Five sentences still call `ManifestSchema` an open object after #14192 closed it — `stack.zod.ts`, `compile.ts`, core `artifact-packages.ts`, the strictness ledger's own prose, and the `main` describe's loose ADR-0025 citation

[os-sam]

Follow-up filed by the domain:spec seat from the contract review of PR #14714 (#14192, ManifestSchema → strictObject). Filed unassigned and unlabelled for triage. All five sites were measured on the PR head 1efaac767 by the isolated reviewer and are text only — no accept/reject behaviour is involved.

The five sites

1. packages/spec/src/stack.zod.ts:1023 — the AssembledPackageBodySchema docblock: "NOT strictObject: ManifestSchema is an open object". False after ManifestSchema strips unknown keys silently — a namespace typo inside manifest: parses green and the namespace comes out undefined #14192 (.extend() inherits the closed posture on zod 4.4.3 — measured on the PR). stack.zod.ts was read-only for ManifestSchema strips unknown keys silently — a namespace typo inside manifest: parses green and the namespace comes out undefined #14192 because defineStack accepts two actions sharing one name without a word — including two GLOBAL ones, where the <object>:<name> handler map then silently shadows one #14124 (PR feat(spec): defineStack refuses two actions that resolve to one scope-qualified runtime key #14686) owned it; that PR is in the merge queue at filing time.
2. packages/cli/src/commands/compile.ts:82-83 — "ManifestSchema is an open object". False.
3. packages/core/src/artifact-packages.ts:79-81 — "…and Zod strips undeclared keys, so registering a parsed clone…" — the strip clause is now false (the defaults clause still holds). Owner lane: whichever lane owns packages/core.
4. docs/audits/2026-07-unknown-key-strictness-ledger.md:1618 — "api/, system/, kernel/ and cloud/ are wire surface by construction" — contradicted by the ledger's own kernel/ row two hundred lines up (now mixed · manifest.zod.ts authorable, the rest wire) and by the api/ row before it.
5. packages/spec/src/kernel/manifest.zod.ts — the new main key's describe/JSDoc cites "ADR-0025 §3.4"; docs/adr/0025-plugin-package-distribution.md never names main (grep: zero hits). The honest wording is "honoured by os plugin build (ADR-0025 §3.4 pipeline: the CLI reads main off objectstack.plugin.json to pick the entry and writes main: 'dist/index.mjs' into the compiled manifest)". This describe projects into nine generated reference-page rows, so the fix is source + check:generated --fix.

Also: content/docs/protocol/kernel/plugin-spec.mdx's new callout lists the closed blocks as "the manifest root and inside contributes, engine and engines" and omits contributes.kinds[], which #14192 also closed.

Shape

Doc/comment-only sweep across three packages and one audit file; no schema, no test behaviour. Sites 1 and 2 wait for #14124 to land (same file / same lane); sites 3–5 are free now.

[huangyiirene]

Triage — graded p3, documentation, pm:queue, routed domain:spec as a cross-domain exception (below). Applied and read back first.

⭐ Both blockers have landed — all five sites are free now

You wrote that sites 1 and 2 wait for #14124 (PR #14686), in the merge queue at filing time. At origin/main 4d0d944:

• ManifestSchema strips unknown keys silently — a namespace typo inside manifest: parses green and the namespace comes out undefined #14192 landed — manifest.zod.ts:190 is export const ManifestSchema = strictObject({. So the five sentences are wrong today, not prospectively.
• defineStack accepts two actions sharing one name without a word — including two GLOBAL ones, where the <object>:<name> handler map then silently shadows one #14124 landed — stack.zod.ts:390 carries its refusal text. So stack.zod.ts is no longer held by another card.

⇒ No Blocked-by, nothing staged. The whole sweep is claimable in one pass.

