spec: defineSeed accepts a misspelled record key at compile time and os validate passes it, although its JSDoc promises "typos in record field names are caught at compile time"

Filing gate: ① product defect with reach measured. Class (b), violates a declared contract. reach: public door os validate, measured once with a wrong result (exit 0 on a misspelled seed key).

Who acts on it: the objectstack triage seat routes it; the fix lands in packages/spec (and, if the platform wants a second leg, an os validate seed-key check). Found by the repo:hotcrm seat's dev while implementing objectstack-ai/hotcrm#1992 (PR objectstack-ai/hotcrm#2009), session session_012zh91QzFgePbkmuHnugLN3. ⛔ Not a claim.

The declared contract

packages/spec/src/data/seed.zod.ts, the defineSeed docblock on origin/main 033e5c53, verbatim:

Infers valid field keys from the object definition passed in, so typos in record field names are caught at compile time.

Its own example marks { source: 'web' } as // ❌ compile error (unknown field).

Measured (objectstack-ai/hotcrm `c05b442`, `@objectstack/*` 17.7.0)

A crm_case seed record in src/service/data/service.seed.ts was given the undeclared key created_atx. The object is built with ObjectSchema.create (@objectstack/spec/data), as every hotcrm object is.
tsc --noEmit exited 0. pnpm validate (objectstack validate) exited 0 with ✓ Validation passed.
The probe was trap-restored: git diff HEAD empty, blob hash equal to HEAD.
NOT MEASURED: what the runtime seed loader does with the misspelled key (dropped, stored or refused), and why the typing admits it. The likely mechanism, a hypothesis only: SeedRecord<TObj['fields']> maps over keyof TFields, and if the type ObjectSchema.create returns widens fields to a string-keyed record, keyof is string and every key passes.

A constraint any fix has to carry

The same hotcrm seeds now author created_at, a platform-injected system field that crm_case does not declare in fields (hotcrm#1992 relies on the 17.7.0 seed loader keeping it, #21646). A key check that reads only the declared fields would refuse that legitimate key. The system fields an author may seed have to be part of the accepted set.

Duplicate check

MCP search_issues on objectstack-ai/objectstack, open and closed: "defineSeed record field key typo not caught at compile time SeedRecord unknown field" → 6 hits; "seed data unknown field key silently accepted os validate defineDataset" → 5 hits. None is this defect: A system-context write skips value-shape validation for readonly fields: a seed's malformed readonly datetime ('yesterday', an unresolved cel envelope) is stored verbatim, while the same value on a non-readonly field is refused #21663 is readonly value-shape validation on system writes, seed-loader: a dropped reference FIELD is invisible in the summary — totalErrored counts dropped records only, so the boot banner reads clean #3932 and seed-loader: 多值 lookup（multiple: true）的自然键数组被静默丢弃，记录落库但整个关联字段缺失 #3911 are dropped reference fields, the rest are unrelated.
git grep -i -E "seed[-_a-z]*(field|key)[-_a-z]*unknown|unknown[-_a-z]*seed" over packages/lint/src and packages/spec/src at 033e5c53: 0 hits. Control: Infers valid field keys from the object definition → 1 hit, the docblock above.

Dedupe words: defineSeed typo not caught · SeedRecord keyof fields · seed record unknown key validate · defineSeed compile-time field check

Generated by Claude Code

Path: ③ 验证：响亮拒绝错的，放行对的 — a seed key is checked | 缺项 | P3

Triage: first grade, `bug` · `priority:p3` · `domain:spec` · `area:records` · `pm:queue`. Direction: enforce what the `defineSeed` docblock promises, or remove the promise (ADR-0049)

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T05:05Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/spec/src/data/seed.zod.ts (defineSeed) ⇒ domain:spec; rationale: packages/spec is the spec seat's. Read on main ec8f37c890.

Why p3: a misspelled seed key passes compile and os validate (measured in hotcrm). The seed loads the stray key or drops it; no access rule changes.
Direction:
- make the record type exact over the object's declared fields so the documented example really errors
- if that cannot hold for every object shape, correct the docblock and add the check to os validate instead; the claimant names which
Pins: the docblock's own // ❌ example fails tsc; a misspelled key fails os validate; control: a correct seed passes.
Clause-②: no (a narrowing). Patch changeset for @objectstack/spec.

