fix(pm): the widening refusal names the two doors that move its exit code, and pins the re-declared key

[os-warren]

Fixes #17848

Clause-②: no

REFUSAL_SENTENCE in scripts/pm/check-widening-tells.mjs now names the two doors that
actually move its exit code, and --self-test pins the re-declared-key shape in both
directions. One file changed. ⛔ No exit code moves.

First act: the card's own specimens, re-measured — half one did not reproduce

The card's table was taken 2026-09-12T11:5xZ. Re-run today against all three PR diffs it
names (fetched as the PR's own diff and fed to --declaration no --diff), this matcher
reports no widening tell on any of them:

specimen	judged files	tells	exit
PR #17638 — system/cache.zod.ts:197	3 of 7 (4 NOT MEASURED)	0	0
PR #17796 — ui/view.zod.ts:1615	1 of 3 (2 NOT MEASURED)	0	0
PR #17846 — seven filter: doors	3 of 5 (2 NOT MEASURED)	0	0

⚠️ Every zero above is bracketed by controls, because a zero from a dead invocation reads
the same as a zero from a decline:

• Lit control — a genuinely new key added to packages/spec/src/ui/view.zod.ts (the
  same file as docs(spec): navigation.view stops promising a view selection nothing performs #17796's specimen) fires T1 … :101 and exits 4. The surface covers
  these files and the run is alive.
• Dark control — the card's sharpest specimen reduced to its hunk, with the removed
  line deleted and the three added lines byte-identical, fires
  T1 packages/spec/src/ui/component.zod.ts:2504 and exits 4. The silence is bought
  by the replacement, never by the shape.

⭐ And it did not fire at the card's own filing commit either. Running
check-widening-tells.mjs as it stood at 758ac409 (origin/main, 2026-09-12T11:38Z —
seventeen minutes before the card was written) against the same five inputs reproduces the
same five readings: three specimens exit 0, both controls exit 4. The repair had landed
three days earlier, in #16943's per-change-block replacement budget: a key re-declared in
place removes a T1 line and adds one, and the removal pays.

⇒ the card's "nine tells" was carried over from the threads that accumulated on closed card
#17618; it was not a reading of the gate on the day it was filed. Two of the three PRs have
since merged (#17846 on 2026-09-12, #17638 on 2026-09-13) and #17796 was closed unmerged, so
the "three PRs parked" cost is also spent.

Why no matcher change was made for half one

⛔ The shapes the card floated — pairing across a HUNK, or diffing the file's key SET instead
of the block's added lines — are the silence changeBlocks's own docblock refuses: a hunk
carries three context lines each side and routinely holds an unrelated removal at one end and
a real addition at the other, so pairing across it pays for a new key with a removal that has
nothing to do with it. Buying that would trade a loud failure for a quiet one to repair a
defect that is not there. A fix that silences T1 generally is worse than the bug, and
this PR does not make one.

What half one did leave is a gap in the instrument, not in the reader: the
{ error: … } re-declaration had no case of its own, and it is arithmetically distinct from
the .describe() pair #16943 pinned — the block removes ONE line and adds THREE, of which
exactly one is a key. A budget counting LINES instead of KINDS comes up short right there.
It is pinned now, with both controls above and a third:

• ⭐ surplus control — a genuinely new key (filterLogic:) added in the SAME block as the
  re-declaration still fires at its own file:line. One removal pays for one key; a real
  widening riding along with a re-declaration is still caught.

Half two — the remedy with no reader — is what this PR repairs

The sentence offered two doors and only one was real:

re-declare yes or explain in the claim why this addition does not widen

c5WideningTell() compares the declaration against the diff's tells and stops there; nothing
in either file reads an explanation. So an author who followed the instruction got the
identical exit 4 with no way to learn that the remedy was never implemented — and the only
door that DID move the number was Clause-②: no → yes, which on a false tell is the one
thing the standing rule forbids outright: 「⛔ 永不把 no 翻成 yes 去过门」. ⚠️ A gate
whose only working door is a lie teaches the lie.

