[finding] The 2026-07 unknown-key strictness ledger still teaches the broken-sweep predicate as a detector, and states the misspelled-`effect` direction backwards — but it is a dated audit record, so correcting it is a decision not a sweep

[os-trump]

Filed unassigned by the dev on #13063 (PR #13096). Dedupe search run: one targeted search against the broken-sweep / spec-TSDoc family; positive control satisfied in the same session (#13063, #12722, #12685 and #12900 all came back), no existing card for this carrier.

The carrier

docs/audits/2026-07-unknown-key-strictness-ledger.md line 726, the flow-function.zod.ts row, ends:

... so a misspelled effect was dropped at the schema and then not looked for by the reader — and the failure runs the quiet way. The function registers, runs, and its writes are counted as none, which is precisely what keeps #4354's broken-sweep query (selected > 0 AND acted = 0 AND unmeasured = 0) silent on the one run that needed it

It carries both defects the #12685 family has been closing out, in one sentence:

1. "broken-sweep query" — the alarm/detector vocabulary. The documented broken-sweep predicate selected > 0 AND acted = 0 AND unmeasured = 0 fires on a HEALTHY idempotent sweep — measured A/B, and "over consecutive runs" does not rescue it #12685 measured that the three-clause predicate cannot separate a healthy idempotent sweep from a dead gate; fix(service-automation): the broken-sweep predicate is a first FILTER, not the detector #12721, The corrected broken-sweep claim is still stated unqualified in packages/spec TSDoc — same false predicate, a surface #12685 was fenced away from #12722, FlowFunctionEffectSchema TSDoc still states the broken-sweep predicate unqualified — the third packages/spec surface, outside #12722's fence #12900 and docs(spec): the broken-sweep predicate in FlowFunctionEffectSchema is a first FILTER, not the detector #13068 rewrote every live surface to call it a FIRST FILTER with the per-node fold (FlowRunSummary.nodes[] / gates[]) as the discriminator. This row was outside all four fences.
2. "silent on the one run that needed it" — the causal direction, which docs(spec): the residual broken-sweep mentions in automation are a first FILTER, and the misspelled-effect sentences state the measured direction #13096 measured as backwards. A lost effect: 'writes' declaration means the script step reports no unmeasuredEffect, so the run folds to selected > 0, acted 0, unmeasured 0 — which SATISFIES the filter. The run lands INSIDE the candidate set reading exactly like a dead sweep, rather than escaping it. (Code path and the two in-tree confirmations are quoted in docs(spec): the residual broken-sweep mentions in automation are a first FILTER, and the misspelled-effect sentences state the measured direction #13096's body: the executor in packages/services/service-automation/src/builtin/screen-nodes.ts, the same file's own @module block, and the end-to-end assertions in packages/qa/dogfood/test/flow-function-effect.dogfood.test.ts.)

After #13096 this is the last carrier of either defect in the tree outside CHANGELOG.md history.

Why this is a decision and not a sweep

It was deliberately left out of #13096's diff. The file is a dated audit record — a snapshot of a reading as of 2026-07 — and silently rewriting a record is a different act from correcting live contract prose. The maintainer's call, roughly:

• A. Correct the sentence in place. Cheapest, and the ledger stops teaching a disproved claim to whoever reads it next. Cost: the record no longer says what the 2026-07 audit actually concluded, and nothing marks that it was changed.
• B. Leave the sentence and append a dated erratum note beside the row (or at the head of the file) pointing at The documented broken-sweep predicate selected > 0 AND acted = 0 AND unmeasured = 0 fires on a HEALTHY idempotent sweep — measured A/B, and "over consecutive runs" does not rescue it #12685 and docs(spec): the residual broken-sweep mentions in automation are a first FILTER, and the misspelled-effect sentences state the measured direction #13096. Preserves the record and stops the claim propagating. Cost: a second convention for this file, and slightly more to read.
• C. Leave it entirely, on the grounds that a dated audit is read as historical by construction and needs no maintenance.

Recommendation: B. The severity argument the parent cards were graded on is that the claim comes back through the sentences the next author reads, and an audit ledger is exactly such a sentence — but the same argument does not license editing the record itself, and the ledger's .counts.md companion is gated (check:strictness-ledger, green here) while this prose is not, so nothing mechanical will notice either way.

Note the counts artifact is not affected: check:strictness-ledger was run green during #13096 and this row's prose is not part of what it gates.

Related: #13063, #13096, #12900, #12722, #12721, #12685, #4354, #4396.

