docs(audits): the strictness ledger's `control-flow.zod.ts` row still says the schema and `validateControlFlow` "do not fight" and meet at "exactly one seam" — #16134 made both false

[claude]

Found by the os-dev discharging the #16835 / #15239 fold (PR #16947), while answering a PM instruction to check by hand whether any hand-written page restates the claims those two cards retire. It does. ⛔ Not graded and not routed — no domain:*, no priority:*, no pm:*: that is the triage seat's to produce.

What is false

docs/audits/2026-07-unknown-key-strictness-ledger.md, the control-flow.zod.ts row (line 738 at the time of reading — ⛔ re-locate by text, this is a one-line table row and the number will move) restates both sentences #16835 retires, as a paraphrase rather than a quotation:

validateControlFlow is a sibling guard, not a key gate, and the two do not fight: it answers single-entry / single-exit / acyclic, which no key check can decide, and the schema answers key membership, which no structural check can decide. They meet at exactly one seam — the guard safeParses each region slot before analyzing it … Nothing was duplicated and nothing removed …

Both halves are now false, for exactly the reason #16835 gives:

1. "the two do not fight" / "the schema answers key membership, which no structural check can decide" — since Decision: do a flow's top-level nodes[] and its region bodies (loop / try_catch / parallel) share ONE node-id space, or two? — uniqueness is now enforced inside each, never across #16134 (landed as 21aabbc7b, PR feat(spec)!: one node-id space — FlowSchema refuses a region node whose id is declared elsewhere in the flow (#16134) #16825) FlowSchema's superRefine refuses a duplicate node id, which is a structural fact decided by the schema. The clean division this sentence draws is what the ruling deliberately removed, and the two guards now overlap within the depth ceiling.
2. "They meet at exactly one seam" — there are now two: the 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 region-slot safeParse seam, and the Decision: do a flow's top-level nodes[] and its region bodies (loop / try_catch / parallel) share ONE node-id space, or two? — uniqueness is now enforced inside each, never across #16134 node-id-collision seam. Past MAX_REGION_DEPTH (32) the parse stops walking and analyzeRegion is the only refusal of a within-region duplicate, so the guards also hand off at a measured boundary.

Measured

On origin/main at PR #16947's head c5ee37f6c, git status --porcelain empty:

$ grep -c "do not fight"        docs/audits/2026-07-unknown-key-strictness-ledger.md   → 1
$ grep -c "meet at exactly one seam" docs/audits/2026-07-unknown-key-strictness-ledger.md → 1
CONTROL, same file: grep -c "validateControlFlow" → fires (the row is read)

The corrected wording already exists and is reviewable: PR #16947 rewrites the canonical control-flow.zod.ts docblock to name both seams and the MAX_REGION_DEPTH handoff, checked against FlowSchema's superRefine header and analyzeRegion's header — the two in-tree comments that came through #16825's own reviews.

Why it was not fixed in PR #16947

⛔ Deliberately left alone rather than overlooked. Two reasons, both stated in that PR:

• its governing claim comment fences the file surface to control-flow.zod.ts + sharing.zod.ts and says "⛔ Nothing else";
• docs/audits/** is a campaign ledger with a merge=os-regen driver and a generated companion (….counts.md, gated by check:strictness-ledger), so editing it opens a verification surface that fold did not carry. The bounded in-place-fix exemption needs no new verification surface, and this fails that limb.

Scope

• Correct the two clauses in that one row to the post-Decision: do a flow's top-level nodes[] and its region bodies (loop / try_catch / parallel) share ONE node-id space, or two? — uniqueness is now enforced inside each, never across #16134 division. Prose only — ⛔ no site counts move (this is wording inside an existing row, not a row added or removed), so check:strictness-ledger should stay green; confirm rather than assume.
• ⛔ Do not write another temporal promise. Say what is true today and name the artefact — a landed commit, a registry entry, a test — never a schedule. Both control-flow.zod.ts's docblock (and the reference page generated from it) says the schema and validateControlFlow "cannot fight" and meet at ONE seam — #16134 makes both sentences false #16835 and spec: three sharing.zod.ts docblock sentences go false when #15072 lands — the field recipient stops being "not yet authorable" #15239 exist because a sentence promised a future.
• ⛔ content/docs/references/** is generated from the docblock and is already handled by PR docs(spec): two docblocks that promised a future which has already arrived (#16835, #15239) #16947; this card is the hand-written ledger only.

Sequencing

Independent of PR #16947 — the ledger is a separate file and the two do not conflict. It can land before or after. ⚠️ Whoever takes it should re-read the docblock as PR #16947 leaves it, so the ledger and the source agree rather than drifting into two descriptions of one boundary.

Dup check

GET /repos/objectstack-ai/objectstack/issues?state=open&labels=documentation&per_page=100, paged to closure (100 + 4 + 0 = 104 open documentation cards read), grepped for strictness-ledger / strictness ledger / cannot fight / one seam / do not fight / 2026-07-unknown-key. The only hits are #16835 itself (the docblock card) and PR #16947 (its fix); no card covers the audit ledger. CONTROL on the same corpus: control-flow matches 2 cards, so the scan reads bodies rather than returning a vacuous zero. ⚠️ The documentation label was the narrowing — a card filed without that label would not appear.

---

Generated by Claude Code