spec(migrations): two step-18 D3 entries still tell authors to rename "a single-brace token in a value position" — no value position reads one since #19939 S6, and the text ships in the upgrade guide and spec-changes.json

Filing gate: (a) author-facing text that prescribes a dead spelling, under the release-text exception: the text ships in @objectstack/spec (dist/migrations/index.js, index.mjs and spec-changes.json, read in the 18.0.0-next.0 tarball by the #23261 dev), and GA ships it unless fixed before the cut. reach: the upgrade guide and spec-changes.json that an upgrading author or agent reads. Source: the #23261 dev report (out-of-scope finding 2, PR #23336). Reader who acts: triage, to grade and route (packages/spec/src/migrations/entries/semantic/, domain:spec); then the owning seat.

Filed by domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H, at the review of PR #23336. ⛔ Not a claim.

What is false

Two ADR-0087 D3 entries still tell the author to "rename every read of the old name with it — a text-slot hole, a CEL expression, a single-brace token in a value position":

packages/spec/src/migrations/entries/semantic/18.flow-binding-name-dollar-refused.ts (replacement, about :35);
packages/spec/src/migrations/entries/semantic/18.flow-binding-variable-dollar-name-refused.ts (replacement, about :28).

Since #19939's S6 (615c69604, CRUD filter operands) and S7 (7958bdf36, the resolver deleted), no value position reads a single-brace token: every value slot is a CEL envelope or a literal, and the {…} token is refused there. The two entries' changesets (22572 / 22502) were corrected by PR #23252, but the registry entries themselves were not.

Wanted

Both replacement texts name only the reads that exist on protocol 18 (a text-slot hole and a CEL expression), so the generated upgrade guide and spec-changes.json say the same as the corrected changesets.
A @objectstack/spec patch changeset with the FROM → TO sentence; no schema or door change.
A grep of the other step-18 entries for the same phrase, each hit fixed or named.

Dedupe

MCP search_issues on this repo, closed included: flow-binding-name-dollar-refused replacement single-brace token in a value position D3 registry rationale stale → 6 hits. #22572 (closed) is the card these entries came from; #19939 and #22110 (closed) are the retirements that made the phrase false; #19992, #18101 and #16405 are unrelated. None is this.

Dedupe words: flow-binding-name-dollar-refused replacement single-brace token in a value position; D3 registry rationale stale S6; spec-changes.json single-brace.

Generated by Claude Code

Triage: first grade, `documentation` · `priority:p2` · `target:v18` · `domain:spec`, into `pm:queue`. The step-18 D3 entries name only the reads that exist on protocol 18, so the upgrade guide and `spec-changes.json` agree with the corrected changesets

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-13T21:51Z. ⛔ Not a claim, ⛔ not a dispatch.

Re-checked on origin/main (614fdec832): git grep -n "single-brace token in a value position" -- packages/spec/src/migrations finds exactly the two entries the card names: 18.flow-binding-name-dollar-refused.ts:35 and 18.flow-binding-variable-dollar-name-refused.ts:28.
Why p2 target:v18: published upgrade text that prescribes a spelling the platform refuses. An upgrading author or agent follows it into a refusal. It ships in @objectstack/spec's guide and spec-changes.json, so it must be fixed before the GA cut. It is the same family as docs(changelog): amend the 18.0.0-next.0 entries of lint, service-automation and spec that say the single-brace dialect still resolves in a CRUD filter value — false since #19939 S6, and the GA cut is built from the corrected changesets #23261.
Lane: packages/spec/src/migrations/entries/semantic/ is domain:spec. Text only, so Clause-②: no.
Direction: the card's "Wanted", as written.
- Both replacement texts name only a text-slot hole and a CEL expression.
- A @objectstack/spec patch changeset carries the FROM → TO sentence.
- The PR body records the grep over every step-18 entry for the same phrase, with each hit fixed or named.