⚠️ This file's header had already recorded that twice — at #16822 and again at #16943 —
without ever changing the string a refused author actually reads. So the file knew and the
author could not: a declared-but-unenforced remedy, which this repo removes rather than
documents.

Three shapes were weighed:

1. Delete the second branch. ⛔ Refused. It leaves re-declare yes as the only door,
   which on a FALSE tell is exactly the forbidden lie — the message would then instruct it.
2. Give the explanation a reader. ⛔ Refused. An author-written sentence that clears the
   author's own gate is 自查放行, and it needs the new claim-line syntax pm gates: a "widening tell" check — a diff that ADDS a key / arm / branch to a schema or registration while its claim says Clause-②: no is refused at enqueue (mechanical control for the directional Clause-② ruling on #16349) #16448 forbids.
3. Name the door that was always the right one. ⭐ Chosen. finding(pm): check-widening-tells' T2 BARE_STRING_ELEMENT fires on the FIRST fragment of a multi-line string ARGUMENT — one false C5 blocked a landing whose diff only narrows #16822 already ruled where a
   demonstrated false positive gets repaired — HERE, in the matcher, with a --self-test
   case pinning the shape — and the sentence now says so, names the file to open, allows
   filing it as its own card when it is out of the PR's scope, and states outright that an
   explanation moves no exit code so nobody spends a round rediscovering it.

Both doors the sentence now names are doors this file can open. That is the pin.

Exit-code contract — ⛔ UNCHANGED

EXIT_OK 0 · EXIT_USAGE 1 · EXIT_INCOMPLETE 2 · EXIT_REFUSED 4, all unmoved, and no
verdict state changes. Every tell fires exactly where it fired: the only behavioural surface
touched is the TEXT a refusal renders. The seat reading $? reads the same table it read
yesterday.

Verification

--self-test: 309 cases pass, exit 0 — measured against 298 on origin/main's own
copy of this file, so 11 cases were added and none removed. Sibling
check-clause2-carriers.mjs --self-test: 715 cases pass, exit 0 — it renders
REFUSAL_SENTENCE unparaphrased and that pin still holds through the constant.

All 31 commands derived by dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
for this file surface were run; every one exited 0, each exit code captured by
redirect-then-$?, never through a pipe.

Non-vacuity — three ablation legs, each proving the mutation reached disk by a
grep -c (LINES) count on the anchored text before and after, each restored under a
trap … EXIT INT TERM, and each restore proven by git hash-object equalling the HEAD blob
9ecddb0c… with git diff HEAD empty:

leg	mutation	on-disk proof	self-test	which cases red
budget	the replacement budget never pays	1 → 0	exit 1, 26 fail	the specimen case, the surplus control, and #16943's own live pairs
t1-silent	T1 declines unconditionally	0 → 1	exit 1, 43 fail	⭐ the dark control AND the surplus control — the "silencing T1 generally" direction
old-sentence	the pre-#17848 wording restored	0 → 1	exit 1, 4 fail	all four sentence pins

⛔ The first attempt at the t1-silent leg counted an anchor the mutation does not move
(before=1, after=1). It was reported as a void reading and re-run against the injected text
rather than quietly retried until something landed.

skip-changeset, measured not asserted. npm pack --dry-run --json --ignore-scripts in
packages/spec packs 271 entries (the lit control) and 0 matching scripts/pm or
check-widening-tells. The root package is private: true, and 0 of the 70 publishable
workspace packages contain the changed path. Nothing published moves.

