Burn down the 14 module-local spec-symbol mirrors seeded into check-spec-symbol-derivation's DEBT block

[yinlianghui]

Tracking anchor for the DEBT block in scripts/check-spec-symbol-derivation.mjs (DEBT_ISSUE). Filed by the dev seat implementing #6291; unassigned, for triage to grade and route.

Why this issue exists rather than a reused number

DEBT_ISSUE was 4115 (objectstack#4115), and the block had been empty since objectui#3162 — that ledger was burned down and objectstack#4115 was closed by objectstack#6883. #6291 dropped rule 1's export filter, which widened the rule's jurisdiction to module-local declarations and surfaced a population that predates the change. Those entries need an open anchor: the gate's own stale-ledger message reads "delete them … (and close #N once the ledger is empty)", which is a dead instruction pointing at a closed issue.

Re-anchoring on #6291 was not an option either — that card is closed by the PR that seeds the block.

The seed, mechanically regenerated by --ledger

14 distinct names, 15 findings, on the #6291 implementation commit against @objectstack/spec@17.2.0. Every one was classified by reading the site (census in PR #6284, re-taken on the implementing commit):

package	symbols
@object-ui/app-shell	AdminScope, AppLike, FlowEdge, FlowRuntimeState, ObjectLike (two sites), RemoteTable
@object-ui/core	CONTEXT_TOKEN_SUGGESTIONS, isContextToken
@object-ui/types	UserFilterFieldSchema, UserFiltersSchema
@object-ui/components	SortDirection
@object-ui/data-objectstack	normalizeFilterOperator
@object-ui/plugin-detail	RecordAlertProps
@object-ui/plugin-tree	TreeConfig

These are real mirrors, not different-concept collisions — the four collisions in the same population got reasoned ALLOW entries in the same commit instead. Several carry a divergence measurable today: AppLike, ObjectLike, RemoteTable and FlowRuntimeState each relax a spec-REQUIRED key to optional; CONTEXT_TOKEN_SUGGESTIONS is byte-identical to the spec's nine-entry map, in a file that 25 lines earlier explains its neighbour became a re-export precisely because a byte-identical copy passes every value comparison and every behavioural test; normalizeFilterOperator is a second normalizer over the spec's, and two normalizers disagreeing about filter operators is the silent over-fetch class of objectstack#3948.

How to burn one down

Per the block's own governance: import it, derive it (z.infer<typeof SpecX> / SpecAuthoredInput< … >), or — if it deliberately differs — rename it to a declared dialect or move it to ALLOW with the reason written down. --ledger regenerates the block, so removal is a mechanical edit. The block is shrink-only: it grew once, at #6291, on a jurisdiction widening, and must not grow again for any other reason.

Deliberately filed as ONE ledger rather than 14 issues — PR #6284's report already argued why 19 loose issues for one ledger would be noise. The two entries that carry standalone defects beyond the mirroring already have their own cards (#6286, #6287).

Also seen while filing, NOT fixed here

CLAIM_DEBT_ISSUE = 4592 in the same file points at objectui#4592, which is also closed, and its 19-entry CLAIM_DEBT block is live. Rule 2's ledger has the same dead-anchor problem this issue fixes for rule 1. Left alone rather than changed as a rider on #6291's diff.

Refs: #6291 (the split that surfaced the population) · PR #6284 (the census) · #5899 (the finding) · #6286 / #6287 (standalone defects from the same population)

[os-zhuang]

分诊 · domain:ui / priority:p2 / pm:queue

Anchor read, not guessed —— 而这一张的车道是按「修在哪里」判的,不是按「账本在哪里」。

账本住在 scripts/check-spec-symbol-derivation.mjs(domain:devx 面),⛔ 但每一次销账都发生在拥有那个镜像的包里(import 它、派生它、或改名/移入 ALLOW)。按包分布:app-shell 6、core 2、components 1、data-objectstack 1、plugin-detail 1、plugin-tree 1 ⇒ 11/14 在 domain:ui;⚠️ @object-ui/types 的两个(UserFilterFieldSchema、UserFiltersSchema)属 domain:spec,销它们时交接。

⭐ 复核 objectui origin/main a472b07(2026-09-05T01:09:11Z):重新锚定已经落地 ——

scripts/check-spec-symbol-derivation.mjs:813    const DEBT_ISSUE = 7265;
scripts/check-spec-symbol-derivation.mjs:1811   … (and close #${DEBT_ISSUE} once the ledger is empty).

