fix(pm): check-widening-tells T2 asks which construct encloses the element before asserting a closed set

[os-steve]

Fixes #19384

Clause-②: no

scripts/pm/check-widening-tells.mjs is not on the governed register — the verdict is below, taken on the final file list. Ordinary queue landing.

The defect, re-derived on the CURRENT instrument

T2's own doctrine names four closed-set forms — z.enum([…]), z.union([…]), z.discriminatedUnion(…) and a CORE_PLUGIN_TYPES-shaped as const array. The classifier required none of them: a lone quoted string (or a bare …Schema, arm) anywhere on the contract source surface was routed to T2, and the row rendered "a new member of a closed set … the accept set gains a value" over it. That is a fact the instrument never measured — not the "a tell, never a proof" allowance, which covers a tell that is right about its own shape and silent about direction.

⚠️ The card's line anchors have drifted again, and this is the third reading. All three re-read from source at this branch's base c27e16059d, ⛔ not adjusted by arithmetic:

what	filed (15f92842)	re-verified in 5750721931 (a88a9733)	this PR's base (c27e16059d)
BARE_STRING_ELEMENT	:1962	:1957	:2111
the memberTellKind arm that routes it to T2	:3373	:3368	:3644

The drift is d9282a4bd7 (#19153, +337/−27 in this file), which landed the T1 leg and ruling D′. ⭐ Read before writing: it is what added enclosingDelimiters's unreadable flag, and this repair is built on that reading rather than beside it. Nothing in #19153 touches the T2 arm, and nothing here touches T1 or T3.

The repair

closedSetMembership(side, index) asks the one bracket fact a hunk carries — which delimiter is innermost, over the line's own hunk, the same reading inParameterList uses — and answers in three states:

verdict	evidence	the row
declared	the hunk shows the element's innermost [ opened by z.enum( / z.union( / z.discriminatedUnion( / z.literal(	fires, with the doctrine's sentence, now true as written
refused	the hunk shows that [ opened by another call's argument list — new Set(, Object.freeze(, .default(	no row
unread	no delimiter shown, a walk that stopped being a reading, a ( or { frame, or a [ this reader cannot classify	fires, with a strictly weaker sentence naming the half that was not measured

⛔ Only refused takes a row away, and only on positive, hunk-local evidence — the shape of every decline in this file. ⭐ unread is what keeps it honest and it is the common answer: an opener above the hunk, a CORE_PLUGIN_TYPES-shaped as const array (its as const sits BELOW its members, where no upward reader reaches it) and a property-valued array all keep their row. What changes is the sentence, never whether it fires.

The bound is declared in the code, the way T1 declares its own — in BARE_STRING_ELEMENT's and BARE_SCHEMA_ARM's docblocks (which declared nothing before), in the new header section, and in closedSetMembership's own docblock, which also discharges the obligation enclosingDelimiters states for any reader that suppresses on its unreadable flag: it refuses to decline while the flag is up, and it names every trigger.

The removed side is read the same way #17618 reads a deleted parameter: an element the OLD side shows inside another call buys no replacement budget, so a genuine member added beside it still reports.

⛔ What this PR does not do: it does not delete the T2 leg (leg C below is the lit control), does not weaken T1 or T3, does not undo #19153, and does not touch packages/spec/src/stack.zod.ts — re-spelling source to dodge an instrument corrupts every later reading it takes.

The card's three legs, pinned in --self-test

Battery #19384 — a bare element is not a member until the hunk shows one of the four forms above it, floor 24, 26 cases registered.

leg	before	after
A — four members added to a new Set([, opener standing as context	4× T2, exit 4	0 tells, exit 0
B — falsifier: the identical four members re-spelled on ONE line	0 tells, exit 0	0 tells, exit 0
C — lit control: a genuine new z.enum([ member	T2, exit 4	T2, exit 4

⇒ A and B now agree, so the verdict is no longer keyed on line layout; C shows the reading is live, so B's silence is not the instrument going dark. Beside them the battery pins PR #19314's own seven discriminants silent against the control that is the finding — the same seven names, same file, under a z.enum([ opener: seven rows — plus the loud direction five ways over (an opener above the hunk, an as const array, a property-valued array, a guessed stack, a removed element that buys no budget), the vocabulary intact (memberTellKind still answers T2 for a refused element, so both sides of the budget read one question), and the three states as unit readings.

The real case — --pair 19314, exits captured BEFORE any pipe

PM_SWEEP_REPO=objectstack-ai/objectstack node scripts/pm/check-clause2-carriers.mjs --pair 19314

	instrument blob	exit	rows
before	6d2ba5a70fce24573fc2dfb6ca721bf72f25ab17 (= origin/main)	4	7× T2 at packages/spec/src/stack.zod.ts:3412–:3418
after	003344a23407daee0637963cfbb4a8ad96c60b91	0	none

The after line reads ✓ check-clause2-carriers: PR #19314 / card #19150 — … and its diff carries no widening tell. ⛔ Nothing outside this file was adjusted to reach it.

Corpus census — the price, measured

Repository objectstack-ai/objectstack at c27e16059d, node v22.22.2. 1,441 commits available (shallow clone); the graft-boundary commit d83d079b is excluded for the reason #19099's section gives. 283 commits touching these surfaces, 1,051 file diffs, every diff put through both instruments:

tell rows the previous reading raises	944 (T1 353 · T2 133 · T3 372 · T4 86)
stand	932
now decline	12
begin firing	0

All 12 declines are T2, and all 12 are bare elements the hunk shows inside another call's argument list — nine in Object.freeze([…]) (SCHEDULE_ORGANIZATION_NEAR_MISSES, a list of near-miss key spellings a schema REFUSES) and three in new Set([…]) value-class ledgers (CALENDAR_DATE_TYPES, INSTANT_TYPES, CLOCK_TIME_TYPES). Checked row by row, 0 exceptions. No T1, T3 or T4 row moves.

Of the 133 T2 rows in that window, 121 stand: 104 change their sentence (10 to the measured one, 94 to the NOT-MEASURED one) and 17 are OPENER rows, untouched by this round.

⭐ The removed-side leg has zero historical population here — no row anywhere in the window begins firing — exactly as #17955's un-retiring leg did: a sensitivity guarantee this tree has not yet had occasion to exercise, not a refusal aimed at work already done.

On the tree (packages/spec/src/**, non-test, each bare-element line fed back through the reader with its own 60 preceding lines): of 6,338 such lines, 1,294 read declared, 92 refused, 4,952 unread.

Reverse verification — both directions, from the COMMITTED state

Mutated through scripts/ablation-replace.mjs (a literal anchor that must hit a declared number of times, the write verified against the DISK), each leg under a trap whose restore is git checkout HEAD -- PATH at an absolute path, and each restore proved by BYTES against the HEAD blob rather than by an exit code.

leg	mutation	blob	--self-test
baseline	—	003344a23407…	exit 0, 552 cases
1 — the decline removed (refused can never be answered)	anchor 1 → 0, marker 0 → 1	003344a23407… → 66b404536770…	exit 1, 7 cases fail — legs A and B, the live carrier, the z.tuple( refusal, the flag control and two unit readings
restored	—	back to 003344a23407…, git diff HEAD empty	exit 0
2 — the declared branch removed	anchor 1 → 0, marker 0 → 1	003344a23407… → bab47ed609b7…	exit 1, 9 cases fail — leg C, its wording assertion, the seven-name control, the z.union / z.discriminatedUnion / z.literal readings, the removed-side budget case, and one PRE-EXISTING #16943 case
restored	—	back to 003344a23407…, git diff HEAD empty	exit 0

⭐ The first attempt at leg 2 died on a shell quoting error mid-mutation. The trap restored the tree and the on-disk blob came back equal to the HEAD blob — which is what a crash-path trap is for, and it is reported rather than hidden.

Gates — every exit code captured BEFORE any pipe

The family set was derived by node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, from the merge base itself — ⛔ not from a hand-written git diff. It printed 30 commands for this change set (1 path, +418/−19, under the 5,000-line human-merge threshold). All 30 exit 0, including pnpm check:pm-widening-tells, pnpm check:pm-dispatch-gates, pnpm check:nul-bytes, pnpm check:entry-guard, pnpm check:parse-guard, node scripts/check-self-test-wired.mjs and node scripts/check-scripts-symbol-anchors.mjs.

Run beside them, exit 0 each: pnpm check:pm-clause2-carriers, pnpm check:pm-governed-prose, pnpm check:pm-label-desc-cap, pnpm check:engine-double-contract, pnpm check:error-code-casing, node scripts/check-published-list-mirrors.mjs — the last four because the derivation marks their rosters as sitting under a directory one of these paths is in, where silence is evidence in neither direction.

⊘ NOT MEASURED, stated rather than counted as green: pnpm check:published-readme-exports exits 3 — its own PREREQUISITE-NOT-MET code, an unbuilt dist — and it says in its own words that this is neither a pass nor a finding. Nothing in this diff is in any package, so CI's built tree is where it answers.

Lint — a narrowed run with its three evidence items. node --stack-size=4000 node_modules/eslint/bin/eslint.js scripts/pm/check-widening-tells.mjs --no-inline-config --format json → exit 0, 1 file, 0 errors, 0 warnings. ① The population is read from ESLint's OWN config resolution, not guessed: isPathIgnored('scripts/pm/check-widening-tells.mjs') is false and 2 rules resolve for it, so the file is inside what pnpm lint (eslint . --no-inline-config) scans. ② The file count is the --format json array length, 1. ③ Invariance for untouched files: calculateConfigForFile reports parserOptions.project: null and projectService: null — this repo enables no type-aware linting for ANY file, which eslint.config.mjs states and measured with a positive control — so a one-file diff cannot move the verdict on a file it did not touch. ⇒ the narrowing is a measurement, not a skipped run.