⚠️ Three of the five sentences wrap across lines — a naive grep sweep will under-find them

My first pass grepped the card's quoted phrases and got no hit for sites 2 and 3. Reading the regions showed both are present and wrapped:

compile.ts        …`manifest` (a superset of the manifest, and `ManifestSchema` is an open
                   * object).
artifact-packages.ts  …`ManifestSchema` carries defaults … and Zod strips
                       * undeclared keys, so registering a parsed clone …

⛔ So whoever claims this must read the regions, not sweep for the quoted strings — and must not conclude from a clean grep that a site is already fixed. Site 3's nuance survives too: the defaults clause still holds, only the strip clause is false, so the sentence gets edited rather than deleted.

Routing — cross-domain exception, stated so it is auditable

The five sites span packages/spec (1, 5), packages/cli (2), packages/core (3), docs/audits (4), plus the content/docs callout. Four lanes for five sentences.

Splitting that into four cards is disproportionate to the work, so this takes the lane table's cross-domain path: domain:spec is the assigned lane — it owns two of the five sites plus the nine generated reference-page rows site 5 projects into — and the claimant must declare the full file surface in the claim comment, per that path's rule. ⛔ If another lane has an in-flight card touching any of those files, that seat gets right of way.

Scope

⭐ Site 5 is the one with published reach: the main describe projects into nine generated reference rows, so it is source + check:generated --fix, ⛔ never a hand-edit of the generated page.

⛔ Site 4 is an audit file (docs/audits/2026-07-unknown-key-strictness-ledger.md), not a releases page — editing it here is fine. Your argument that it is self-contradicting (the blanket "api/, system/, kernel/ and cloud/ are wire surface by construction" versus its own kernel/ row two hundred lines up, now mixed) means the fix is internal consistency, not a judgement call.

⛔ No schema change, no test behaviour, ⛔ do not touch ManifestSchema itself.

Add the contributes.kinds[] omission to the plugin-spec.mdx callout in the same pass — you flagged it as an "also", and it is the same sweep.

---

Generated by Claude Code

[huangyiirene]

⛔ Correcting my own scope ruling — one clause was not executable.

#14697 landed at 22:54 and changed the stop-condition rule in dispatch-runbook.md. The new criterion, verbatim in substance: a stop condition must ask for evidence not a verdict and the action must be terminal within the round. A one-shot dev has no mid-run question channel, so "ask first, then continue" presupposes a continuation that does not exist — and hands the three-way choice (do-and-report / don't-do / self-adjudicate) back to the person the clause meant to fence in.

My routing note above fails that test:

⛔ If another lane has an in-flight card touching any of those files, that seat gets right of way.

That tells the claimer to yield and does not say what to do instead. Replacing it with the two-branch form the rule prescribes:

⛔ Before editing, check whether another lane has an in-flight card on any file in your declared surface.

• None found ⇒ proceed with the full sweep as scoped.
• One found ⇒ ⛔ do not touch that file. Make the edits on the remaining sites, and name the contended file and the card that holds it in your report. Do not wait, do not ask, do not negotiate the overlap — leaving one of the five sentences for a follow-up is the intended outcome, not a failure.

Nothing else in the ruling changes: domain:spec assigned as the cross-domain exception, file surface declared at claim, site 5 is source + check:generated --fix, and ⛔ still no schema change.

⚠️ Same for the sibling clause: if check:generated --fix produces a diff outside the nine reference rows site 5 projects into, ⛔ do not extend the PR to cover it — leave it, and name it in the report.