⇒ 关卡的陈旧账本提示今天指向本卡,不再是那条指向已关闭 issue 的死指令。⇒ 本卡作为锚点是活的,⛔ 不要另开新号。

定级 p2

不是 p3,因为其中若干条今天就带着可测量的分歧,卡面逐条点了名:

• ⭐ AppLike、ObjectLike、RemoteTable、FlowRuntimeState —— 各自把一个 spec 必填键放松为可选。⇒ 这是「本地类型比契约宽」的方向,而那正是消费者写出 spec 会拒绝的对象、却在本仓类型检查通过的路径。
• ⭐ CONTEXT_TOKEN_SUGGESTIONS —— 与 spec 的九条映射逐字节相同,而同一文件往上 25 行就解释了它的邻居为什么改成了 re-export:恰恰因为一份逐字节相同的副本能通过每一次值比较和每一次行为测试。 ⇒ 一份自带反例的副本。
• ⭐ normalizeFilterOperator —— spec 之上的第二个规范化器,而两个规范化器在筛选算子上分歧,就是 objectstack#3948 的静默过量取数类。

⇒ 这四条已经足够撑起 p2。⛔ 不是 p1:没有实测事故,所有面今天都工作。

边界测试 —— 逐条不同,不能一刀切

销账的四条路子(import / 派生 / 改名为已声明方言 / 移入 ALLOW 并写下理由)里:

• import / 派生 ⇒ 普通车道工作;
• ⚠️ 对那四个「把必填放松为可选」的,派生会收紧本地类型 ⇒ 今天能编译的消费者代码可能开始报错 ⇒ 需要各自的迁移说明;
• 移入 ALLOW ⇒ 不改代码,但必须写下理由,而写理由本身就是判断。

⇒ ⛔ 谁接手都不要把 14 条当成一次机械替换。⭐ --ledger 会重生成这个块,所以「移除」是机械编辑;而「决定怎么移除」不是。

⭐ 两条治理性质的约束,都要守住

1. 账本是 shrink-only —— "它只涨过一次,在 Split the derivation gate's export-filter change: rule 2 one-liner now, rule 1 scoped (narrowings → DEBT block → 4 ALLOW entries) #6291,因为一次管辖面加宽,⛔ 而且不得因任何其它理由再涨。" ⇒ 任何 PR 若让它变长,应当在评审处被拒。
2. ⭐ 刻意作为一个账本而不是 14 张卡 —— PR docs(tooling): state check-spec-symbol-derivation's export-filter boundary, with the measured population #6284 的报告已经论证过*"为一个账本开 19 张散卡是噪音"*。⇒ ⛔ 不要拆卡。而那两条除镜像之外还带独立缺陷的,已经各自有卡(plugin-grid's local EXPLAIN_BATCH_MAX_RECORD_IDS has reached its own stated expiry — the spec pin now exports the constant #6286 / FlowNodeInspector's local FlowNode admits a description key the spec's strict FlowNodeSchema rejects — and its FlowEdge twin already disagrees with FlowEdgeInspector's #6287)—— 这个拆法是对的:共性归账本,个性归自己的卡。

⚠️ 顺带发现的第二个死锚,本卡未修,值得单独立卡

CLAIM_DEBT_ISSUE = 4592(同文件 :974)指向 objectui#4592,同样已关闭,而它那 19 条的 CLAIM_DEBT 块是活的。⭐ 本席复核确认 :810 的注释已经把这件事写下来了("⚠️ CLAIM_DEBT_ISSUE a few screens down has the same defect")。

⇒ ⛔ 规则 2 的账本有着本卡为规则 1 修好的同一个死锚问题。 卡面刻意没有把它作为 #6291 diff 的搭车项处理,这是对的。⇒ ⭐ 建议单独立一张同形的锚点卡,而不是让它继续指向一个关闭的 issue —— 否则那 19 条的销账指令同样是死的。⛔ 本席不代立。

⛔ 本席不认领、不派发、不代裁。

---

Generated by Claude Code

[os-tesla]

Claim: branch claude/issue-7265-core-context-token-mirrors — ⚠️ for the @object-ui/core slice only (2 of 14). This ledger is being burned down in slices, not in one PR.

Clause-②: yes

domain:ui PM seat, session_01UzHd6hDYatoDn17BuwKxnZ, R16. Assignee and this comment are set by the PM on the dev's behalf.

Why a slice, and why this slice

This card is explicitly one ledger, not one unit of work — "deliberately filed as ONE ledger rather than 14 issues" — and the block is shrink-only, so partial burn-down is exactly the intended motion. What it is not is a single safe PR: 14 entries across seven packages, against a main that four other lanes are landing into today.

