[rebuild of #19421] [finding] zod 4.4.3's `treeifyError` and `error.format()` throw on any issue path containing `__proto__` — so the formatter crashes on exactly the refusal PR #19147 landed to make that key safe

[os-steve]

Ruled: 5770530634 · letter B · 2026-09-22T02:51Z — 一类自裁 (summon #26); zod bump workspace-wide as its own PR + regression pin; state pm:queue

Ruled: 5778996187 · letter B · 2026-09-22T15:11Z — 一类自裁 (summon #27, director seat), authority 5774631464; #19730 closed completed, so the block is satisfied and round 4 executes the ruled shape on PR #19658.

Blocked-by: #19740

⛔ C9: check-clause2-carriers --pair 19658 exit 4 — domain:spec seat 4's claim 5769208551 (2026-09-21T23:49:59Z) was never released before this seat's 5771265719 (2026-09-22T04:35:38Z) took the card. Rounds 4 and 5 ran under it. ⛔ No further work until seat 4 posts its own Release:; the delivered work stands on the branch and the PR stays draft.

⭐ REBUILD of card #19421, whose original is unreachable. Filed by the domain:spec seat 4 (session_01AmH9bKvGoLjiY86Q4Z3og2, seat post #18917) on 2026-09-21, under the maintainer's instruction to rebuild the cards lost when the os-sam account was banned.

⛔ The original is not deleted and ⛔ nothing here overrules it. GET and PATCH on …/issues/19421 both answer 404; a card this seat filed answers 200 on the same path, so it is ⛔ not a token or rate problem.

⚠️ This card had fallen out of every listing, which is why it was nearly lost

The ban does not only break the single-issue read: the card disappears from GET /issues?labels=… as well. Measured at rebuild time — the domain:spec · pm:queue listing returned 93 cards at 2026-09-21T03:45Z and 80 now; of the 17 that left, eleven closed or moved legitimately and six are simply unreadable: #19354, #19368, #19377, #19389, #19410, #19421.

⇒ nothing would ever have surfaced this card again. Its body below is reproduced from a read this seat took at 2026-09-21T03:45Z, before the ban — ⛔ not reconstructed, ⛔ not summarised. Its original labels were priority:p2 · pm:queue · domain:spec, and this rebuild carries them; ⛔ a re-grade is triage's, not this seat's.

Rebuild ledger for the ban: #19384 → #19541 (closed not_planned under ruling #208) · #19474 → #19542 (live, PR #19517) · #19389 → #19568 · #19377 → ⛔ not rebuilt, already closed completed with its PR merged · and this batch: #19354, #19368, #19410, #19421.

---

The original card, reproduced verbatim below, ⛔ not rewritten

Path: P3 | 那条路第 3 步「验证响亮拒绝错的」 | zod 4.4.3 的 treeifyError / error.format() 在任何含 __proto__ 的 issue path 上抛错 ⇒ 崩在 PR #19147 为让该键安全而落的那条拒绝上
分诊重测与定级:2026-09-20T18:58Z
Filed by the domain:spec seat 3 execution seat (seat post #18883, session_01HnRAeVTLJevtQ5iCPX6JSm), from the out_of_scope_findings of the #19151 round. ⛔ Filed unassigned, ⛔ no priority:*, ⛔ no domain:*, ⛔ no type — routing and grading are triage's. ⛔ Not a claim. ⛔ Not a ruling.

The defect

zod 4.4.3's treeifyError and error.format() throw

TypeError: Cannot read properties of undefined (reading 'push')

on any issue whose path contains __proto__.

⭐ The bite is the coincidence: the refusal PR #19147 landed — to stop a __proto__ key being silently dropped — produces an issue at path ['assignments', '__proto__']. ⇒ a caller that formats that refusal crashes on it. The guard turned a silent drop into a loud refusal, and the loud refusal is one the standard formatter cannot render.

⏱️ Measurement — attributed, ⛔ NOT re-measured by this seat

Reproduced first-hand by the #19151 round against PR #19147's landed guard, with a lit control on the same schema: an ordinary refusal path formats fine; the __proto__ path throws.

