spec(types): group E of objectui#7759 — five runtime slots still carry a `z.function()` mirror the objectui#6124 sweep missed

[os-warren]

Filed unassigned by the domain:spec@objectui PM seat, session session_01Jmxdo7bmeqCQHLSfmLVX9w, carving group E out of objectui#7759 so it can be implemented. objectui#7759's own charter is measurement-and-proposal — "this card changes no source file and opens no PR" — so the implementation lane needs its own card. ⛔ objectui#7759 stays open and unclaimed.

⭐ A ruling already exists and this is the part its sweep missed. Director batch #112 delegated exactly this to the seat: 「E 组由席位按 #6124 直接派」 — dispatch group E against objectui#6124 directly, ⛔ without spending a maintainer letter.

The ruling

objectui#6124, maintainer ruling 2026-08-30 (Q2 → A with C): replace z.function() handler mirrors with a named refusal arm. The machinery is in-tree — handlerKeyRefusal(key, disposition, label?) at packages/types/src/zod/tombstone.zod.ts:109, with HandlerKeyDisposition at :69.

Premise re-derived on origin/main before filing

reading	value
handlerKeyRefusal defined	tombstone.zod.ts:109
surviving z.function( in data-display.zod.ts (907 lines)	3
surviving z.function( in form.zod.ts (861 lines)	2

⭐ The control that makes this a residue and not an unswept file: handlerKeyRefusal( already appears 8× in data-display.zod.ts and 20× in form.zod.ts. ⇒ the objectui#6124 sweep demonstrably did reach these exact files; these five are what it left behind. A file the ruling never touched would show 0.

Sites located (⛔ re-derive every address — this seat has had line numbers rot twice tonight):

• data-display.zod.ts:157 — cell: z.function().optional().describe('Custom cell renderer')
• data-display.zod.ts:314 — renderCellEditor: z.function().optional().describe(…)
• form.zod.ts:175 — validate: z.function().optional().describe('Custom validation function')
• form.zod.ts:186 — custom: z.function().optional().describe('Custom condition function')

⚠️ objectui#7759's proposal F moves FormFieldSchema::validation into this group: measured member-by-member it is not structural — FieldConstraintsSchema and FieldValidationRules agree on all seven members except validate, which is the z.function() above. On main, form.zod.ts:618 is validation: FieldConstraintsSchema.optional() and :619 is condition: FieldConditionSchema.optional() — both structural references whose referenced schema carries the function. ⭐ Decide explicitly whether fixing FieldConstraintsSchema::validate and FieldConditionSchema::custom discharges them, and say which.

⚠️ data-display.zod.ts:250 is NOT one of these

cell: retirementTombstone('RETIRED (objectui#5474) — never read by the static table; use data-table') — already retired by a different ruling, a different mechanism. ⛔ Do not touch it, and ⛔ do not confuse it with :157, which is a live z.function() on a different schema.

What is owed

1. Re-derive the surviving z.function() population yourself, with the handlerKeyRefusal count as your firing control, and report it. ⛔ Do not trust the figures above.
2. Convert each to a named refusal arm using the existing handlerKeyRefusal machinery. ⛔ Do not invent a second mechanism — 20 call sites in one file are the house pattern.
3. ⭐ Each key's HandlerKeyDisposition is a judgement about what the TypeScript twin does. Read the twin per key and say what you read; ⛔ do not pick a disposition by analogy with a neighbour.
4. A firing control per key: the refusal must be shown refusing by name, and a control key that still parses green.
5. ⚠️ renderCellEditor's docblock says "z.function() encodes no parameter shape, so the member on DataTableSchema is the authority for it". ⛔ Check whether the refusal preserves that pointer, or whether it strips the only place the parameter shape is documented.

Clause-②: yes — this narrows the accept set on a published authoring face, which is exactly why director batch #112 put every mirror-narrowing proposal at yes. ⛔ Declared yes on that ground and on the charter tie-break, ⛔ not because a widening tell fired.

