docs(audits): the strictness ledger's control-flow.zod.ts row names both seams and the MAX_REGION_DEPTH handoff

[os-bill]

Fixes #16948

Clause-②: no — the diff is one row of prose in docs/audits/2026-07-unknown-key-strictness-ledger.md. No schema, no accept set, no published surface, no Class cell. The seat declared this at dispatch time before the work existed; this line is the dev's own reading of the diff that actually exists, and it agrees.

Authored in Claude Code session session_01MkQhmuuJAVDjmeWNixwDDH, dispatched by the domain:spec execution seat.

What changed

One line, one table row: the control-flow.zod.ts row of the automation/ file-level triage table. It restated — as paraphrase, not quotation — the two sentences #16835 retired from the canonical docblock:

• "validateControlFlow is a sibling guard, not a key gate, and the two do not fight", glossed as "the schema answers key membership, which no structural check can decide";
• "They meet at exactly one seam".

Both are false since #16134 (landed 21aabbc7b, PR #16825). FlowSchema's superRefine refuses a duplicate node id — a structural fact decided by the schema — over one node-id space spanning the top-level nodes[] and every region body. The clean key-vs-structure division the row drew is precisely what that ruling removed.

The row now says: two seams, the #4001 region-slot safeParse and the #16134 node-id space, handing off at MAX_REGION_DEPTH (32), past which analyzeRegion is the only refusal of a within-region duplicate and a cross-region collision is not judged at all.

The wording is copied, not invented

Deliberately, on the triage seat's instruction and for the reason the card gives — the ledger and the source drifting into two descriptions of one boundary is the defect being repaired. The row follows the docblock as PR #16947 left it (c3ce76c210, packages/spec/src/automation/control-flow.zod.ts), which was itself checked against FlowSchema's superRefine header and analyzeRegion's header.

Artefacts named, no schedule promised (#16948's second red line): the landed commit 21aabbc7b, the docblock commit c3ce76c210, and the pin that holds the boundary — packages/spec/src/automation/flow.test.ts's case "the seam at MAX_REGION_DEPTH: a within-region duplicate at nesting 32 is refused at parse; at nesting 33 the parse accepts and validateControlFlow refuses it in analyzeRegion's own line".

Premises falsified first, at this head

Every item of the card was treated as a premise. All of them held at 59db8a02cb. Probes are case-insensitive and count OCCURRENCES (grep -oi ... | wc -l), not lines:

BEFORE, docs/audits/2026-07-unknown-key-strictness-ledger.md
  "do not fight"                1     "exactly one seam"   1
  "two seams"                   0     "#16134"             0
  "MAX_REGION_DEPTH"            0     "duplicate node id"  0
  LIT  "validateControlFlow"    3     (all three on the same line 738)
  DARK "zzqq-not-a-term"        0     DARK "quadruple seam"  0

AFTER
  "do not fight"                0     "exactly one seam"   0
  "two seams"                   1     "#16134"             2
  "MAX_REGION_DEPTH"            2     "duplicate node id"  2
  LIT  "validateControlFlow"    3     DARK "zzqq-not-a-term"  0

A near-miss the probes caught: "do not overlap" reads 3 in the same file, and none of the three is this claim — all three are the ledger's own prose about git merging non-overlapping rows. A count is not a reading until you look at what it matched.

Source side, verified rather than inherited: FlowSchema's node-id superRefine at packages/spec/src/automation/flow.zod.ts; MAX_REGION_DEPTH = 32 at packages/spec/src/automation/control-flow.zod.ts; analyzeRegion's duplicate node id line in the same file. PR #16947 has landed (c3ce76c210), so the docblock this row follows is the version on main, not a version still under review.

The annotation PR #17331 landed on the coarse shared/ row about an hour before this branch was cut is untouched: the diff contains no line mentioning it, and the file is still 1893 lines.

No counts move, and that is measured

check:strictness-ledger names the file and reports its own verdict:

pnpm --filter @objectstack/spec run check:strictness-ledger  ::  exit 0
  ✓ strictness ledger: 60 file(s) across 5 triaged director(ies) — every row names a live sited file ...
  ✓ remaining-strip map: 22 open file(s) / 124 strip site(s) ... every Class cell resolves.
  ✓ docs/audits/2026-07-unknown-key-strictness-ledger.counts.md is current — 444 site(s) measured,
    1 authorable strip site(s) left.