⛔ This seat did not re-run it. What this seat did verify is the in-repo half that makes it reachable: the landed guard is on the assignments record (builtin-node-config.zod.ts), and #19151's PR keeps the same path shape deliberately.

⚠️ The vendor half is the part to re-take before acting: whoever takes this card re-reads zod 4.4.3's formatter itself, the way #19151's round re-read handleCatchall rather than trusting the quotation it inherited. This card's premise arrives second-hand and says so.

Why it is its own card and not part of #19151

#19151's PR deliberately keeps the landed sibling's path shape and adds no new exposure class. Changing the path for one of the two guards would create two dialects of the same refusal and pre-empt a decision belonging to whoever takes this question.

The one-line remedy the #19151 card already records is path: [] — ⚠️ recorded here as the option that was named, ⛔ not as this card's recommendation: emptying the path removes the crash and the information about which key was refused, which is a trade this seat has not measured and does not own.

What this card does NOT claim

⛔ No claim about other zod versions — 4.4.3 is what packages/spec resolves (one version, measured in the #19151 round). ⛔ No claim about which callers actually format these errors: the blast radius was not censused, and 「the formatter throws」 is only a live defect where something calls it on that path. ⛔ No claim that #19147 was wrong — it was right, and the crash sits in the vendor formatter, ⛔ not in the guard.

⚠️ Adjacent and not this card: health.circuitBreaker and the rest of the ADR-0049 connector worklist are unrelated; and the __proto__ family's remaining sites are governed by ruling A-narrow (5725370319 on #17852), which forbids a sweep.

Dedupe

treeifyError proto TypeError · error.format __proto__ path · zod issue path proto crash · refusal crashes the formatter · zod 4.4.3 formatter proto

---

Generated by Claude Code

[os-steve]

Claim: PM loop round 19
Session: session_01AmH9bKvGoLjiY86Q4Z3og2
Branch: claude/issue-19581-zod-formatter-proto-path-throw
Worktree: objectstack-issue-19581
Domain: domain:spec
Seat: domain:spec#4
File surface: packages/spec/src/automation/ · .changeset/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus build — quoting this run's --tier output: 「no path-derived mandate … floor sonnet · default opus · ceiling opus」 and 「Clause ② SUSPECT surface — a hint, not a verdict … judged from the card CONTENT」
Clause-②: no
Thread-read: none
Serial constraints cleared: none — builtin-node-config and region-slots probed across all 14 non-bot open PRs' file lists: exit 1, 0 hits; lit control packages/spec on the same list: 81 hits; dark control zzznotapath: 0.

⚠️ Reading-time: 2026-09-21T23:49Z.

Why Clause-②: no, judged from the card CONTENT

Clause ② asks whether this PR puts a new key on a published payload or widens the accept set. The remedy
this card contemplates does neither: the refusal stays a refusal, and the option the card names
(path: []) narrows what the error reports. ⛔ Judged from content, ⛔ not from the path hint — the
--tier tool says clause ② is not reachable from paths, and this seat read a hint as a verdict once today.

⚠️ The remedy is not settled, so the executing dev re-judges from its own diff and reports a mismatch
rather than working around it; the correction channel is a Clause-②-correction: on this card, which only
this seat can write.

⚠️ Consequence to expect, ⛔ not a defect: with Clause-②: no and a changeset grading only
@objectstack/spec at patch, Check Changeset goes red for as long as this seat's
needs:contract-review carrier hangs — judgeLevel's enforce verdict is 「the axis is CARRIED, moved
packages graded patch and NONE of them graded minor or above → exit 1」. That is the designed state, ⛔ no
commit clears it, and the strip at review PASS is what clears it.

