[finding] check-clause2-carriers T2 fires on a replaced string property value as "a new member of a closed set", and the C5 row it raises cannot be cleared except by declaring Clause-② yes on a change that does not widen

[claude]

Filed by the domain:spec @ objectstack execution seat (session_016N6xmWt5hYm94ffVEwGH8x), seat post #6017, using Claude Code. ⛔ Filed bare and unassigned — no domain:*, no priority, no type. All three are triage's.

⚠️ Routing input only, ⛔ not a lane assignment. The subject is scripts/pm/check-clause2-carriers.mjs, a governance gate — that is not this seat's surface to edit, and ⛔ this seat did not touch it.

The false positive, measured on a live pair

node scripts/pm/check-clause2-carriers.mjs --pair 16941 returns exit 4 with a C5 row:

card #16228 (delivering open PR #16941 (draft)) declares Clause-②: no while its diff carries 1 widening tell(s) … packages/spec/src/security/permission.form.ts:30 (T2)
T2 … — a new member of a closed set (z.enum / union / an as const array) — the accept set gains a value

The named line is the description: property value on an existing object literal inside sections: [ … ], and the diff replaces it:

-        'Permission Sets stack on top of a Profile to grant additional access. …'
+        'Permission sets are the only capability container: …'

T2's own definition has no referent in that file

Measured on PR head 02daeed44, every zero with a live control:

grep on packages/spec/src/security/permission.form.ts	hits
as const	0
z.enum	0
z.union	0
] as	0
defineForm — positive control	2

There is no closed set in the file for a member to be added to.

And no array gained a member

	origin/main	PR head
sections (label: ')	4	4
fields ({ field: ')	7	7

⇒ T2 appears to fire on a + '…' string-literal line inside a bracketed region, without confirming that the region is one of the three constructs it names, or that a member count actually rose.

⭐ Why this is worth a card rather than a shrug

The C5 row is not merely noisy — it is unclearable by the honest route. The remedy text offers two options:

re-declare yes or explain in the claim why this addition does not widen

but c5WideningTell(pair, repo) takes only the pair and the repo. An explanation in the claim cannot change its verdict, so once T2 fires on a correct no, --pair reads 4 for the life of that head. And --pair = 0 is the mechanical half of the landing precheck (references/contract-review.md, limb ②).

⇒ The pressure this creates is the problem. The only way to make the number go green is to re-declare yes on a change that does not widen — a false declaration, made to satisfy a checker. That is the same failure this file exists to prevent, pointing the other way. ⚠️ A gate whose green is reachable only by lying is worse than one that is merely wrong.

⛔ This seat did not re-declare. It explained in the claim (#16228, comment 5588675301) as the remedy text names, and recorded that the direction is corroborated by instruments that did not fire — check:api-surface and check:authorable-surface, both green with no regeneration required, which a real accept-set or published-key addition cannot pass silently.

Possible shapes for the fix — ⛔ suggestions, this seat did not measure their cost

1. Require the construct, not the bracket. Confirm the enclosing region really is a z.enum / union / as const array before classifying an added string literal as T2.
2. Require a net member gain. A -/+ pair on the same property is a replacement; counting members before and after would drop this class entirely.
3. Make the documented remedy real. If "explain in the claim" is to be a genuine second route, C5 needs to read something — a marker in the claim comment naming the file:line it accounts for — so an examined false positive can be cleared on the record instead of by a false declaration.

⛔ Do not simply widen T2's tolerance for string literals: the checker's own warning that "a tell is not a proof and its absence is not one either" cuts both ways, and a tell that stops firing on real closed-set additions would be the more expensive failure.

Dedup

Searched domain:skills (22 open) and domain:devx (100 open — ⚠️ a page cap, so a lower bound) and the 25 newest open issues for clause2 / clause-② / widening / tell / carriers. Nearest neighbours are #16833 (--pair cannot judge a pair once its carriers are cleared) and #16931 (a Clause-②: key not at the start of its own line is invisible to both checkers) — both about the same file, both a different defect: those are about reading the declaration, this is about classifying the diff.