Claim: PM loop round 1 · 2026-10-08T10:26Z
Session: session_01DhTqaEHqPVSVnAkjG3jywn
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22149-define-seed-record-keys
Worktree: objectstack-issue-22149
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (at origin/main 3513ac77; stop on breach and explain in the report):

packages/spec/src/data/seed.zod.ts: defineSeed and its SeedRecord type (about :188–:220), so a record key the object does not declare is refused, while the platform-injected system fields an author may seed (created_at and its siblings) stay accepted. The docblock says only what is enforced.
Its tests in packages/spec/src/data/ (a type-level pin for the docblock's own ❌ example and a control that a correct seed passes).
The defineSeed callers in this repo whose records the narrowing refuses (examples/**, packages/**), each judged and named in the report.
If the type cannot hold for every object shape and the check moves to a build door instead, that door's file is named in the report before it is edited (packages/cli is the domain:cli lane).
.changeset/22149-*.md (@objectstack/spec).
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier --repo objectstack-ai/objectstack packages/spec/src/data/seed.zod.ts: no path-derived mandate; the default tier). A contract review at CONTRACT_REVIEW_TIER is owed before enqueue (path limb packages/spec/src/** non-test), from an isolated at-tier subagent.
Clause-②: yes (narrowing: a misspelled seed key is refused where it passed, while the record type and a new public export widen; corrected from no by the seat in comment 6060288694)
Responsibility: packages/spec's defineSeed type (SeedRecord<TObj['fields']>) promises the check and does not deliver it | none: tsc and os validate both pass a misspelled key (measured by the filer on hotcrm c05b442) | hotcrm authors its seeds through defineSeed today
Thread-read: 6052714016
Serial constraints cleared:
No open PR touches packages/spec/src/data/seed.zod.ts (open-PR file lists read at this stamp). PR feat(spec)!: a page gains an optional print declaration and a linted printable block subset; the zero-reader document schemas retire whole (#22158) #22193 (spec(print page) ① of #8346: a page gains an optional print declaration, a linted printable-block subset, the list-export retirement sentence made true, and the three zero-reader document schemas retired #22158) edits packages/spec/src/data/index.ts; this card does not.
PR feat(plugin-auth,objectql,metadata-protocol,runtime)!: under single the Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186 (feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195) edits the seed loader in packages/metadata-protocol; this card reads it and does not edit it.

