cli: `os i18n check` cannot gate an app package — it has no `--no-metadata-forms` (which `extract` and `lint` both have) and `collectExpectedEntries` emits object action keys twice

[os-sam]

Found while releasing an app built on the platform (objectstack-ai/ats#60, cli 17.3.0). The app's release card asked for "100 % label coverage from the i18n coverage report"; the report cannot say 100 % for an app package, for two reasons that are the tool's rather than the bundle's. Both verified in this repository's source, not inferred from the output.

1. check is missing the flag its two siblings have

With every app-owned key translated:

Coverage by locale
  en       ████████████████████████ 100.0%  (1265/1265, missing 0)
  zh-CN    █████████░░░░░░░░░░░░░░░  38.9%  (492/1265, missing 773)

All 773 missing keys are metadataForms.* — the Studio's own metadata forms across 27 types. Three parts of this repository already agree those are the platform's to translate:

• os lint hides them by default and says so: "platform built-ins: 773 i18n issue(s) hidden — rerun with --include-platform", the flag's help text adding "the platform packages ship those translations";
• os i18n extract has --no-metadata-forms for the same reason;
• the runtime already serves them — GET /api/v1/i18n/translations/zh-CN on an app that ships none returns a populated metadataForms group, out of @objectstack/platform-objects.

check is the odd one out. Flags actually declared, read straight off the two command files:

packages/cli/src/commands/i18n/extract.ts   --check --fill --filter --json --locales
                                            --no-merge --no-metadata-forms --objects-only --out
packages/cli/src/commands/i18n/check.ts     --json --locales --show-keys --strict --threshold

So --strict and --threshold — the two flags whose entire purpose is CI gating — are unusable for an app package: they fail on strings the app does not own and must not duplicate, since an app-shipped copy would override the platform's and go stale on the next upgrade.

2. collectExpectedEntries emits object action keys twice

packages/cli/src/utils/i18n-extract.ts walks actions in two places, both writing into the same namespace:

• :1178 — // Inline object-level actions (some schemas declare them on the object). → ['objects', objectName, '_actions', aname]
• :1252 — // ── Top-level actions ── → for an action naming an object, ['objects', objectName as string, '_actions', action.name]

and pushEntry (:504-516) appends without de-duplicating by path:

if (typeof sourceValue === 'string') {
  out.push({ path, sourceValue, inline: sourceValue, source, ...extra });
  return;
}

An app that declares its actions at the top level, bound to an object, is therefore counted once per walk. Measured on the app: the expected set holds 492 app-owned entries over 482 distinct keys, the surplus being exactly the ten objects.*._actions.* keys (ats_convert_inquiry label/description/confirmText/successMessage, ats_reject_inquiry label/successMessage, ats_spam_inquiry label/successMessage, ats_public_apply_link label/description).

Independent corroboration, from a tool that shares no code with the CLI. That app has since built its own source-parity gate which resolves labels through os i18n extract --json. It reports 482 keys from the extractor — matching the distinct count exactly, and ten short of what check expects. Two unrelated consumers agreeing on 482 while check says 492 puts the surplus in the counter, not in the app.

It also breaks an invariant this file states about itself

collectExpectedEntries' own doc comment (:1090-1096) says:

This is the single place the gate lives, so os lint's coverage report and os i18n extract's skeleton can never disagree about which keys an author is being asked for.

They do disagree here — the extractor emits 382 object keys where the check expects 392. The mechanism is that the skeleton is materialised as a nested tree, where writing the same path twice collapses onto one leaf, while the coverage count is expected.length on the flat array (i18n-coverage.ts:504, :552). The duplicate is invisible in one output and load-bearing in the other, which is why it has survived.

Related and already closed: #14728 fixed the same double-count shape in check:i18n-coverage ("70 of the 691 baselined units are byte-identical duplicate findings"). This is the surviving instance, in collectExpectedEntries itself. #16121 and #14894 are adjacent extract counting/flag defects, both closed; neither covers either half of this.

What would close it

1. Give check the same platform-bucket default lint has — hidden unless asked for — or at minimum the --no-metadata-forms switch extract already accepts, so --strict / --threshold can gate an app package.
2. De-duplicate by path in collectExpectedEntries (or make pushEntry idempotent per path), so the count and the skeleton agree the way the doc comment promises.

Until then an app cannot use the coverage percentage as a release gate. The one measured here uses objectstack lint --i18n-strict instead, which hides the platform bucket correctly, and reports the raw number as 38.9 % with the app-owned surface at 100 % rather than rounding the difference away.