Acceptance notes

• noted, not filed — the card's own "nine tells, 2026-09-12T11:5xZ" figure was not a
  reading of the gate on that date; its table's git grep -oF counts (which prove the keys
  are not new) were fresh, the tell count was not. Successor: this PR's body and the report.
• noted, not filed — SELF_TEST_BATTERY_FLOOR is 16 against a roster of 22 declared
  batteries, so five could be deleted without reddening. That is what a floor IS (AGENTS.md
  prescribes a minimum, not an equality), and adding batteries must not red — an observation
  about slack, not a defect. Successor: none.
• ⛔ Nothing here attaches, removes or waits on needs:contract-review; scripts/pm/** is
  not in GOVERNED_SURFACES (check-governed-merges.mjs: docs/adr/**, .claude/**,
  skills/**, AGENTS.md, CLAUDE.md), so this is an ordinary landing path.
• ⛔ The three PRs the card names were not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KB5PFtxuy1x3dcR5gxudx6

---

Generated by Claude Code

---

Landing note (seat, 2026-09-17)

Contract review at CONTRACT_REVIEW_TIER on head f8ca2fdddf: PASS — record is comment 5706908992 on this PR.

⭐ The review did not reason about this gate, it executed it: it git archived a runnable subset at the head, at origin/main and at 758ac409 (main seventeen minutes before the card was filed), ran --self-test at each (309 / 298 / 269, all exit 0), re-fetched the three specimen PR heads and fed their real diffs through all three file versions, and ran three ablations with the blob hash re-verified after each restore. That is what makes its central finding trustworthy.

Central finding, which confirms this PR rather than undermining it: the card's half one — T1 firing on a re-declared key — was never real on any reachable version of the file, with a lit control alive at every one. The card's 「nine tells」 figure reproduces nowhere. Half two (a remedy with no reader) was real and is what this PR fixes. ⇒ closing #17848 on this PR is supportable.

The direction that mattered — does this weaken the gate? No. Every predicate (patchLines, changeBlocks, memberTellKind, tellsInFile incl. the #16943 budget, wideningRefusal, exitForRefusal) is byte-for-byte unchanged; the exported symbol list is identical at 46; the exit register stays 0/1/2/4; and the t1-silent ablation reds both the new dark and surplus controls. The only output change is the text of REFUSAL_SENTENCE, which no parser outside the file reads (0 hits, control 9).

⚠️ Two self-narration discrepancies in this body, appended rather than rewritten (this repo squashes, so the body becomes the permanent commit message): the battery roster is 21 at head, not the 22 the body states (20 at main); and the budget-ablation failure count measured 24, not 26 — the direction is confirmed, the exact figure is not as stated.

⚠️ One pin label overclaims, recorded not fixed: 「the row it reports is the new key, never the re-declared one」 holds for the fixture's ordering only. With the new key written before the re-declaration in the same block the gate still refuses (1 tell) but reports the re-declared line. That is #16943's pre-existing patch-order budget and it is the loud direction, so nothing is weakened — the word 「never」 is simply too strong. ⛔ Not fixed in-branch: that moves the head and voids an otherwise complete review record, for a word in a test label.

Pre-landing checks: ① review PASS on record ✅ · ② check-clause2-carriers --pair 18539 exit 0; ⛔ no carriers were hung on this pair (Clause-②: no, no declared surface) so there is nothing to strip ✅ · ③ re-taken at landing time, latest-run-per-check-name ✅. Governed-surface predicate: 0 of 1 path hits the register ⇒ ordinary queue landing.

---

Generated by Claude Code

[os-litant]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: f8ca2fdddfed1eafc3e235a4d89b3fd37a1a4798

