docs(audits): the strictness ledger stops restating the union-flattening claim in its ui/ batch narrative - #16792

Fixes #14977

Delivers the card's whole remaining scope after PR #16766: the fourth instance of the union-flattening claim in docs/audits/2026-07-unknown-key-strictness-ledger.md, in the ui/ batch narrative's clause (a).

What changed

One file, one paragraph. The clause asserted two things that the tree does not do:

• a cleft — "What carries the named surface and the rename to the author is packages/lint/src/zod-issue-format.ts's arm unpacking" — which makes lint's unpacker the author's only route;
• the generalisation that followed it — "a general fact about this campaign's remaining union sites, not a chart detail" — the same generalisation PR docs(audits): the strictness ledger stops asserting a union flattening the tree no longer does #16766 withdrew from the chart.zod.ts row.

Both are struck, only as loud as becomes exactly as loud as, and packages/spec/src/shared/union-branch-policy.ts is named as what lifted it. The parenthesis the paragraph keeps — zod still raises a keyless invalid_union whose message is the bare string "Invalid input" — is untouched and still true.

Why corrected outright rather than given a LIFTED note

Ruling A on #14977 (comment 5579112979): a row keeps its batch-tense text and gains an inline LIFTED note, except a clause that was false at its own batch, which is corrected outright. This site is in the exception, and I re-measured that rather than inheriting it:

e0f300ba5  2026-08-08 09:30:53   wrote this clause (#5583) -- the SAME commit as the :676 clause
546ab3c49  2026-08-05 00:23:55   the #4971 lift landed
git merge-base --is-ancestor 546ab3c49 e0f300ba5   -> exit 0
git rev-parse --is-shallow-repository              -> false

Exit 0 is the self-proving direction: the lift was already in the tree three days before the clause was written.

Evidence — a reproduction, not a green gate

pnpm --filter @objectstack/spec check:strictness-ledger grades row structure and the generated counts, not prose, and is green either way. It is reported below, and it is not evidence for this diff.

The evidence is a run through the door the paragraph itself names — spec's own formatZodError, with no packages/lint anywhere in the path, on @objectstack/spec freshly built at this branch:

safeParse.success = false
--- raw top-level issues (the parenthesis the paragraph KEEPS) ---
  code=invalid_union path=["groupBy"] message="Invalid input" branches=2
--- rendered by spec formatZodError (falsifies the clause under correction) ---
chart aggregate (1 issue):

  x groupBy: Invalid input
    x groupBy: Unrecognized key(s) on this chart groupBy: `dateGranularty`.
      Did you mean `dateGranularty` -> `dateGranularity`? ...

The surface, the offending key and the rename all arrive; the union's cost is the one wrapper line. Mechanism read in source: formatZodIssue (packages/spec/src/shared/error-map.zod.ts:221) descends invalid_union and ranks the branches through selectUnionBranches; packages/spec/src/api/zod-issues-to-fields.ts:51 imports the same function — one policy since #8318.

The probe was a scratch file inside the worktree, run under an EXIT INT TERM trap and deleted; git status is clean and no test file is added. No ablation applies — the deliverable is prose, not a guard.

Consistency with the chart row

The two statements of the mechanism now read identically:

:676  a strict object arm inside a union is exactly as loud as its consumer's unpacking
:993  a strict object arm inside a union is exactly as loud as its consumer's unpacking

The note also points the reader up to the chart row rather than arguing the case a second time.

Fifth-site sweep — method and result

Result: no fifth site to correct. One adjacent finding, reported not filed (below).

Method, because a count is only as good as the way it was taken, and a single-line grep over a line slice already produced one false zero on this card:

1. Wrap-aware pass. The file mixes single-line table rows with hard-wrapped prose, so the file was normalised into 243 blank-line-separated blocks and each block matched with newlines folded to spaces. 11 pattern families: flatten*, collaps*, as loud as, invalid_union, Invalid input, zod-issue-format, formatZodError|formatZodIssue|zodIssuesToFields|selectUnionBranches, unpack*, never reaches|does not reach|not in the message, #4971|#5014|#5341, and the note vocabulary. 7 candidate blocks.
2. Orthogonal completeness pass. Any statement of this claim must name a union, so a second, independent pass enumerated on the word union alone — no formatter or flattening vocabulary at all. 15 blocks, and it surfaced no claim-bearing block the first pass had missed.
3. Positive control. Both passes return all four known sites (:676, :737, :940, :976), so the zero elsewhere is a real zero and not an unread file.

Classification of all 7 candidates:

One block deserves naming because it is a claim the first three passes on this card never examined — see 验收备注.

Gates

Derived, not guessed: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack docs/audits/2026-07-unknown-key-strictness-ledger.md, then reconciled.

Run reconciliation - 17 derived, 17 run, 0 NOT-MEASURED, 0 UNRUN.

All 17 exit 0, each captured before any pipe (cmd > log 2>&1; ex=$?). Verdict lines quoted rather than bare $?:

strictness ledger: 60 file(s) across 5 triaged director(ies) - every row names a live sited file
docs/audits/2026-07-unknown-key-strictness-ledger.counts.md is current - 444 site(s) measured
check-nul-bytes: OK (scanned 8282 text file(s) ... no raw ASCII control bytes)

pnpm --filter @objectstack/lint check:doc-formula-expressions first returned exit 3 = PREREQUISITE NOT MET ("Nothing was measured"); @objectstack/formula and @objectstack/lint were built as it instructed, under scripts/pm/os-verify-lock.sh (VERDICT command-exit 0), and only the re-run is recorded as measured.

Outside this run by the tool's own accounting: the 2 families taking a value from the workflow, 10 declaring a population too wide to place, 43 artifact rosters whose silence is a fact about a list, and the always-runs tail. No repo-wide eslint run — pnpm lint is CI-owned.

Changeset

skip-changeset, measured rather than assumed: the root package is private: true, docs/audits/ is a repo-root path outside every package directory so no package-relative files[] can reach it, and 0 of the 23 files[] declarations name it. Nothing published moves.

验收备注

A fifth clause exists, it is NOT this card's exception case, and it is deliberately untouched. dashboard.zod.ts :673 carries, beside the batch record this card already verified as correctly framed, a second and distinct present-tense sentence: "#5014 still binds every OTHER curated message this campaign has put inside a union arm — this row is one slot's correction, not the finding's retraction." That sentence is present-tense and no longer describes the tree. It is not in ruling A's correct-outright exception, and I measured that rather than assuming it:

d17df8017  2026-08-04 06:34:16  wrote ':673 still binds' (#5011)
git merge-base --is-ancestor 546ab3c49 d17df8017  -> exit 1   (lift NOT yet in tree)
control leg: git merge-base --is-ancestor d17df8017^ d17df8017 -> exit 0

So it was true when written and expired the next day — which under ruling A is the LIFTED-note case, not the correct-outright case, and a different edit from this one. It is also explicitly fenced by this dispatch (do not touch :673). Reported, not filed: a stale prose sentence is not a reproducible defect, a declared-contract violation, or a metadata-authoring trap — the same grading the seat applied to the fourth site. Successor: this seat, on the ledger-convention pass that ruling A opened; the two prior readings of :673 looked at its batch-record clause and its RESOLVED note, not at this sentence.

Interim state now ends. Before this PR the file carried a corrected chart row and an uncorrected restatement of it ~300 lines below. After it, the two agree.

Generated by Claude Code