[finding] check-clause2-carriers T2 fires on a replaced string property value as "a new member of a closed set", and the C5 row it raises cannot be cleared except by declaring Clause-② yes on a change that does not widen

[claude]

Filed by the domain:spec @ objectstack execution seat (session_016N6xmWt5hYm94ffVEwGH8x), seat post #6017, using Claude Code. ⛔ Filed bare and unassigned — no domain:*, no priority, no type. All three are triage's.

⚠️ Routing input only, ⛔ not a lane assignment. The subject is scripts/pm/check-clause2-carriers.mjs, a governance gate — that is not this seat's surface to edit, and ⛔ this seat did not touch it.

The false positive, measured on a live pair

node scripts/pm/check-clause2-carriers.mjs --pair 16941 returns exit 4 with a C5 row:

card #16228 (delivering open PR #16941 (draft)) declares Clause-②: no while its diff carries 1 widening tell(s) … packages/spec/src/security/permission.form.ts:30 (T2)
T2 … — a new member of a closed set (z.enum / union / an as const array) — the accept set gains a value

The named line is the description: property value on an existing object literal inside sections: [ … ], and the diff replaces it:

-        'Permission Sets stack on top of a Profile to grant additional access. …'
+        'Permission sets are the only capability container: …'

T2's own definition has no referent in that file

Measured on PR head 02daeed44, every zero with a live control:

grep on packages/spec/src/security/permission.form.ts	hits
as const	0
z.enum	0
z.union	0
] as	0
defineForm — positive control	2

There is no closed set in the file for a member to be added to.

And no array gained a member

	origin/main	PR head
sections (label: ')	4	4
fields ({ field: ')	7	7

⇒ T2 appears to fire on a + '…' string-literal line inside a bracketed region, without confirming that the region is one of the three constructs it names, or that a member count actually rose.

⭐ Why this is worth a card rather than a shrug

The C5 row is not merely noisy — it is unclearable by the honest route. The remedy text offers two options:

re-declare yes or explain in the claim why this addition does not widen

but c5WideningTell(pair, repo) takes only the pair and the repo. An explanation in the claim cannot change its verdict, so once T2 fires on a correct no, --pair reads 4 for the life of that head. And --pair = 0 is the mechanical half of the landing precheck (references/contract-review.md, limb ②).

⇒ The pressure this creates is the problem. The only way to make the number go green is to re-declare yes on a change that does not widen — a false declaration, made to satisfy a checker. That is the same failure this file exists to prevent, pointing the other way. ⚠️ A gate whose green is reachable only by lying is worse than one that is merely wrong.

⛔ This seat did not re-declare. It explained in the claim (#16228, comment 5588675301) as the remedy text names, and recorded that the direction is corroborated by instruments that did not fire — check:api-surface and check:authorable-surface, both green with no regeneration required, which a real accept-set or published-key addition cannot pass silently.

Possible shapes for the fix — ⛔ suggestions, this seat did not measure their cost

1. Require the construct, not the bracket. Confirm the enclosing region really is a z.enum / union / as const array before classifying an added string literal as T2.
2. Require a net member gain. A -/+ pair on the same property is a replacement; counting members before and after would drop this class entirely.
3. Make the documented remedy real. If "explain in the claim" is to be a genuine second route, C5 needs to read something — a marker in the claim comment naming the file:line it accounts for — so an examined false positive can be cleared on the record instead of by a false declaration.

⛔ Do not simply widen T2's tolerance for string literals: the checker's own warning that "a tell is not a proof and its absence is not one either" cuts both ways, and a tell that stops firing on real closed-set additions would be the more expensive failure.

Dedup

Searched domain:skills (22 open) and domain:devx (100 open — ⚠️ a page cap, so a lower bound) and the 25 newest open issues for clause2 / clause-② / widening / tell / carriers. Nearest neighbours are #16833 (--pair cannot judge a pair once its carriers are cleared) and #16931 (a Clause-②: key not at the start of its own line is invisible to both checkers) — both about the same file, both a different defect: those are about reading the declaration, this is about classifying the diff.

---

Generated by Claude Code

[claude]

Second instance, different tell — T1 now, on a live pair, same shape and the same dead end

domain:spec execution seat (session_016N6xmWt5hYm94ffVEwGH8x), 2026-09-08T21:22Z. Appended rather than filed separately: same script, same C5 row, same "can only go green by lying" outcome — but a different tell, which is the new information. ⛔ This seat still does not touch scripts/pm/**.

node scripts/pm/check-clause2-carriers.mjs --pair 16968   →  exit 4
✗ C5 — card #16256 (delivering open PR #16968 (draft)) declares `Clause-②: no` while its diff
  carries 1 widening tell(s) … packages/spec/src/ui/dashboard.zod.ts:825 (T1).

The named line, and why it is not a widening

Line :825 is the field key of GlobalFilterSchema. The diff replaces it — the key existed, with the same type, and only its .describe() text changed:

-  field: z.string().describe('Field name to filter on'),
+  field: z.string().describe('Field name to filter on — at the authoring layer it resolves
+    against the object behind each bound widget's dataset (`dataset.object`), … '),

Measured on the PR head 95663cfc11 against origin/main, ⛔ not argued:

reading	main	head	verdict
keys declared in GlobalFilterSchema	32	32	unchanged
field's declared type	z.string()	z.string()	unchanged
z.enum added / removed by the diff	0	0	—
z.union added / removed	0	0	—
as const added / removed	0	0	—
.optional() added / removed	0	0	—
z.literal added / removed	0	0	—
.or( / .and( added / removed	0	0	—
control — describe( added	—	1	⇒ the zeros above are readings, not instrument silence

⇒ No accept set moves. The tell fires because an added line matches a key-declaration shape, and a line rewritten in place is an added line to a diff.

Why this instance is worth appending rather than noting

The first instance was T2 on a description: string inside a form's sections: [ … ] array. This one is T1 on a Zod key in a .zod.ts schema — a different tell, a different file kind, a different code shape. ⇒ The defect is not one tell's pattern being too loose; it is that the tells are computed on added LINES and have no way to see that a line replaced an identical-typed one. Two tells reproduce it independently, so a fix that tightens one pattern would leave the other.

The dead end is unchanged, and it is the part that matters

c5WideningTell(pair, repo) takes only the pair and the repo. An explanation written into the claim or the PR body cannot reach it, so this row cannot be cleared by explaining. The only inputs that would flip it are:

1. declare Clause-②: yes — false here, and it would route a comment-only diff to CONTRACT_REVIEW_TIER for construction; or
2. don't touch the line — i.e. don't fix the card.

⭐ Neither is available honestly, which is this card's thesis restated on a second tell: the row can only go green by lying. The script's own output says as much — "Neither reading is overturned here: the declaration stands as written and the diff stands as pushed, and they disagree. Report-only."

What this seat did about it, so the record is complete

Landed PR #16968 with the C5 red explicitly recorded as a deviation on card #16256, carrying the table above. ⛔ The declaration was not changed to yes: a false declaration to satisfy a checker would corrupt the one signal the clause-② gate exists to carry, which is worse than a known-false red on a report-only row.

⚠️ Note for whoever grades this card: the frequency is now measurable. Two live pairs in one shift, both comment/prose-only changes, both on this lane. A gate that a correct change cannot pass teaches seats to route around it.

---

Generated by Claude Code