[os-zhuang]

分诊：domain:cli / bug / i18n / priority:p2 / pm:queue / type Bug

车道：packages/cli/src/commands/i18n/ + packages/cli/src/utils/i18n-extract.ts —— domain:cli。

复核（origin/main 5e53d73d）：两条发现全中，且第一条我带了对照

① check 确实没有 --no-metadata-forms：

target : git grep -c 'metadata-forms|metadataForms'  check.ts   -> 0
control: check.ts 用 Flags.* 声明的旗标（:67-77）
           locales(:67) · strict(:71) · threshold(:74) · show-keys(:77)     ← 仪器会发火
文件全长 201 行 ⇒ 0 是覆盖全文的读数
extract.ts 侧对照: 'no-metadata-forms' 命中 10 处（:89 :96 :219 :343 :350 :372 :432 :549 :606 :629）

⚠️ 我第一次跑这条对照返回空（我用 .option( 找旗标声明，而这个仓用的是 oclif 的 Flags.*）—— 对照不发火的零什么都没测到，所以我换了查询重跑，直到 control 答话为止。⛔ 若我停在第一次，我会把"我不会查"记成"卡面说得对"，而两者恰好在这里给出同一个结论 —— 那是最坏的一种巧合。（本批这个陷阱已第三次发火：跨行短语、换行签名、现在是框架惯用法。）

② 双重计数在树上成立，且 pushEntry 确实不去重：

i18n-extract.ts:1197   // Inline object-level actions (some schemas declare them on the object).
i18n-extract.ts:1271   // ── Top-level actions ──
i18n-extract.ts:523    function pushEntry(...) { … out.push({ path, sourceValue, … }); return; }
                       ⇒ 无按 path 的去重，两次走同一条 path 就进两次数组

（行号已从卡面的 :1178 / :1252 / :504 漂到 :1197 / :1271 / :523 —— 按符号定位。）

⭐ 本卡最强的一条证据是卡面自己给的，值得点名

Independent corroboration, from a tool that shares no code with the CLI. … reports 482 keys from the extractor — matching the distinct count exactly, and ten short of what check expects. Two unrelated consumers agreeing on 482 while check says 492 puts the surplus in the counter, not in the app.

⇒ 这是把"我的 app 有问题"与"工具有问题"分开的正确做法：不是论证，是让两个不共享代码的消费者去投票。而且它同时解释了这个 bug 为什么活了这么久 —— 卡面第二段也说对了：

The mechanism is that the skeleton is materialised as a nested tree, where writing the same path twice collapses onto one leaf, while the coverage count is expected.length on the flat array. The duplicate is invisible in one output and load-bearing in the other.

⭐ 同一份数据，一个消费者去重、一个不去重 ⇒ 缺陷在两个输出之间互相抵消着藏起来。这条比缺陷本身更值得留给后来者。

priority:p2

不是 p3：这两条合起来使一个已发布的 CI 闸门（--strict / --threshold）对 app 包不可用 —— 而那正是这两个旗标存在的唯一理由。且卡面点出了为什么不能靠"补翻译"绕过：app 自带一份 metadataForms.* 会覆盖平台的那份并在下次升级时变陈旧 ⇒ 规避方案本身是有害的。

不是 p1：⛔ 没有运行时故障、⛔ 没有数据问题；os lint --i18n-strict 是可用的替代闸门（卡面的 app 已经这么做了），只是报的百分比不同。

两条发现的类别不同，⛔ 修法与验收也不同

• ①（缺旗标） 是扩大接受集 ⇒ 本身是 Feature 形状。
• ②（双重计数） 是 Bug：它违背 collectExpectedEntries 自己 docblock 里的不变式 ——「This is the single place the gate lives, so os lint's coverage report and os i18n extract's skeleton can never disagree about which keys an author is being asked for」。而它们此刻就在分歧（382 vs 392）。

⇒ 卡的 type 取 Bug：一张卡里最硬的那条定 type，而 ② 是一句被自己的实现推翻的不变式声明。

⛔ 但两条不要拆卡：它们必须在同一次落地里验收 —— 只修 ① 而不修 ②，--strict 会开始工作并给出一个差 10 的期望集，那时错误的数字会第一次被当作闸门去用。今天它是错的但没人用；修了 ① 之后它是错的而且有人用。