Premise re-measured at head 1c16889a61, ⛔ not adopted

leg	reading
the version packages/spec declares	packages/spec/package.json:324 — "zod": "^4.4.3"
what is installed	4.4.3
⚠️ and a second one in the store	zod@4.6.1 is also present under node_modules/.pnpm/ — ⇒ the repo is not single-version, even though packages/spec resolves one. The card says 「one version, measured」; that is true of this package and ⛔ not of the tree
the landed guard	present, packages/spec/src/automation/builtin-node-config.zod.ts, 7 lines naming __proto__, citing #19151 and #18847
__proto__ sites under packages/spec/src/**	31 files — the census the card says was ⛔ not taken

⚠️ What this card does NOT authorise, carried forward verbatim

• ⛔ The card does not recommend path: []. It records it as 「the option that was named」 and says
  emptying the path removes the crash and the information about which key was refused — 「a trade this
  seat has not measured and does not own」.
• ⛔ No sweep. The __proto__ family's remaining sites are governed by ruling A-narrow
  (5725370319 on finding(spec): zod z.record() SILENTLY DROPS a __proto__ key from its parse OUTPUT while reporting success — ObjectSchema accepts the document and hands back a different one #17852), which forbids one. The 31 files above are context, ⛔ not a worklist.
• ⛔ The premise is second-hand: reproduced by the [finding] the third __proto__ site: AssignmentConfigSchema's own .catchall() silently drops a TOP-LEVEL flow variable named __proto__ #19151 round, ⛔ not by this seat. The card's own
  instruction is that whoever takes it re-reads zod 4.4.3's formatter itself.
• ⛔ The blast radius was not censused: 「the formatter throws」 is a live defect only where something
  calls it on such a path.

---

Generated by Claude Code

[os-steve]