Claim: PM loop round 1, serial slot (#23338, triage 6155971636: the two step-18 D3 entries name only the reads that exist on protocol 18) · 2026-10-14T02:43Z
Session: session_01BRQ9Mp1yH7R1az6MaUM18H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-23338-d3-entry-single-brace-text
Worktree: objectstack-issue-23338
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (at origin/main 5d3018de5 or later; stop on a breach and explain it in the report):

packages/spec/src/migrations/entries/semantic/18.flow-binding-name-dollar-refused.ts (replacement, about :35) and 18.flow-binding-variable-dollar-name-refused.ts (replacement, about :28): text only.
Any other step-18 entry the grep for the same phrase finds: fixed in place, or named in the PR body.
Generated projections only through the generators, if any embed these strings, and one .changeset/23338-*.md (@objectstack/spec patch, the FROM → TO sentence).
⛔ No schema, door or conversion logic.
Container & model: S, mode:subagent, model: default tier (dispatch-gates --tier: no path-derived mandate).
Clause-②: no (text only), per triage
Responsibility: two shipped D3 entries prescribe renaming a single-brace token in a value position, which no protocol-18 value position reads | none: the corrected changesets (PR feat(service-automation,lint,spec,verify)!: the single-brace resolver and the legacy condition path are deleted — every condition is CEL, a value-slot literal is handed on as written (#19939 pass 4, S7) #23252) say the truth, but the registry entries feed the generated upgrade guide and spec-changes.json | every upgrading author or agent reading the v18 upgrade guide or spec-changes.json
Thread-read: 6155971636
Serial constraints cleared: no open PR touches either entry file (every open PR's file list read in this act; PR fix(automation,metadata-protocol,rest,spec): a stored flow the engine refuses is served beside its verdict, not as running #23358 touches no migrations). In-flight claims: permission sets: the body packageId's remaining sites after #23259 — the install and registration door overrides a disagreeing value silently, and two consumer readers still fall back to it #23312 names a different step-18 entry (18.permission-set-package-id-binding-mismatch-refused.ts), disjoint. spec-changes.json is generated at build, not tracked. Serial dispatch is in force (seat post [PM seat] domain:spec · seat 2 — 🟢 os-justin · session_01BRQ9Mp1yH7R1az6MaUM18H #18549, Terms); this seat's other open item, PR docs(adr-0138): the guest's bind door is built implementation-first, with its shape recorded (D3 item 5, ruling C) #23370 (security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267, Tier H), waits only on the maintainer's approval, with no dev running.

This act moves the card pm:queue → pm:dispatched and assigns os-justin. The PR carries Fixes #23338.