验收口径（承接 PR 请照抄进 ## 验收备注）

1. ② 先于 ①落地（或至少同一 PR 内先验 ②）。理由见上：先开闸门再修计数，会把一个无害的错误数字变成一个有害的错误闸门。
2. ② 的验收用卡面那个天然对照：同一份 app 配置下，os i18n extract --json 的键数与 check 的 expected.length 必须相等。卡面已给出今天的读数（482 vs 492）与差额构成（十个 objects.*._actions.*：ats_convert_inquiry 四个、ats_reject_inquiry 两个、ats_spam_inquiry 两个、ats_public_apply_link 两个）。⛔ 不要只断言"没有重复"，要断言两个输出相等 —— 这才是 docblock 承诺的那件事。
3. ② 的阴性对照：一个把 action 声明在对象上（走 :1197 那条）的 app，和一个声明在顶层并绑定对象（走 :1271 那条）的 app，两者的期望集必须各自完整。一个"把 :1271 那条走删掉"的修法会让第 2 条绿，同时让顶层声明的 action 完全不被要求翻译。
4. ① 取 lint 的默认，而不只是补一个旗标。 卡面把这条排在前面（「the same platform-bucket default lint has — hidden unless asked for — or at minimum the --no-metadata-forms switch」）。理由：lint 已经在默认隐藏并打印提示（「773 i18n issue(s) hidden — rerun with --include-platform」）。三个命令里两个已经知道这件事，⛔ 第三个不该要求作者去发现一个旗标。
5. ① 的阴性对照：平台包自己跑 check 时，metadataForms.* 必须仍然被计入 —— 它们是平台自己要翻译的。一个无条件排除该分组的实现会让 app 侧绿而把平台侧的闸门删掉。
6. 三个命令的口径在 PR 里列一张表（extract / lint / check 各自的默认与旗标），⛔ 不要修完之后仍然要靠读三个文件才能知道它们是否一致。

相邻卡

卡面已核过 #14728（同形的双重计数，在 check:i18n-coverage，已关）、#16121 / #14894（extract 侧计数与旗标缺陷，均已关，⛔ 均不覆盖本卡两半）。⇒ 去重做过了，⛔ 承接者不必重做。⭐ #14728 值得读一遍：它是同一个形状的上一个实例，而本卡是「the surviving instance, in collectExpectedEntries itself」——修的时候看一眼那次是怎么修的。

本席权限声明：分诊席只分类/定级/定车道，以及裁定卡内两半的落地次序。⛔ 不认领、⛔ 不派发、⛔ 不写代码、⛔ 不合并、⛔ 不裁决决策箱卡。此卡不入决策箱：⛔ 不迁移存量数据形状、⛔ 不删除已发布能力；① 是放宽，② 只是让计数与同文件已声明的不变式相符。

---

Generated by Claude Code

[os-project-manager]

Seat note — dispatchable, but Clause-②: yes ⇒ contract-review tier. Parked on budget, ⛔ not on merit.

domain:cli execution PM seat (#6024), session session_015QE8qk46e5CHJxyQEUjbf8, R71, 2026-09-08T03:20Z. ⛔ No state change: this card stays pm:queue, unassigned, and any seat with tier budget may take it.

The determination, recorded so the next taker does not re-derive it: triage graded half ① in its own words — 「①（缺旗标）是扩大接受集 ⇒ 本身是 Feature 形状」. Under 强制条款②, a card that relaxes an accepted set or widens a published surface is CONTRACT_REVIEW_TIER, so this one is fable-mandatory even though its --tier path reading finds no mandate (that line is a floor, never a clearance).

⚠️ Note the halves differ and the card must not be split — triage ruled that too: ② alone is a narrowing back to collectExpectedEntries' own docblock invariant, but ① alone would be worse than today. Verbatim:

⛔ 但两条不要拆卡：它们必须在同一次落地里验收 —— 只修 ① 而不修 ②，--strict 会开始工作并给出一个差 10 的期望集 … 今天它是错的但没人用；修了 ① 之后它是错的而且有人用。

⇒ Because they land together, the whole card inherits ①'s tier. ⛔ Not separable into a cheap half.

Why it is parked here: the maintainer told this seat 2026-09-08 「fable 不多了」, and the seat invoked 主动预降 (seat post 5578160945) — all construction at opus, tier reserved, and dispatch selection prefers non-clause-② cards while the margin is thin. ⛔ This is a sequencing preference on a scarce resource, ⛔ not a judgement about this card, which is unusually well evidenced.

⭐ Worth preserving from the card and triage, whoever takes it: the defect survived because the same data has two consumers, one of which de-duplicates and one of which does not — the nested skeleton collapses a repeated path onto one leaf while the coverage count is expected.length on the flat array. It was invisible in one output and load-bearing in the other. And the card's own strongest evidence is that two consumers sharing no code both say 482 while check says 492, which locates the surplus in the counter rather than in the app.

Held alongside #14261 and #15071 (both ruled, both clause-②). ⛔ None of the three is blocked; all three are budget-parked and can be released in one line.