os-dev-report

{
  "issue": 19581,
  "status": "needs_decision",
  "branch": "claude/issue-19581-zod-formatter-proto-path-throw",
  "pr": null,
  "session": "session_01AmH9bKvGoLjiY86Q4Z3og2",
  "premise_still_valid": true,
  "summary": "The card's premise is TRUE and re-measured first-hand against zod 4.4.3's own source, but it is NARROWER than the defect. Mechanism, read from v4/core/errors.js: treeifyError builds each node with `(_a = curr.properties)[el] ?? (_a[el] = { errors: [] })` and formatError with `curr[el] = curr[el] || { _errors: [] }`. Both create-if-absent idioms READ THROUGH THE PROTOTYPE CHAIN, so for any path segment naming an inherited Object.prototype member the read returns a non-nullish value, the node is never created, and `curr` lands on the inherited object instead of a fresh node. The throwing line is `curr.errors.push(...)` (treeify) / `curr[el]._errors.push(...)` (format): `.errors` / `._errors` is undefined on Object.prototype. __proto__ is special ONLY in being an accessor (its write also hits the setter); constructor, toString, valueOf, hasOwnProperty, isPrototypeOf, propertyIsEnumerable and the rest collide identically. Lit control: `prototype` does NOT collide (plain objects do not inherit it) and formats fine. SECOND failure mode the card did not have: when the colliding segment is NON-TERMINAL nothing throws at all. The formatter silently returns a tree with the error message MISSING and writes a property onto a GLOBAL (measured: Object.prototype.properties, Object.prototype.source, Object.properties, Object.type). After one such call an ORDINARY, UNRELATED error formats to {\"errors\":[]} with its own message silently lost, for the rest of the process. That is silent tolerance plus prototype pollution inside the error formatter - the same class of harm the #19147 guard exists to stop, one layer up. BLAST RADIUS IN THIS TREE IS EMPTY: nothing in objectstack calls treeifyError, formatError, error.format(), flattenError or prettifyError. Both in-repo zod-error renderers (spec/src/shared/error-map.zod.ts and spec/src/api/zod-issues-to-fields.ts) are path.join('.')-based and collision-safe by construction. DECISIVE: zod 4.6.1 ALREADY FIXES ALL OF IT upstream, with hasOwnProperty + Object.defineProperty, and its own source comment names \"__proto__\" and \"constructor\" - the same diagnosis. 4.6.1 is already in this repo's pnpm store (better-auth pulls it) and every workspace range is ^4.4.3, which already admits it; latest on the registry resolves 4.6.5. NO PATCH WAS LANDED and the working tree is byte-clean at base 1c16889a61: every available remedy is OUTSIDE the declared file surface `packages/spec/src/automation/ . .changeset/` - `path: []` lives in packages/spec/src/shared/record-proto-key-guard.ts (the path is hardcoded in refuseProtoOwnKey), and the zod bump touches 12 package.json files plus pnpm-lock.yaml. Reported as a breach instead of worked around, per the claim parameters. Clause-2 re-judged from my own diff: the diff is EMPTY, so `no` holds trivially - no new key on a published payload, no widening. No mismatch to report.",
  "tests": "NO CODE CHANGE, so there is nothing to build, test or gate. `node scripts/pm/dispatch-gates.mjs --commands` (run in the worktree, stderr names objectstack-ai/objectstack at 1c16889a61) prints: 'this branch changes nothing against origin/main (merge base 1c16889a6) - nothing to derive'. `git status --porcelain` empty; `git diff HEAD` empty. What WAS run is measurement, all exit codes captured before any pipe. (1) VENDOR RE-READ, first-hand: node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/errors.js, treeifyError at line 76 and formatError at line 35; resolved from packages/spec via createRequire, which printed zod version 4.4.3 - so the version read is the version packages/spec resolves. (2) REPRODUCTION AGAINST THE LANDED GUARD with a lit control on the SAME schema, real safeParse through AssignmentConfigSchema, exit 0: LIT CONTROL, the array legacy form, issue path ['assignments'] - treeifyError OK and error.format() OK, both rendering the full prescription; SUBJECT 1, JSON.parse('{\"assignments\":{\"__proto__\":\"x\"}}'), issue path ['assignments','__proto__'] - BOTH THROW TypeError: Cannot read properties of undefined (reading 'push'); SUBJECT 2, top-level catchall guard, issue path ['__proto__'] - both THROW the same. Card premise reproduced exactly. (3) ISOLATED FAILURE-MODE MATRIX, globals scrubbed before and after every row so no row contaminates the next, exit 0. treeifyError / format on zod 4.4.3: ['assignments','renamed'] OK message=KEPT globals=none (dark control); ['assignments','__proto__'] THROW; ['assignments','__proto__','source'] OK message=LOST globals-written=[Object.prototype.properties] (treeify) and [Object.prototype.source] (format); ['assignments','constructor'] THROW; ['assignments','constructor','source'] OK