[finding] The two `os migrate` remedy branches in `engine.ts` carry the same defaulting `else` arm as #16067 — total by construction today, on a union one member from widening

[claude]

Observed while measuring #16067 (branch claude/issue-16067-attest-remedy-mapping, PR #16180) as an out-of-scope finding. ⛔ Not ridden in that PR: it is a different package with a different gate family, so it is filed rather than carried.

What was observed

packages/platform-objects/src/system/migration-flag.ts was the third of three sites in this tree that build an os migrate remedy string dynamically. The census is exact — git grep -n "os migrate ' +" -- packages returns three lines, and PR #16180 repairs one of them. The other two are in packages/objectql/src/engine.ts, on origin/main 81b426f77:

8142:  (migrationId === FILE_REFERENCES_MIGRATION_ID ? 'files-to-references' : 'value-shapes')   // recordObservedDeviation, #4797
8245:  (migrationId === FILE_REFERENCES_MIGRATION_ID ? 'files-to-references' : 'value-shapes')   // retractCreationAttestation, #4769

Both carry the same shape the card named: a two-way branch over a migration id whose else arm hands out value-shapes to anything it does not recognise.

Why this is an observation and NOT a live defect

Measured, not assumed. Both are private and each has exactly one caller — noteAdmittedValueShapeViolation, engine.ts:8044 and :8045. That function derives migrationId at engine.ts:8029 from violation.gate, declared in packages/objectql/src/validation/record-validator.ts:1050 as the closed union:

gate: 'media' | 'value-shape';

engine.ts:8029 is also the only writer of admittedValueShapeViolations. So the domain of both branches is exactly two ids today, each branch is total over it, and every sentence either one can emit is correct. Nothing an operator can see is wrong.

⇒ finding, no priority. It is latent fragility of the same class, one layer up: the day a third ADR-0104 gate class widens that union, both else arms start prescribing value-shapes for it, silently and correctly-looking — the exact shape #16067 recorded one package over.

A third ternary at packages/objectql/src/validation/record-validator.ts:861 is deliberately not part of this: it branches on a boolean isMedia, so it has no third case to get wrong.

Suggested shape, if it is ever picked up

The same one PR #16180 landed for attestFreshDatastore — an explicit id-to-remedy register rather than a branch with a default arm — so a widened gate union produces a missing row (loud, at the point of change) instead of an inherited remedy. There is no ready-made shared home for that register today: packages/spec owns the id constants, platform-objects must not take a runtime dependency on the engine (stated at migration-flag.ts:30), and objectql depends on platform-objects, so a single shared table is its own small design question rather than a copy-paste.

Re-check

git grep -n "os migrate ' +" -- packages
git grep -n "recordObservedDeviation\|retractCreationAttestation" -- packages/objectql/src
sed -n '1043,1051p' packages/objectql/src/validation/record-validator.ts

Dedup

REST /search/issues answers 403 through this container's proxy by design (measured this round; a repo-scoped REST read on the same channel answers 200 as a control), so dedup ran on the repo-scoped list endpoint plus a local grep over all 646 open issues, with a firing control (#16067 itself is found in the corpus). Zero hits for recordObservedDeviation, retractCreationAttestation, deviation marker and creation attestation; the only ternary and value-shapes hits are #16067 itself. Zero MCP calls were spent.

---

Generated by Claude Code