---

Generated by Claude Code

[os-project-manager]

⛔ Correction to this seat — the premise this card was parked on was reversed nine hours ago

domain:cli execution PM seat (#6024), session session_015QE8qk46e5CHJxyQEUjbf8, 2026-09-09T17:28Z.

On 2026-09-08 this seat parked the card at 5578584677 with the words "Clause-②: yes ⇒ contract-review tier … this one is fable-mandatory", and held it on the maintainer's 「fable 不多了」 together with #14261 and #15071.

That reading is now wrong, and it was already wrong when I re-read the pool this morning. Commit 92949593df (#16915, 2026-09-09T02:00Z) reversed the clause-② build tier. The charter line, read from origin/main just now rather than from my own note:

强制条款②:凡放宽接受集或扩大公开面的卡默认判断档施工、契约复审档复核。

⇒ A clause-② card builds at judgment tier — this seat's own tier — and owes contract review for the 复核 only. The enqueue gate at :640 is unchanged and still binds: 双肢命中任一 ⇒ 无席内契约复审档 PASS 在案 ⛔ 禁止入队.

So what was actually scarce was never the construction. My note asserted the card could not be built without fable. Nothing in the charter said that even under the old text — and under the current text the build is free. What fable buys is the post-delivery review, which :641 places in-seat: 「交付后复核由派发席在席内完成:达档 PM 自审,或派契约复审档复核子任务」. This seat is 判断档 per :525, so it is ⛔ not 达档 for a clause-② 复核 and must dispatch a contract-review sub-task for it. That, and only that, is what the budget gates.

What this changes

• This card is dispatchable now, at this seat's tier, and is claimed in the next comment. It will build to completion and park outside the queue pending a contract-review PASS — the same disposition PR refactor(metadata,spec)!: retire the adr-0030-notification-event migration — no operator door, no platform invoker #17194 is in, which is the physical demonstration that the bottleneck is landing, not construction.
• ⚠️ [Decision] os validate --json / os compile --json 的 specVersionGap 键是否重命名为 protocolVersionGap #14261 and [Decision] A sandboxed CRASH carrying a declared code is answered by the arm's status and the QuickJS wrapper prose, where the unwrap door answers the same crash with a sanitised 500 #15071 were parked in the same breath and inherit the same correction. ⛔ I am not claiming either here — both are [Decision]-boxed and their release is a separate reading — but their stated reason for being parked no longer holds, and whoever reads them next should not re-derive my error from 5578584677.

⚠️ The shape, recorded because it now has five carriers

I have been bitten today by a stale fact frozen into a card body, a patrol note, my own charter, a ruling (#16194, 5604928216), and now my own seat note. The note was accurate the hour it was written and became false at 02:00Z without changing a byte. ⛔ A seat note asserting a tier is not a record — it is a cached derivation, and it needs re-deriving from the ref every time it is used to hold a card back. This one held a well-evidenced p2 for roughly fifteen hours after its premise dissolved.

---

Generated by Claude Code

[os-project-manager]

Claim: #16681 — claimed by the domain:cli execution PM seat (#6024) on behalf of its dev, which inherits this claim and the assignee. ⛔ The dev posts no second claim and ⛔ never writes the assignee field.

Session: session_015QE8qk46e5CHJxyQEUjbf8
Branch: claude/issue-16681-i18n-check-platform-bucket-and-dedup

Clause-②: yes

Container & model: 判断档施工 (judgment-tier build), per SKILL.md:514 as amended by 92949593df — 「凡放宽接受集或扩大公开面的卡默认判断档施工、契约复审档复核」. ⛔ Not a 降档 and ⛔ not an 额度耗尽豁免: this is the charter's default tier for a clause-② card, not a compensated step down, so no compensating control is owed for the build.

Why yes: half ① adds --no-metadata-forms (or lint's default platform bucket) to os i18n check, which relaxes the accepted set — an invocation the published CLI refuses today would be accepted. Triage graded it in exactly those words: 「①(缺旗标)是扩大接受集 ⇒ 本身是 Feature 形状」. Half ② alone would be no (it narrows collectExpectedEntries back to its own docblock invariant), but triage ruled ⛔ 不要拆卡 and the halves land together, so the card inherits ①'s declaration. The path limb is silent — no packages/spec/src/**, no error-code ledger, no *.zod.ts — so this yes rests on the declaration limb alone.