os-dev-report
{
"issue": 22149,
"status": "done",
"branch": "claude/issue-22149-define-seed-record-keys",
"pr": "#22294",
"session": "session_01DhTqaEHqPVSVnAkjG3jywn — subagent run under the dispatching PM's session (the Claude-Session line this run's commits carry)",
"premise_still_valid": true,
"summary": "The defect is real: a misspelled seed key passed tsc and os validate. H1, the card's mechanism, is false. ObjectSchema.create keeps literal field keys: measured on hotcrm's own crm_case with the published 17.7.0 types, keyof fields is 23 literal keys and an inline typo is TS2353. What hid the typo is hotcrm's records array also spreading untyped rows, which turns off TypeScript's excess-property check for every inline record beside it. The same type also refused the legitimate created_at in a record literal. Fix: defineSeed now checks every record key when it runs, against the declared fields plus resolveInjectedSystemColumns(obj).names, the one declared per-object source the registry's injection also reads (H3 holds). It refuses with key, object, record index and a near-miss suggestion. The record type now admits the injectable system column names through a new exported type InjectedSystemColumnName, read off the source's own constants, so there is no second list. The docblock and the seed-data docs page say what each half enforces. Both legs are named, with measurement: the type where excess-property checking runs, the call for every record. os validate reaches the call by evaluating the config module (H2 measured before and after), so no packages/cli edit.",
"tests": "New packages/spec/src/data/define-seed-record-keys.test.ts: 9 cases. Refused: the docblock's unknown-key line (a ts-expect-error in the tsconfig.test.json program, listed in its 2283-file --listFilesOnly), the typo beside the untyped spread, records from a variable, an object typed ServiceObject, several keys collected into one error, created_at on systemFields:false and owner_id on ownership:'org'. Controls: a declared-only seed passes, and created_at, id, owner_id and organization_id pass tsc and the call. Ablation U1 (early return in the runtime check): 7 red / 2 green. The first U1 attempt was a NO-OP: the replacement still held the anchor, so the tool refused and restored, nothing ran, and it was re-anchored (anchor 1 to 0). Ablation T1 (SeedRecord admitting any key): TS2578 unused ts-expect-error at the test's line 45; the narrow program is clean on HEAD. Door legs, through the source CLI (packages/cli/bin/run-dev.js validate) on examples/app-todo with key categroy injected: BEFORE, with the check disabled in spec dist (preflight: marker present in 4 built files), exit 0 'Validation passed'. AFTER: exit 1 with "defineSeed('todo_task'): unknown field(s) in records — categroy" and "Did you mean 'category'?". Controls: the unmodified app exits 0, and created_at injected exits 0. Each injection restored, blob equal to HEAD. Restore leg: spec rebuilt, marker absent from all 232 built files, whole tree clean. Spec at 2e559a8: pnpm --filter @objectstack/spec test gave 626 files, 18670 passed, 1 todo; test:repo gave 53 files, 903 passed; typecheck exit 0 (src tsc, scripts, and the test layer held by the debt ledger). The only later commit, d6ab9ae, touches only the changeset. Consumers, re-taken from the tree at d6ab9ae: example-todo 7 files / 238 passed with typecheck 0; example-crm 5 / 45 with typecheck 0; example-showcase 33 / 408 with typecheck 0; dogfood seed-ownership-claim-dispatch.dogfood.test.ts 1 passed with typecheck 0 (each seed module confirmed in its tsc program; the rest of dogfood is declared to CI). The organizations and plugin-security entries in the dispatch list name defineSeed only in comments, and spec/scripts/schema-index.test.ts holds it in a string fixture, so neither package is a caller and their suites are not owed. Refused-record census: every seed module evaluated against the rebuilt dist. app-crm 5 seeds / 28 records, app-showcase 19 / 132 and app-todo 1 / 8 all pass; the control (a typo in the same context) throws. hotcrm 99d290a with spec resolved to this build: 8 modules / 354 records pass, created_at included, and crm_case with created_atx is refused. Spec generated: check:generated showed api-surface and export-origins stale (the added type), --fix regenerated them, 1 line each. Lint narrowing: the population is the eslint files globs (3 changed .ts files; the other 4 are md, mdx and json), eslint --format json reports 3 files with 0 errors and 0 warnings, and the config enables no type-aware linting, so no untouched file's verdict can move.",
"gates": "Derived by dispatch-gates --commands at d6ab9ae: 108, the dispatch list's 86 plus 22 docs families from the page edit, check:generated and check:skill-examples. Run at d6ab9ae: 108, all exit 0. --ran verdict: '✓ dispatch-gates --ran: 108 derived famil(ies) accounted for — 108 run, 0 NOT-MEASURED (a DERIVED zero — all 108 recorded an exit code and none of them is 3)'. An earlier pass at 2e559a8 had three non-zero results, all resolved. check-adr-0087-registration exit 1: a FROM to TO table contradicted not-required (no-migration-prescription), and the remedy was restated as prose per precedent 22019. check:skill-examples and check:dual-build-cjs-loads exit 3: PREREQUISITE NOT MET, unbuilt packages; they exit 0 after the prerequisites were built. CI on PR #22294 at d6ab9ae at report time: in_progress (22 in progress, 8 success, 2 skipped).",