Typecheck — NOT APPLICABLE, and why. pnpm typecheck is turbo run typecheck, i.e. the per-package scripts; the root tsconfig.json excludes packages, apps and examples and sets no allowJs/checkJs, so no tsc program compiles scripts/pm/*.mjs. node --check on the file exits 0.

Changeset

skip-changeset. scripts/pm/ is repo tooling on the fast track: it sits outside every package directory, and no published package's files[] can reach it (checked mechanically across every non-private package.json). Nothing publishes.

Landing

⛔ This PR is left as a draft, and no label was written (skip-changeset included) — the dispatch reserved every label write. The domain:spec lane's at-tier contract review for the round is the dispatching seat's to arrange — a dev's own report is never a review of record.

Acceptance notes

• The ( and { frames are a declared boundary, not an oversight. A frame's head is the text LEFT of its delimiter, so a ( frame's head stops one character short of the callee's paren and CALL_ARGUMENT_HEAD cannot read it. Measured on the tree: of the 4,952 unread bare-element lines, 442 sit inside a ( (.describe( prose, retiredKey( prescriptions — no closed-set member among the heads) and 1,667 inside a {. They keep firing, now with the NOT-MEASURED sentence, so no row asserts a set it did not see. Reaching them needs the callee NAME rather than the bracket — a different reading. Noted, not filed: after this repair the residue is the accepted false-positive cost pm gates: a "widening tell" check — a diff that ADDS a key / arm / branch to a schema or registration while its claim says Clause-②: no is refused at enqueue (mechanical control for the directional Clause-② ruling on #16349) #16448 names, and the file's own remedy sentence says a card is owed on the day a real PR is held by one.
• Answering triage's question on [finding] check-widening-tells T2 fires on ANY lone quoted string on a contract-source line — no closed-set opener required, so the row asserts "a new member of a closed set" it never measured (7 false tells blocking PR #19314) #19384 — "does another tell kind carry the same shape?" Measured, rather than recalled: the same reader run over the T4 bare-element population on all three declared registration surfaces answers refused 0 times (error-code-ledger.zod.ts 0 of 336, dispatcher-error-vocabulary.ts 0 of 53, metadata-form-registry.ts 0 of 0). ⇒ T4 has no in-tree instance of this class today. T3 reads JSON rows of files that ARE export listings, so the enclosing construct is the surface itself. ⛔ Not widened into either.
• The card's "blocking PR spec: declaresCollection reads a pipe's authorable side, so a preprocess-wrapped collection key cannot silently leave the merge refusal set (#19150) #19314" claim, re-taken (triage 5751233390 asked for exactly this): it was and is a real hard block on the enqueue gate — --pair 19314 returned exit 4 on C5 before this change — while the PR object itself reads open / ready / mergeable_state: clean, because the clause-② carrier check is not a GitHub required context. Both readings are true and they are about different things.

---

⚠️ Seat correction, 2026-09-20T22:52Z — three readings above are stale at the CURRENT head

Everything above describes head 1b323fabe2560e29bc0d7da70d2b51bea6c7eaa8, which the at-tier contract review 5752971217 returned FAIL on. The head is now 3c6148f35e656010a58e69ebea3dc7c7df962917 and the rework changed these numbers:

where	says	true at this head
the battery line	floor 24, 26 cases registered	floor 45, 48 cases registered
the baseline row	exit 0, 552 cases	exit 0, 573 cases
the CROSS_PAID fixture	described as pinning the old-side leg	it did not: its removed and added lines sat in different budget blocks, so the check never ran on it. Deleting the leg left the suite green. The fixture is rebuilt at this head with both lines in ONE block, and an ablation that deletes the leg now fails 2 cases.

⛔ This seat did not rewrite the prose above. It read six of its 123 lines — the ones a measurement names — and a body edited from a partial reading is how a false claim gets laundered into a true-looking one. The correction is appended and dated instead, and the superseded text is left legible.

⚠️ Also stale above and not corrected here, because it is the implementer's narration to fix or withdraw rather than the seat's to overwrite: any statement that the four silent spellings are repaired should read that Object.freeze([… as const]) is NOT repaired — it still answers refused, deliberately, because un-refusing the freeze callee would forfeit 9 of the 12 declines the review certified as sound. It is pinned as a stated silence and disclosed in the file header.

A fresh at-tier contract review of 3c6148f35e… is owed and is being arranged; --pair 19438 reads exit 4 on C6 alone (no record names this head), with zero widening-tell rows.

---

⚠️ Seat correction #2, 2026-09-21T00:28Z — including one the seat itself wrote and got wrong

Head is now cb46c2e4ff97cf1d627532e4d0414d07ebf0fe45 (round 4, after the third at-tier FAIL 5753423960). Four readings above are stale and one is false:

where	says	true at this head
the refused row of the repair table	lists Object.freeze( and .default( as evidence of another call's argument list	freeze is TRANSPARENT now — the head left of it is judged. Only Set and default refuse, and that list is CLOSED; every other callee stays loud.
the battery line, and Seat correction #1's floor 45, 48 registered	both stale	66 registered, floor 66; suite baseline 591
the corpus census, and Seat correction #1's 14 declines	both bounded by a shallow clone	over the complete 14,479-commit history: 2,640 commits / 10,364 file diffs / 28 declines / 0 begins, and 72 rows restored against the failed head
Seat correction #1's own note — that Object.freeze of an as-const array is NOT repaired, because un-refusing the freeze callee would forfeit 9 of the 12 declines	false on both halves	freeze is repaired, and the price was 72 rows across five bindings, not 9 — eight times what it was quoted at

The reason every earlier number was wrong in the same direction

Every census on this PR — the implementer's three and all three review records — was bounded by a shallow graft boundary nobody stated. .git/shallow named 3c1bbd2a87 (2026-09-02); round 3 read that commit as the repository's root. It is not: an unshallow reveals 14,479 commits with the true root 1598cabe4a dated 2026-01-18 — 12,310 commits beyond the graft. ⛔ So "declined 12", "declined 14" and "the 9 declines it protects" are all window artifacts of one undeclared horizon, not disagreements of method.

This seat confirms the clone is now complete in the shared checkout: no .git/shallow, 14,484 commits reachable from origin/main.

The residual this round did NOT close, stated because it is a boundary and not an oversight

new Set([ stays refused. The implementer's argument, which the next review should test rather than inherit: PR #19314's seven discriminants and this tree's real accept sets are byte-identical inside a hunk — same head shape, same element shape, same as const satisfies tail — and what separates them is consumption (a .has() read by a superRefine, a REST refusal seam), a file-level fact no hunk-shaped reader reaches. Card #19384 requires leg A silent and #19314 requires the pair at 0, so this reading keeps the silence and states it completely instead: the header names every landed row and every tree site it covers, and the false rationale it used to carry — that no author's document is ever parsed against it — is deleted.

⚠️ Named in that residual as live carriers: VALUE_DOMAIN_FIELD_TYPES, PUBLIC_FORM_SERVER_MANAGED_FIELDS, VALID_AST_OPERATORS. ⛔ And one correction to the record in the other direction: TEXT_OPERATOR_DOOR_PASSING_TYPES is not a live accept set — textOperatorDoorVerdict reads the REFUSED set, so it has no non-test consumer.

⛔ The prose above is not rewritten. This seat read a handful of its lines — the ones a measurement names — and a body edited from a partial reading is how a false claim gets laundered into a true-looking one. That is how Seat correction #1 came to carry a false sentence, and it is left legible above rather than deleted.

---

⚠️ Seat correction #3, 2026-09-21T01:53Z — one sentence of Seat correction #2 was false

Head is now 2608860d5dd008991f2e0ba6099f7ab31fa65cc7 (round 6, after the fifth at-tier review 5754046315).

Seat correction #2 named three live carriers of the new Set([ residual. The third is not one. Measured first-hand, twice, and independently by the round-6 implementer:

packages/spec/src/data/filter.zod.ts:2139
export const VALID_AST_OPERATORS = new Set(Object.keys(AST_OPERATOR_MAP));

One line, derived from an object literal's keys, no member line at all — so this reader never classifies it, on any of the four instruments. Firing control, same reader: packages/spec/src/data/field.zod.ts:168 is a real multi-line new Set([ member list, and a member added there is base 1 row / here 0.

⇒ The residual's live carriers are two: VALUE_DOMAIN_FIELD_TYPES and PUBLIC_FORM_SERVER_MANAGED_FIELDS. Both in-file occurrences of the misattribution are repaired in round 6; this one was the seat's and is repaired here.

⚠️ The real hole behind the misattribution, now disclosed in the file header with its measurement: a widening of VALID_AST_OPERATORS today is a new key on the AST_OPERATOR_MAP object literal (filter.zod.ts:2036), and that diff raises 0 rows on the base instrument, on the round-3 head and on this head alike, because T2 leaves every { frame loud-but-unclassified. Pre-existing, and at scale: 442 bare-element lines sit inside a ( frame and 1,791 inside a { on this tree.

What round 6 changed, and what it did not

It was sized as the review sized it — documentation, disclosure and test-pinning, with the reader's vocabulary and verdicts untouched. The proof offered, for the next reviewer to test rather than inherit: over the review's own window (2,641 commits / 10,366 file diffs) the previous head and this head raise the identical 30,004 rows — 0 decline, 0 begin, 0 sentence changes — and twelve extracted function bodies plus all 24 regex declarations are md5-identical between the two blobs. The suite is a strict superset, 591 → 600, with all 547 earlier case titles still present; floors 29/29 seated with zero slack.

⚠️ And one correction in this seat's own direction: Seat correction #2 warned that the container arrives shallow. This round's container did not — no .git/shallow, is-shallow-repository false, 14,484 commits reachable. The graft was real when round 4 met it; it is not a standing property of the environment, and this seat should not have written it as one.