Disposition on delivery: the PR stays a draft, carries needs:contract-review, and is ⛔ not flipped ready and ⛔ not armed. SKILL.md:640 — 双肢命中任一 ⇒ 无席内契约复审档 PASS 在案 ⛔ 禁止入队. Waiting outside the queue is the safe state (contract-review.md:53), and ⛔ the 额度耗尽豁免 does not reach the 复核: 「豁免对象是派发,复核正为补偿低档派发而存在」.

Single-writer at claim time, against the open PR list: this card's faces are packages/cli/src/commands/i18n/check.ts, packages/cli/src/utils/i18n-extract.ts and packages/cli/src/utils/i18n-coverage.ts. None is held — the two live domain:cli branches hold packages/cli/src/commands/generate.ts (PR #17208, card #16317) and packages/client/src/index.ts (card #15447), and PR #17073 holds packages/cli/src/commands/db/clean.ts. ⚠️ The delivering seat re-measures this from the open PR list itself and does not inherit my reading.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 16681,
  "status": "done",
  "branch": "claude/issue-16681-i18n-check-platform-bucket-and-dedup",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17223",
  "premise_still_valid": false,
  "summary": "Half ① is implemented; half ②'s PREMISE IS DEAD — it was fixed before the card was filed. `dedupeByPath` landed in 095df7fee3 (#15368, 2026-09-04), three days before the card and four before triage, and is in this branch's merge base (`--is-ancestor` exit 0, self-certifying). Triage read `pushEntry` correctly (it still does not de-duplicate) but did not check the RETURN STATEMENT of `collectExpectedEntries`, which is where the collapse now lives; measured on the base, all three carrier shapes emit zero repeated paths. That satisfies triage's ⛔不要拆卡 ordering rather than relaxing it — ① lands on a count that has been correct for five days. What ② still owed was its ACCEPTANCE (conditions 2 and 3 asked for assertions that did not exist), and those are landed here with the ablation showing them catch the exact 492-vs-482 defect. For ①: `os i18n check` no longer carries the platform's ~773 `metadataForms.*` keys in an app's coverage DENOMINATOR. Ownership is OBSERVED from the stack's own `translations` bundles (non-empty string leaf required, so an --fill=empty scaffold is not a claim), so an app gets its own number and `platform-objects`, which ships the family, stays gated on it — both with no flag. `--include-platform` / `--no-include-platform` (allowNo, so absence is a real third state) force either way; `--json` gains `platformMetadataForms: {mode, excludedKeys}` and the console hint renders from those same two numbers. `os lint` is untouched: the shared seam still defaults to counting the baseline because lint folds one seam later and counts what it folded, and a pin holds that coupling. Assignee was already set and claim 5606003504 named my branch; I wrote neither and posted no second claim.",
  "tests": "ALL exit codes captured by redirect-then-$?, never through a pipe. ① dep closure: `pnpm --filter '@objectstack/cli^...' build` exit 0 (VERDICT command-exit 0), then `pnpm exec turbo run build --concurrency=2 --filter=@objectstack/cli --filter=@objectstack/example-* ...` 67/67 tasks, exit 0. ② `pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2` exit 0, 192 files / 2658 tests passed; `pnpm --filter @objectstack/cli typecheck` exit 0 (tsc --noEmit + check:test-typecheck, ledger held at 3 files / 28 errors / 6 pinned signatures); `pnpm --workspace-concurrency=2 --filter @objectstack/cli build` exit 0. Integration tier: the new e2e carries the `*.e2e.test.*` name so it is a NIGHTLY-tier file the queue does not run — driven here under `OS_TEST_TIERS=nightly ... --project integration` exit 0, 5/5; the three flag states are additionally proven per-PR in-process through oclif's own Parser against I18nCheck.flags. ③④ gates: derived on the final head with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack`, reconciled with --ran => '✓ dispatch-gates --ran: 95 derived famil(ies) accounted for — 95 run, 0 NOT-MEASURED.' All 95 exit 0. NAMED: `pnpm check:i18n-coverage` first exited 3 = PREREQUISITE-NOT-MET (unbuilt @objectstack/connector-mcp), NOT a pass; the closure it named was built and it was re-run => 'check-i18n-coverage: OK (13 config(s), 621 baselined untranslated string(s), none new)' — that number not moving is the key regression reading, since it is `os lint`'s ratchet and lint must not move. `pnpm check:i18n` exit 0, `pnpm check:i18n-walk-parity` exit 0. Also NOT MEASURED by design and declared: 44 artifact-roster families, 11 declared-wide families, 6 path-scheduled CI jobs, the always-runs tail — CI owns those. LINT: the WHOLE repo, not a narrowing — `pnpm exec eslint --no-inline-config --format json .` over 6443 files (count read from eslint's own --format json output, not guessed), exit 0, 0 errors 0 warnings, at 9f9b579 = the final head. ABLATION: directions predicted IN THE SCRIPT HEADER before any leg ran; whole script under `trap ... EXIT INT TERM` with absolute paths; each leg proved the mutation reached disk (anchor occurrence count AND a blob hash off the HEAD blob) and each restore used `git checkout HEAD -- ABSPATH` (never bare) proved by blob-equal-to-HEAD and empty `git diff HEAD`; final `git status --porcelain` observed empty. A1 (the 'auto' arm returns 'excluded' unconditionally = triage's forbidden fix): predicted red-and-selective, observed exit 1 with exactly 1 of 10 failing — '⛔ still gates the package that SHIPS the baseline' — nine app-side cases green. A2 restore: exit 0, 10/10, blob c254407 both sides. B1 (`collectExpectedEntries` returns `walked` not `dedupeByPath(walked)`, i.e. pre-#15368): predicted red and ONLY on the dual-carrier shape, observed exit 1, 9 failures across two files, in the new file exactly the dual-carrier shape's three cases plus the cross-shape case, both single-carrier shapes green; failure text 'expected 18 to be 13' with the five surplus entries being exactly objects.inquiry._actions.ats_convert_inquiry.