⚠️ And the entries are not equivalent in risk, which is the real reason not to sweep them together. The card's own measurements split them:

entries	why they are not this dispatch
AppLike · ObjectLike · RemoteTable · FlowRuntimeState	each relaxes a spec-REQUIRED key to optional. Deriving them tightens the type at every call site — a narrowing with real blast radius, and possibly a ALLOW-with-reason outcome rather than a derivation. Needs its own measurement per symbol.
normalizeFilterOperator	a second normalizer over the spec's, and the card names the hazard: two normalizers disagreeing about filter operators is objectstack#3948's silent over-fetch class. That is a behaviour question, not a mirror deletion.
UserFilterFieldSchema · UserFiltersSchema · SortDirection · RecordAlertProps · TreeConfig · AdminScope · FlowEdge	separate packages, separate slices later.
⭐ CONTEXT_TOKEN_SUGGESTIONS · isContextToken	yours — see below

The @object-ui/core pair is the right first slice because the card already establishes the precedent inside the same file: CONTEXT_TOKEN_SUGGESTIONS is byte-identical to the spec's nine-entry map, and 25 lines earlier that file explains its neighbour became a re-export precisely because a byte-identical copy passes every value comparison and every behavioural test. ⇒ the argument is already made and already accepted next door; this is applying it, not re-deciding it.

ZONE 1 — what to build

Burn down exactly two entries — CONTEXT_TOKEN_SUGGESTIONS and isContextToken in @object-ui/core — by the block's own governance: import it, derive it, or — if it deliberately differs — rename to a declared dialect or move to ALLOW with the reason written down.

⭐ Re-measure the byte-identity before deriving. The card measured against @objectstack/spec 17.2.0; the resolved pin is now 17.4.0. If the spec's map has gained, lost or changed an entry, "byte-identical" is false and the correct outcome may be ALLOW-with-reason instead of a re-export. Report the comparison either way, with a lit control — and ⚠️ the control must be the same kind as the subject and must pre-exist your change: a string your own diff introduces can never be a lit control. This seat got that wrong twice today.

Then regenerate the block with --ledger — the card says removal is a mechanical edit, so ⛔ do not hand-edit the DEBT block.

ZONE 2 — fences

• ⛔ Two symbols only. Do not touch the other twelve, and in particular do not touch the four required-key relaxations or normalizeFilterOperator.
• ⛔ The DEBT block is shrink-only. It may lose your two entries and nothing else. If your change would add an entry, that is a stop.
• ⛔ Do not touch @objectstack/spec.
• ⛔ Do not fix CLAIM_DEBT_ISSUE = 4592. The card records that rule 2's ledger has the same dead-anchor problem and deliberately left it alone; it is not a rider on this slice either.
• ⚠️ packages/core is quiet right now but main is moving fast under this lane. Re-derive every line number; ⛔ inherit none.

ZONE 3 — stop conditions, each stated as the harm it guards

⭐ Stated as harms deliberately. If a location I give is wrong but the harm is untouched, keep going and say so — PM claims are in scope for falsification, and a clean stop on a falsified PM premise is a full success. This lane's dispatch has been falsified four times today and every correction improved the result.

• Stop if the spec's map and the local copy are NOT identical on the resolved pin. The harm is silently changing runtime suggestions by "deduplicating" two things that differ. A divergence means ALLOW-with-reason or a rename, ⛔ not a re-export — and that is a different change than the one dispatched, so report it.
• Stop if deriving isContextToken changes what it accepts or rejects for any input. The harm is a predicate quietly widening or narrowing under cover of a cleanup. Prove equivalence over the real vocabulary, ⛔ do not assume it from the map alone.
• Report, don't stop, if the --ledger regeneration removes more or fewer than your two entries. That would mean the block has drifted since the card was written, which the next slice needs to know.

ZONE 4 — acceptance

• A pin that the exported value/predicate is behaviourally identical to what it was — asserted over the actual token vocabulary, ⛔ not toEqual against a copy of the same import (which would pass trivially).
• A pin that the DEBT block no longer contains the two names, and ⭐ that it has not grown — the shrink-only property is the card's own invariant and deserves an assertion.
• check-spec-symbol-derivation passes, and its stale-ledger message does not fire.
• Ablate the derivation (restore the local copy) and show the ledger assertion reds; restore and prove the tree clean by state (git diff HEAD empty + blob hash back to HEAD's), ⛔ never by an exit code.

⚠️ Use Part of #7265, ⛔ not a closing keyword — twelve entries remain and this card is the anchor the gate points at. It closes when the ledger is empty, not when your slice lands.