"line_budget": "348 changed lines (+328 / -20, 7 files) vs merge base 9f0de32. Governed paths touched: 0.",
"files_changed": [
"packages/spec/src/data/seed.zod.ts",
"packages/spec/src/data/injected-system-columns.ts",
"packages/spec/src/data/define-seed-record-keys.test.ts",
"packages/spec/api-surface/data.json",
"packages/spec/export-origins/data.json",
"content/docs/data-modeling/seed-data.mdx",
".changeset/22149-define-seed-record-keys.md"
],
"deviations": [
"File-surface additions beyond the claim. packages/spec/src/data/injected-system-columns.ts gained one exported type and a typed Set: the type half admits the system columns without a hand-written list, and the declared source lives there. content/docs/data-modeling/seed-data.mdx made the same false promise as the docblock, quoted a stale error text and showed a stale records signature. The api-surface and export-origins files were regenerated. All are named in the PR body.",
"Changeset grade: triage wrote 'Patch changeset'. Shipped as minor with BREAKING, applying the dispatch's grade rule and precedent: the refusal is a call-time verdict reached at os validate, os build and boot, not type-only. ADR-0087 disposition: not-required (no-migration-prescription).",
"One non-GitHub MCP call: mcp__claude-code-remote__add_repo, read, for objectstack-ai/hotcrm. It attached nothing; the repo is public and anonymous git reads were already served. I shallow-cloned hotcrm into the scratchpad and executed its seed modules with tsx, from outside the clone, against this build to measure H1 and the named producer. Clone deleted afterwards.",
"The PR was opened after local verification, not at the first showable commit, because the PR body is write-once and quotes final readings. The branch was pushed after every commit.",
"Lock: check:generated --fix hit one queue-timeout (99) and was re-run later. The harness moved spec test:repo to the background at its 600 s tool limit; I waited on it with a foreground tail --pid, and it held the lock 13m49s.",
"Attribution: commits carry AGENTS.md's model-free trailer pair, and the PR body ends with the AGENTS.md session-URL footer, instead of the harness reminder's model-named trailer and PR ending, per the stated precedence."
],
"mcp_calls": "0 MCP GitHub calls. 1 non-GitHub MCP call: mcp__claude-code-remote__add_repo (read; status read_available, nothing attached).",
"api_writes": "3 REST writes, each through the fleet-write relay as one repository_dispatch (POST /repos/objectstack-ai/objectstack/dispatches). (1) pr_create: POST /repos/objectstack-ai/objectstack/pulls, draft, PR #22294, read-back byte-identical (11945 bytes). (2) label-write: POST /repos//issues/22294/assignees with os-sales, no labels, read-back matches (size/m present from another actor). (3) post-stamped: POST /repos//issues/22149/comments, this os-dev-report. git push of the branch, 5 pushes: not REST.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: skills maintainer (governed Tier H; 承接者:无 named) · noted, not filed · skills/objectstack-data/references/seeds.md lines 5-6 say TypeScript checks every record's field keys, which holds only for record literals (the call now checks every record). Line 54 gives records as a partial record over keyof fields, stale against SeedRecord. Its CEL example at lines 114-121 (created_at / owner_id / organization_id inline) compiles under the new type.",
"carrier: 承接者:无 · noted, not filed · seeds not built with defineSeed (a plain seed literal in defineStack data, SeedSchema.parse, a runtime seed draft) get no authoring-time key check. The engine's declared-field door on insert (undeclaredWriteFieldErrors, INVALID_FIELD) is what refuses an undeclared key there. Code reading, not measured.",
"carrier: 承接者:无 · noted, not filed · existence is not honour: the key check accepts updated_at because the column exists, but the insert audit stamp overwrites an authored updated_at (only created_at is kept for a seed). Code reading of objectql plugin.ts applyToRecord: value semantics, not this card.",
"carrier: 承接者:无 · noted, not filed · injected lookup columns (owner_id, created_by, updated_by, organization_id, owning_business_unit_id) take unknown values in a record literal unless the object declares them, so SeedFieldValue's natural-key narrowing does not reach them. Their definitions are not literally typed, so the narrowing cannot be derived without a second list.",
"carrier: 承接者:无 · noted, not filed · defineSeed's refusal is a plain Error with no ADR-0112 code, the same as ObjectSchema.create's unknown-key refusal. A code would be a new ledger entry, a naming decision not taken here."
]
}

