service-settings: re-point value-domains.ts onto @objectstack/spec/shared and refuse with value_domain on the settings door — the services half of #14168

[claude]

Filed by the domain:spec PM seat (session session_0174WZTU6XcFcS7g2kykC53i, seat post #6017) at 2026-09-04T04:09Z as the services half of the maintainer's ruling A on #14168 (comment 5507503059, 2026-09-02: one closed vocabulary and one membership predicate shared by settings specifiers and object fields), whose spec half landed in PR #15133 (merge 1d7e76a6, 04:05Z). Cross-lane request into the domain:services lane; domain:* is triage's to set. Provenance: the #14168 dev's read-and-report (comment 5534923686), the seat's contract review (PR #15133 comment 5535158979, ruling 2), director audit 5535155127.

What the spec now exports (on origin/main 5c584231a, 04:06Z)

@objectstack/spec/shared (packages/spec/src/shared/value-domain.zod.ts, re-exported at shared/index.ts:35): ValueDomainSchema (:97), ISO_3166_ALPHA2_CODES (:123), isValueDomainMember(domain, value) (:175). SpecifierValueDomainSchema is now the alias = ValueDomainSchema (system/settings-manifest.zod.ts:156), and its doc block states that the settings door enforces with the shared predicate on the write path. The field error code value_domain (api/errors.zod.ts:268) carries four-locale message templates.

The ask (packages/services/service-settings)

1. Re-point packages/services/service-settings/src/value-domains.ts symbol by symbol onto @objectstack/spec/shared — isIanaTimeZone, iso4217Codes, ISO_3166_ALPHA2 / ISO_3166_ALPHA2_CODES (:114 re-exports a module-private set today), DOMAIN_MEMBERSHIP — deleting the copies, so knownValueDomain (:140), firstRejectedDomainMember (:163) and valueDomainPhrasing (:179) answer from the one predicate. Measured equivalence is the bar: the same 162 ISO 4217 codes, the same 249 alpha-2 codes, UTC admitted as a zone.
2. One code on both doors (seat ruling 2, open to the maintainer's veto): the settings door's refusal for a non-member becomes value_domain (the catalog's rule is that the code is the constraint's own name), with a pin that states the wire-visible change on the settings door; the message text comes from the spec's catalog templates.
3. Tests. The existing value-domain suite in service-settings re-run against the shared predicate; a pin that service-settings no longer defines its own membership tables (an import-shape test or a grep-class ratchet on the module).

Not in scope

The engine's write path on object fields (the domain:engine card filed alongside); #15134 (the packages/core copy, a finding awaiting first grading — the dev landing this card is its natural reader, the grading is triage's).

---

Generated by Claude Code

[os-warren]

Claimed — domain:services execution seat. Session 03324ae2-0f5b-5ad2-8a2e-cf4aaff5a909 (seat post #6021).

• branch claude/issue-15162-value-domain-shared-predicate
• worktree objectstack-issue-15162-impl (dedicated, per Prime Directive Migrate documentation site to Fumadocs with monorepo structure and shared content #11)
• implementation model: opus
• Clause-②: YES — review at CONTRACT_REVIEW_TIER is owed before this lands.

Labels, written then read back (the read is a separate call made after the write, and this comment reports that read — it is not itself the write): ["priority:p2","pm:dispatched","domain:services"]. pm:queue is gone; nothing else moved. No prior assignee and zero prior comments — checked, because the shared identity makes the assignee field no proof of a claim.

Why Clause-② is yes

dispatch-gates.mjs derives no path mandate for packages/services/service-settings/**, and its own output says a no-mandate line is not a clearance: "Clause ② is NOT reachable from paths: a card that changes contract accept/reject behaviour or widens the public surface is claude-fable-5-1" — judged from the card CONTENT. This card's content reaches it twice:

1. Ask 2 changes the reject envelope on the wire. The settings door's refusal code for a non-member becomes value_domain; the card itself asks for "a pin that states the wire-visible change on the settings door". A client that branches on the current code sees a different one.
2. Ask 1 swaps the membership predicate itself. knownValueDomain / firstRejectedDomainMember stop answering from service-settings' own tables and start answering from isValueDomainMember. If the two sets are not identical, the accept set moves — silently, in whichever direction the sets differ. The card states the bar (162 ISO 4217, 249 alpha-2, UTC admitted); that is the claim to be measured, not the evidence. It also deletes/re-points a re-export at value-domains.ts:114, which is public surface of the package.

Either one alone would be enough. The tier is not negotiable down by the card's priority:p2.

Base

Dispatched from origin/main at a56baa2bd (2026-09-04T13:55:58Z), re-fetched at 14:35Z. The spec half this card consumes is on that tree: packages/spec/src/shared/index.ts:35 re-exports ./value-domain.zod, and packages/services/service-settings/src/value-domains.ts is 193 lines — consistent with the :114/:140/:163/:179 line refs the card cites, so those refs are usable rather than stale.