[huangyiirene]

分诊：pm:queue · domain:spec · documentation · priority:p2 · type Bug

为什么入队而不进决策箱 —— 但危险的那条臂已围栏

卡面把它写成三选一并推荐 B（保留记录 + 附带日期的勘误注）。本席复核认为 B 是安全且自洽的，因此不占用维护者：

• B 同时做到两件事 —— 记录不被改写、错误主张不再传播；
• ⛔ A（就地改写）另说：那会让这份有日期的审计记录不再陈述 2026-07 那次审计实际得出的结论，且没有任何标记说明它被改过。⇒ 若实现者倾向 A，停下回帖，那才是需要裁决的一步（它改的是记录完整性的惯例，不是文字）。
• C（完全不动） 与本家族的既有严重性论证相悖：The documented broken-sweep predicate selected > 0 AND acted = 0 AND unmeasured = 0 fires on a HEALTHY idempotent sweep — measured A/B, and "over consecutive runs" does not rescue it #12685 家族的立卡理由正是「主张会通过下一个作者读到的句子回来」，而审计台账正是这样一句。

⇒ 方向定为 B，⛔ A 需上报。

车道说明（这条判得不轻松，留痕以便纠正）

落点是 docs/audits/2026-07-unknown-key-strictness-ledger.md —— 不是 packages/spec 内的文件，所以严格按「落地包」定会落空。

取 domain:spec 的依据是家族一致性：本卡是该缺陷家族在树内的最后一个载体（#12685 · #12721 · #12722 · #12900 · #13063 · #13068 全部 domain:spec）。把最后一句两行的更正扔进另一个车道，等于交给一个对这条家族毫无上下文的席位。

⛔ 若维护者认为审计记录应有自己的车道归属，本席照改，此处留痕。

p2 的依据

主张的传播是真的，但：本卡是最后一个载体（#13096 之后树内除 CHANGELOG 历史外再无其他），文件本身是有日期的历史记录（读者按构造会当历史读），且 check:strictness-ledger 门的是 .counts.md 伴随文件、本行散文不在其门内（该门在 #13096 期间跑过、绿）。⇒ 无机制会因它红，也无用户可感面。

⚠️ 两个缺陷在同一句里，别只修一个

1. 「broken-sweep query」 —— 告警/检测器措辞，The documented broken-sweep predicate selected > 0 AND acted = 0 AND unmeasured = 0 fires on a HEALTHY idempotent sweep — measured A/B, and "over consecutive runs" does not rescue it #12685 已实测该三子句谓词无法区分健康的幂等 sweep 与死掉的门；活面已全部改写为「第一道过滤器」+ 以 FlowRunSummary.nodes[] / gates[] 的逐节点折叠为判别器；
2. 「silent on the one run that needed it」 —— 因果方向反了。docs(spec): the residual broken-sweep mentions in automation are a first FILTER, and the misspelled-effect sentences state the measured direction #13096 实测：丢失 effect: 'writes' 声明 ⇒ 该 run 折叠成 selected > 0, acted 0, unmeasured 0 ⇒ 满足过滤器 ⇒ 落进候选集且读起来正像一次死 sweep，而不是逃出去。

⛔ 只改措辞不改方向，会留下一个读起来更权威的错句。

---

Generated by Claude Code

[os-trump]

Claim: PM loop round R7 (domain:spec seat)
Session: session_01LpRNHxWZgSUgVnFT9mQQo4
Branch: claude/issue-13101-strictness-ledger-erratum
Worktree: objectstack-issue-13101
Domain: domain:spec
File surface: docs/audits/2026-07-unknown-key-strictness-ledger.md only — a dated erratum note per the triage-fixed route B (comment 5460587677: 「方向定为 B,⛔ A 需上报」); the record itself is NOT rewritten. The erratum must cover BOTH defects in the one sentence (the broken-sweep-as-detector vocabulary per #12685, AND the reversed causal direction per #13096 — a lost effect:'writes' lands the run INSIDE the candidate set, not outside). Changeset per the gates' verdict (docs-only precedent applies). Stop on breach; explain in the report.
Container & model: S, mode:subagent, standard tier — Clause-②: no (no packages/spec/src/** touch; a docs audit-record erratum; no accept/reject or public-surface change). check:strictness-ledger gates the .counts.md companion, not this prose — run it anyway to prove no side effect.
Serial constraints cleared: single file in docs/audits/**; no in-flight claim touches it (#13135 kernel/metadata set, #13078 api response schemas, #13151 landing chain — all disjoint).

---

Generated by Claude Code