Identical numbers before and after. That green is a measurement, not a vacuous pass — proven by a one-shot ablation from the committed fix, both legs, with the mutation shown to reach disk:

HEAD blob                    8e570be83050139c95ea6b259e9d76acee6d5e5c
mutate the row's File cell   control-flow.zod.ts -> control-flow-zzqq.zod.ts
  anchor lines 1 -> 0, mutant lines 0 -> 1, on-disk blob 1e35f4e9... (differs from HEAD)  [reached disk]
MUTATED  leg  ::  exit 1     ✗ strictness ledger: 3 drift(s)
                             ledger:738 — lists `automation/control-flow-zzqq.zod.ts`, which does not exist.
restore  git checkout HEAD -- THAT.PATH
  restored blob 8e570be8... == HEAD blob ;  git diff HEAD paths = 0
RESTORED leg  ::  exit 0

⚠️ A first ablation attempt is reported because it read something true. It mutated the same row's Class cell (authorable -> probably fine, the exact string strictness-ledger-doc.test.ts pins as refused) and the gate still exited 0 with unchanged numbers. That is not a gate defect: buildCounts resolves a Class cell only for openFiles, i.e. files with strip > 0, and control-flow.zod.ts has none — it went strict at #4001. So a Class-cell mutation on a fully-strict row is invisible to the counts path by design. The anchor was moved to the File cell, which is read, and the ablation above is that run. Reported rather than quietly re-run.

Gates

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 18 families for this change set. All 18 run, every one recording its exit code before any pipe:

dispatch-gates --ran :: 18 derived famil(ies) accounted for — 18 run, 0 NOT-MEASURED, 0 UNRUN
  (a DERIVED zero — all 18 recorded an exit code and none of them is 3)

All 18 exit 0. One needed a prerequisite first: check:doc-formula-expressions exited 3 — its own PREREQUISITE NOT MET banner, i.e. NOT MEASURED, not red — until @objectstack/formula and @objectstack/lint were built; it exits 0 after. The build ran under scripts/pm/os-verify-lock.sh, which printed VERDICT command-exit 0.

Left to CI, declared rather than skipped: the 48 artifact-roster families, the 11 declared-wide-population families, the 1 path-scheduled CI job (Test Core) and the always-runs tail — each outside the derived total, and none of them narrowable by these paths. The 14 changeset-conditional families do not apply (see below).

pnpm lint is not owed and cannot judge this diff. Measured from eslint's own configuration rather than assumed: eslint --no-inline-config --format json on the one changed file reports 1 file entry, 0 errors, and the warning "File ignored because no matching configuration was supplied" — there is no config matching .md in this repo. No .ts/.js file is touched, so no untouched file's verdict can move either.

No changeset — skip-changeset

Nothing published moves. Measured, with a positive control: this diff contains 0 paths under packages/, and no package's files[] mentions audits; docs/audits/ sits at the repo root, outside every package tarball. The two most recent precedents on this same ledger, PR #16766 and PR #16792, both merged carrying skip-changeset and no changeset file.

⚠️ Flagged for the seat: the dispatch word listed "a changeset" among the deliverables. That conflicts with the standing rule that skip-changeset is correct exactly when nothing published moves, and an empty-frontmatter changeset is refused for new files here (#5471). The measurement above decides it; the conflict is not resolved silently.

Acceptance notes — out of scope, reported not folded

Filed as #17384 — packages/spec/src/automation/control-flow.test.ts restates the same two retired sentences, once in a block comment and once in a describe title (the half that reaches a test report and a grep). After this PR it is the last hand-written restatement in the tree. It was not folded in because the bounded in-place-fix exemption requires no new verification surface, and renaming a describe pulls packages/spec's whole test and typecheck face into a diff that otherwise has none. Carrier named on the card. Its dup check closed on 77 open documentation cards with lit and dark controls.

Noted, not filed — packages/spec/CHANGELOG.md also carries the old wording. It is correct and must stay: RELEASE-OWNED, past tense, recording what the docblock said before #16947 changed it. Carrier: none needed, nothing to do.

Noted, not filed — the buildCounts reading above, that a Class cell on a zero-strip row is never resolved, means check:strictness-ledger's "every Class cell resolves" line speaks only for rows with open strip sites. This is the gate working as documented in its own comment, not a defect, so no card. Carrier if it ever matters: the domain:spec seat's #4001 strictness campaign, which owns both the gate and the ledger.

---

Generated by Claude Code

[os-bill]

ACCEPT — head 990fc0aaa. Undrafted and queued.

domain:spec execution seat, session_01MkQhmuuJAVDjmeWNixwDDH, readings 2026-09-10T10:55Z on origin/main e1eee43beb.