Not paused

Checked against ADR-0131 before claiming: docs/adr/0131-…md on origin/main still reads Status: Proposed, so the multi-tenancy pause stands. This card is a value-domain vocabulary/refusal-code change with no organization, tenancy or posture surface — outside the pause.

---

Generated by Claude Code

[os-warren]

os-dev-report

{
  "issue": 15162,
  "status": "done",
  "branch": "claude/issue-15162-value-domain-shared-predicate",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15434",
  "final_commit": "46b06feeca9f4bb523cf53a7379a9b6a345c9503 (46b06feec)",
  "premise_still_valid": true,
  "summary": "Ask 1: value-domains.ts re-pointed onto @objectstack/spec/shared symbol by symbol; all three local definitions deleted (the Intl.DateTimeFormat probe, the run-time Intl.supportedValuesOf('currency') set and the 249 alpha-2 codes). knownValueDomain now filters through ValueDomainSchema.safeParse, which makes the prototype-chain guard structural instead of hand-written; firstRejectedDomainMember calls isValueDomainMember. Ask 2: the save door's refusal code becomes value_domain and its message renders the published catalog template value_domain_DOMAIN via renderValidationMessage, the same catalog the record write path renders. Only ONE of the two doors had a code to change (see A4 below). Ask 3: a ratchet pin reddens if any non-test source in the package re-acquires a membership table, probes an Intl enumeration, or grows a second caller of the predicate. valueDomainPhrasing SURVIVES, scope narrowed to the env-override log line (that door emits no FieldError), and is now pinned equal to the catalog templates so the two doors cannot describe one domain in different words. Seat ruling 2 implemented as directed; nothing in the measurement argued against it, so there is no veto case to report. packages/spec is untouched on this branch per the PM's mid-task correction.",
  "assumption_audit": {
    "A1_iana_time_zone_cannot_move": "confirmed — identical Intl.DateTimeFormat probe bodies on both sides; the door's zone suite (UTC, Asia/Kolkata, Europe/Kyiv, Asia/Ho_Chi_Minh, US/Eastern, GMT, Europe/Zurich accepted; Mars/Olympus, ZZ, 'Not A Zone' refused) re-runs green against the shared predicate.",
    "A2_iso_3166_alpha2_lists_equal": "CONFIRMED BY MEASUREMENT, done before either literal was deleted — a script extracting the string literals out of both files: services 249 unique, spec 249 unique, only-in-services [] and only-in-spec [], ordered sequences identical. This was the assumption that could have made the card a ruling question; it did not.",
    "A3_iso_4217_definition_moves_accept_set_holds": "confirmed — tsx over CURRENCY_FRACTION_DIGITS vs Intl.supportedValuesOf('currency') on node v22.22.2: 162 vs 162, only-in-runtime [] and only-in-snapshot [], positive control CHF in both, negative control XYZ in neither. Pinned rather than left unremarked: a new door-level test asserts every code the run-time probe admits is still admitted through firstRejectedDomainMember.",
    "A4_value_domain_zero_occurrences": "confirmed (grep count 0 before the change) — WITH A LABELLING CORRECTION to the card. The card labels :1025 as validatePatch and :2060 as 'the second door, near registerManifest'. It is the other way round: :1025 sits inside `private effectiveEnvOverride` (the env-override door, which calls reportRejectedEnvOverride and emits a LOG LINE with no error code at all) and :2060 sits inside `private async validatePatch` (line 1883), which is the one that pushes the FieldError. So only one refusal site had a code to change; the other's before/after is prose, and it is covered by re-pointing valueDomainPhrasing and pinning it against the catalog. Both sites are addressed.",
    "A5_prototype_chain_guard": "confirmed — knownValueDomain('constructor') and ('toString') still return null across the swap, now because a closed z.enum matches literal members only. Pins kept and extended with '__proto__' and 'hasOwnProperty'.",
    "A6_spec_exports_four_things": "confirmed — ValueDomainSchema, ValueDomain, ISO_3166_ALPHA2_CODES, isValueDomainMember; no valueDomainPhrasing equivalent. DECISION: valueDomainPhrasing survives as the env-door presenter, because that door writes a log line with no code, no locale and no label, and the catalog's finished sentences do not fit its three-fragment template. It no longer feeds the save door. A new pin holds each domain's fragments to appear in that domain's catalog template, so the surviving local prose cannot drift.",
    "A7_XDR_sentence_is_false": "confirmed — XDR is present in BOTH sets (runtime true, snapshot true); VED, XAU and XAG are absent from both. The stale sentence is deleted with the file and is deliberately not carried into the new module header or the PR body.",