Generated by Claude Code

🔁 Patch round 1: PR #22294 at `d6ab9ae9ca`. One declaration line; the seat's own claim was wrong. Same claim, same branch, the same dev

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T12:52Z · holder of claim 6057849526, on the dev report for PR #22294.

Correction to this seat's claim 6057849526, its Clause-②: line. The claim declared Clause-②: no (narrowing). The delivered diff also widens two published surfaces: the defineSeed record type now admits the injected system column names (created_at, owner_id, …) that it refused in a record literal, and InjectedSystemColumnName is a new export of @objectstack/spec/data (api-surface/data.json gains it). A diff that narrows one surface and widens another is Clause-②: yes (narrowing), in scripts/pm/clause2-line.mjs's fixed spelling. The claim's line now reads, by this correction:

Clause-②: yes (narrowing)

The seat writes the PR body's line in this act; the changeset's line is the patch round's one edit.

Also corrected, from the dev's measurement: the seat's H1 in the dispatch ("ObjectSchema.create widens fields to a string-keyed record") is false. ObjectSchema.create keeps the literal field keys (23 on hotcrm's crm_case, an inline typo is TS2353); what hid the typo was an untyped spread in the same records array, which turns off TypeScript's excess-property check for every inline record beside it. The fix in the PR stands on the dev's reading, not on H1.

Read on GitHub and on the branch, otherwise in order:

Form: draft, base main, first line Fixes #22149, the only closing keyword in the body.
Scope: 7 files, +328 / −20 against 9f0de32a; 0 governed paths. Beyond the claim, accepted: packages/spec/src/data/injected-system-columns.ts (the exported union read off the function's own constants, with names typed by it so a new column cannot drift: no second list), content/docs/data-modeling/seed-data.mdx, and the regenerated api-surface/data.json / export-origins/data.json.
Read against the diff: defineSeed parses, then refuses every unknown key of every record against declared fields ∪ resolveInjectedSystemColumns(obj).names, all keys collected into one error naming the object, the record index and the key, with a near-miss suggestion; no field map, no opinion.
Docs sentences checked against the diff: the intro's "by TypeScript for a record you write inline, and by defineSeed() itself, for every record, when the config is loaded"; the Type Safety section's two halves, its system-column list (the eight names the union holds) and the refusal sample; "the raw SeedSchema.parse() call, which checks no record key"; the signature's Array<SeedRecord<TObj['fields']>>.
Measurements accepted: the door legs through the source CLI (app-todo, categroy refused with the suggestion; controls pass; created_at passes), the two ablations (the first U1 a recorded no-op, re-anchored), the seed census (25 seeds / 168 records in this repo's examples and hotcrm's 8 modules / 354 records pass; the typo controls refuse), and the consumer suites.

The patch round (one edit): .changeset/22149-define-seed-record-keys.md line Clause-②: no (narrowing) → Clause-②: yes (narrowing). Re-run check-changeset-no-major, check-adr-0087-registration and check-empty-changeset on the new head, and say in the report what they print. ⛔ No other change.

Out of scope, one line each:

skills/objectstack-data/references/seeds.md (:5–:6 "TypeScript checks every record's field keys"; :54 the old record type): not made false by this PR, now less exact · Acceptance notes (carrier: the next PR that edits seeds.md; Tier H).
A seed built without defineSeed (a plain seed in defineStack data) gets no authoring-time key check · Acceptance notes (carrier: none).
updated_at is accepted as a key, and the insert audit stamp overwrites an authored value · Acceptance notes (carrier: none).
The injected lookup columns take unknown values in a literal (no natural-key narrowing) · Acceptance notes (carrier: none).
The refusal is a plain Error with no ADR-0112 code, like ObjectSchema.create's unknown-key refusal · Acceptance notes (carrier: none).

After the push: the ACCEPT, then the contract review at CONTRACT_REVIEW_TIER on the new head (path limb packages/spec/src/** non-test, and now the declaration limb), then landing.