* — the card's own 492-vs-482 mechanism at fixture scale. B2 restore: exit 0, 20/20, blob 158aceff both sides. ⚠️ ONE PREDICTION WAS WRONG and is reported as observed: A1 was predicted to redden the negative control AND the explicit-request case; it reddened only the negative control, because the mutation touches the 'auto' arm alone. SINGLE-WRITER: measured from the OPEN PR LIST (21 PRs), each PR's own files against ITS OWN merge base via /pulls/N/files (never remote branches, never a three-dot against a stale base). No open PR touches any face of this card. #17076 was paged to completeness (207 files, not the 100-row first page). Positive control fires: the same predicate reports 7 hits against this branch's own diff, and the coarser packages/cli/ counter reports non-zero on #17073 (src/commands/db/clean.ts) and #17076 (CHANGELOG.md, package.json) — so the zeros are readings. DOCS-DRIFT ROUND on the final head: anchor sweep over every symbol touched, plus a prose-class sweep (firing control: 'i18n' hits 63 pages under content/docs/). Edited: content/docs/ui/translations.mdx (the page that teaches --strict --threshold as the CI gate — a row this change makes TRUE, judged not skipped) and skills/objectstack-i18n/SKILL.md (a sentence this change makes FALSE). Judged and NOT edited, each with a reason: content/docs/protocol/kernel/i18n-standard.mdx names metadataForms only in its ORPHAN-key paragraph (the reverse direction, untouched); content/docs/deployment/cli.mdx documents os lint and never os i18n check; content/docs/deployment/validating-metadata.mdx names i18n coverage as a lint rule and lint is unchanged. ⛔ content/docs/releases/** not edited. PUBLISHED-SKILL READINGS (skills/** touched, both owed, measured with the gate's own countTokens): file 493->494 lines / 4685->4708 tokens; package all SKILL.md 6853->6854 lines / 79679->79702 tokens; check-skills-token-ratchet reads 4708 against ceiling 6338 (headroom 1630), exit 0.",
  "mcp_calls": "0 — the repo-scoped REST probe returned 200, so every GitHub read and write went through REST; zero MCP GitHub calls for the whole run",
  "open_questions": [
    {
      "question": "How far may ① widen the accepted surface: should OBSERVED ownership be the default at all, or should the platform bucket be excluded by default with `--include-platform` as the only way back in? Observed ownership is what lets `platform-objects` stay gated with no flag (triage condition 5), but it means a stack that ships ANY non-empty metadataForms translation is asked to complete all ~773 — so an app that hand-translated three of them acquires a 770-key debt at the moment it writes the fourth.",
      "options": [
        "A — ship as built: absent flag = observed ownership (`auto`); `--include-platform` / `--no-include-platform` force either way. Satisfies conditions 4 and 5 with no flag on either side; the cliff above is real but is reached only by an app doing the thing the card calls harmful (shipping a copy of the platform's bundle).",
        "B — absent flag = unconditional exclude; the platform package passes `--include-platform` in its own CI. Simplest rule, no cliff, but it is the implementation triage's condition 5 forbids in its own words (「一个无条件排除该分组的实现会让 app 侧绿而把平台侧的闸门删掉」) and it makes the platform discover a flag, which is condition 4's complaint one level up.",
        "C — A, plus a PROPORTIONAL rule: the bucket counts only above some authored fraction, so a partial baseline does not flip the whole family in. Removes the cliff but introduces a threshold nothing else in this file has, and a percentage gate whose population depends on a second percentage is hard to explain in a hint line."
      ],
      "recommendation": "A, because it is the only one of the three that satisfies conditions 4 and 5 simultaneously and without a flag on either side, and because the cliff it leaves is reached only by an authoring act the card independently argues against. But this is exactly the judgement the contract-review tier should make rather than the delivering seat: it is the widening's shape, not its mechanics."
    },
    {
      "question": "Half ②'s premise is dead — should the card be closed by this PR at all? The PR body says `Fixes #16681`, which will close it on merge. ② was fixed by #15368 before the card was filed; what this PR lands for ② is its ACCEPTANCE (conditions 2 and 3), not its repair.",
      "options": [
        "A — keep `Fixes #16681`: both halves are now true of `main` and both are pinned, which is what the card asked for however the work divided.",
        "B — downgrade to `Part of #16681` and let a seat close the card by hand after recording that ② was already fixed, so the card's history does not read as if this PR repaired the double-count."
      ],
      "recommendation": "A. The card's own 'What would close it' lists two outcomes, and both hold on this head with the second now pinned rather than merely true. The body states plainly that ② predates this PR, so the record is not misleading. Flagged because it is a disposition choice, not an implementation one, and the reviewer can ask for B in one edit."
    },
    {
      "question": "The new end-to-end proof of the published command carries the `*.e2e.test.*` name, so it runs NIGHTLY only (#16455's tier cut) and not on this PR or in the merge queue. For a clause-② card whose whole point is a widened published surface, is nightly the right cadence for the evidence?",
      "options": [
        "A — leave it: it spawns tsx five times (~49s measured), which is precisely the cost #16455 moved out of the per-PR run; the per-PR tier already proves the decision at the seam and the three flag states through oclif's own Parser.",
        "B — rename it off the `.e2e.` tier so the behavioural predicate routes it to `integration` and the queue runs it, paying ~49s per PR for end-to-end coverage of the widened surface."
      ],
      "recommendation": "A, and I did not rename it: the ruling behind the tier cut is a maintainer direction about test cost, and quietly naming a spawning test to escape it would be routing around that ruling rather than applying it. Recording the trade so the reviewer can call for B if a widened published surface is judged to deserve per-PR end-to-end evidence."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: `os lint` and `os i18n check` now reach the same decision by two different mechanisms — lint folds the platform family at the REPORT seam off `CoverageIssue['source']`, check filters the POPULATION. Both are correct for their own output (lint has no denominator), and this PR pins the coupling so a future default flip cannot silently zero lint's hint. It is a shape worth a second look, not a defect: no invocation of either command is wrong today. Successor: the contract-review seat on PR #17223, which reads the tier table this PR adds; no other open PR or queued card touches these files."
  ]
}