⛔ The maintainer's ordering rule governs this card

Verbatim, from the director's batch #112 note: 「我们的项目以 objectstack 协议为准,文档应该以实际实现为准。协议不正确的应该先修改协议。」 and its ordering gloss: 凡「实现或立 spec 卡退役」处,先判协议对不对;判协议不对的,spec 卡先行、本卡阻塞其上。

⇒ ⛔ Never narrow or widen a spec-declared shape locally in objectui. ⛔ Never add an author-writable key the spec does not declare. If you judge the protocol itself wrong, the deliverable is stop and say so — a spec card goes first and this card blocks on it.

Standing rules — read every line, they are not boilerplate

Identity. The card is assigned and the Claim: on it is yours; it names your branch. ⛔ Never write the assignee field. ⛔ Never post a second Claim:. If the newest Claim: names another branch, stop and report.

Container hazards.

• /home/user/objectui is SHALLOW with a STALE origin/main. ⛔ Never git fetch, git checkout, or cut a worktree there. Clone fresh into your own scratchpad subdirectory.
• /home/user/objectstack is a shared primary checkout — read-only.
• ⛔ Never git stash. ⛔ Never kill a process by name. ⛔ Never mutate node_modules. ⛔ Never touch content/docs/releases/.
• ⛔ These do NOT exist in objectui and are never a red you can wait for: scripts/pm/os-regen-merge.sh, scripts/pm/check-widening-tells.mjs, scripts/pm/check-clause2-carriers.mjs.

Measurement discipline.

• ⛔ Never write "(no output above = clean)" or any unconditional false-clean echo. Print the command and the exit code.
• ⭐ A control is only a control if it is known to fire in the region being tested. ⚠️ Two true negatives are not a reading.
• ⛔ A bad probe value is not a reading — a multi-line grep -F pattern is split into OR'd patterns and is one. ⛔ An empty gate section is a FAILED RUN.
• ⛔ Never quote a bare grep -c without its exact command.
• ⛔ A claim written in the tree is a claim, not a reading — a docblock, a card body, a triage comment. Three devs refuted this seat tonight by measuring something I had quoted from in-tree prose. Refute me the same way if the measurement says so.
• Read the stored body back after every GitHub write and report what came back.

Deliverable. Worktree → code → tests → changeset → push → draft PR carrying needs:contract-review. ⛔ Do not flip ready, ⛔ do not enqueue, ⛔ no auto-merge — landing is the seat's. Report structured JSON: PR number and head sha, every premise confirmed or refuted with exact commands, your firing controls, and CI as total / success / skipped / non-green plus whether the reported total_count equals the returned array length.

---

Generated by Claude Code

[os-warren]

Claim: session session_01Jmxdo7bmeqCQHLSfmLVX9w (PM seat domain:spec@objectui) → dev subagent on branch claude/issue-9091-function-slot-refusal-arms
Session: session_01Jmxdo7bmeqCQHLSfmLVX9w
Branch: claude/issue-9091-function-slot-refusal-arms
Clause-②: yes

Scope: group E of objectui#7759 — convert the five surviving z.function() mirrors to named refusal arms per the objectui#6124 ruling.

⭐ The declaration is yes because this moves a published authoring face, which is the ground director batch #112 put every mirror-moving proposal at yes on — ⛔ not because a widening tell fired. ⇒ needs:contract-review is now on this card, the dual carrier must AGREE, so hang it on your PR too. An in-seat ceiling-tier review is owed on your final head; ⛔ do not flip ready, ⛔ do not enqueue, ⛔ no auto-merge.

⚠️ The claim comment is the carrier the enqueue gate reads, and its spelling is fixed. scripts/pm/check-clause2-carriers.mjs:751-752 requires a line BEGINNING Claim:, and the declaration must be exactly Clause-②: yes or Clause-②: no, unadorned, on its own line. This seat broke that earlier tonight by writing **Claim:** and Clause-②: **yes** — markdown emphasis on a field a machine reads is corruption, and the gate then reported not "this is wrong" but "there is nothing here to read". Recorded so it is not repeated.

⛔ Re-derive every line address on this card before touching anything. Tonight this seat has had card addresses rot twice (objectui#9026, objectui#8832), deleted out from under a card once (objectui#8811), and quoted one bad probe value into a card body (this card's own ObjectGridSchema offsets, flagged in place).

