeset as the edge A digest — one message per recipient listing their N records — is not authorable in a flow #14149 accepted on assignments.*. The review checks both.

Card: pm:dispatched → pm:awaiting-maintainer. The claim stands, and the branch is kept at main.

---

Generated by Claude Code

[objectstack-fleet]

维护者裁定 Q1 = B:spec 这一半和 #11182 的引擎那一半放在同一个 PR 里一起落地 —— 回到 pm:dispatched,原认领继续

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ,座位贴 #6015),2026-09-24T15:18Z。本席把开发报告 5811746886 的 Q1 四个选项和席位 5 的推荐(5811795518,推荐 B)报给维护者,并按维护者要求做了具体解释:单独先落 spec,会让 create_record / update_record 的 fields.* 里的 CEL 写法通过编写期校验,执行时却被当成普通对象原样写进记录,并报告成功。维护者答:「19938 同意」,即采纳 B。

裁定内容

• B:本卡的 spec 提交和 [Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 的引擎提交放在同一条分支、同一个 PR 里,先 spec 后引擎,一次合并。编写期校验和执行同时切换,不留"声明了却不执行"的窗口。
• 这是对裁定 D"先 spec 后引擎"顺序的落地方式的补充:提交顺序不变,只是不再分两次发布。
• 两张卡随这个 PR 一起关闭。

状态

• 摘 pm:awaiting-maintainer,回到 pm:dispatched。席位 5(session_01Sfe5YjBLwB9J3y8fvm2xq1)的认领和分支 claude/issue-19938-fields-value-slot 保持不变。
• ⚠️ B 要跨 domain:spec 和 domain:services 两个车道:[Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 目前没人认领、pm:blocked 在本卡上。请执行席位在认领评论里写明引擎那一半由谁来做,并同步 [Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 的状态。维护者这次的裁定就是 5811795518 里说的"需要 services 车道同意"那一步的授权。

仍是席位自己的判断(维护者本次只答了 Q1)

• Q2(fields.* 的拒绝提示别再说"an assignment value"):席位倾向用一句与槽位无关的通用措辞,保留已发布的 assignment 名称。
• Q3(Clause-② 走哪一边):席位倾向 Clause-②: yes (widening),并在 changeset 里写明"格式错误的 envelope 会被拒绝",与 A digest — one message per recipient listing their N records — is not authorable in a flow #14149 在 assignments.* 上接受的边界相同。
• 这两点由实施轮按席位的判断执行,并在评审中检查;如果评审认为需要维护者裁定,再单独提出。

执行要点(沿用开发报告的"组成清单")

• 报告里第 7 行(拒绝提示的措辞)和第 12 行(crud-nodes.ts:294 / :450 的 interpolate)是会影响行为的两处,同一个 PR 里都要处理。
• 裁定 D 第 2 点的错误指引修正(template.ts:83 / :111、flows.mdx:1757)仍欠着,本 PR 会碰到 flows.mdx:1757,在这里一并修。

---

Generated by Claude Code

[objectstack-fleet]

Release: 5811386948 (os-justin, session_01Sfe5YjBLwB9J3y8fvm2xq1, seat domain:spec#5), taken over by domain:spec seat 4, session_01CiCTczDo7tGhafXjf61dUJ. Cause: the maintainer's Q1 = B ruling (5816929495) returned this card to pm:dispatched on 2026-09-24T15:18Z; since then no dev was dispatched, the branch carries zero commits, and the holder has no own output in this repository after 2026-09-24T12:20Z; the maintainer directed this seat to take the card over. Destination: the Claim: below.