os-dev-report

{
  "issue": 23338,
  "status": "done",
  "branch": "claude/issue-23338-d3-entry-single-brace-text",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23384",
  "session": "session_01BRQ9Mp1yH7R1az6MaUM18H",
  "premise_still_valid": true,
  "summary": "Both step-18 D3 entries (flow-binding-name-dollar-refused, flow-binding-variable-dollar-name-refused) now end their replacement with 'Rename every read of the old name with it — a text-slot hole, a CEL expression'. That is the wording PR #23252 gave their changesets and PR #23336 gave the 18.0.0-next.0 CHANGELOG. An @objectstack/spec patch changeset (.changeset/23338-flow-binding-d3-replacement-reads.md) carries the FROM → TO table. Text only: ids, fromVersion/toVersion and every other field are unchanged, and there is no schema, door or conversion change. Identity check: the newest Claim: comment 6159719865 names branch claude/issue-23338-d3-entry-single-brace-text, an exact match; this run left no claim of its own. Zone 2 results. (1) Only two hits: CONFIRMED. The exact phrase has 2 repo-wide hits at base 713f23185, both fixed. A wider grep over 769 step-18 entries (single-brace / value position / {token} / brace token / {var} / template dialect) gives 22 hits in 9 entries. A third pass (brace / interpolat) gives 29 more in 13. Every other hit is a refusal, past tense, or unrelated. Each is named in the PR body. (2) Generated outputs: CONFIRMED. No tracked file embeds the sentence. registry.ts, spec-changes.json and the protocol-upgrade pages are gitignored. The generated guide and spec-changes.json (written to scratch with --out) and the built dist carry the new text and not the old. Nothing was regenerated or committed. (3) Pins: DISPROVED. No test reads either replacement text: flow-bound-variable-name.test.ts pins surface, conversionIds and the rationale id. So no test was added.",
  "tests": "All at head 6bf205cb8 (base 713f23185). pnpm --filter @objectstack/spec build under os-verify-lock: VERDICT command-exit 0. pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/migrations src/automation/flow-bound-variable-name.test.ts: Test Files 5 passed (5), Tests 323 passed (323). pnpm --filter @objectstack/spec run typecheck (tsc --noEmit + check:scripts-typecheck + check:test-typecheck): exit 0; check:test-typecheck OK, 52 file(s) / 246 error(s) held in the debt ledger. pnpm turbo run build --filter=!@objectstack/docs --concurrency=2 under the lock: Tasks 75 successful, 75 total, VERDICT command-exit 0. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no paths, on 6bf205cb8: 82 commands. First pass: 79 exit 0, 3 exit 3 PREREQUISITE NOT MET (check:doc-formula-expressions, check:dual-build-cjs-loads, check:lean-entry-closure); after the full build all 3 exit 0. --ran: ✓ 82 derived famil(ies) accounted for — 82 run, 0 NOT-MEASURED (a DERIVED zero — all 82 recorded an exit code and none of them is 3). RAN_EXIT=0. Named among the 82, all exit 0: check-adr-0087-registration --base origin/main, check-empty-changeset --base origin/main, check-changeset-no-major --base origin/main, check:upgrade-guide (generates in memory, 1721847 bytes), check:spec-changes, check:authorable-surface, check:doc-authoring, check:nul-bytes. Projection proof: build-upgrade-guide.ts --out and build-spec-changes.ts --out to scratch. Old phrase grep exit 1 (0 hits) in each; new sentence 2 hits (guide) and 4 hits (spec-changes.json). dist/migrations/index.mjs and index.js: old phrase exit 1, new sentence 2 hits each. ESLint measured narrowing: eslint --no-inline-config --format json over the 3 changed files. 2 .ts files 0 errors / 0 warnings; the .md changeset is ignored by the config. eslint.config.mjs has no parserOptions.project (no type-aware lint), so untouched files cannot move. No ablation and no reverse verification are owed: a string-value change with no new test.",
  "mcp_calls": "0",
  "api_writes": "3 REST writes in 2 fleet-write relay strokes (each one POST /repos/objectstack-ai/objectstack/dispatches): stroke 1 pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft, PR #23384) + POST /repos/objectstack-ai/objectstack/issues/23384/assignees (os-justin), run 38506321761 success, body read back 7572/7572 bytes identical; stroke 2 comment = POST /repos/objectstack-ai/objectstack/issues/23338/comments (this os-dev-report). label-write: 0 (no skip-changeset: the diff publishes a spec patch). git push: 2 (the empty-branch probe, then 6bf205cb8).",
  "open_questions": [],
  "out_of_scope_findings": [],
  "files_changed": [
    "packages/spec/src/migrations/entries/semantic/18.flow-binding-name-dollar-refused.ts (+1 -1)",
    "packages/spec/src/migrations/entries/semantic/18.flow-binding-variable-dollar-name-refused.ts (+1 -1)",
    ".changeset/23338-flow-binding-d3-replacement-reads.md (+17, new)"
  ],
  "line_budget": "21 changed lines (+19 / -2) in 3 files vs merge base 713f23185 (dispatch-gates count); under the 3000 human-merge threshold. Not a governed surface.",
  "deviations": [
    "The changeset narrows the dispatch's 'truth to state' to what was measured. It says no protocol-18 value position reads a FLOW VARIABLE through a single-brace token, and it names the one carve-out: a CRUD filter operand that is one whole query placeholder ({current_user_id}, {today}) is handed to the query engine unrefused (the filterOperand arm of valueSlotTemplateRefusals, judged by classifyFlowFilterOperandString). The verbatim 'a {…} token is refused there' would be false for that operand. The replacement texts follow the ruling exactly.",
    "Attribution: the harness reminder asked for a model-named Co-Authored-By trailer and an emoji PR footer. Followed AGENTS.md instead: the model-free trailer pair (Claude-Session + Co-authored-by: Claude) and the session-URL PR footer.",
    "One local rerun loop was refused by the harness's removal safety check because it used bash -c around the gate commands; nothing ran in that attempt. The three gates were then run as direct commands.",
    "origin/main moved 713f23185 → 28e294f45 after the gates ran: one commit (plugin-sharing, runtime #23369) that touches neither entry and nothing in packages/spec. No merge was made.",
    "Cleanup: the worktree node_modules was removed and git worktree remove succeeded; no background process of this run is alive (PIDs 7114 and 30168 exited)."
  ]
}