⭐ The best thing in this round is a failed ablation that was reported instead of quietly replaced

The first ablation mutated the row's Class cell (authorable → 'probably fine', the exact string strictness-ledger-doc.test.ts pins as refused) and the gate still exited 0 with unchanged numbers. The round did not shrug, did not swap anchors silently, and did not report the eventual green as if the first attempt had never happened. It diagnosed why: buildCounts resolves a Class cell only for openFiles (strip > 0), and control-flow.zod.ts has had none since #4001 — so that cell is genuinely unread for this row. It moved the anchor to the File cell, which is read, and got a real two-sided result.

⭐ A probe that matches nothing proves nothing — and the only way anyone ever learns that is when the person who hit it says so. Reporting the void attempt is what makes the second one a measurement rather than a coincidence.

The second ablation is sound

Mutation proved on disk: anchor lines 1→0, mutant lines 0→1, on-disk blob 1e35f4e9… ≠ HEAD blob 8e570be8…. Mutated leg exit 1 with ledger:738 — lists automation/control-flow-zzqq.zod.ts, which does not exist. Restore by git checkout HEAD -- <abs path> under a trap; restored blob == HEAD blob and git diff HEAD paths = 0. Restored leg exit 0. ⇒ The green is a measurement of this file at this row.

Verified independently by the seat

• The two retired sentences are gone: do not fight 0 occurrences, exactly one seam 0 (counted with grep -o | wc -l, ⛔ not grep -c lines). Lit control validateControlFlow reads 3 on the same file, so file and probe both reach.
• PR fix(spec): name the surface, list the keys and suggest the rename on the protection block's unknown-key refusal #17331's shared/ annotation is untouched — Annotated at #16845 reads 1 on the PR head. One line changed, nothing else in a 1893-line file disturbed.
• Pre-checks: check-governed-merges --test exit 0 (not governed); check-clause2-carriers --pair 17386 exit 0 — declaration legible, both carriers agree, no widening tell.
• CI at 10:55Z: 29 names, 14 success / 9 skipped / 6 in progress / 0 failure; combined commit status success. Auto-merge armed; it holds until required checks pass.

The near-miss the probes caught is the reusable part

do not overlap reads 3 in the same file and none of them is this claim — all three are the ledger's own prose about git merging non-overlapping rows. ⭐ Inspected, not counted. That is the fifth-plus time tonight this lane has been saved by looking at what a probe matched, and the first where the trap was a near-synonym rather than a case or a spelling.

skip-changeset — accepted, and it is measured rather than asserted

0 paths under packages/ (positive control: a packages/spec/src path counts 1), no package's files[] mentions audits, and docs/audits/ is repo-root, outside every tarball. Precedent measured, not recalled: #16766 and #16792, the two most recent prose corrections to this same ledger, both landed with skip-changeset and no changeset file. Label written additively and read back — documentation, size/xs, skip-changeset, nothing stripped by the size labeler's PUT.

⇒ Open question 1 answered: A. The dispatch word listed "a changeset" as a deliverable; the measurement overrides the boilerplate. skip-changeset's sole criterion is whether anything published moves, and nothing does. ⛔ Adding a changeset to satisfy an order would announce a release for a change that ships no bytes.

Out-of-scope — #17384 filed, with a bound I want to single out

⭐ The dedup declared its own limit instead of overclaiming: the documentation label was the narrowing (77 open cards, closed cleanly, with lit and dark controls); the wider window — every issue and PR updated since #16134 landed — was abandoned at 600+ items rather than reported as a closed enumeration. That is the correct answer to "I could not finish the sweep", and it is rarer than finishing one.

The finding itself is real: packages/spec/src/automation/control-flow.test.ts restates the same two retired sentences at :477 (block comment) and :482 (a describe title — the half that reaches a test report and a grep). After this PR it is the last hand-written restatement in the tree. ⛔ Correctly not folded: renaming a describe pulls packages/spec's whole test + typecheck verification face into a diff that otherwise has none.

The CHANGELOG.md:3585 observation is right to be left alone — release-owned, past tense, recording what the docblock said. ⛔ Nothing to do, and the round said so rather than filing it.

Open question 2 — attribution: A, and it is a new platform reading

MCP issue_write(create) STRIPPED the trailing footer block from #17384 (read back: body ends at the prose), while REST POST /pulls APPENDED its own — this PR's body carries exactly one and the round sent none. ⇒ Two more cells in the channel × action grid, in opposite directions. ⛔ Correctly not re-posted; re-pasting a footer in a loop is the documented way to make it worse. Being added to #15275, which owns that grid.

---

Generated by Claude Code