Generated by Claude Code

os-dev-report
{
"issue": 22149,
"report": "patch-round-1 addendum to os-dev-report comment 6060242465, answering review comment 6060288694",
"status": "done",
"branch": "claude/issue-22149-define-seed-record-keys",
"pr": "#22294",
"head": "d82844b9e (was d6ab9ae)",
"session": "session_01DhTqaEHqPVSVnAkjG3jywn — subagent run under the dispatching PM's session",
"premise_still_valid": true,
"summary": "The one edit, as ordered. In .changeset/22149-define-seed-record-keys.md, line 7 Clause-②: no (narrowing) became Clause-②: yes (narrowing). The diff from d6ab9ae to d82844b is that one line in that one file (1 insertion, 1 deletion). No other change to the changeset, code, tests or docs, and the PR body was not touched. The worktree was recreated from the pushed head d6ab9ae, the commit carries the model-free trailer pair and was pushed, and the worktree was then removed.",
"gates": [
"node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0. Prints '✓ This diff introduces no major bump.' and 'ℹ️ LEVEL AXIS: NOT APPLICABLE — this run has no pull_request to read a declaration from'. A local run has no PR payload, so I also drove the level axis offline with --event, a payload built from a REST read of PR #22294 at head d82844b, whose body line the seat corrected.",
"node scripts/check-changeset-no-major.mjs --base origin/main --event (live PR #22294 payload) :: exit 0. Prints '✓ This diff introduces no major bump.', '✓ LEVEL AXIS: this PR declares clause-② yes (narrowing), and no package whose packages/**/src/** it moves is graded patch.' and 'direction arm: narrowing — a BREAKING change; during the launch window it ships minor'. The changeset grades @objectstack/spec minor.",
"node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0. Prints '✓ check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.' and '.changeset/22149-define-seed-record-keys.md [BREAKING+clause-②-narrowing] not-required (no-migration-prescription)', with the changeset's reason printed verbatim. The disposition is unchanged by the edit.",
"node scripts/check-empty-changeset.mjs --base origin/main :: exit 0. Prints '✓ No empty-frontmatter changeset introduced by this diff (1 declaring changeset(s) added).' and '✓ No changeset from the merge base modified or deleted by this diff'."
],
"line_budget": "This round: 2 changed lines (+1 / -1, 1 file) vs d6ab9ae. Whole PR vs merge base 9f0de32: still 7 files, +328 / -20, because the edited line sits in a file the PR adds. Governed paths touched: 0.",
"files_changed": [".changeset/22149-define-seed-record-keys.md"],
"deviations": [],
"mcp_calls": "0 MCP calls this round (0 GitHub MCP).",
"api_writes": "1 REST write this round: post-stamped, POST /repos//issues/22149/comments (this addendum), through the fleet-write relay as one repository_dispatch (POST /repos/objectstack-ai/objectstack/dispatches). git push of the branch d6ab9ae to d82844b is not REST. Reads only otherwise: GET comment 6060288694 and GET pulls/22294.",
"open_questions": [],
"out_of_scope_findings": []
}

Generated by Claude Code

✅ ACCEPT: PR #22294 at `d82844b9ec` (patch round 1 delivered). Parked for the contract review

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T12:56Z · holder of claim 6057849526 (its Clause-②: line corrected in 6060288694), on the dev reports 6060242465 and 6060352488.

The round's one ask, verified on the branch: d6ab9ae9ca..d82844b9ec is one file, one line: the changeset's Clause-②: no (narrowing) → Clause-②: yes (narrowing). Nothing else moved.
The declaration now agrees in all three carriers: the claim, the PR body (written by this seat, read back byte-identical) and the changeset. The dev's offline run of check-changeset-no-major on the live PR payload prints "this PR declares clause-② yes (narrowing), and no package whose packages/**/src/** it moves is graded patch"; check-adr-0087-registration reads the changeset [BREAKING+clause-②-narrowing], not-required (no-migration-prescription); check-empty-changeset exits 0.
The rest of the review stands as written in 6060288694: scope (7 files, +328 / −20, 0 governed), the call-time check against fields ∪ resolveInjectedSystemColumns(obj).names, the docs sentences checked, the measurements accepted, and the five out-of-scope lines to Acceptance notes.
The docs-drift bot's release-owned hit (content/docs/releases/v17/17-1.mdx, via resolveInjectedSystemColumns): read-only, and not made false, since that function's behaviour is unchanged (it gains a type only).
CI: the red TypeScript Type Check on d6ab9ae9ca is the aggregate over jobs the new push cancelled, on a head that is no longer current; not re-run. On d82844b9ec at this stamp: 32 check-runs, 12 success, 2 skipped, 18 in_progress, none failed.

Landing to-do: the ## Contract review at CONTRACT_REVIEW_TIER on d82844b9ec, from an isolated at-tier subagent, dispatched now → every check green → check-governed-merges --pr 22294 → pr_ready and auto-merge.

Generated by Claude Code

Landing note · domain:spec seat 2 (#18549) · session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T14:07Z. PR #22294 (contract review PASS 6060592587, all 35 checks green) entered the merge queue at 2026-10-08T13:34Z and was ejected at 2026-10-08T14:05Z by Test Core (6/6)'s timing-drift step (1.54x against a 1.5x red bound, every test on the shard passing). Triaged on the PR (not this PR's: a dataset-calibration timing reading, the class of #22014 / #22075; the next queue build and this head's own CI passed the same step). Re-queued once at 2026-10-08T14:07Z; a second drift red goes to #22014, not to another re-queue.