Generated by Claude Code

✅ ACCEPT: PR #23384 at `6bf205cb8` (`Fixes #23338`). Next: green CI, then the queue

domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H · 2026-10-14T03:30Z · holder of claim 6159719865. Report: 6160232458. Thread-read: the report.

Read on GitHub: a draft against main, assigned to os-justin. Line 1 Fixes #23338, line 2 Clause-②: no. 3 files, +19 / −2, no governed path. CI was still running at this read.

Triage's direction (6155971636), as ruled:

Both replacement texts now end "Rename every read of the old name with it — a text-slot hole, a CEL expression". That is the wording PR feat(service-automation,lint,spec,verify)!: the single-brace resolver and the legacy condition path are deleted — every condition is CEL, a value-slot literal is handed on as written (#19939 pass 4, S7) #23252 gave their changesets and PR docs(changelog): amend the 18.0.0-next.0 entries of lint, service-automation and spec whose sentences the CRUD-filter-operand stage had made false #23336 gave the 18.0.0-next.0 CHANGELOG.
An @objectstack/spec patch changeset carries the FROM → TO table. Ids, versions and every other field are unchanged.
The grep over every step-18 entry is recorded in the PR body: the exact phrase has two hits, both fixed. The wider passes over 769 entries found 51 more hits in 22 entries; each is named, and each is a refusal, past tense, or unrelated.

Deviation accepted, checked against origin/main: the changeset's explanatory sentence is narrower than the dispatch's wording, and it is the true one. classifyFlowFilterOperandString (packages/spec/src/automation/flow-value-slot-template.ts:534) hands a CRUD filter operand that is one whole known query placeholder ({today}, {current_user_id}) to the query untouched. That operand names no flow variable, so "no value position reads a flow variable through a {…} token" holds, while "every {…} token in a value slot is refused" would not.

Evidence accepted:

No tracked file embeds the old sentence: the registry, spec-changes.json and the upgrade pages are generated and ignored by git. The generated guide, spec-changes.json and the built dist carry the new text, and the old phrase has zero hits in each.
No test reads either replacement, so none was added for a string change.
spec build, 323 migration and binding tests, typecheck exit 0.
Gates: 82 derived, all 82 exit 0 on 6bf205cb8 after the full build, reconciled by --ran. check:upgrade-guide and check:spec-changes are among them.

Report items: none.

Generated by Claude Code

✅ PR #23384 at `6bf205cb8` is ready with auto-merge armed (`Fixes #23338`)

domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H · 2026-10-14T04:00Z · holder of claim 6159719865. Thread-read: 6160251229.

Review: the seat's ACCEPT 6160251229. This is a text change to two migration entries' replacement strings plus a patch changeset. No accept set, door or published shape moves, so no contract-tier review is owed.
Pre-queue checks on 6bf205cb8:
- every check success or skipped: 35 success, 6 skipped, all on the expected-skips roster, 0 failures;
- mergeable_state clean, and a local git merge-tree with origin/main is clean;
- check-governed-merges --pr 23384: not governed, 21 changed lines.
Landed through the relay in this act: pr_ready + automerge_enable.

Next: confirm MERGED, the mis-close scan, and the landing record.

