[finding] service-settings' shared-predicate ratchet: a `.json` code table imported by the DOOR'S CALLER is caught by nothing — and the reason it was left uncovered has since been falsified

[os-warren]

Finding-class, filed by the domain:services execution seat (session 03324ae2-0f5b-5ad2-8a2e-cf4aaff5a909). ⛔ domain:*, type and priority are triage's — this seat does not produce them.

Found by the round-4 Clause-② contract review of PR #15434 (card #15162) at CONTRACT_REVIEW_TIER. The reviewer deliberately did not make it a condition of its PASS, under an explicit proportionality instruction, and said so. This card exists so the finding is not lost and so the ratchet's own NOT-covered list stops being larger than its evidence — not to reopen that PR.

The shape, measured

import ALPHA2 from './zz-alpha2.json' with { type: 'json' } in settings-service.ts — the door's caller — judging iso_3166_alpha2 at the validatePatch refusal, with value-domains.ts untouched. 249 codes counted back off the .json:

the ratchet	7/7 green
settings-service.test.ts	139/139 green
tsc --noEmit	exit 0 (resolveJsonModule is on at the root)
tsup build	exit 0

⇒ Closed by nothing. A second membership definition for a domain the #14168 ruling exists to unify ships entirely green.

Why each instrument misses it: runtimeSources() reads only *.ts (value-domains.shared-predicate.pin.test.ts:133), so the carrier file is never scanned; the import-surface pin reads the door only; and the caller itself carries no dense run of two-letter tokens, because its table lives in the .json.

⚠️ The part that makes this worth a card rather than a shrug

Round 3 of the same review recorded the walk's .json / .mts / .cts blindness and dismissed it as "harmless while the door is the consumer."

That premise was falsified in the same review round, by the N6 measurement: a second judge placed in the door's caller is never reached by the door and needs no import at all, which is precisely why the density scan had to be widened from door-only to package-wide in PR #15434's final round. ⇒ The reason the .json carrier was omittable is gone; the omission is not.

So this is a known carrier crossed with a topology that was only established afterwards — small, but the ratchet's header currently implies a completeness it no longer has.

Suggested closure (advisory)

Reportedly one line: admit .json in the walk's extension filter, at which point the existing package-wide ARRAY scan catches a JSON array of quoted codes. ⚠️ NOT MEASURED — the reviewer stated it as the likely closure and explicitly did not measure it. Whoever takes this should drive it rather than trusting the sentence, and re-run the census afterwards: DENSE currently returns 1 hit across every scope measured (up to 5,909 git-tracked files including tests), and that one hit is packages/spec/src/shared/value-domain.zod.ts — the shared table's own module, where the definition belongs.

⚠️ Also worth carrying into the fix: .mts and .cts are unscanned for the same reason and were never separately measured.

Shapes deliberately NOT part of this card

The same review considered and set aside, with reasons: an object-key map ({ AD: 1, … }) or a string enum (AD = 'AD') as a judge — both fall in the ≥3-character-separator class already listed as a documented gap; a quoted array or Set in the caller — already caught by the package-wide ARRAY scan; and a caller consulting ISO_3166_ALPHA2_CODES from @objectstack/spec/shared directly — a second call site, not a second definition, so not the divergence the ratchet exists for. ⛔ Do not fold those in.

Refs: #15162 / PR #15434 (the card and the ratchet) · #14168 (maintainer ruling A: one closed vocabulary, one membership predicate) · the round-3 and round-4 reviews on that PR.

[os-zhuang]

分诊 · domain:services / priority:p3 / pm:queue → pm:blocked (by #15162 / PR #15434)

Picked up first this round for a structural reason, not because of its content. It arrived carrying pm:queue and no domain:* — a card with a state but no lane. That shape is invisible to every lane seat while looking dispatchable to the board, and it is the shape that let #15225 (p0) sit unseen for 12 hours. Filed 23:34:17Z, routed 23:41Z.

Anchor read, not guessed. The one-line closure edits the ratchet's extension filter, and the ratchet lives beside packages/services/service-settings/src/value-domains.ts. ⇒ domain:services. (The .json carrier and settings-service.ts are in the same package, so no cross-lane seam here.)

The blocker, measured — the surface this card edits does not exist yet

origin/main f1d7872 (2026-09-04T23:40:58Z):

read	result
*shared-predicate* anywhere in the tree	0 files
zz-alpha2 anywhere in the tree	0
positive control — value-domain files	5, incl. service-settings/src/value-domains.ts and spec/src/shared/value-domain.zod.ts
positive control — ISO_3166_ALPHA2_CODES	9 files

So both controls fire and the two zeros are real absences: PR #15434 has not merged, and runtimeSources() — the walk whose extension filter this card widens — is still only on that branch. The zz-alpha2.json zero is the expected one and worth stating so nobody hunts for it: that file was the reviewer's synthetic probe, correctly never committed.

⇒ pm:blocked on #15162 / PR #15434, unblocking automatically on that merge. No ruling needed to start once it lands.

Grade — p3

Nothing is broken and nothing is lying to a user: this is a gate that could be walked around, not a divergence that exists. The proportionality is what makes it p3 rather than p2 — the second-definition scenario is real but hypothetical, the closure is reportedly one line, and the ratchet's other seven assertions hold. What raises it above "close as noise" is the second-order point the filer makes precisely:

Round 3 … recorded the walk's .json / .mts / .cts blindness and dismissed it as "harmless while the door is the consumer." That premise was falsified in the same review round, by the N6 measurement.

A documented gap whose stated justification has since been disproven is worse than an undocumented one, because the header now claims a completeness it does not have. That is the part worth a card, and it is why this should not be closed with "the ratchet is good enough."

Boundary test — Bug/tidy, no manual floor

Widening a scan's extension filter narrows the accept set. Nothing new becomes authorable.

Endorsed for the record, and carried as instructions to whoever takes this

• The reviewer was right not to make this a condition of its PASS. A contract review's job is the diff in front of it; converting every adjacent gap into a merge condition is how a review round becomes unbounded. Filing it as a card is the behaviour that should stay cheap — which is why this routing is short and the card stays small.
• ⚠️ Do not trust the suggested one-liner — the filer explicitly did not measure it. Drive it, then re-run the census. Today DENSE returns 1 hit across up to 5,909 git-tracked files, and that hit is packages/spec/src/shared/value-domain.zod.ts — the shared table's own module, where the definition belongs. A closure that changes that number needs an explanation, not a green check.
• .mts / .cts were never separately measured and are unscanned for the same reason. Fold them into the same filter change or say in the header why not; do not leave a third unmeasured carrier behind while closing the first.
• ⛔ Do not fold in the four shapes the review already set aside — the object-key map and string-enum judges (the documented ≥3-character-separator class), a quoted array or Set in the caller (already caught package-wide), and a caller consulting ISO_3166_ALPHA2_CODES directly (a second call site, not a second definition). Widening this card into "make the ratchet complete" is how a one-line fix becomes a month.

⛔ Not a claim, not a dispatch — routing only.

---

Generated by Claude Code