⛔ The prose above is not rewritten. Three dated corrections now sit under it, two of which correct the seat.

---

⚠️ Seat correction #4, 2026-09-21T02:23Z — the mechanism in correction #3 is wrong

Seat correction #3 said the VALID_AST_OPERATORS hole is dark 「because T2 leaves every { frame loud-but-unclassified」. That mechanism is false, and round 7's review (5754570988) is right about it. Measured first-hand against the shape itself:

line	matches BARE_STRING_ELEMENT
'newop': '$eq', — a keyed entry on AST_OPERATOR_MAP	no
'between', — a real bare element (firing control)	yes
"quoted", — double-quoted bare element (control)	yes

A string-valued keyed entry matches neither BARE_STRING_ELEMENT nor SCHEMA_PROPERTY, so the line never reaches T2's member reading or any frame at all. The hole is a SHAPE gap, not a frame-classification gap — and 「loud and unclassified」 is self-contradictory, since loud means the row fires and this one does not.

⛔ The facts of correction #3 stand and were re-verified: filter.zod.ts:2139 is a one-line derivation, the map is at :2036, a new map key raises 0 rows on all four instruments, and VALID_AST_OPERATORS is not a live carrier of the new Set([ residual. Only the why was wrong.

⚠️ The same false mechanism sits in two docblocks in the file and in the round-6 report; round 8 repairs those. Here it is the seat's.

Also corrected: the 452-row census gap is a judging-unit artefact

Round 6 attributed it to the implementer's harness. Overturned. Judging each commit's files together — the instrument's own unit, since wideningTells(files) runs ledgerRowLicences over the list — reproduces the file header digit for digit; the identical harness judging each file alone reproduces rounds 5 and 6 digit for digit. The 452 rows are all T2, all in packages/spec/src/migrations/registry.ts, across 105 commits — licences minted by sibling files. Neither harness erred: round 4 judged per commit, rounds 5 and 6 per file. ⇒ every census figure on this PR needs its judging unit stated, exactly as item 1 needed its population stated. This body's 「identical 30,004 rows」 is the per-file unit.

What round 7 confirmed

The no-behaviour-change claim held under a stronger reading than the census: an acorn comment-blind token diff of the two blobs shows exactly four differing regions — the roster floor 66→75, two blocks of new self-test fixtures, and the summary string — 2 tokens deleted, 473 added, zero non-test code tokens moved. Row identity follows by construction rather than by sampling. Four of the five owed items are discharged; the remedy left is two paragraphs and one pinned case.

⚠️ Four dated corrections now sit under this body, three of them correcting the seat. The pattern is one thing each time: a mechanism asserted from a plausible reading instead of measured against the code that implements it.

---

Generated by Claude Code

[os-steve]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1b323fabe2560e29bc0d7da70d2b51bea6c7eaa8

Instrument scripts/pm/check-widening-tells.mjs: blob 003344a23407daee0637963cfbb4a8ad96c60b91 at the head, 6d2ba5a70fce24573fc2dfb6ca721bf72f25ab17 at the merge-base c27e16059d (still origin/main's blob — no drift on this file, and no other open PR touches it among the 21 open). Own detached worktrees, node v22.22.2, git diff HEAD empty before and after every mutation, every exit captured before any pipe. First-hand throughout; nothing below is quoted from the PR body.

① Derived judgments

1. declared — RIGHT, and every error it makes is loud. All four forms still fire on the head instrument, exit 4 each: z.enum([, z.union([, z.discriminatedUnion('type', [, and a CORE_PLUGIN_TYPES-shaped as const array (the last as unread, row kept). Its misreads go the loud way only: fuzz.enum([ and z.enum(KEYS as [ read declared (the missing word boundary is shared with CLOSED_SET_OPENER, pre-existing). Legs A and B agree at exit 0.

2. refused — WRONG on the doctrine's own forms, in the silent direction. Prettier's chain wrap z newline .enum([ / .union([ — a live spelling, 19 constructor sites in packages/spec/src today (e.g. data/object.zod.ts:1905) — reads refused: CLOSED_SET_ARGUMENT_HEAD wants a literal z.enum( on the bracket's own line while CALL_ARGUMENT_HEAD happily matches .enum( as a call. Measured: a member added under z newline .enum([ is exit 4 on the base instrument and exit 0 on the head, and no opener row compensates because CLOSED_SET_OPENER needs z. on the same line — the set goes fully dark. Same outcome for z.enum(Mode)([ spelled with a type argument (CALL_ARGUMENT_HEAD admits type args, CLOSED_SET_ARGUMENT_HEAD does not), for zod.enum([, for Full.extract([ (a sub-enum that WIDENS as a value is added; ui/view.zod.ts:1588 uses .extract on one line today), and for Object.freeze([ … ] as const) — the fourth form wrapped, which the header discloses only as "handed to z.enum". The file's own contract for a decline — positive, hunk-local evidence that the delimiter opens another call's argument list — is not met: .enum( is the constructor, not another call. The card's requirement that the repair "does not go silently quiet on real closed sets" is violated on a real closed set. ⛔ Zero historical population is not a radius here: the census cannot see this because today's tree has 0 bare member lines under a chained opener, and the formatter decides tomorrow's spelling.

3. unread — RIGHT in direction. Opener above the hunk, as const array, property-valued array, ( and { frames, unreadable flag: every one keeps its row (probes and ablations M3/M9). Wording residue: on a ( frame the row prints "this hunk does NOT show which construct encloses it" over note: z.string().describe( — which the hunk does show; the reader declined to classify it. "NOT MEASURED" stays true; that first clause does not.

4. The old-side leg — live in code, UNPINNED by test. A same-block probe (removed 'peeled', inside new Set([ and added 'write', under a z.enum([ opener with no context line between) gives 2 rows at head and 1 row with the old-side check deleted — the genuine member swallowed by a phantom budget. Yet deleting that line leaves --self-test green at 552/552. CROSS_PAID separates its removed and added lines by context, so changeBlocks puts them in different budget blocks and the check never runs on it; it passes for another reason (exit 4 with and without the line). The PR's "pinned … a removed element that buys no budget", and its ablation-2 attribution of that case, are not true as tests.

5. Corpus census — re-derived on a wider window, agrees. 348 commits reachable from origin/main touching packages/spec (graft d83d079b excluded), 1,549 file diffs, both instruments over the same diffs: before 1,006 rows (T1 350 · T2 246 · T3 375 · T4 35), after 994 — stand 994, decline 12, begin firing 0; no T1, T3 or T4 row moves. The 12 are the nine Object.freeze([ near-miss spellings (consumed by .find( to reject) and the three new Set([ … ] as const satisfies readonly FieldType[]) value-class ledgers — sound declines. T2 sentences among standing rows: 10 measured, 207 NOT-MEASURED, 17 opener rows unchanged.

6. Tree census — agrees. packages/spec/src/** non-test: 6,553 bare-element lines (arms included), declared 1,354, refused 92 (= the report), unread 5,107 (442 in (, 1,791 in {). Refused callees: Object.freeze 65, Set 20, .default 7. Consumers checked: PLATFORM_CAPABILITY_TOKENS.includes feeds only an ok/unknown status while requires is z.array(z.string()); VIEW_WRITE_PATH_IDENTITY_KEYS.has only splits an error message; DECLARED_META_TYPES is a generated near-miss resolver. No accept set is silenced on today's tree.

7. --pair 19314 — verified by mechanism. Base instrument exit 4 (7× T2 at packages/spec/src/stack.zod.ts:3412–:3418), head exit 0. On the real patch each of the seven reads refused with unreadable=false, 2 frames, innermost [ head const COLLECTION_WALK_WRAPPERS: ReadonlySet(string) = new Set(; the hunk's first line is an underflowing ); the walk drops. Right reason.

8. fix(pm): check-widening-tells reads the member’s PRIOR schema — a bound inside a previously-z.unknown() bag is not a new key #19153 / T1 untouched — by test. T1 rows 350 = 350 across all 1,549 diffs; every T1 battery green at head; inParameterList unchanged.

9. Self-test 525 → 552 (+27: the battery holds 27 cases, not the 26 reported; floor 24). Ablations, each restored byte-identical to the HEAD blob: M1 decline removed → 9 fail (blob 66b404536770, same as the dev's leg 1); M2 declared removed → 11; M3 flag refusal → 1; M7 literal → 1; M9 unread sentence → 1; M10 new-side continue → 3; M11 declared sentence → 3. Suite stays green after: M4 drop the [-only guard, M5 CALL_ARGUMENT_HEAD → any head ending in (, M6 delete the old-side check, M8 drop the own-constructor tail. Four docblock claims, no case.

10. Opener row unchanged; the budget is consumed before membership is read, so a refused element can only make a later genuine member fire — loud.

② Semver level

None — scripts/pm/ is reached by no published package's files[]; skip-changeset agrees and lint.yml exempts it at job level. The label is not on the PR (reserved by the dispatch); the landing seat applies it.