---

Generated by Claude Code

[os-warren]

WITHDRAWN — claim released, card stays OPEN and unassigned. The seat is winding down for the night at the maintainer's instruction; this card is Clause-②: yes, so it owes a ceiling-tier contract review, and starting that now is the most expensive thing left on the board. ⛔ Nothing about the card's premise changed — it is still correct and still ready to take.

No PR was opened and no branch carries work.

⭐ One measurement from the withdrawn run, kept so the next seat does not re-derive it: FieldConstraintsSchema::validate is LIVE — spread straight into the react-hook-form rules object at its read site. ⛔ That is directly load-bearing for this card's item 3: its HandlerKeyDisposition is not the same as a key whose twin is unread, and picking one by analogy with a neighbour would have got it wrong. ⚠️ The run was stopped before custom and the other condition evaluator were checked, so ⛔ treat only validate as read.

Everything else on this card stands: the handlerKeyRefusal machinery at tombstone.zod.ts:109, the 8×/20× sweep control, and the four located sites (re-derive them anyway).

---

Generated by Claude Code

[os-litant]

Triage: half-state healed — pm:queue added; priority:p3; type set to Task. domain:spec unchanged.

分诊席 · session_017VGfRocA8VjczSe84fgjY3 · R+177 · 2026-09-11T02:3xZ · 本评论来自分诊座位

The heal

Same shape as its sibling objectui#9092: the seat released the claim cleanly at wind-down but no pm-state went on in the same write, so the card sat in the ③ 析取 and was invisible to every queue. ⇒ pm:queue. needs:contract-review kept — a legal card-side intermediate state before the PR exists.

Why Task and ⛔ not Bug — the discriminator against its sibling

⚠️ Its sibling #9092 is graded Bug this same minute, so the difference is worth stating: there, an author following a landed ruling is refused by tsc — a declared contract contradicted, with a victim. Here the five surviving z.function() mirrors are the old spelling of a converted surface: nothing is refused, no author is blocked, and the runtime is unaffected. ⇒ residue of a sweep, ⛔ not a contract violation. Task.

Why p3

No user and no author is blocked; this is the tail of a completed conversion. ⛔ Not p2 — leaving it costs only that the surface has two spellings for one thing, which is a maintenance cost rather than a live defect.

⭐ The control that makes this dispatchable rather than a re-survey

The filer's own reading, and it is the reason this card needs no discovery phase:

handlerKeyRefusal( already appears 8× in data-display.zod.ts and 20× in form.zod.ts. ⇒ the objectui#6124 sweep demonstrably did reach these exact files; these five are what it left behind. A file the ruling never touched would show 0.

⇒ a positive control that separates 「residue」 from 「unswept file」. ⛔ The round does not need to re-derive whether the ruling applies here — it does, and the machinery is in-tree (handlerKeyRefusal(key, disposition, label?) at packages/types/src/zod/tombstone.zod.ts:109, HandlerKeyDisposition at :69).

⛔ Fences

• ⭐ A ruling is already in hand — objectui#6124 (maintainer, 2026-08-30, Q2 → A with C), delegated by director batch chore(deps): bump express and @types/express #112: 「E 组由席位按 finding(types): 28 zod-mirror keys are declared z.function(), which NO JSON document can satisfy — 14 in-repo corpus files author them and are silently invalid #6124 直接派」. ⇒ ⛔ no maintainer letter, ⛔ do not re-escalate.
• ⚠️ ⛔ Re-derive every address. The filer says so in as many words — 「this seat has had line numbers rot twice tonight」. The counts (3 in data-display.zod.ts, 2 in form.zod.ts) are the thing to re-measure, ⛔ not the line numbers to trust.
• ⛔ Do not convert a z.function() the ruling did not cover. Five is the measured population; a sixth found mid-round is a separate reading and goes in the PR body, ⛔ not silently into the diff.
• ⛔ Do not close objectui#7759 — measurement-and-proposal charter, stays open and unclaimed.

Size/model suggestion: S — five call sites onto an in-tree helper, with the count re-derived first.

_{分诊席位 · session_017VGfRocA8VjczSe84fgjY3 · R+177 · 2026-09-11T02:3xZ · 本评论来自分诊座位}

---

Generated by Claude Code