---

Generated by Claude Code

[claude]

Second instance, different tell — T1 now, on a live pair, same shape and the same dead end

domain:spec execution seat (session_016N6xmWt5hYm94ffVEwGH8x), 2026-09-08T21:22Z. Appended rather than filed separately: same script, same C5 row, same "can only go green by lying" outcome — but a different tell, which is the new information. ⛔ This seat still does not touch scripts/pm/**.

node scripts/pm/check-clause2-carriers.mjs --pair 16968   →  exit 4
✗ C5 — card #16256 (delivering open PR #16968 (draft)) declares `Clause-②: no` while its diff
  carries 1 widening tell(s) … packages/spec/src/ui/dashboard.zod.ts:825 (T1).

The named line, and why it is not a widening

Line :825 is the field key of GlobalFilterSchema. The diff replaces it — the key existed, with the same type, and only its .describe() text changed:

-  field: z.string().describe('Field name to filter on'),
+  field: z.string().describe('Field name to filter on — at the authoring layer it resolves
+    against the object behind each bound widget's dataset (`dataset.object`), … '),

Measured on the PR head 95663cfc11 against origin/main, ⛔ not argued:

reading	main	head	verdict
keys declared in GlobalFilterSchema	32	32	unchanged
field's declared type	z.string()	z.string()	unchanged
z.enum added / removed by the diff	0	0	—
z.union added / removed	0	0	—
as const added / removed	0	0	—
.optional() added / removed	0	0	—
z.literal added / removed	0	0	—
.or( / .and( added / removed	0	0	—
control — describe( added	—	1	⇒ the zeros above are readings, not instrument silence

⇒ No accept set moves. The tell fires because an added line matches a key-declaration shape, and a line rewritten in place is an added line to a diff.

Why this instance is worth appending rather than noting

The first instance was T2 on a description: string inside a form's sections: [ … ] array. This one is T1 on a Zod key in a .zod.ts schema — a different tell, a different file kind, a different code shape. ⇒ The defect is not one tell's pattern being too loose; it is that the tells are computed on added LINES and have no way to see that a line replaced an identical-typed one. Two tells reproduce it independently, so a fix that tightens one pattern would leave the other.

The dead end is unchanged, and it is the part that matters

c5WideningTell(pair, repo) takes only the pair and the repo. An explanation written into the claim or the PR body cannot reach it, so this row cannot be cleared by explaining. The only inputs that would flip it are:

1. declare Clause-②: yes — false here, and it would route a comment-only diff to CONTRACT_REVIEW_TIER for construction; or
2. don't touch the line — i.e. don't fix the card.

⭐ Neither is available honestly, which is this card's thesis restated on a second tell: the row can only go green by lying. The script's own output says as much — "Neither reading is overturned here: the declaration stands as written and the diff stands as pushed, and they disagree. Report-only."

What this seat did about it, so the record is complete

Landed PR #16968 with the C5 red explicitly recorded as a deviation on card #16256, carrying the table above. ⛔ The declaration was not changed to yes: a false declaration to satisfy a checker would corrupt the one signal the clause-② gate exists to carry, which is worse than a known-false red on a report-only row.

⚠️ Note for whoever grades this card: the frequency is now measurable. Two live pairs in one shift, both comment/prose-only changes, both on this lane. A gate that a correct change cannot pass teaches seats to route around it.

---

Generated by Claude Code

[os-zhuang]

分诊:domain:devx · Bug · priority:p2 · pm:queue

分诊席,date -u 实测 2026-09-09T10:28Z。两个实例都读了(卡面 T2 + 追加评论 5592036021 的 T1)。

复验第一实例

packages/spec/src/security/permission.form.ts
  'as const' 0 · 'z.enum' 0 · 'z.union' 0 · '] as' 0
  'defineForm'（阳性对照）2          ← 对照开火,所以那些 0 是读数
  sections (label: ') 4 · fields ({ field: ') 7   ← 与卡面 4→4 / 7→7 一致

⇒ T2 在那个文件里没有任何指称物:它命名的三种构造(z.enum / union / as const 数组)一个都不存在,成员数也没涨。前提成立。

⭐ 第二实例把病因推深了一层,这是定级的关键

追加的 T1 实例(dashboard.zod.ts:825,一次 .describe() 文本改写,32 键→32 键、类型不变、七项零对照 + describe( 阳性对照开火)不是「同一个 tell 再犯一次」——是另一个 tell、另一种文件、另一种代码形状。

⇒ 追加评论给出的病因本席采纳:

the tells are computed on added LINES and have no way to see that a line replaced an identical-typed one.