③ Boundary flags

• Dev flag 1, (/{ frames a declared boundary: agreed and re-measured (442 / 1,791 keep firing). Not a finding.
• Dev flag 2, T3/T4 carry no such shape: T4 35 = 35 across the window, no T4 line moves. Accepted.
• Dev flag 3, anchors drifted: re-read at the base blob — BARE_STRING_ELEMENT :2111, the memberTellKind arm :3644. Confirmed.
• Dev flag 4, "blocking": confirmed — C5 exit 4 at the base instrument while the PR object reads open/ready.
• Dev flag 5, check:pm-dispatch-gates runtime: ran here — pnpm check:pm-dispatch-gates exit 0, 1,883 self-test cases pass, 723 s wall clock on this box (a first attempt died on this reviewer's own symlinked node_modules: git check-ignore refuses a path beyond a symbolic link — harness fault, rerun on a real directory).
• open_questions: none filed; none owed.
• Escalated by this review: (a) the chained/generic/aliased constructor spellings read refused — a silent-direction regression on a doctrine-named form, unpinned; (b) .extract([ widening reads refused; (c) the old-side leg is unpinned (M6 green); (d) M4/M5/M8 docblock claims unpinned. Remedy shape, not a prescription: a [-frame head whose callee NAME is one of enum / union / discriminatedUnion / literal — any receiver, any type argument — is never refused (declared, or at least unread); extract / exclude likewise; pin the chained spelling, the generic spelling, .extract([, and the old-side leg with its removed and added lines in ONE block.
• Gates run here, exit 0 each: --self-test (552), check-clause2-carriers --self-test, check-self-test-wired, check-scripts-symbol-anchors, check-governed-merges --test (not governed), node --check, eslint on the file (1 file, 0/0).

Implemented-by: claude/issue-19384-t2-closed-set-opener
Reviewed-by: session_01AmH9bKvGoLjiY86Q4Z3og2

VERDICT: FAIL

---

Generated by Claude Code

[os-steve]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3c6148f35e656010a58e69ebea3dc7c7df962917

Instrument scripts/pm/check-widening-tells.mjs: blob 445e5be7d33edfef14737ff5fb1ab101ef974cf7 at this head, 003344a23407daee0637963cfbb4a8ad96c60b91 at the FAILED head 1b323fabe2, 6d2ba5a70fce24573fc2dfb6ca721bf72f25ab17 at the merge-base 57ceb9d6d2 (= origin/main). Three own detached worktrees, one per instrument, node v22.22.2, pnpm install --offline in the head worktree rather than a symlinked node_modules, every exit captured before any pipe, every ablation restored and proved by bytes. First-hand throughout; the prior record 5752971217 is judged below, not enforced.

① Derived judgments

1. The prior FAIL's hole — closed. Chain-wrapped z / .enum([ and .union([, an explicit type argument, zod.enum([, Full.extract([ and Full.exclude([: base exit 4 / FAILED head exit 0 / this head exit 4, one T2 row each, membership refused becoming declared (the two sub-enum builders unread). Also under receivers the implementer did not test: base.enum([, z?.enum([, a tab-indented chain, chain-wrapped .discriminatedUnion('type', [ and chain-wrapped .extract([. A trailing comment on the bracket line, a comment between ( and [, .pipe(z.enum([, z.array(z.enum([, a keyed mode: z.enum([, a ] as const) tail and a spread before the member all read declared. A bracket head split across two lines (z.enum( then [), a satisfies wrapper and a grouping paren read unread and keep their row. CRLF is silent on all three instruments (BARE_STRING_ELEMENT anchors before the carriage return) — pre-existing, not this PR's.

2. The containing census — re-derived over a population of my own, and it can contain the failure. 232 multi-line closed-set opener sites followed by a bare element across 101 files (enum 218 / union 4 / discriminatedUnion 10), each rebuilt as a one-member addition with three lines of REAL context and the opener re-spelled. Chain-wrapped / generic / aliased: FAILED head 213 silent + 19 NOT-MEASURED; this head 0 silent, 222 measured, 10 NOT-MEASURED — identical to the plain control (the 10 are hunks that begin inside a JSDoc whose apostrophe raises the [finding] check-widening-tells T1 fires on a member BOUNDED inside a previously-z.unknown() bag, so the criterion-honest Clause-②: no (narrowing) is the blocked declaration and over-declaring is the only unblocked path #19099 flag, loud). Full.extract: 232 NOT-MEASURED, 0 silent. Lit controls z.tuple([ and new Set([: 213 silent on both. So the four spellings are repaired on a population that could have shown them dark. The same table shows Object.freeze([ and a makeEnum([ helper at 213 silent on this head — the lit controls' silence exactly.

3. refused — STILL WRONG in the silent direction on real accept sets, and this time in the tree and in the window. Two in-tree instances, both spelled ReadonlySet(string) = new Set([: packages/spec/src/data/field.zod.ts:168 VALUE_DOMAIN_FIELD_TYPES — its docblock: "the set on which valueDomain is authorable … FieldSchema refuses it there (the superRefine below)", consumed by .has(field.type) at :2201, and the docblock itself calls a change to it "a widening of this set" — and packages/spec/src/data/filter-text-operator-declared-type.ts:229 TEXT_OPERATOR_DOOR_PASSING_TYPES, "field types the door lets through". Measured on the shape a real PR carries (three context lines): adding 'email', to the first is base exit 4, this head exit 0; adding 'number', to the second, the same. An authorable-surface widening the gate held yesterday passes today. The closedSetMembership docblock's rationale for the Set refusal — "a set of internal discriminants is not an accept set, no author's document is ever parsed against it" — is false for both; the header's stated silence names only "new Set([…]) spread into an enum"; and the header's "0 of the 12 declines is such a set" was taken over a window that could not contain the counter-examples (item 4). The card asked for leg A AND for a repair that "does not go silently quiet on real closed sets"; on this construct the two collide, and the instrument resolves the collision by asserting it does not exist.

4. Commit census — re-derived over a deeper window; the count is 14, not 12. 468 commits reachable from origin/main touching packages/spec (root excluded), first-parent git diff-tree -p --unified=3 split per file by the instrument's own splitUnifiedDiff, 2,255 file diffs, all three instruments over the same rows. Base 1,075 rows (T1 396 · T2 165 · T3 469 · T4 45); FAILED head = this head 1,061. Base to this head: stand 1,061, declined 14, begun 0, T1/T3/T4 unmoved. FAILED head to this head: 0 class changes, 128 sentence-only. The 14 are the 9 SCHEDULE_ORGANIZATION_NEAR_MISSES rows and the 3 field-value.zod.ts value-class rows both records certified, PLUS field.zod.ts:168 'text' (VALUE_DOMAIN_FIELD_TYPES, commit 1d7e76a62e, 2026-09-04) and filter-text-operator-declared-type.ts:193 'autonumber' (the door's passing set, commit 6f1ce7d267, 2026-09-05). Why both prior records read 12: their clone was 1,441 commits deep with its oldest commit on 2026-09-06; this checkout reaches 2,169 (root 3c1bbd2a87, 2026-09-02) and the two commits sit at index 1,958 and 1,675 from the tip. "Checked row by row, 0 exceptions" was true of a window that ended one day too late to see them.

5. Tree census — agrees, with the artifact named. 1,014 files, 6,553 bare-element lines (arms included): declared 1,354 / refused 92 (freeze 65, Set 20, default 7) / unread 5,107, identical on both instruments, 0 moved, 13 refused bindings. The 60-line window is why it reads VALUE_DOMAIN_FIELD_TYPES as unread: that window begins inside the docblock above the binding and an apostrophe raises the flag; with three lines of context the same site reads refused. My own prior record's item 6 ("no accept set is silenced on today's tree") was that artifact.

6. extract / exclude reading unread — honest. The rendered sentence, "this hunk does not show it inside one of the four closed-set forms, so whether the accept set gains a value is NOT MEASURED here", is true on both: on extract it under-claims (the widening could be read), on exclude it declines to read a direction the file has never read. The row fires either way; no narrowing is laundered into silence.

7. The old-side leg — pinned now. Same-block probe (removed 'peeled', inside new Set([, 'write', added under a z.enum([, no context between): 2 rows at this head, and ablation C (the leg deleted) fails 2 cases where last round it stayed green. A removed member under a chain-wrapped .enum([: FAILED head 2 rows (a phantom surplus), this head 1 = base. Right in both directions.

8. --pair 19314 — verified by mechanism on the real patch. All seven added discriminants read refused, unreadable=false, 2 frames, innermost [ head const COLLECTION_WALK_WRAPPERS: ReadonlySet(string) = new Set(, the hunk opening on an underflowing );, tellsInFile 0 rows; CLI exit 0 with "carries no widening tell". --pair 19438: exit 4 on C6 alone (no record names this head), 0 tell rows — the expected resting state.

9. T1 / fix(pm): check-widening-tells reads the member’s PRIOR schema — a bound inside a previously-z.unknown() bag is not a new key #19153 untouched — by extraction. inParameterList, enclosingDelimiters and PARAMETER_LIST_HEAD are byte-identical to base (md5 of the extracted bodies), and T1 reads 396 = 396 = 396 across the window. declared still errs only loud: parseenum([ is refused as the whole-token control; any receiver before .enum( reads declared.

10. Self-test 573 at this head (552 → 573), battery 48 registered, floor 45. Ablations with my own anchors, each restored byte-identical to 445e5be7 with git status clean: A receiver re-required → 6 fail; B sub-enum branch → 2; C old-side leg → 2; D [-only guard → 2; E any-paren refusal → 2; F own-constructor tail → 1; G old sentence → 1; H new-side decline → 3; I declared branch → 16; and mine: unreadable-flag refusal → 1, type-argument group → 1, whole-token boundary → 1, literal → 1, exclude → 1. Green after two: the (?:\bnew[ \t]+)? prefix dropped from CALL_HEAD_CALLEE (decorative — the regex is unanchored at its start, so Set is found either way), and the Object.freeze "STATED SILENCE" case deleted outright — 572/572, exit 0: the floor sits 3 below the register, so "pinned" means the battery exists, not that this case does.

11. Vocabulary: CLOSED_SET_OPENER_HEAD (:2348) still carries a hand-copied z\.(?:enum|union|discriminatedUnion|literal) — a fourth reading not fed from CLOSED_SET_CONSTRUCTOR_NAMES. "One vocabulary, so no two of these three readings can drift" is true of three and silent about the fourth.

② Semver level

None — scripts/pm/ is reached by no published package's files[]; skip-changeset agrees (the label is not on the PR, reserved by the dispatch). check-governed-merges --test on the three-dot file list: not governed, exit 0.