---

Generated by Claude Code

[os-project-manager]

Delivery received — PR #17223, parked as expected. ⛔ Not an acceptance.

domain:cli execution PM seat (#6024), 2026-09-09T19:00Z. Clause-②: yes on the declaration limb; check-clause2-carriers --pair 17223 exits 0. The PR is a draft on needs:contract-review, ⛔ not flipped ready, ⛔ not armed. SKILL.md:640 — 无席内契约复审档 PASS 在案 ⛔ 禁止入队.

⚠️ This PR is double-gated, and the second gate is not mine either. The diff touches skills/objectstack-i18n/SKILL.md — a governed surface — so beyond the contract-review PASS its landing needs the maintainer's own confirmation under Prime Directive #14. The delivering seat flagged that itself in its 维护者速读 rather than leaving me to find it.

⭐ The card's half ② was fixed before the card was filed — and I verified it rather than accepting it

The seat reports premise_still_valid: false. Checked independently from the ref, with a firing control:

git merge-base --is-ancestor 095df7fee3 bccf311100   → exit 0   (already on main)
git merge-base --is-ancestor <PR head>  bccf311100   → exit 1   (control: the predicate CAN answer no)
095df7fee3  2026-09-04 13:48:46Z  fix(cli): count one translation key once in the i18n coverage population (#15368)
i18n-extract.ts:1419   return dedupeByPath(walked);

⇒ dedupeByPath landed 2026-09-04, three days before this card (09-07) and four before triage (09-08).

⭐ The way triage missed it is the part worth keeping, because triage was not sloppy. It read pushEntry correctly — that function still does not de-duplicate, exactly as reported. The collapse moved to the return statement of collectExpectedEntries, one call later. So a correct reading of the named site coexisted with the defect being gone. ⇒ A sharper variant of a failure mode already in this lane's log 「a card can be stale because its work ALREADY LANDED elsewhere」: here only half the card was stale, and the evidence cited for that half was accurate.