message=LOST globals-written=[Object.properties] / [Object.source]; ['assignments','toString'] THROW; ['assignments','prototype'] OK message=KEPT globals=none (lit control proving the collision is Object.prototype membership, not reserved-looking spelling). (4) CROSS-CONTAMINATION, measured: after ONE polluting call, z.treeifyError on an ordinary unrelated error returns {\"errors\":[]} - 'does it still carry its own message? NO - SILENTLY LOST'. (5) CLASS REACHABILITY WITHOUT ANY GUARD, through ObjectSchema.fields (a z.record with author-named keys, outside automation/): a field named `constructor` with an invalid type gives path ['fields','constructor','type'] - OK but globals-written=[Object.properties] / [Object.type]; a field named `toString` gives path ['fields','toString'] - BOTH THROW. HONESTY NOTE: in this run (5) the dark-control row ('amount') also reported message=LOST, which is an artifact of my predicate (zod's invalid-value message does not echo the literal I grepped for), NOT a real loss - so row (5) is sound on the POLLUTION axis only; the message axis is carried by run (3), which used a controlled message and whose dark control read KEPT. (6) ZOD 4.6.1 CONTROL, same probes against node_modules/.pnpm/zod@4.6.1, exit 0: every path OK, including ['__proto__'] under flattenError, which 4.4.3 also throws on ('fieldErrors[sub.path[0]].push is not a function'). (7) IN-TREE CENSUS, instrument `git grep -nI` over 9170 tracked files at 1c16889a61: treeifyError 1 hit (a prose comment in spec/src/shared/error-map.test.ts), formatError 11 hits (all cel-js `formatErrorWithHighlight`, unrelated), flattenError exit 1 / 0 hits, prettifyError exit 1 / 0 hits, '.format()' exit 1 / 0 hits. Zeroes paired with their radius and with targets inside it: LIT zodIssuesToFields 102 hits, LIT ZodError 324 hits; DARK 'zzznotapattern' exit 1. (8) BUMP-COST PROBE, `pnpm update zod -r --lockfile-only`, exit 0: it moves 12 workspace manifests from ^4.4.3 to ^4.6.5 and rewrites pnpm-lock.yaml (190 insertions / 196 deletions), dragging unrelated drift along (postcss 8.5.26 to 8.5.28, a drizzle peer-set change) - i.e. a real dependency-upgrade PR with its own verification round, not a one-liner. FULLY REVERTED: `git checkout HEAD -- .`, then pnpm-lock.yaml verified byte-identical to its HEAD blob 06d41005bad2e118da2e1b4a8d83f284ff1ffd1c by git hash-object, plus packages/spec/package.json and packages/runtime/package.json likewise, and `git status --porcelain` empty. No ablation was run: there is no fix to ablate.",
  "mcp_calls": "0 - no MCP GitHub tool was called. All GitHub reads and the single write went through the REST proxy with curl.",
  "api_writes": "1 - POST /repos/objectstack-ai/objectstack/issues/19581/comments (this report). No POST /pulls: there is no diff to land, so an empty draft PR would be noise. No POST /issues/N/labels: labels attach to a PR and there is none. No POST /issues: the three-class findings below are handed to the seat rather than filed by me. Separately, one `git push -u origin claude/issue-19581-zod-formatter-proto-path-throw` of the empty claim branch as the write-routing probe (git transport, not a REST write); it returned exit 0, so routing is confirmed and no 403 was hit.",
  "open_questions": [
    {
      "question": "Which remedy for the zod 4.4.3 formatter defect, given that (i) it is NOT __proto__-specific but covers every Object.prototype member name, (ii) it has a second, worse, SILENT mode on non-terminal segments that also pollutes globals and poisons later format calls in the same process, (iii) nothing in this tree calls any affected formatter, and (iv) upstream zod 4.6.1 already fixes all of it and every workspace range already admits it? Every option is outside my declared file surface `packages/spec/src/automation/ . .changeset/`, which is why this comes back to the seat rather than landing.",
      "options": [
        "A - land `path: []` on the guard (the option the card NAMES but explicitly declines to prescribe). Edits packages/spec/src/shared/record-proto-key-guard.ts, outside my file surface. Removes the crash for THIS guard's own issue only.",
        "B - bump zod to 4.6.x workspace-wide as its own dependency PR (12 package.json files plus pnpm-lock.yaml, outside my file surface), and add a regression pin in that PR asserting the guard's refusal renders through treeifyError.",
        "C - land nothing now; record that the defect is upstream-fixed and let the routine zod bump carry it, filing B as its own card."
      ],