① Derived judgments

1. Accept / refuse behaviour: UNCHANGED. The diff touches no line of patchLines, changeBlocks, memberTellKind, tellsInFile (including the [finding] check-clause2-carriers T2 fires on a replaced string property value as "a new member of a closed set", and the C5 row it raises cannot be cleared except by declaring Clause-② yes on a change that does not widen #16943 replacement budget), wideningRefusal or exitForRefusal. Measured, not inferred: feat(spec): the seven converged rule-array filter doors name the array form when they refuse the record form #17846, feat(spec)!: retire the scheduled cache-warmup strategy — the cron it selected left in this same major (ADR-0049) #17638, docs(spec): navigation.view stops promising a view selection nothing performs #17796, the lit control and the PR's own diff return the same verdict and exit with main's file and head's file. The PR's "no exit code moves, every tell fires where it fired" is correct.
2. What was true BEFORE (origin/main) about half one: the T1 false positive the card headlines does not fire — not at origin/main, not at the merge base, and not at 758ac409 (origin/main seventeen minutes before the card was filed). The "nine tells" figure is not reproducible on any version of the file I could reach, with the lit control alive at every one. The PR's reading (did not reproduce; [finding] check-clause2-carriers T2 fires on a replaced string property value as "a new member of a closed set", and the C5 row it raises cannot be cleared except by declaring Clause-② yes on a change that does not widen #16943's per-block budget already pays for the re-declared line) is correct. The card's stated cost was also already spent: feat(spec): the seven converged rule-array filter doors name the array form when they refuse the record form #17846 merged 2026-09-12T13:03Z (68 minutes after the card), feat(spec)!: retire the scheduled cache-warmup strategy — the cron it selected left in this same major (ADR-0049) #17638 merged 09-13, docs(spec): navigation.view stops promising a view selection nothing performs #17796 closed unmerged 09-13.
3. What was true BEFORE about the sentence (half two): main's REFUSAL_SENTENCE offered "explain in the claim"; nothing reads one — wideningRefusal({ declaration, files, repo }) and the sibling's c5WideningTell → pairWidening → wideningRefusal take no explanation input, and the sibling has no such reader anywhere. The file's own header at main (lines 83–86, 180–183) had already recorded that and named the matcher as where a demonstrated false positive is repaired. The PR's characterisation is correct, and its chosen shape (name the two doors that work; refuse to give the explanation a reader) is consistent with that prior text.
4. Public surface: no symbol or code moves. Exported symbols identical (46); exit register 0/1/2/4 unchanged. The ONLY output change is the text of REFUSAL_SENTENCE, rendered in this file's refused verdict (SENTENCE — N tell(s): …) and in the sibling's C5 row (SENTENCE. file:line (T?) …). No parser depends on the wording (0 hits outside the file); the sibling renders the constant unparaphrased and its self-test (715) holds. The sentence contains no needs: (pinned). Judged: a text-only change to a PM-tooling verdict string, not a contract surface.
5. Self-test: +11 cases, none lost. New battery #17848 … (floor 8) and the sentence battery floor 8 → 11; roster 20 → 21. Main's pin says(REFUSAL_SENTENCE, 'explain in the claim') is replaced by its negation — a deliberate inversion, not a deletion. Ablation shows the new cases reach the budget arm (budget leg reds the specimen, clean-pair and surplus cases) and the T1 arm (t1-silent leg reds both controls), and the sentence pins reach the constant (exactly 4 red on the old wording).
6. Fixture fidelity (nit, not a defect): the fixture is the card's compressed 3-line rendering; the literal feat(spec): the seven converged rule-array filter doors name the array form when they refuse the record form #17846 hunk is 1 removed / 6 added per door (the error param spans four lines), and the fixture's hunk header counts (-2491,7 +2502,12) do not match its own body. patchLines does not validate counts, so it is harmless, and I measured the literal hunk (0 tells). The header's "removes ONE line and adds THREE" describes the fixture, not the PR.
7. Two pin labels overclaim (neither weakens the gate): (a) "the re-declaration does not license the block: a THIRD key …" — the extra: line lands in a SECOND block (a context line separates it; measured 2 blocks), so this pins the next-block direction; the same-block direction is the surplus control. (b) "the row it reports is the new key, never the re-declared one" — true for the fixture's ordering only; with the new key written before the re-declaration in the same block the gate still refuses (1 tell) but reports the re-declared line (T1@2505). That is [finding] check-clause2-carriers T2 fires on a replaced string property value as "a new member of a closed set", and the C5 row it raises cannot be cleared except by declaring Clause-② yes on a change that does not widen #16943's patch-order budget, pre-existing, and the loud direction; the word "never" is too strong.