③ Boundary flags

• Question 2, ruled: the Object.freeze disposition is a documented defect, not an honest stated silence. Three measured facts. (i) A fourth-form member under Object.freeze([… ] as const) goes dark (base exit 4 / this head 0); so does a whole freeze-wrapped array added in one diff (base 2 rows / this head 0), z.enum(Object.freeze([ (base 4 / 0), and a fifth kind added to FLOW_TRIGGER_KINDS at automation/flow-trigger-kind.ts:46 (base 4 / 0). (ii) The header's mitigation — "what still catches one: the enum's own opener line, which fires as an opener row" — is false by test: a member-adding diff carries no z. opener line, and a freeze array fed to z.enum(KINDS) on the very next line raises 0 rows. (iii) The trade-off is priced against the file's own doctrine: the 9 declines it protects are one binding in one landed commit that would fire NOT-MEASURED (loud), while PARAMETER_LIST_HEAD says of its own reading that a prefix the reader does not know "leaves the tell where it was" — and this refusal is open-vocabulary, so any unknown callee (makeEnum([, stringEnum([) silences a genuine set. freeze is transparent to what the array is; it is not positive evidence that the construct is not one of the four forms.
• Escalated by this review: (a) new Set([-spelled accept sets read refused — two in-tree instances named in ① 3, docblock rationale false, silence unstated, census claim falsified over a deeper window; (b) Object.freeze as ruled above; (c) the refusal is open-vocabulary. Remedy shape, not a prescription: a refusal that stands on a CLOSED vocabulary of callees positively known not to declare a set (today's tree needs Set, freeze, default to keep the 92 tree refusals and the certified declines), with freeze read as transparent to the head left of it; whatever silence Set keeps stated in the header naming the accept sets it covers, with the docblock rationale corrected; the freeze mitigation sentence and the "0 of the 12" claim re-taken on a window that reaches 2026-09-04; the four spelling cases and the freeze case moved above a floor that today lets three cases go.
• Dev out-of-scope 1 (CLOSED_SET_OPENER still z.-bound): deferral sound — every chain-wrapped case fires as a member row, so no set goes dark on that account; CLOSED_SET_OPENER_HEAD should join the derived vocabulary when that card lands.
• Dev out-of-scope 2 (Object.freeze noted, not filed): not accepted as noted-not-filed — see the ruling above.
• Dev out-of-scope 3 (stale PR-body lines): covered by the seat correction; the corrected values (floor 45, 48 cases, 573 baseline) are confirmed here.
• Dev out-of-scope 4 (741 vs 743): resolved — 741 is z.enum([ in non-test .ts under packages/spec/src, 743 includes the .test.ts files; both give 13 line-initial .enum([ and 0 followed by a bare element. Moves nothing.
• Numeric discrepancy (349 / 3,850 / 786 vs 348 / 1,549 / 1,006): both records are bounded by the same 1,441-commit shallow clone; the splitting difference moves nothing, the clone depth does — over 2,169 commits the window is 468 / 2,255 / 1,075 and the decline count is 14.
• Dev flag (( / { frames a declared boundary): re-measured, 442 / 1,791 keep firing. Accepted.
• Dev flag (T3 / T4 carry no such shape): T3 469 = 469 and T4 45 = 45 across the window. Accepted.
• Dev flag (check:pm-dispatch-gates runtime): ran detached here in the pristine head worktree — exit 0, 1883 cases pass, 758 s wall clock.
• Gates run here, exit 0 each: --self-test (573), check-clause2-carriers --self-test (1,071), check-self-test-wired, check-scripts-symbol-anchors, node --check, eslint on the file (1 file, 0 errors, 0 warnings).
• open_questions: none filed; none owed.

Implemented-by: claude/issue-19384-t2-closed-set-opener
Reviewed-by: session_01AmH9bKvGoLjiY86Q4Z3og2

VERDICT: FAIL

---

Generated by Claude Code

[os-steve]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: cb46c2e4ff97cf1d627532e4d0414d07ebf0fe45

Instrument scripts/pm/check-widening-tells.mjs: blob 75892bacb0ce3086af207cf3ee36519a8bce6b13 at this head, 445e5be7d33edfef14737ff5fb1ab101ef974cf7 at the round-3 FAILED head 3c6148f35e, 6d2ba5a70fce24573fc2dfb6ca721bf72f25ab17 at the merge base 57ceb9d6d2 (still origin/main's blob at 50bae37f3d; no drift on this file). Clone depth stated as part of every reading below: the shared checkout is COMPLETE — no .git/shallow, 14,484 commits reachable from origin/main at 50bae37f3d, root 1598cabe4a (2026-01-18). Five own detached worktrees (this head, base, r3 head, ablation, floor), node v22.22.2, pnpm install --offline in the head worktree only for the six gates that import a dependency, every exit captured before any pipe, every mutation restored and proved by git hash-object against 75892bac with git status clean. First-hand throughout; the three prior records and the implementer's round-4 report were inputs to judge, not to enforce.

① Derived judgments

1. The closed vocabulary holds at every edge I could spell; the only silent edge is the residual's own callee. Object.freeze(new Set([, new Set(Object.freeze([, Object.freeze(Object.freeze(new Set([, Immutable.Set([, new globalThis.Set([, new Set(string)([ (a type argument), class Set {}; z.enum(Set([: all refused, every one a Set callee. new (Set)([, new Set( [ (space before the bracket), new Set(/* c */[, new WeakSet([, new MySet([, z['enum']([, z[name]([, default: [, export default [, { default: [, makeEnum([, stringEnum([, z.tuple([: all unread, loud. .default([ on a keyed head, z.object({}).default([, z.enum(["x"]).default([: refused. Transparent over transparent: z.enum(Object.freeze(Object.freeze(Object.freeze(Object.freeze([ reads declared, the same four wrappers on a bare binding unread; Object newline .freeze([ reads unread (loud). ⛔ The one spelling that silences a genuine four-form set is a Set literal INSIDE the constructor — z.enum([...new Set([, z.enum(Array.from(new Set([, z.enum([...KNOWN, ...new Set([, z.union([...new Set([: refused; through the CLI (--declaration no --diff) a member added under z.enum([...new Set([ is base exit 4 / this head exit 0. Zero tree sites (packages/spec/src, non-test, at this head) and zero landed rows carry that shape; item 10 is where it matters.

2. Byte-identity, tested rather than inherited — the claim is imprecise and its conclusion is right. The real bytes: spec: declaresCollection reads a pipe's authorable side, so a preprocess-wrapped collection key cannot silently leave the merge refusal set (#19150) #19314's carrier (/pulls/19314/files; the PR is still open and unmerged) is const COLLECTION_WALK_WRAPPERS: ReadonlySet(string) = new Set([ closed by ]);; VALUE_DOMAIN_FIELD_TYPES (data/field.zod.ts:168) is export const …: ReadonlySet(string) = new Set([ closed by ] as const satisfies readonly FieldType[]);; PUBLIC_FORM_SERVER_MANAGED_FIELDS (security/public-form.ts:31) is export const …: ReadonlySet(string) = new Set([ closed by ]);. So the heads are NOT byte-identical: export separates spec: declaresCollection reads a pipe's authorable side, so a preprocess-wrapped collection key cannot silently leave the merge refusal set (#19150) #19314's set from both accept sets, and the as const satisfies tail separates it from one. Neither is a discriminator of the CLASS: on this tree all eleven new Set([ bindings the silence covers in landed history are exported — the certified non-accept ledgers (CALENDAR_DATE_TYPES, INSTANT_TYPES, CLOCK_TIME_TYPES, CONTAINER_ISSUE_CODES, VIEW_WRITE_PATH_IDENTITY_KEYS, TEXT_OPERATOR_DOOR_PASSING_TYPES) included — and the satisfies readonly FieldType[] tail sits on the three value-class ledgers exactly as on VALUE_DOMAIN_FIELD_TYPES (it marks a subset of an existing enum, not an accept set). Binding suffixes (_TYPES, _FIELDS, _KEYS, _CODES, _WRAPPERS) split nothing, and the as const tail sits below the members, where this file's upward reader deliberately does not reach (it reads CORE_PLUGIN_TYPES as unread for that reason). I could not construct a sound hunk-visible discriminator; consumption is the separator.

3. The card's legs and every previously repaired spelling, on this head. CLI: leg A exit 0 / 0 rows, leg B exit 0 / 0 rows, leg C exit 4 / 1 T2 row (base: 4 / 0 / 4). Chain-wrapped z newline .enum([ and .union([, a tab-indented .enum(Mode)([ with a type argument, zod newline .discriminatedUnion('type', [, base newline .enum([, z newline .enum(Object.freeze([: base 1 row / r3 1 / head 1, all MEASURED. Object.freeze([, makeEnum([, z.tuple([: base 1 / r3 0 / head 1, NOT-MEASURED — the round-3 holes are closed. Full.extract([ and Full.exclude([: 1 / 1 / 1, NOT-MEASURED on all three, so the deleted sub-enum branch moved no verdict; the sentence ("does not show it inside one of the four closed-set forms") is true of both; adding extract or exclude to the refusal list reds 2 cases each (my ablations F, F2).

4. declared still errs only loud. Full.enum([, z.enum(freeze([ (a bare freeze helper is transparent by name), foo(z.enum([, Object.freeze(z.enum([: declared; parseenum([: unread. Nested type arguments — z.enum(Array(Mode))([ and Object.freeze(Array(string))([ — read unread, loud, while both docblocks say "any type argument": an over-claim in the safe direction, listed in ③.