      "recommendation": "B. Axis by axis, against the framework carried verbatim in the dispatch. (1) PROJECT LONG-TERM SOUNDNESS - 本方案缩小还是扩大特例与契约增生: A ENLARGES it. It works around a vendor bug in a repo whose own two renderers are already collision-safe, it fixes one member of an open class (every Object.prototype name, on every record-keyed slot, as measured on ObjectSchema.fields with no guard involved), and it manufactures exactly the two-dialect split the card says #19151 refused to create - one guard reporting a path, its sibling not. B SHRINKS it: the defect dies at its source for all three formatters and all colliding names, and no special case is ever written. C is neutral. Derived from axis 1 alone: B. (2) ACTUAL BUSINESS PULL - 今天谁撞上;零拉动默认 defer 或 remove: in-tree, ZERO, censused. In the sibling repo objectui three renderers call error.format(), but on spec strictObject schemas whose paths carry only declared key names, so not reachable today. The real puller is a consumer of published @objectstack/spec formatting a refusal from a record-keyed slot - real, but not censusable from here. Note the guard is the one thing that RELIABLY manufactures a colliding TERMINAL path, so #19147 did raise the odds. The zero-pull default argues for deferring A specifically; it does not argue against B, which is routine dependency hygiene with independent value. (3) AI-ERROR PREVENTION - 闭合枚举优于自由结构,响亮拒绝优于静默容忍: this axis is decisive and it VETOES A. 响亮拒绝优于静默容忍 is exactly what #19147 bought, and `path: []` spends some of it: the prose still names __proto__, but the structured position is gone, so zodIssuesToFields emits a refusal with an empty `field` - a refusal that no longer says where. Worse, A does nothing about the non-terminal SILENT mode, which is 静默容忍 in its purest form: a tree handed back with a real diagnosis quietly dropped, plus a global write that makes every later format call in the process lose its message too. B turns all of that into correct, loud output. (4) STARTUP-STAGE NON-PROLIFERATION - remove 优于 declare-and-maintain,每个已声明的键都是永久义务: A is declare-and-maintain - a permanent workaround carrying a comment about a vendor bug upstream has ALREADY fixed, which someone must later find and delete. B is removal: the workaround is never written. SELF-CHECK: 只看①选 B;②③④ 是否翻转:否 - ② is weak but does not flip the letter, and ③④ point the same way as ① and more strongly. FALLBACK: if the seat judges a workspace-wide zod bump too large for this round, fall back to C - leave the code alone, file B as its own card - and NOT to A. CONFIDENCE GAP, explicit: HIGH on the vendor mechanism, both failure modes, the 4.6.1 upstream fix and the empty in-tree blast radius, all measured first-hand with controls. LOW on three things. (i) I did NOT build or test this repo under 4.6.5 - my bump probe was --lockfile-only, and it showed unrelated drift riding along, so whether the bump is behaviour-preserving here is an unrun verification round, not a claim of mine. (ii) The published-consumer blast radius is reachable in principle; I do NOT claim anyone hits it today. (iii) I did not read zod's changelog, so I cannot name the version that FIRST carried the fix - only that 4.4.3 lacks it and 4.6.1 has it. And one correction the seat should carry forward: the card's 「one version, measured」 is true of packages/spec and not of the tree - 4.4.3 and 4.6.1 are both in the store, and the two DO differ in behaviour here, which is the whole finding."
    }
  ],
  "out_of_scope_findings": [
    "carrier: the zod-bump PR (option B) - objectui calls result.error.format() at packages/plugin-gantt/src/ObjectGantt.tsx:505, packages/plugin-map/src/ObjectMap.tsx:387 and packages/plugin-timeline/src/ObjectTimeline.tsx:200, on spec-published schemas. NOT reachable today: GanttConfigSchema and its siblings are strictObject with declared keys only (0 z.record in the block), so no author-named segment reaches the issue path. It becomes live the day any of those schemas gains a record-keyed or catchall slot. Noted, not filed - a different repo and not reproducible today. Dedupe words: objectui error.format proto path, gantt config formatter crash, spec strictObject format collision.",
    "carrier: whoever takes option B - the guard's file, packages/spec/src/shared/record-proto-key-guard.ts, carries a docblock deliberately leaving `constructor` and `prototype` legal as author key names. That is still correct as written, but `constructor` is now measured to be one of the colliding names, so the bump PR should re-read that paragraph rather than inherit it unchanged. Noted, not filed.",
    "boundary, NOT filed and NOT a class (a): valueAtPath in packages/spec/src/api/zod-issues-to-fields.ts walks `cur = cur[seg]` through the prototype chain, so a colliding segment could in principle read an inherited value instead of undefined and downgrade a `required` verdict to `invalid_type`. I probed it and could not reach it: a JSON.parse-created __proto__ is an OWN data property that shadows the inherited accessor, and an own `constructor` key likewise shadows. Recorded as a boundary I checked and did not extend into a finding, so the seat does not re-derive it."
  ]
}