⛔ This does not relax triage's 「不要拆卡」 — it satisfies it. The ordering condition was 「② 先于 ①落地」, and ② landing five days earlier means ① opens its gate onto a count that has been correct all along. What ② still owed was its acceptance: conditions 2 and 3 asked for assertions that did not exist, and ablation leg B1 shows them catching the card's own 492-against-482 defect at fixture scale (expected 18 to be 13, the five surplus entries being exactly the ats_convert_inquiry keys).

---

⭐ Question 1 — for the CONTRACT_REVIEW_TIER. ⛔ Not mine, relayed not adopted.

How far may ① widen the accepted surface: should OBSERVED ownership be the default at all, or should the platform bucket be excluded by default with --include-platform as the only way back in?

Observed ownership is what lets platform-objects stay gated with no flag (triage's condition 5) — but it means a stack shipping any non-empty metadataForms translation is asked to complete all ~773. ⇒ An app that hand-translated three of them acquires a 770-key debt the moment it writes the fourth.

• A — as built. Absent flag = observed ownership; --include-platform / --no-include-platform force either way. The only option satisfying conditions 4 and 5 with no flag on either side. The cliff is real but reached only by an app doing the thing the card calls harmful.
• B — unconditional exclude by default, platform passes --include-platform in its own CI. Simplest, no cliff — but it is the implementation triage's condition 5 forbids in its own words: 「一个无条件排除该分组的实现会让 app 侧绿而把平台侧的闸门删掉」, and it makes the platform discover a flag, which is condition 4's complaint one level up.
• C — A plus a proportional rule, the bucket counting only above some authored fraction. Removes the cliff; introduces a threshold nothing else in the file has, and a percentage gate whose population depends on a second percentage.

Its recommendation, which I relay and ⛔ do not adopt: A — "it is the widening's shape, not its mechanics", and therefore the tier's.

---

Questions 2 and 3 — these are MINE, and I am answering them rather than passing three upward

⛔ A seat that forwards every question is not routing, it is abdicating. Two of the three are not contract questions.

Q2 — Fixes #16681 or Part of #16681? ⇒ Keep Fixes. This is card lifecycle, ⛔ not contract. The card's own "What would close it" names two outcomes and both hold on this head — ① implemented here, ② true since #15368 and now pinned rather than merely true. A card is closed by the world being as it asked, ⛔ not by one PR having personally caused every part of it. The PR body states plainly that ② predates it, so the record is not misleading; Part of would leave a card open whose stated conditions are met, which is its own half-state.

Q3 — the e2e proof runs nightly only; is that the right cadence for a widened published surface? ⇒ A stands, and ⛔ B is not the tier's to grant either — it is the maintainer's. ⭐ The seat declined to rename the file and gave the correct reason: "the ruling behind the tier cut is a maintainer direction about test cost, and quietly naming a spawning test to escape it would be routing around that ruling rather than applying it." That is exactly right and worth naming — the cheap move here was a rename nobody would have queried. #16455's cut stands; the per-PR tier already proves the decision at the seam and all three flag states through oclif's own Parser.

---

⭐ Worth keeping from the round

• A wrong prediction, reported as observed rather than as written. Ablation A1 was predicted to redden the negative control and the explicit-request case; it reddened only the negative control, because the mutation touches the 'auto' arm alone and the explicit include/exclude requests route around it. Direction held, count did not — and the report says so in those terms. ⛔ A prediction quietly amended after the fact is worth nothing.
• The forbidden implementation was installed and measured. Leg A1 is literally triage's condition-5 counterexample — the unconditional exclude — and it reddens exactly 1 of 10: "⛔ still gates the package that SHIPS the baseline", nine app-side cases staying green. ⇒ The negative control is demonstrably load-bearing, not decorative.
• Ownership is observed, not asserted — read from the stack's own translations bundles, requiring a non-empty string leaf so an --fill=empty scaffold is not mistaken for a claim of ownership.
• os lint's ratchet did not move: check-i18n-coverage: OK (13 config(s), 621 baselined untranslated string(s), none new). That number holding still is the regression reading that matters most here.

Noted from the round, ⛔ not filed and I agree it should not be: os lint and os i18n check now reach the same decision by two different mechanisms — lint folds at the report seam, check filters the population. Both correct for their own output (lint has no denominator), and this PR pins the coupling so a future default flip cannot silently zero lint's hint. Successor named: the contract-review seat on this PR.

---

Generated by Claude Code