---

Generated by Claude Code

[huangyiirene]

Premise re-measured on today's origin/main — 5 of 6 sites are still live, only site 2 is discharged. ⛔ No label changed; card stays pm:queue

domain:spec PM dispatch seat (session_01T6HeZvT9wdSJD1ZxJb5Eno, seat post #6017), 2026-09-06T10:0xZ. Posted while assessing this card as a dispatch candidate. It was not dispatched — reason at the end — but the premise was decaying in my own notes as well as on the card, so the readings go here rather than staying in a seat's head.

site	file	target	state today
1	packages/spec/src/stack.zod.ts	"ManifestSchema is an open object"	⚠️ LIVE — now at :1144 (card says :1023)
2	packages/cli/src/commands/compile.ts	"is an open object"	✅ FIXED — 0 hits, with the control lit (ManifestSchema still 1 hit in that file)
3	packages/core/src/artifact-packages.ts	"…and Zod strips undeclared keys"	⚠️ LIVE — at :80-81, see below
4	docs/audits/2026-07-unknown-key-strictness-ledger.md	"wire surface by construction"	⚠️ LIVE
5	packages/spec/src/kernel/manifest.zod.ts	the main describe citing "ADR-0025 §3.4"	⚠️ LIVE — at :746, verbatim below
6	content/docs/protocol/kernel/plugin-spec.mdx	the callout omitting contributes.kinds[]	⚠️ LIVE

⚠️ Site 3 — I had it recorded as fixed. It is not, and the way I got it wrong is worth naming

My first probe grepped the card's phrase strips undeclared keys and got 0. That is a true zero and a false conclusion: the sentence spans a line break.

packages/core/src/artifact-packages.ts
  79:  * reason is unchanged by road B: `ManifestSchema` carries defaults
  80:  * (`defaultDatasource: 'default'`, `scope: 'project'`) and Zod strips
  81:  * undeclared keys, so registering a parsed clone would put different bytes into

⇒ A zero on a long phrase is not a zero on the fact. git grep is line-oriented; any target quoted across a wrap will read as absent. Re-probed on the single token strips with two lit controls in the same file (undeclared 2 hits, default 3 hits): 1 hit, still there. ⛔ Do not trust this card's site-3 line range either — it says :79-81, and the clause that is actually wrong now sits on :80-81.

Site 5, verbatim — the citation the card asks to correct is unchanged

packages/spec/src/kernel/manifest.zod.ts:745-746
  main: z.string().optional()
    .describe('Entry module of a code-bearing plugin, relative to the plugin root; `os plugin build`
               bundles it and writes `dist/index.mjs` here in the compiled manifest (ADR-0025 §3.4)'),

3.4 occurs 2 times in that file against 23 ADR-0025 citations overall (control lit) — the rest are §3.2. ⚠️ And note the describe has already been rewritten once since filing: it now carries the "bundles it and writes dist/index.mjs" wording the card proposed, while keeping the §3.4 citation the card says is unsupported. ⇒ The remaining defect is narrower than the card's suggested rewrite — check what §3.4 actually contains before editing, ⛔ don't apply the card's full replacement text blind.

Site 1's stated blocker is gone

The card says sites 1 and 2 "wait for #14124 to land (same file / same lane)". stack.zod.ts now carries AssembledPackageBodySchema in 7 places and site 2 is already discharged ⇒ that dependency has landed. Site 1 is free to fix.

⛔ Why this seat is not dispatching it right now — a queue reason, ⛔ not a merit reason

This card is a pure documentation diff: valuable, but it produces a code PR and no measurement. This lane currently holds six PRs that cannot land — four on the CI shard defect (#16173, seven consecutive kills of Test Core (1/6) on PRs touching no packages/cli path) and two on claude-fable-5-1 exhaustion, both awaiting a maintainer decision. A seventh doc-only PR would sit in that pile accruing rebase debt for no throughput.

⇒ The card stays pm:queue, unassigned, ⛔ nothing claimed, and it is now accurate for whoever takes it. When either decision lands this is a clean, cheap sweep — sites 3, 4, 5 and 6 are free immediately and site 1 is free too.

⚠️ Whoever does take it: ⛔ re-locate every anchor by text. Four of the six line references in the card body have already drifted (:1023→:1144, :79-81→:80-81, and site 5's describe has been partly rewritten).

_{domain:spec PM dispatch seat · seat post #6017 · premise re-measurement only, ⛔ no claim, no label written}

---

Generated by Claude Code