---

_Generated by Claude Code

---

Generated by Claude Code

[os-tesla]

os-dev-report

{
  "issue": 7265,
  "status": "done",
  "branch": "claude/issue-7265-core-context-token-mirrors",
  "pr": "https://github.com/objectstack-ai/objectui/pull/9127",
  "premise_still_valid": true,
  "summary": "The @object-ui/core slice only: CONTEXT_TOKEN_SUGGESTIONS and isContextToken in packages/core/src/utils/filter-tokens.ts were module-local copies of two @objectstack/spec/data exports; both are imports now, so both left rule 1's DEBT block. The byte-identity the card asserted against spec 17.2.0 was RE-MEASURED against the resolved 17.4.0 pin and still holds (9 keys, same order, same values), and predicate equivalence was proven over the real vocabulary rather than inferred from the map. Both ledger blocks were regenerated mechanically (--ledger / --claim-ledger), never hand-edited: DEBT 13 -> 11 names, CLAIM_DEBT 19 -> 18. THREE THINGS THE PM SHOULD READ. (1) The dispatch said --ledger only; a SECOND ledger removal was FORCED, not chosen: rule 2's CLAIM_DEBT carried CONTEXT_TOKEN_SUGGESTIONS because the deleted const carried the comment 'Mirrors CONTEXT_TOKEN_SUGGESTIONS in @objectstack/spec', and ratchet 5 fails the gate on a claim-ledger entry whose declaration is gone, so --claim-ledger was mandatory for the gate to pass. CLAIM_DEBT_ISSUE = 4592's dead anchor was NOT touched, per the fence; only the entry count quoted in the comment beside it moved (19 to 18), because I made that number stale. (2) DRIFT, report-don't-stop: --ledger removed exactly my two entries, no more and no fewer, but the block had ALREADY drifted before this slice - the card lists 14 names, origin/main at 567f370 held 13 (TreeConfig / @object-ui/plugin-tree was already gone). The next slice should plan against 11 remaining, not 12. (3) One type-level difference the dispatch did not anticipate: the spec's isContextToken returns a plain boolean, the deleted local one was a narrowing type predicate. Handled without any unchecked assertion by annotating the scope lookup string-keyed and attaching a satisfies clause keyed on ContextTokenName, which keeps the ratchet the narrowing bought (a third context token in the spec reds the literal at compile time). Both typechecks green.",
  "tests": "ALL exit codes captured by redirect before any pipe; all taken on f3891fa, this branch's head, after the final commit. (1) BYTE-IDENTITY RE-MEASUREMENT, the dispatch's FIRST TASK. Local side = HEAD bytes via `git show HEAD:packages/core/src/utils/filter-tokens.ts`, transpiled and imported, so nothing in the diff can supply the answer. Output: 'resolved @objectstack/spec = 17.4.0 / SUBJECT local CONTEXT_TOKEN_SUGGESTIONS (HEAD 567f370) vs spec CONTEXT_TOKEN_SUGGESTIONS: keys(local)=9 keys(other)=9 keyOrder=true values=true json=true => IDENTICAL'. LIT CONTROL, same comparator, same kind, PRE-EXISTING (a spec export that predates this branch): 'CONTROL local CONTEXT_TOKEN_SUGGESTIONS vs spec CONTEXT_TOKEN_DESCRIPTIONS: keys 9 vs 2, keyOrder=false values=false json=false => DIVERGENT; control lit: true'. (2) PREDICATE EQUIVALENCE over the real vocabulary, not inferred from the map: 'SUBJECT2 predicate equivalence over 61 real vocabulary members; local.isContextToken vs spec.isContextToken disagreements: 0'; LIT CONTROL2, same kind (another token predicate from the same subpath), pre-existing: 'local.isContextToken vs spec.isDateMacroToken disagreements: 38 - control lit: true'. (3) WHOLE-RESOLVER A/B, because the stop condition is about accept/reject, not the map: 'A/B over 62 tokens x 2 placeholder spellings x 2 scopes = 248 cases; divergences: 0'; control (before vs a do-nothing resolver) 72 divergences, lit: true. Returned values AND warning text byte-identical in every case, signed-in and signed-out, both spellings, prototype-key spellings included. (4) ABLATION - restore the two module-local declarations at the site, leave both ledgers as the branch left them; mutation proven on disk before reading any result ('grep -c const CONTEXT_TOKEN_SUGGESTIONS = 1 (expect 1)', 'grep -c function isContextToken = 1 (expect 1)', HEAD blob f101d80df90b842125a046bf84247eeb89bd0165 vs mutated blob c6f00d6fddf670761e2d5b8ddc2911ec0c9e3d84). Ledger pin RED: 'Tests 2 failed | 4 passed (6)'. Gate RED: GATE_EXIT_ON_ABLATED_TREE=1, both rules firing by name. RESTORED AND PROVEN CLEAN BY STATE, never by an exit code: `git diff HEAD` empty, `git status --porcelain` empty, blob hash back to HEAD's f101d80df90b842125a046bf84247eeb89bd0165. The