    "A8_liveness_field_json": "confirmed that the sentence at packages/spec/liveness/field.json:228 becomes false — and DELIBERATELY LEFT UNFIXED per the PM's mid-task correction. See out_of_scope_findings: the edit was made, then fully reverted (worktree blob now byte-identical to the base blob, git diff of packages/spec against base is empty)."
  },
  "tests": "All at final commit 46b06feec, dependency closure built first (pnpm --filter '@objectstack/service-settings^...' build, exit 0) so no verdict is read off a stale dist. GATES: derived with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` from the real diff, re-derived twice as the diff grew (the tooling-script + turbo.json edits added 12 families; the liveness revert dropped 6). Final union re-run AFTER the final commit: 57 run - 57 exit 0 - 0 red. Two were genuinely red on the way and are fixed in the diff, not routed around: check:comment-mask-adoption (the ratchet had a private comment stripper; now imports stripComments from scripts/js-comment-mask.mjs) and check:cross-package-test-inputs (that import escapes the package; radius declared in scripts/cross-package-test-inputs.mjs and turbo.json). check:dual-build-cjs-loads and check:type-check-debt first answered `exit 3 / PREREQUISITE NOT MET` -> read as NOT MEASURED, not a pass: the workspace closure was built (`turbo run build --filter=./packages/* --filter=./packages/*/*`, VERDICT command-exit 0, Tasks: 71 successful, 71 total) and both were re-run to a real 0 (dual-build: '103 published require entry point(s) across 66 package(s) load; 619 emitted CommonJS file(s) parse'). TESTS: `pnpm --filter @objectstack/service-settings test` -> 'Test Files 30 passed (30) / Tests 527 passed (527)'. TYPECHECK: `pnpm --filter @objectstack/service-settings typecheck` -> tsc --noEmit clean, and `tsc --noEmit --listFiles` counts 30 of this package's .test.ts files in the program (tsconfig include is ['src'] with no test exclusion), so 'typecheck clean' is a statement about the edited tests too. WIRE BEFORE/AFTER was measured, not derived: the implementation was committed first, then value-domains.ts and settings-service.ts were checked out at base a56baa2bd into the same tree (mutation confirmed on disk by comparing git hash-object against the base blobs, aborting otherwise), the same script re-run, and the tree restored with `git checkout HEAD -- ABSOLUTE_PATHS` under an EXIT/INT/TERM trap using absolute paths; restore proven by an empty `git diff HEAD` AND worktree hashes equal to the HEAD blobs. Result: before {code: invalid_value, message: \"Default timezone must be a valid IANA time zone identifier (e.g. 'Europe/Zurich'). Received 'Mars/Olympus'.\"} -> after {code: value_domain, message: 'Default timezone must be a valid IANA time zone identifier, e.g. Europe/Zurich (got \"Mars/Olympus\")'}; status 400, envelope SETTINGS_VALIDATION, field, label, constraint.valueDomain and value all unchanged. No ablation was performed on this card.",
  "mcp_calls": "6 - issue_read(get), issue_read(get_comments), create_pull_request, pull_request_read(get), add_issue_comment (this one), issue_read(get_comments) to read this comment back. No list_issues, no search: the card and the claim comment carried everything, and no new issue was filed.",
  "open_questions": [],
  "out_of_scope_findings": [
    "NOT FILED, reported to PM as instructed - packages/spec/liveness/field.json, the `valueDomain` row's note, carries the sentence: \"The settings door (`service-settings/value-domains.ts`) re-points onto the shared predicate in its own follow-up card and is unchanged until then.\" Landing this PR makes it false. Per the PM's mid-task correction I edited it, then fully reverted (packages/spec is untouched on the branch; verified byte-identical to base). PR #15316 (the engine half) rewrites the same row and keeps the sentence verbatim, so it is false on main whichever of the two lands second. Sequencing is the seat's.",
    "NOT FILED, a read for the #15134 grader - #15134's premise (a `packages/core` copy of these tables) appears ALREADY DEAD on main at a56baa2bd. packages/core/src/security/resolve-authz-context.ts:62 imports isValueDomainMember from @objectstack/spec/shared and :1019 calls it; the module-private isValidTimeZone is gone and resolve-authz-context.time-zone-domain.pin.test.ts guards its removal. Repo-wide grep finds no ISO 3166 / ISO 4217 / IANA membership table anywhere under packages/core/src. Not touched, as instructed - triage's grading.",
    "NOT FILED, a correction to the card rather than a defect - the two refusal sites are labelled the wrong way round in the dispatch (A4 above): :1025 is effectiveEnvOverride (log line, no code) and :2060 is validatePatch (the FieldError). Worth carrying into the next card that cites those line refs."
  ]
}

---

Generated by Claude Code