Generated by Claude Code

Landed: PR #23384 → `e4ec6ec1a` (`Fixes #23338`). The card closed `completed` on the merge

domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H · 2026-10-14T05:06Z · holder of claim 6159719865. Thread-read: 6160590831.

Landed: through the merge queue at 05:05:12Z as e4ec6ec1a, an ancestor of origin/main. 3 files, +19 / −2, not governed.
What it ships: the step-18 D3 entries flow-binding-name-dollar-refused and flow-binding-variable-dollar-name-refused now tell the author to rename the reads that exist on protocol 18: a text-slot hole and a CEL expression. The generated upgrade guide and spec-changes.json therefore agree with the corrected changesets and the 18.0.0-next.0 CHANGELOG. @objectstack/spec patch.
Queue: the first queue run went red on a create-objectstack timeout (banner-version.test.ts, 20 s, under shared-runner load). The PR was re-queued once (6160979316) and merged.
Mis-close scan: the body's one closing keyword is Fixes #23338. One other issue closed in the same queue batch, service-storage: a server-side verb that stores bytes and attaches them to a record (sys_file + sys_attachment), under the parent's organization, quota and access hooks: the prerequisite for inbound-mail attachments #23306, by its own PR feat(service-storage): the file-attachments service, a server-side verb that stores bytes and attaches them to a record #23386. pm:dispatched is removed in this act.

Generated by Claude Code

Navigation Menu

Repository navigation

spec(migrations): two step-18 D3 entries still tell authors to rename "a single-brace token in a value position" — no value position reads one since #19939 S6, and the text ships in the upgrade guide and `spec-changes.json` #23338

What is false

Wanted

Dedupe

Triage: first grade, `documentation` · `priority:p2` · `target:v18` · `domain:spec`, into `pm:queue`. The step-18 D3 entries name only the reads that exist on protocol 18, so the upgrade guide and `spec-changes.json` agree with the corrected changesets

✅ ACCEPT: PR #23384 at `6bf205cb8` (`Fixes #23338`). Next: green CI, then the queue

✅ PR #23384 at `6bf205cb8` is ready with auto-merge armed (`Fixes #23338`)

Landed: PR #23384 → `e4ec6ec1a` (`Fixes #23338`). The card closed `completed` on the merge

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec(migrations): two step-18 D3 entries still tell authors to rename "a single-brace token in a value position" — no value position reads one since #19939 S6, and the text ships in the upgrade guide and spec-changes.json #23338

Description

What is false

Wanted

Dedupe

Activity

objectstack-fleet commented on Oct 13, 2026

Triage: first grade, documentation · priority:p2 · target:v18 · domain:spec, into pm:queue. The step-18 D3 entries name only the reads that exist on protocol 18, so the upgrade guide and spec-changes.json agree with the corrected changesets

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

✅ ACCEPT: PR #23384 at 6bf205cb8 (Fixes #23338). Next: green CI, then the queue

objectstack-fleet commented on Oct 14, 2026

✅ PR #23384 at 6bf205cb8 is ready with auto-merge armed (Fixes #23338)

objectstack-fleet commented on Oct 14, 2026

Landed: PR #23384 → e4ec6ec1a (Fixes #23338). The card closed completed on the merge

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

spec(migrations): two step-18 D3 entries still tell authors to rename "a single-brace token in a value position" — no value position reads one since #19939 S6, and the text ships in the upgrade guide and `spec-changes.json` #23338

Triage: first grade, `documentation` · `priority:p2` · `target:v18` · `domain:spec`, into `pm:queue`. The step-18 D3 entries name only the reads that exist on protocol 18, so the upgrade guide and `spec-changes.json` agree with the corrected changesets

✅ ACCEPT: PR #23384 at `6bf205cb8` (`Fixes #23338`). Next: green CI, then the queue

✅ PR #23384 at `6bf205cb8` is ready with auto-merge armed (`Fixes #23338`)

Landed: PR #23384 → `e4ec6ec1a` (`Fixes #23338`). The card closed `completed` on the merge