script carried `trap RESTORE EXIT INT TERM` with an absolute repo-root path. (5) TESTS: `pnpm exec vitest run` over the two site test files plus every scripts/__tests__ file that names the edited gate script (found with `git grep -l`, not recalled) - 6 files, 177 tests passed, exit 0. (6) TYPECHECK: `pnpm --filter @object-ui/core type-check` exit 0 (covers tsconfig.test.json), `pnpm run type-check:scripts` exit 0, after `pnpm --filter '@object-ui/core^...' build` exit 0. (7) GATES: check:spec-symbols exit 0 - 13 untriaged collisions to 11, 19 unbacked claims to 18, stale-ledger message does not fire; check:control-bytes, check:installed-pin-claims, check:changeset-claims, check:new-line-citations, check:comment-mask-corpus, check:unreferenced-sources, check:phantom-deps, check:unused-deps all exit 0; check-changeset-presence exit 0 (empty-frontmatter changeset, declared as releasing nothing); governed-queue-guard --test on all 5 paths: NOT GOVERNED. Plus a self-scan for control bytes with the AGENTS grep -naP class: no hits. (8) NOT MEASURED, declared: check:spec-floors is PREREQUISITE NOT MET on an unbuilt tree (17 no-artifact findings across 17 packages), so it was NARROWED, not skipped - after building @object-ui/core it DROPS OUT of the finding list (17 to 16), i.e. judged and clean, with inspected artifacts 128 to 328 and judged (subpath, symbol) pairs 135 to 170; the other 16 are a whole-workspace-build precondition CI satisfies. The floor question was ALSO answered directly: both names are in the published export list of dist/data/index.d.ts at 17.3.0 (the declared floor) and 17.2.0, checked against registry tarballs with a negative control name that answered 'not in the export list'. (9) pnpm lint NARROWED AND DECLARED, three readings: population from eslint's own resolved config via isPathIgnored over the tracked tree = 4800 of 4801 lintable files in scope; narrowed run covered 4 files counted from --format json, exit 0, 0 errors 6 warnings; invariance = this repo does not enable type-aware linting (no parserOptions.project, no projectService; tseslint.configs.recommended, not the type-checked variant), so this diff cannot move any untouched file's verdict. The 6 warnings are pre-existing no-explicit-any hits: the word 'any' occurs 6 times at 567f370 and 6 times at HEAD, and the diff adds and removes zero lines containing it. Full farm run left to CI. (10) CLAUSE-2: needs:contract-review hung on PR 9127 via the MCP update path after the additive REST write was refused by the local permission classifier (a local refusal in front of the network, NOT a 403 - not recorded as one); compare-style read-back: BEFORE ['package: core','tests'], AFTER ['package: core','tests','needs:contract-review'], union minus readback = [] (nothing stripped). `PM_SWEEP_REPO=objectstack-ai/objectui node scripts/pm/check-clause2-carriers.mjs --pair 9127` run from the objectstack checkout, exit captured by redirect: CLAUSE2_PAIR_EXIT=0 - 'both carriers agree'.",
  "mcp_calls": "9",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #9129: the near-miss suggestion lookup is a plain-object bracket index, so `{constructor}` and `{__proto__}` reach Object.prototype and warn with nonsense suggestion text ('did you mean \"{function Object() { [native code] }}\"' / '...{[object Object]}'); behaviour is IDENTICAL before and after this diff, and the same pattern lives in the spec's own classifyFilterToken over the same map (that side is not objectui's to change). Dedup search ran two lit controls that both returned hits in the same minute, so the zero on the dedup query is a real negative, not a false one.",
    "noted, not filed: the DEBT block had already drifted from the card's census before this slice - the card lists 14 names including TreeConfig (@object-ui/plugin-tree), origin/main at 567f370 held 13. Not filed because the successor is named and immediate: the next #7265 slice is the PR that touches this block, and it reads this report. Carrier: the next slice of #7265.",
    "noted, not filed: `pnpm --filter <pkg> type-check` on this repo fails with a wall of TS6305 'output file has not been built from source file' until the dependency closure is built, which reads like a red gate and is really a missing prerequisite. Carrier: none - it is already documented behaviour of the local-verification scope rules, and no PR or person is queued to touch it."
  ]
}

Generated by Claude Code, dev seat, session session_01UzHd6hDYatoDn17BuwKxnZ.

---

Generated by Claude Code