② Semver level

skip-changeset is correct. Checked: root package is private: true; the changed path lies outside every workspace package directory (0 package manifests under packages/** or apps/** reference scripts/pm, and a tarball cannot include a path above its own package dir); AGENTS.md §3 rule — the label "is for a diff that publishes nothing from any released package" — is satisfied; the export list is identical between revisions; the Check Changeset job passed under the label. Clause-②: no is correct: the gate run on the PR's own diff with --declaration no gives 0 judged / 1 NOT MEASURED / exit 0 because scripts/pm/** sits on no declared surface — so that exit 0 is "not measured", not "measured clean", and the measurement that stands in is the identical export list plus the byte-identical predicates: nothing is added to any key, member, export or registration surface.

③ Boundary flags

• open_questions: [] in the os-dev report; nothing declared open, and I found nothing that must escalate.
• The card's original complaint: half one (T1 fires on a re-declared key) — never real on any reachable version of the file (758ac409, merge base, origin/main, head), lit control alive throughout. Half two (a remedy with no reader) — real, and now addressed: the sentence names two doors this file can open and states that an explanation moves no exit code. Closing the widening refusal offers a remedy with no reader — "explain in the claim" moves no exit code (the T1 re-declared-key half did NOT reproduce) #17848 on this PR is supportable. No maintainer ruling exists on the card; none is required, since scripts/pm/** is not in GOVERNED_SURFACES and the register does not move.
• Dangerous direction (gate MISSES a real widening): none introduced. Every predicate is byte-for-byte unchanged, and the t1-silent leg reds the new dark and surplus controls — the direction the seat's claim called non-negotiable. One PRE-EXISTING quiet direction is noted and unchanged: a removed key pays for a differently-named added key in the same block (rename shape → 0 tells), [finding] check-clause2-carriers T2 fires on a replaced string property value as "a new member of a closed set", and the C5 row it raises cannot be cleared except by declaring Clause-② yes on a change that does not widen #16943's documented trade; not this PR's to fix and not widened by it.
• Noisy direction (refuses something legitimate): none — no new tell.
• Door 2 of the new sentence ("repair it here in the matcher … or file that repair as its own card when it is out of this PR's scope"): the sentence does not itself say WHO may edit the gate inside a refused PR. What bounds it is the claim's file-surface discipline (a spec-lane claim does not name scripts/pm/**) and the required --self-test case; the "own card" clause routes the ordinary case. Answered; not escalating. An optional later wording pass could say "in its own card unless this PR's claim names this file" — editorial, not blocking.
• What the PR declares it does NOT close, judged: (a) no matcher change for half one — correct; hunk-wide or key-set pairing would buy exactly the silence changeBlocks refuses. (b) The three named PRs untouched — moot, all resolved. (c) SELF_TEST_BATTERY_FLOOR 16 vs roster — the PR says 22; measured 21 at head (20 at main); slack by design, immaterial mis-count in a noted-not-filed item. (d) The "nine tells" provenance — noted, not filed; agreed no card is owed since the PR body and card thread now record it.
• Self-narration discrepancies (immaterial): roster "22" (21); budget-ablation "26 fail" versus my 24 at a different mutation site — direction confirmed, exact figure unverified as stated.
• State: the PR is a draft and must be un-drafted to land; the seat's note that landing is held on charter conflict: does a Clause-②: no PR that touches no contract surface still owe an in-seat review before it can land? #18536 is outside this review's authority and not judged.

Implemented-by: claude/issue-17848-t1-redeclared-key-tell
Reviewed-by: session_01LvwGppdonww4zGLWZo5rho

VERDICT: PASS

---

Generated by Claude Code