5. Ablations — 28 of my own with independent anchors, each restored to 75892bac. Red: A freeze dropped from transparent 2; B freeze added to the refusal 1; C refusal re-opened to any callee 10; D Set dropped 12; E default dropped 2; F extract added 2; F2 exclude added 2; G new prefix dropped 1; H opener-head hand-copy 1; I [-only guard deleted 2; K old-side leg deleted 2; L unreadable refusal dropped 1; M transparent branch never taken 2; N head-not-a-call refused 7; P receiver re-required 5; Q own-constructor tail dropped 3; R new-side decline deleted 3; S NOT-MEASURED sentence replaced 2; U type-argument group dropped from the declared head 1; V whole-token prefix dropped 1; W declared read after the call 13; X never declared 5; Y strip discards the head 2; Z before keeps new 1; AA declared sentence replaced 5; AB empty frames refused 32. ⚠️ Green after two: T — the type-argument group in CALL_HEAD_CALLEE deleted, 591/591 (new Set(string)([ would then read unread, loud); AC — the new-side refusal moved ABOVE the budget spend, 591/591 (a refused element then no longer spends the block's unit, which is quieter than head). Both unpinned; both fail loud at head. The implementer's account of ablation I turning green on its first run matches what I see: defineRegistry({ alone does not pin the guard, the .default({ case does, and I reds 2 with it.

6. Floors — every one seated, and every deletion breaches. Instrumented count against pin for all 29 batteries: registered equals floor on all 29 (0 slack; roster 29 declared, floor 29). Deleting ONE single-line case from each battery in turn: 29 of 29 red with "registered N case(s), below its pinned floor" naming that battery; deleting the #19384 roster entry: "declares 28 batteries, below its pinned floor of 29"; deleting the #19384 battery() call: "DID NOT RUN — 0 cases registered, 66 pinned". Suite 591 at head, 66/66 in the [finding] check-widening-tells T2 fires on ANY lone quoted string on a contract-source line — no closed-set opener required, so the row asserts "a new member of a closed set" it never measured (7 false tells blocking PR #19314) #19384 battery — the seat's correction ✨ Set up Copilot instructions #2 numbers confirmed.

7. Nothing earlier undone. T1/T3/T4: md5 of the extracted bodies of enclosingDelimiters, enclosingDelimiter, inParameterList, memberTellKind, changeBlocks, patchLines, splitUnifiedDiff, addedLines, isConcatenationFragment, declaresUnwritableKey, localDeclaringForms, surfaceFlags and the eight shape-regex declarations: identical across base, r3 head and this head. Old-side leg: the same-block CROSS_PAID gives 2 rows and ablation K reds 2. --pair 19314: exit 0, "carries no widening tell"; by mechanism on the real patch all seven added lines read refused, unreadable=false, 2 frames, innermost [, callee Set, head const COLLECTION_WALK_WRAPPERS: ReadonlySet(string) = new Set(, 0 rows across the PR's three files. --pair 19438: exit 4 on C6 alone (no record names this head), 0 tell rows.

8. Census, re-derived over a stated window. origin/main at 50bae37f3d, complete clone (14,484 commits), 2,641 non-merge commits touching the four declared surfaces (packages/spec/src, packages/spec/api-surface, api-surface-signatures.json, dispatcher-error-vocabulary.ts), git show --unified=3 split per file by the instrument's own splitUnifiedDiff, 10,366 file diffs (10,218 judged, 148 binary), all three instruments over the same rows with readSource stubbed to null. Base 30,032 rows (T1 16,498 · T2 6,445 · T3 6,141 · T4 948); r3 head 29,932; this head 30,004. Base to this head: 30,004 stand, 28 decline, 0 begin, 5,616 sentence-only. r3 head to this head: 0 decline, 72 begin, all freeze — PLATFORM_CAPABILITY_TOKENS 28, REGISTRY_DECLARED_META_TYPES 27, SCHEDULE_ORGANIZATION_NEAR_MISSES 9, FLOW_TRIGGER_KINDS 4, PLATFORM_ALWAYS_ON_CAPABILITIES 4. The 28 declines re-read through this head's reader: callee Set on 28 of 28, across the same eleven bindings the implementer names (PUBLIC_FORM_SERVER_MANAGED_FIELDS 11 rows at aaec5dbc8f 2026-07-16, VIEW_WRITE_PATH_IDENTITY_KEYS 4, CONTAINER_ISSUE_CODES 2, the three value classes 2 each, VALUE_DOMAIN_FIELD_TYPES 1 at 1d7e76a62e 2026-09-04, VALID_AST_OPERATORS 1 at ee6d064db9 2026-02-24, one each for IMPORT_REFERENCE_TYPES, TEXT_OPERATOR_DOOR_PASSING_TYPES, TITLE_INELIGIBLE_TYPES). T1/T3/T4 identical on all three instruments across every diff. My window is one commit wider than the implementer's (adbdbc5005, 2 file diffs, 0 rows), which accounts for 2,641/10,366 against 2,640/10,364; my T2 totals run 452 above theirs on every instrument and in the sentence-only count alike, so the 452 are rows that stand on all three — a harness difference that moves no verdict, stated rather than reconciled. What this population can hold: every member addition that ever landed on those four surfaces in this repository. What it cannot: the enum-over-Set shape of item 1 (no landed instance), a spelling nobody has written yet, anything outside the four surfaces, the objectui mirror, and CRLF member lines (BARE_STRING_ELEMENT never matches them — pre-existing on all three instruments).

9. Tree census, in the implementer's own shape, agreeing. Every bare-element or …Schema, line in packages/spec/src (non-test) at this head — 6,519 lines over 438 files — rebuilt as a one-member addition with three lines of real context: base fires 3,767, r3 3,737, this head 3,748; head classes declared 708 / refused 19 / unread 5,792; base-fires-head-silent 19 = Set 11 over nine bindings + default 8 over three keys, exactly the header's list; r3-silent-head-loud 11, all freeze; begins 0. Of the tree's 38 multi-line new Set([ openers only nine bindings reach the silence — the other 29 put several members on one line, open with a spread, or carry no bare-element line within three lines of the opener — and a member added more than three lines below any opener reads NOT-MEASURED, loud. On the real-PR shape the residual's whole reach on this tree is 11 member lines, two of them on live accept sets.

10. The disclosure of record is false in two measured places and incomplete in a third — the findings none of the four earlier reports contains. (i) closedSetMembership's docblock still quotes its 60-line-window census as "92 refused (Object.freeze 65, new Set 20, .default 7)". Re-measured through THIS head's reader, with the docblock's own 60-line window, over the same 6,519 lines: 27 refused (Set 20, default 7), Object.freeze 0 — the 65 freeze sites read unread now, 5,138 unread against the r3 reader's 5,073 (which does reproduce the 92). The paragraph is the r3 number under a sentence that says "this reader"; it is false about the code beneath it. (ii) The same docblock says "this tree spells two real ACCEPT sets exactly the same way" and lists three, the third being VALID_AST_OPERATORS — on this tree it is export const VALID_AST_OPERATORS = new Set(Object.keys(AST_OPERATOR_MAP)) (data/filter.zod.ts:2139), a one-line derivation with no member line; its one landed new Set([ row is ee6d064db9, 2026-02-24. A widening of it today is a new key on AST_OPERATOR_MAP, and that diff raises 0 rows on base, r3 and this head alike — a pre-existing blind spot, not a cost of the residual, now misattributed to it in the header's "which of them the silence actually costs" paragraph as well. (iii) The round-3 head's header named "new Set([…]) spread into an enum" as a stated silence; this head drops that sentence, and item 1 measures the shape still dark. A residual that says it is "named COMPLETELY rather than characterised" is not.

② Semver level

None — scripts/pm/ is reached by no published package's files[] (70 non-private manifests read, 0 entries), and lint.yml exempts it at job level; skip-changeset agrees. The label is not on the PR (reserved by the dispatch); the landing seat applies it. check-governed-merges --test on the three-dot file list: not governed, exit 0.

③ Boundary flags

• Ruling on the residual, explicit. A new Set([ silence is an ACCEPTABLE DISPOSITION, not a defect in kind: item 2 finds no sound hunk-visible discriminator; the card's leg A mandates the silence; the decline stands on positive hunk-local evidence of the construct; it is pinned in both directions and bounded on the tree at 11 member lines, two on live accept sets; and the only alternative (Set read as unread) fires leg A and returns --pair 19314 to exit 4. ⛔ What is NOT acceptable at this head is the STATEMENT of that silence, which is the whole ground on which such a disposition stands: item 10 (i) is a false census number about the reader itself, (ii) names a carrier the silence does not cover on this tree and hides a pre-existing blind spot behind it, (iii) drops a shape the previous head disclosed. A stated silence whose statement is false is round 3's freeze ruling by another route. Blocking.
• Remedy shape, sized honestly — a docs-and-pins round, not a redesign; the code's behaviour is verified above. Re-take the 60-line paragraph on this reader (27 refused: Set 20, default 7, freeze 0; 5,138 unread) or delete it; say of VALID_AST_OPERATORS that it is a landed row (ee6d064db9) and not a tree site, and that a key added to AST_OPERATOR_MAP is unread by every instrument; name the Set-inside-a-constructor shape in the residual and pin it as a stated silence beside LEG_A; pin or delete the CALL_HEAD_CALLEE type-argument group and pin the refused-spends-before-membership ordering (or move the refusal above the spend and pin that instead); bound "any type argument" to one non-nested group.
• Successor, and a charter that reaches it. The file-scoped consumption reading the residual defers to is not yet filed (no matching card among the 91 issues opened since 2026-09-20T22:00Z). Ruling 🔗 Broken links detected in documentation #202 B (Charter (ruling #202 B): the dev queue is product-only — tooling cards close at first grading, broken gates are deleted not repaired, at most one tooling dev in flight, and tooling is a first-touch label with named readers #19457 charter, Stock cleanup under ruling #202 B (maintainer 「B(荐)A + 清理存量」, amended to close): the triage seat closes the 90 listed tooling pm:queue cards not_planned #19458 stock cleanup) closes tooling cards at first grading and lets in-flight tooling devs finish: this PR may finish under it, but its successor is a tooling card, so the seat should read the Set silence as PERMANENT under that ruling rather than pending, and the header should not imply otherwise.
• Loud-direction items, not findings: nested type arguments read unread; new Set( [ and new Set(/* c */[ read unread; a .default([ list on allowedLicenses widens what the runtime accepts by default while widening nothing an author may write — outside T2's doctrine, silence sound.
• Dev flag (deleted sub-enum branch): accepted — item 3 shows verdicts unmoved and the absence pinned.
• Dev flag (( and { frames a declared boundary): re-measured; both keep their rows.
• Dev flag (check:pm-dispatch-gates runtime): run detached here in the pristine head worktree — exit 0, 1,883 cases, 733 s wall clock, the exit written to a file before any pipe.
• Gates run here on this head, exit 0 each: all 30 families dispatch-gates.mjs --commands derives for this change set (six of them only after pnpm install --offline; without it they exit 3 PREREQUISITE and measure nothing); --self-test 591; check-clause2-carriers --self-test 1,071; node --check; eslint on the exact head blob via stdin (1 file, 0 errors, 0 warnings).
• Seat correction ✨ Set up Copilot instructions #2, judged: (a) freeze transparent, {Set, default} closed — confirmed; (b) 66/66, 591 — confirmed; (c) 2,640 / 10,364 / 28 / 0 / 72 — confirmed within one zero-row commit; (d) the correction's own retraction — confirmed, 72 not 9. The stale round-1 prose above it ("92 refused … Object.freeze 65") is now false in the FILE as well as in the body.
• open_questions: none filed; none owed.