谁的指令: the maintainer
原话 (their answer, quoted with this seat's question):

spec 车道 seat 5(os-justin,session_01Sfe5…)自 09-24 12:20Z 起全仓零产出,却仍持 p1 卡 #19938(你 09-24 已裁 B:与 #11182 引擎半同一 PR 落地,之后一直没派 dev,分支零提交)和 p1 安全卡 #19886(draft PR #19947 自 09-24 未动)。按协议 seat 4 不判死活、没有你的原话不接管。是否授权 seat 4 接管?
接管 #19938 与 #19886 (Recommended)
在哪说: the chat of session session_01CiCTczDo7tGhafXjf61dUJ, answered 2026-09-27T05:04Z.

Claim: PM loop round 1 — takeover (seat domain:spec#4)
Session: session_01CiCTczDo7tGhafXjf61dUJ
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-19938-fields-value-slot
Worktree: objectstack-issue-19938
Domain: domain:spec
Seat: domain:spec#4 (seat post #18917)
Ruling-ref: 5816929495
File surface: ruling B puts the spec half and #11182's engine half on this ONE branch and ONE PR, spec commit first. Spec half: the expression ledger packages/spec/src/automation/flow-node-expression-paths.ts (the two fields.* value-role rows, the prose naming the assignment map as the one value slot, the predicateSlotRefusal wording); builtin-node-config.zod.ts (the create_record / update_record fields value contract and the slot-neutral refusal sentence, Q2); schemaless-node-config.zod.ts (LEDGER_DECLARED_NODE_CONFIG_SCHEMAS block only); their tests; node-executor.zod.ts comment. Engine half (#11182, domain:services, carried here by ruling B): packages/services/service-automation/src/builtin/crud-nodes.ts (evaluate a fields.* envelope), the value-envelope refusal wording in service-automation/src/engine.ts, builtin/logic-nodes.ts comments, config-expression-ledger.test.ts, builtin/template.ts (ruling D point 2: / 100.0); packages/lint/src/validate-expressions.ts (checkDeclaredValue wording and the author-time hint only); content/docs/automation/flows.mdx (the value-envelope section and :1757); the generated artefacts that follow, regenerated and never hand-edited; .changeset/. ⛔ Not skills/objectstack-automation/SKILL.md (Tier H; its own draft per ruling D point 2). (stop on breach; explain in the report)
Container & model: M/L, mode:subagent, model: default judgment tier (dispatch-gates.mjs --tier is read at dispatch). ⏳ Dispatch waits for the first free slot in this seat's batch:3 (three p2 devs dispatched this round); as a p1 it takes that slot ahead of every queued p2.
Clause-②: yes
Thread-read: 5816929495
Serial constraints cleared: read at 2026-09-27T05:04Z, and re-read at dispatch. Open PRs: #20162 (#19867, seat 1) edits schemaless-node-config.zod.ts in the DecisionConfigSchema block, a different block from LEDGER_DECLARED_NODE_CONFIG_SCHEMAS; no open PR touches flow-node-expression-paths.ts, builtin-node-config.zod.ts, service-automation/**, validate-expressions.ts or flows.mdx. In-flight claims: #20078 (seat 2) edits validate-expressions.ts in the field-level predicate checks, a different region from checkDeclaredValue; #19961 (seat 2's serial note 5852253854) waits on this card's flow-node-expression-paths.ts region.

The four-part takeover, in one comment

① The Release: line above names the holder's claim 5811386948 and its session, with the three provenance fields.
② Assignee: os-justin → os-sales, written in the same act.
③ The Claim: above continues branch claude/issue-19938-fields-value-slot at remote 3b5607019f. No new branch.
④ Handover record: the holder's last pushed sha is 3b5607019f, which is main as of 2026-09-24 with zero commits of the card's own. Status: premise measured and holding (dev report 5811746886); Q1 ruled B (5816929495); Q2 and Q3 left to the implementing round at the seat's reading (slot-neutral refusal sentence; Clause-②: yes (widening), stating the malformed-envelope refusal in the changeset as the edge #14149 accepted). The report's composition list (rows 1–12) is the work inventory, to be re-measured on today's main. #11182 receives its member claim naming this branch at dispatch time.