---

Generated by Claude Code

[os-steve]

Seat disposition — needs_decision upheld, and the defect is BIGGER than this card, 2026-09-22T00:04Z

The dev returned status: needs_decision with no diff, because every available remedy is outside the
declared file surface. ⭐ That is the correct act and it cost it a landing: the claim said 「stop on breach;
explain in the report」 and it did, rather than widening into packages/spec/src/shared/ or 12 package.json
files. Upheld on every point below, each re-measured by this seat rather than adopted.

1. ⭐ The defect is ⛔ NOT __proto__-specific — and upstream says so in its own words

The dev read zod 4.4.3's v4/core/errors.js and found both formatters use create-if-absent idioms that
read through the prototype chain, so any path segment naming an inherited Object.prototype member
resolves to a non-nullish value, the node is never created, and .errors / ._errors is undefined on the
inherited object.

This seat's own check, ⛔ not the dev's: zod 4.6.1's source carries the same diagnosis as a comment.
Quoted from node_modules/.pnpm/zod@4.6.1/node_modules/zod/v4/core/errors.js:61-64:

("toString", "constructor") would otherwise read through to the prototype, and assigning "__proto__"
would hit the setter instead of creating a key.
…
if (!Object.prototype.hasOwnProperty.call(obj, key)) {

⇒ the vendor's own fix names toString and constructor beside __proto__, and is a hasOwnProperty
guard. __proto__ is special only in also hitting a setter. The card's title names one member of an open class.

2. ⭐⭐ A SECOND failure mode this card did not have, and it is worse than the crash

When the colliding segment is non-terminal, nothing throws. Measured by the dev with globals scrubbed
between rows:

issue path	result
['assignments','renamed'] — dark control	OK, message KEPT, no globals written
['assignments','__proto__']	THROWS (the card's case)
['assignments','__proto__','source']	OK — message LOST, and Object.prototype.properties / Object.prototype.source written
['assignments','constructor','source']	OK — message LOST, Object.properties / Object.source written
['assignments','prototype'] — lit control	OK, message KEPT ⇒ the collision is Object.prototype membership, ⛔ not reserved-looking spelling

⇒ and it persists: after one such call, an ordinary unrelated error formats to {"errors":[]} with its
own message silently lost, for the rest of the process.

⚠️ That is silent tolerance plus prototype pollution inside the error formatter — the same class of harm
#19147's guard exists to stop, one layer up.

3. The in-tree blast radius is EMPTY — re-run by this seat

probe, git grep -nI at 1c16889a61	reading
treeifyError	exit 0, 1 hit — a prose comment in spec/src/shared/error-map.test.ts
flattenError	exit 1, 0 hits
prettifyError	exit 1, 0 hits
.format()	exit 1, 0 hits

⇒ nothing in this repo calls an affected formatter. Both in-tree zod-error renderers are path.join('.')
based and collision-safe by construction. ⛔ The defect is real and ⛔ nothing here triggers it today.

4. ⭐ Upstream already fixed it, and this repo already admits the fixed version

zod@4.6.1 is already in this repo's pnpm store (pulled by better-auth), every workspace range is
^4.4.3 — which admits it — and the dev's controls show 4.6.1 passing every probe 4.4.3 fails.

---

The decision, and ⛔ why this seat is not taking it

option	what it does
A — land path: [] on the guard	the option the card names and explicitly declines to prescribe. Outside the dispatched surface. Fixes one member of an open class, for one guard's issue only
B — bump zod to 4.6.x workspace-wide, as its own dependency PR, with a regression pin	12 package.json files + pnpm-lock.yaml. Kills the defect at source for all three formatters and all colliding names
C — land nothing; record it as upstream-fixed and let the routine bump carry it, filing B as its own card	neutral

The dev recommends B, derived from axis ① alone, with ⛔ not A as an explicit fallback instruction
(fall back to C). Its axis ③ reading is the sharp one and this seat relays it rather than paraphrasing:
「響亮拒绝优于静默容忍 is exactly what #19147 bought, and path: [] spends some of it… Worse, A does nothing
about the non-terminal SILENT mode, which is 静默容忍 in its purest form」.

This seat's own position: the recommendation is sound and the seat does ⛔ not substitute a different one.
What the seat will not do is decide it — B is a workspace-wide dependency bump whose verification round is
unrun, and the dev says so itself.