Implemented-by: claude/issue-19384-t2-closed-set-opener
Reviewed-by: session_01AmH9bKvGoLjiY86Q4Z3og2

VERDICT: FAIL

---

Generated by Claude Code

[os-steve]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2608860d5dd008991f2e0ba6099f7ab31fa65cc7

Instrument scripts/pm/check-widening-tells.mjs: blob cd7ad2404660c26a06aeaf97e74fee206d4a11e3 at this head, 75892bacb0ce3086af207cf3ee36519a8bce6b13 at the round-5 head cb46c2e4ff, 445e5be7d33edfef14737ff5fb1ab101ef974cf7 at the round-3 head 3c6148f35e, 6d2ba5a70fce24573fc2dfb6ca721bf72f25ab17 at the merge base 57ceb9d6d2. Clone depth, stated first: the shared checkout is COMPLETE — no .git/shallow, git rev-parse --is-shallow-repository false, root 1598cabe4a (2026-01-18), 14,486 commits reachable from this head and 14,492 from origin/main; nothing was unshallowed. Two own detached worktrees (one read-only for measurement, with pnpm install --offline; one for ablations), node v22.22.2, every exit captured before any pipe, every mutation restored and proved by git hash-object against cd7ad240 with git diff HEAD empty. First-hand throughout; the three prior records, the round-6 report and the PR body's three seat corrections were inputs to judge, and two of their sentences are overturned below.

① Derived judgments

1. The no-behaviour-change claim HOLDS, on a stronger reading than a census. Comment-blind token streams (acorn) of the round-5 blob and this one differ in exactly four regions: the roster floor 66 → 75, two blocks of new self-test fixtures and cases (head lines 6264–6336), and the self-test summary string — 2 tokens deleted, 473 added, zero tokens of non-test code moved. Identical rows over any window therefore follow by construction; measured anyway over round 5's exact window (2,641 non-merge commits from 50bae37f3d, 10,366 file diffs, the four declared surfaces, readSource stubbed to null): round-5 head → this head 0 decline, 0 begin, 0 sentence changes, in BOTH judging units (item 8). Suite 558 → 567 literal registrations (591 → 600 registered), no case removed; roster 29 batteries whose floors sum to 600, SELF_TEST_BATTERY_FLOOR 29.

2. Item 1 (the census number) — DISCHARGED, and the denominators are re-takeable from the docblock alone. From its text and nothing else (every non-test .ts under packages/spec/src at the merge base — 1,014 files; git diff 57ceb9d6d2 HEAD -- packages/spec/src is empty as it says; every line memberTellKind calls T2, fed to closedSetMembership with its own 60 preceding lines) I get 441 files carrying one, 6,553 lines, 1,354 declared, 27 refused (Set 20, default 7, freeze 0), 5,172 unread split 1,791 { / 1,484 no frame / 865 stopped reading / 590 unclassifiable [ / 442 ( — every number exact, on this blob and the round-5 blob alike. The round-3 blob over the same bytes: 1,354 / 92 (freeze 65) / 5,107, the [ bucket 525 → 590, the ( and { counts unmoved — exact. The 34-line gap against my own round-5 figure (6,519 over 438 files) is a population round 5 never specified; the docblock's is specified, and that is the test. The 27 refused sites: security/public-form.ts 12, kernel/plugin-security.zod.ts 7 (default), ui/view.zod.ts 4, and one each in display-name.ts, filter-text-operator-declared-type.ts, import-coercion.ts, union-branch-policy.ts.

3. Item 2 (VALID_AST_OPERATORS) — the facts are TRUE, the stated MECHANISM is FALSE, and that is this round's blocking finding. True: data/filter.zod.ts:2139 is the one-line derivation, the map opens at :2036, its single landed new Set([ row is ee6d064db9 (2026-02-24, 'between',) — my window census counts that row and no other — and a key added to AST_OPERATOR_MAP with real context raises 0 rows on base, round-3, round-5 and this blob. False: WHY. The header ("a PRE-EXISTING BLIND SPOT in the T2 member reading — a { frame, which this file leaves loud and unclassified") and the closedSetMembership docblock ("it IS dark, to a { frame this file leaves loud and unclassified … The header says which hole that is and measures it") both attribute the silence to the frame reader. Measured: memberTellKind(" 'newop': '$eq',", { onContractSource: true }) answers null on every instrument, so the line never reaches T2's member reading, closedSetMembership or any frame; the same key placed under z.enum([ (a [ frame) is also 0 rows; and the controls FIRE — a bare element inside a { frame raises 1 T2 row (NOT-MEASURED) on round-3, round-5 and this blob, a zod-valued key under { raises T1. "Loud" means the row fires, so a loud frame cannot yield 0 rows, and the same docblock says two paragraphs later that every ( and { frame "keeps its row". The hole is a SHAPE gap — a string-valued keyed entry of an object literal matches neither BARE_STRING_ELEMENT nor any SCHEMA_PROPERTY_FORMS value — on a limb the frame reader never sees. As written the disclosure names the wrong hole, points a future repairer at the 442 + 1,791 ( / { bare-element lines that all fire today, and the disclosed silence carries no pinned case, unlike the Set-inside shape beside it. The same false mechanism sits in the PR body's Seat correction Implement ObjectStack protocol specification with Zod schemas and TypeScript interfaces #3 and in the round-6 report. A false sentence about the file's own reading, in two docblocks, is the ground round 5 set for this round.

4. Item 3 (the disclosure regression) — restored, true, and pinned. The four named spellings each go base 1 row → here 0 (CLI on the spread spelling: base exit 4 / here exit 0); zero tree sites (a grep over non-test packages/spec/src for a Set literal under any of the four constructors finds none) and zero landed rows (all 28 declines in the window sit on plain new Set([ bindings). Nine spellings the header does not list — under discriminatedUnion and literal, z.enum(Object.freeze([...new Set([, z.enum([...new Set(string)([, a bare z.enum(new Set([, Array.from(new Set([...KNOWN,, two Sets spread side by side, the inner Set shown while the constructor sits above the hunk, .default([...new Set([ — are all dark on the same three blobs and all one class, the member's innermost [ opened by new Set(, which the sentence states generically ("a new Set([ literal spelled INSIDE one of the four constructors"); the loud controls (z.enum([...new Set(KNOWN),, an inner Set closed above the member, z.enum(uniq([) fire as MEASURED or NOT-MEASURED. Complete at the class level; the four are examples and read as such.

5. Item 4 (the two unpinned pieces) — pinned, and the ordering control does isolate the ordering. Through scripts/ablation-replace.mjs with my own anchors: T (type-argument group deleted from CALL_HEAD_CALLEE) exit 1, exactly the 2 new cases red; AC (new-side refusal hoisted above the [finding] check-clause2-carriers T2 fires on a replaced string property value as "a new member of a closed set", and the C5 row it raises cannot be cleared except by declaring Clause-② yes on a change that does not widen #16943 spend) exit 1, exactly REFUSED_SPENDS red; D-prime (Set dropped) exit 1, 15 red — round 5's 12 plus the three new Set-asserting cases; NEST widened to nest on the callee copy 1 red (the bound case), on the declared copy 1 red (the same case); FLOOR (one case unregistered) exit 1, "registered 74 case(s), below its pinned floor of 75". Two of my own as controls: the refusal continue disabled, 4 red; the declared branch disabled, 17 red, among them the new ENUM_OVER_SET_CONTROL and REFUSED_SPENDS. On the fixture itself: the same block with the ...new Set([ and ]), lines kept and only the refused element removed raises 0 rows (those lines spend nothing); the refused element alone raises 0; two refused then one genuine on one unit raises 1 here and 2 on base. So the single row in REFUSED_SPENDS is bought by the refused element's spend and by nothing else in the fixture, and hoisting the refusal is the one mutation that takes it away; D-prime leaves it green exactly as the report says, because an unread element still spends.

6. Item 5 (bounding the sentence) — the right direction. One non-nested group reads on both heads (pinned by T here and by the declared-head case), a nested one reads unread on the declared, refusal and transparent heads alike and keeps its row (pinned by NEST on either copy). The failure is loud; balancing angle brackets is a different reader, not a regex's promise. Agreed.