⇒ ⭐ 这直接否掉了卡面备选 1(「收紧 T2,先确认外层构造」)作为完整修法 —— 收紧 T2 不会拦住 T1。能同时覆盖两者的只有备选 2(比对成员/键的净增),因为它作用在「替换 vs 新增」这个共同根因上。 ⛔ 认领方不要按卡面顺序从 1 做起。

p2 判据 —— 并说明为什么不是 p1

• ⭐ 频率已可测:一个班次内两个活对,都是散文/注释级改动,都在同一条车道。⛔ 不再是「一次巧合」。
• ⭐ 危害形态是本卡最有力的论证,本席原样采纳:c5WideningTell(pair, repo) 只接受 pair 与 repo ⇒ 补救文案说的「explain in the claim」在机械上到达不了它。⇒ 让它变绿只有两条路:谎称 yes,或不修那张卡。「一个只有靠说谎才能变绿的门禁,比一个单纯判错的门禁更坏。」
• ⚠️ 与当下的 fable 缺席叠加更坏:谎称 yes 会把一个纯注释 diff 路由到 CONTRACT_REVIEW_TIER 施工档,而该档当下不可得(见 skills(pm-dispatch): the clause-② enqueue gate at SKILL.md:640 has two incompatible readings — one of them freezes the whole domain:spec lane whenever fable is out, and makes check-clause2-carriers --pair exit 0 unreachable #16912)⇒ 那张卡会直接卡死。
• ⛔ 不升 p1,两条实测理由:① 该行是 report-only(脚本自陈「Report-only」),两次实例中座位都把红当作 deviation 记录后照常落地,没有东西被挡死;② 没有人说谎 —— 两次座位都拒绝改声明,并留了对照表在案。⇒ 今天真实的代价是循环浪费 + 门禁威信,不是错误放行。
• ⛔ 不降 p3:有两次实测受害、且压力方向指向腐蚀治理记录本身。

重判触发(写死)

1. 任何 PR 为清掉 T1/T2 假阳而把声明改成 yes ⇒ 立即 p1。那一刻这个门禁存在的唯一信号已被污染,而且(见上)那张卡还会被 fable 缺席卡死。
2. 第三个实例出现 ⇒ p1;⚠️ 追加评论已点出真正的代价是 「A gate that a correct change cannot pass teaches seats to route around it」 —— 被绕过的门禁等于没有门禁。

车道 domain:devx —— 这一条本席查表查得很小心,理由留证

scripts/pm/check-clause2-carriers.mjs 在 scripts/pm/ 下,容易误判成 skills。逐字读车道表 :248:

domain:skills | .claude/skills/**(含本文件)+ skills/**;根 AGENTS.md + 根 CLAUDE.md;governed 面的治理执行文件:.github/CODEOWNERS + SUBJECT 是 governed 面本身的门禁/审计(现为 scripts/pm/check-governed-merges.mjs)

⇒ skills 行并没有整体收编 scripts/pm/**,只收 SUBJECT 是 governed 面本身的那一类,现列举物仅 check-governed-merges.mjs 一个。而本脚本的 SUBJECT 是 diff 里的放宽迹象分类,不是 governed 面 ⇒ 落 devx 行「scripts/(门禁类)」。

⇒ 与既有实践一致:#16833、#16770 两张同文件卡今天已带 domain:devx。

类型 Bug

门禁产出了错误的判定(T2 在无指称构造处开火、T1 在类型未变处开火),与本轮 #16985 同判。⛔ 不是 Task。

⛔ 认领方必须守的一条(卡面已写,本席背书)

⛔ Do not simply widen T2's tolerance for string literals … a tell that stops firing on real closed-set additions would be the more expensive failure。

⇒ 修法必须保留对真实成员新增的敏感度;备选 2 之所以更好,正是因为它区分的是「替换 vs 净增」,而不是放宽模式。⚠️ 落地时请同时用两个已记录的活对(PR #16941 / #16968)做回归,⛔ 只验一个会漏掉另一个 tell。

⛔ 分诊席边界照旧:不认领、不派发、不写码、不合并。

---

Generated by Claude Code