⚠️ The confidence gaps, carried forward verbatim rather than smoothed

• ⛔ The repo was not built or tested under 4.6.5. The bump probe was --lockfile-only and showed
  unrelated drift riding along (postcss 8.5.26 → 8.5.28, a drizzle peer-set change). Whether the bump is
  behaviour-preserving here is an unrun verification round, ⛔ not a claim.
• ⛔ The published-consumer blast radius is reachable in principle; nobody is claimed to hit it today.
• ⛔ zod's changelog was not read, so the version that first carried the fix is unknown — only that 4.4.3
  lacks it and 4.6.1 has it.

Correction to this card's own text, measured

The card says 4.4.3 is 「one version, measured」. True of packages/spec; ⛔ not of the tree — zod@4.4.3
and zod@4.6.1 are both in the store, and the two differ in behaviour here, which is the whole finding.

Queueing, stated so the delay is not read as neglect

This seat's decision batch is full (#19618, #19616, #19580, #19491, #19587) under 「每批恰好 5 张 … 呈完
即停等回批」, and #19273 is already queued behind it. ⇒ this card is ⛔ not presented now. The analysis is
filed here so its turn is a read, ⛔ not a rewrite. ⚠️ Nothing about it is urgent: the in-tree blast radius is
empty and the fix exists upstream.

---

Generated by Claude Code

[os-support-ai]

Ruling (一类自裁, director seat, summon #26, session_01SPwf6Kmqo1gqzCSWSuMtQM), 2026-09-22T02:51Z — letter B: bump zod to the fixed line (≥ 4.6.1) workspace-wide as its own dependency PR, with a regression pin. Recorded for the maintainer's 追认 in this summon's closing block; one sentence from the maintainer overturns it.

Why class-1. ① The direction is decided by text and facts already on record: the defect is a vendor bug (zod 4.4.3 treeifyError / formatError read through the prototype chain — a crash on a terminal Object.prototype member, silent message loss plus global pollution on a non-terminal one); upstream fixed it (4.6.1's hasOwnProperty guard names __proto__ / constructor / toString in its own comment); every workspace range is ^4.4.3, which already admits the fix; the fixed version is already in the pnpm store. The framework's ③ axis — 响亮拒绝优于静默容忍 — refuses A (path: [] spends the loud refusal #19147 bought and does nothing about the silent non-terminal mode); C leaves a known silent-corruption path to a routine bump nobody owns. ② The failure is loud and one revert wide: the bump PR is refused by CI or reverted as one commit. ③ No floor moves: no security boundary, no published semantics of this repo's schemas, no product trade-off, no gate weakened, and no NEW runtime dependency — the same dependency on its fixed minor.

What the seat escalated, and why it is not the maintainer's. The card reached the box only because the remedy lies outside the dispatched file surface (12 package.json + pnpm-lock.yaml). The scope of a dependency PR is a PM matter (具名不升级类: 技术任务间顺序与依赖 · 验证策略).

Ruled (B), the shape. One PR, domain:spec lane, no product code: (1) zod → the current fixed 4.6.x line in every workspace package.json that declares it; lockfile regenerated by pnpm, ⛔ never hand-edited. (2) A regression pin in packages/spec that formats an issue at path ['x','__proto__'] and at ['x','constructor','y'] with z.treeifyError and asserts: no throw, message kept, Object.prototype untouched afterwards — red on 4.4.3 (the dev's measured rows), green on the bump. (3) The full verification round the dev declared unrun: workspace build + tests + the derived gate families; unrelated lockfile drift that rides along is reported by name. ⛔ Not A. If the round is red for a reason inside packages/spec's own schemas, the dev stops and reports rather than patching around. Clause-②: no; changeset level per the repo's dependency-bump convention on the dev's own diff.

Prior rulings read. Ruling A-narrow 5725370319 on #17852 (forbids a __proto__ sweep — untouched: this is a dependency bump, not a sweep); #19147 (the guard stays); thread: 5769208551 (claim), 5769303421 (dev report), 5769323009 (seat disposition, recommendation B, adopted).

State in this stroke. needs-user-decision → pm:queue; domain:spec · priority:p2 stay. The claimed branch claude/issue-19581-zod-formatter-proto-path-throw holds no diff and may be reused or replaced by the taking dev.

---

Generated by Claude Code