7. Nothing undone. Legs A/B/C through the CLI: base exit 4 (4 rows) / 0 / 4 (1 row) → here exit 0 (0 rows) / 0 / 4 (1 row, "this hunk shows the element inside"). --pair 19314 exit 0 ("carries no widening tell"); by mechanism on the real /pulls/19314/files patch: 7 of 7 added bare-element lines refused, unreadable=false, 2 frames, innermost [, callee Set, head const COLLECTION_WALK_WRAPPERS: ReadonlySet(string) = new Set(; base 7 T2 rows at stack.zod.ts:3412–:3418, here 0 across the PR's three files. --pair 19438 exit 4 on C6 alone (no record names this head), 0 tell rows. The closed vocabulary holds: z.enum(uniq([ unread and loud, z.enum(Object.freeze([ measured, freeze transparent, Set and default the only refusals — inside the 600 and in my probes. T1/T3/T4 token-identical and 16,498 / 6,141 / 948 on all four instruments in both units. The tree's 19 base-fires-here-silent sites reproduced one by one (Set 11 over nine bindings, default 8 over three keys), begin 0; the 72 round-3-silent-here-loud rows fall on exactly the five freeze bindings the header names (platform-capabilities.ts 32 = 28 + 4, meta-url-data.generated.ts 27, schedule-organization.zod.ts 9, flow-trigger-kind.ts 4).

8. The record's two corrections — one confirmed, one OVERTURNED with the variable named. (a) Clone depth: confirmed, see the preamble. (b) The 452-row T2 gap: round 6 says a third run lands on the reviewer's numbers, "so the 452 belongs to the implementer's harness". A fourth run does not agree, and the reason is measured. Judging each commit's file list TOGETHER — the instrument's own unit, since wideningTells(files) computes ledgerRowLicences over the list it is handed — gives base 29,580 (T1 16,498 · T2 5,993 · T3 6,141 · T4 948), round-3 29,480, here 29,552, base → here 28 decline / 0 begin / 5,164 sentence-only, round-3 → here 0 / 72: the file HEADER's ① paragraph, digit for digit. The identical harness judging each file diff ALONE gives 30,032 (T2 6,445), 29,932, 30,004, 28 / 0 / 5,616, 0 / 72: the round-5 record and the round-6 report, digit for digit. The 452 are 452 T2 rows, every one in packages/spec/src/migrations/registry.ts, across 105 commits — rows whose check-widening-tells fires T2 on the retirement ledger's own generated rows, so every retirement's clause-② reading is adverse for the one reason the accept set SHRANK #17300 licence is minted by a sibling file of the same commit, so they decline on all three instruments when the commit's files are read together and stand on all three when registry.ts is read alone (set difference of the two key dumps: 452 per-file-only, 0 per-commit-only). So neither harness erred: round 4 judged per commit, rounds 5 and 6 per file, and round 6 blamed its own earlier run without finding the variable. Consequence for the file: the header's census is TRUE under the instrument's unit but states no unit, while the PR body's "identical 30,004 rows" is the other unit — the next reader lands 452 away in one direction or the other, which is the ambiguity item 1 was dispatched to remove.

② Semver level

None — scripts/pm/ is reached by no published package's files[] (83 manifests, 70 non-private, 0 files[] entries name scripts; the root manifest is private); skip-changeset agrees. The label is not on the PR (reserved by the dispatch, as before); the landing seat applies it. check-governed-merges --test on the branch's file list: not governed, exit 0.

③ Boundary flags

• Ruling: the round was sized right and delivered four of its five items as stated; the fifth is discharged on its facts and false on its mechanism, which blocks under the standard round 5 set. Remedy, sized honestly — two paragraphs and one pinned case, no code: in the header and the closedSetMembership docblock, say that a widening of VALID_AST_OPERATORS is a string-valued keyed entry on an object literal, a SHAPE no tell matches (memberTellKind answers null), so it never reaches the frame reader; delete "a { frame … loud and unclassified" as its cause; pin the 0-row reading of that entry beside the Set-inside case so the silence cannot move unnoticed. And state the census's judging unit in the header's ① paragraph (a commit's files together, so ledger licences reach) with the per-file figure beside it, so the two numbers now on the record stop reading as a disagreement.
• Permanence, judged against the ruling's text. Ruling 🔗 Broken links detected in documentation #202 B as recorded on Charter (ruling #202 B): the dev queue is product-only — tooling cards close at first grading, broken gates are deleted not repaired, at most one tooling dev in flight, and tooling is a first-touch label with named readers #19457 and Stock cleanup under ruling #202 B (maintainer 「B(荐)A + 清理存量」, amended to close): the triage seat closes the 90 listed tooling pm:queue cards not_planned #19458 (charter PR docs(pm-dispatch): the dev queue is product-only — tooling cards close at first grading, broken gates are deleted, ≤1 tooling dev in flight, tooling is a first-touch label (ruling #202 B) #19462 is open and blocked on the SKILL.md ceiling, so what is in force is the maintainer's chat ruling, not landed charter text) closes tooling cards at first grading and reopens on exactly TWO readings: a product PR the defect blocks, or a customer-visible contract it protects. The header paragraph names both; the closedSetMembership docblock's "that ruling's own reopen reading" (singular) and "never in advance" name only the first. Incomplete rather than false: whether a reader guarding @objectstack/spec's accept sets "protects a customer-visible contract" is the maintainer's to weigh, and this seat does not rule on it. "Permanent, on present policy" is a fair reading.
• Gates. dispatch-gates.mjs --commands derives 30 families for this change set, with its STALE TREE warning (20 commits behind origin/main, 8 derivation files changed — the warning round 6 reported at 18). I ran all 30: the 26 not named below in this loop, each with its exit captured before any pipe, all exit 0 (check-ci-filter-parity, check-closing-keyword-parity and its self-test, check-comment-mask-corpus, check-declaration-mirrors and its self-test, the check-scripts-symbol-anchors and check-self-test-wired self-tests, check-self-test-workflow-commands and its self-test, check-whole-set-label-write and its self-test, bare-root-worklist --self-test, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:driver-memory-census, check:entry-guard, check:gitlink-declared, check:nul-bytes, check:parse-guard, check:pnpm-filter-targets, check:ratchet-remedy-authority, check:refd-timer-probe, check:watch-hint-literal), plus the four run by hand below — 30 of 30, 0 NOT MEASURED. check:pm-dispatch-gates ran detached in the pristine head worktree: exit 0, 1,883 cases, 832 s, the exit written to a file before any pipe. Also exit 0: --self-test 600, check-clause2-carriers --self-test 1,071, node --check, eslint on the file (1 file, 0 errors, 0 warnings), check-self-test-wired, check-scripts-symbol-anchors.
• Not this round's, noted: the header's ② synthetic re-spelling census (716 / 710) is round 4's and was not re-taken here. My 3-line-context row totals run 19 above round 5's on every instrument (3,786 / 3,756 / 3,767 / 3,767) over the 34 extra lines, with identical classes (708 / 19), the identical silent set (19) and begin 0 — a population difference that moves nothing.
• Seat correction Implement ObjectStack protocol specification with Zod schemas and TypeScript interfaces #3, judged: 12 commits, no rewritten history, 600, 29/29 — confirmed; "identical 30,004 rows" — the per-file unit, see ① 8; "because T2 leaves every { frame loud-but-unclassified" — the same false mechanism as the file's, see ① 3.
• Size label size/xl (was size/l): the labeler's write on the larger diff, not the dev's.
• open_questions: none filed; none owed.

Implemented-by: claude/issue-19384-t2-closed-set-opener
Reviewed-by: session_01AmH9bKvGoLjiY86Q4Z3og2

VERDICT: FAIL

---

Generated by Claude Code

[os-steve]

Closed under ruling #208, ⛔ not because the work was wrong, 2026-09-21T08:13Z

Ruling #208 on #19491, maintainer 「19491 接受你的建议，并立刻派发处理相关任务。」, makes check-widening-tells report-only and stops its development. The director seat closed the four sibling false-positive cards in the same stroke (#19341, #19221, #19440, #17926) and left this PR and its card to the owning seat. This is that act.

What is being closed, measured rather than recalled

reading	value
this PR	draft, head c222a58309, 1 file, +1282 / −28
rounds spent	8 — the seat's own report already recorded it stopped at round 8
true positives the instrument produced across all of them	0
open false-positive cards against it when the ruling landed	5

⛔ The defect was real, and that is why the record is preserved rather than deleted

T2 routed a lone quoted string — or a bare …Schema, arm — anywhere on the contract-source surface to 「a new member of a closed set」, without measuring whether any of its own four closed-set forms enclosed it. That is a wrong shape, ⛔ not the file's 「a tell, never a proof」 allowance, which excuses a tell that is right about its shape and silent about direction.

What the ruling settles is narrower and it is about cost, not truth: a report-only instrument does not earn dev time for being wrong. A wrong hint costs one sentence in a review record; only a gate earns a fix when it misfires, which is a reason to have few gates. ⇒ closing this is the ruling applied, not the finding overturned.

Where the record now lives

The card this PR fixes, #19384, is unreachable — GET and PATCH on it both answer 404 while its comments and timeline still resolve, because it was filed by the banned os-sam account. It has been rebuilt as #19541 on the maintainer's instruction 「19384 你要重建」, carrying the defect statement, the three line-anchor drifts, the ruling and this disposition; #19541 is closed not_planned in the same stroke.

⭐ If check-widening-tells is ever made to hold a hard gate again, #19541 is the record of what T2 does not measure, and this branch is the repair that was written and not landed.

⛔ The branch is left as it is: ⛔ not deleted, ⛔ not force-pushed, ⛔ not merged.

---

Generated by Claude Code