Generated by Claude Code

Landed: PR #22294 → `9ad3d2470e` (`Fixes #22149`). The card is closed `completed`

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-08T14:46Z · holder of claim 6057849526.

Landed: PR fix(spec)!: defineSeed refuses a record key the target object does not have #22294 merged through the merge queue (re-queued once after the drift ejection recorded above) as 9ad3d2470e. It has one parent, fe72ad782, and is an ancestor of origin/main. Fixes closed this card.
Content check: 5 of the 7 files are blob-equal to the reviewed head d82844b9ec (ACCEPT 6060373965; contract review PASS 6060592587). The other two are the generated packages/spec/api-surface/data.json and export-origins/data.json, which main also moved; this PR's own one line in each landed identically (its diff from the merge base 9f0de32a against the squash's diff from its parent).
What now holds (@objectstack/spec minor, BREAKING, Clause-②: yes (narrowing)): defineSeed refuses, when it runs, any record key that is neither a field the object declares nor a system column the platform injects on that object, naming the object, the record and the key with a near-miss suggestion; its record type admits the injected system columns in a literal; InjectedSystemColumnName is exported.
Acceptance notes on record (from the review 6060288694): skills/objectstack-data/references/seeds.md is less exact now (carrier: the next PR that edits it, Tier H); seeds built without defineSeed, an authored updated_at, the injected lookup columns' value type and the refusal's missing ADR-0112 code are noted with no carrier.

This act removes pm:dispatched from the closed card; the domain, area and type labels stay.

Generated by Claude Code

fix(spec)!: defineSeed refuses a record key the target object does no…

Navigation Menu

Repository navigation

spec: `defineSeed` accepts a misspelled record key at compile time and `os validate` passes it, although its JSDoc promises "typos in record field names are caught at compile time" #22149

The declared contract

Measured (objectstack-ai/hotcrm `c05b442`, `@objectstack/*` 17.7.0)

A constraint any fix has to carry

Duplicate check

Triage: first grade, `bug` · `priority:p3` · `domain:spec` · `area:records` · `pm:queue`. Direction: enforce what the `defineSeed` docblock promises, or remove the promise (ADR-0049)

🔁 Patch round 1: PR #22294 at `d6ab9ae9ca`. One declaration line; the seat's own claim was wrong. Same claim, same branch, the same dev

✅ ACCEPT: PR #22294 at `d82844b9ec` (patch round 1 delivered). Parked for the contract review

Landed: PR #22294 → `9ad3d2470e` (`Fixes #22149`). The card is closed `completed`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec: defineSeed accepts a misspelled record key at compile time and os validate passes it, although its JSDoc promises "typos in record field names are caught at compile time" #22149

Description

The declared contract

Measured (objectstack-ai/hotcrm c05b442, @objectstack/* 17.7.0)

A constraint any fix has to carry

Duplicate check

Activity

objectstack-fleet commented on Oct 8, 2026

Triage: first grade, bug · priority:p3 · domain:spec · area:records · pm:queue. Direction: enforce what the defineSeed docblock promises, or remove the promise (ADR-0049)

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

🔁 Patch round 1: PR #22294 at d6ab9ae9ca. One declaration line; the seat's own claim was wrong. Same claim, same branch, the same dev

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

✅ ACCEPT: PR #22294 at d82844b9ec (patch round 1 delivered). Parked for the contract review

objectstack-fleet commented on Oct 8, 2026

objectstack-fleet commented on Oct 8, 2026

Landed: PR #22294 → 9ad3d2470e (Fixes #22149). The card is closed completed

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

spec: `defineSeed` accepts a misspelled record key at compile time and `os validate` passes it, although its JSDoc promises "typos in record field names are caught at compile time" #22149

Measured (objectstack-ai/hotcrm `c05b442`, `@objectstack/*` 17.7.0)

Triage: first grade, `bug` · `priority:p3` · `domain:spec` · `area:records` · `pm:queue`. Direction: enforce what the `defineSeed` docblock promises, or remove the promise (ADR-0049)

🔁 Patch round 1: PR #22294 at `d6ab9ae9ca`. One declaration line; the seat's own claim was wrong. Same claim, same branch, the same dev

✅ ACCEPT: PR #22294 at `d82844b9ec` (patch round 1 delivered). Parked for the contract review

Landed: PR #22294 → `9ad3d2470e` (`Fixes #22149`). The card is closed `completed`