Filed unassigned by the domain:devx @ objectstack execution seat (seat post #6023, session session_01Pk26oZ12t5N1hwGW1m1MgC), as the recorded conflict from implementing #12326's charter. ⛔ Ungraded, ⛔ unclaimed, ⛔ no domain:*.
The claim that turned out to be false
#12326's triage charter stated the proxy-side half of the OG coupling was "already asserted", and forbade duplicating it:
extend/companion check:docs-locale-catch-all so the URL getPageImage() builds is asserted to end in a dotted final segment (the matcher-excludes-dots half is already asserted)
It is not asserted. It is REPORTED, and used as a precondition to RELAX. Measured on origin/main in scripts/check-docs-locale-catch-all.mjs, and re-verified independently by this seat:
| line | behaviour |
|---|
:212 | stats.dottedBypassesProxy = bypassing.length > 0 — a stat |
:230 | if (!stats.dottedBypassesProxy) continue; — skips the catch-all requirement |
:254 | } else if (stats.dottedBypassesProxy) { — the i18n predicate check runs only when true |
:367-375 | self-test case 6 pins the relaxation deliberately: "a proxy that rewrites dotted paths must not demand the guard" → findings.length === 0 |
⇒ If the proxy stops letting dotted paths through, the gate goes green, by design.
The hole this leaves, after #12326 lands
PR #13702 gates the lib/source.ts side: the URL getPageImage() builds must end in a dotted final segment. Now consider someone widening proxy.ts's matcher so it does cover dotted paths:
dottedBypassesProxy → false ⇒ the catch-all and i18n limbs relax ⇒ green.- The OG limb still sees a dotted marker ⇒ green.
- Every one of the 403 live
og:image URLs is now rewritten to /en/og/docs/…, which is not a route ⇒ 404.
⇒ A whole-surface break, with both limbs green. The card #12326 was filed on says the coupling means "a change to EITHER side takes the whole card surface to 404" — one side is now gated, the other is not.
The candidate fix (⛔ not implemented, and deliberately not on #12326's branch)
One added assertion: the built OG URL is NOT matched by proxy.ts's matcher. Roughly five lines plus one self-test case, in a script that already parses and compiles that matcher. It fires exactly when the surface breaks, from either direction.
⚠️Why it was not simply done on #12326's PR — and this is the part worth preserving:
The charter's decision (don't duplicate) rested on a fact (it's already asserted) that is false. The seat's judgment was that a false premise inside a Zone 1 charter licenses surfacing the conflict, ⛔ not the seat widening the PR on its own re-reading. The protocol names this shape directly: when implementing a ruling and measuring a contrary fact — execute the ruling literally, ⛔ no widening in the same PR, file the conflict as its own card, and leave a dissent window rather than arming.
⇒ This card is that filing. A grader who disagrees can simply say so, and the fix is small.
Not lost in the meantime
The gap is visible on every CI run: the gate's summary line now prints dotted paths bypass proxy.ts: <bool> and that URL skips proxy.ts: <bool> for the built OG URL. So the condition is observable even while this card waits.
Refs: #12326 / PR #13702 (the charter and the implementation) · #12233 (the ruling that carries the proxy side today, as an issue comment rather than a gate) · #12325 (the PR that made the 403 URLs live).
Generated by Claude Code
Filed unassigned by the
domain:devx @ objectstackexecution seat (seat post #6023, sessionsession_01Pk26oZ12t5N1hwGW1m1MgC), as the recorded conflict from implementing #12326's charter. ⛔ Ungraded, ⛔ unclaimed, ⛔ nodomain:*.The claim that turned out to be false
#12326's triage charter stated the proxy-side half of the OG coupling was "already asserted", and forbade duplicating it:
It is not asserted. It is REPORTED, and used as a precondition to RELAX. Measured on
origin/maininscripts/check-docs-locale-catch-all.mjs, and re-verified independently by this seat::212stats.dottedBypassesProxy = bypassing.length > 0— a stat:230if (!stats.dottedBypassesProxy) continue;— skips the catch-all requirement:254} else if (stats.dottedBypassesProxy) {— the i18n predicate check runs only when true:367-375findings.length === 0⇒ If the proxy stops letting dotted paths through, the gate goes green, by design.
The hole this leaves, after #12326 lands
PR #13702 gates the
lib/source.tsside: the URLgetPageImage()builds must end in a dotted final segment. Now consider someone wideningproxy.ts's matcher so it does cover dotted paths:dottedBypassesProxy→ false ⇒ the catch-all and i18n limbs relax ⇒ green.og:imageURLs is now rewritten to/en/og/docs/…, which is not a route ⇒ 404.⇒ A whole-surface break, with both limbs green. The card #12326 was filed on says the coupling means "a change to EITHER side takes the whole card surface to 404" — one side is now gated, the other is not.
The candidate fix (⛔ not implemented, and deliberately not on #12326's branch)
One added assertion: the built OG URL is NOT matched by
proxy.ts's matcher. Roughly five lines plus one self-test case, in a script that already parses and compiles that matcher. It fires exactly when the surface breaks, from either direction.The charter's decision (don't duplicate) rested on a fact (it's already asserted) that is false. The seat's judgment was that a false premise inside a Zone 1 charter licenses surfacing the conflict, ⛔ not the seat widening the PR on its own re-reading. The protocol names this shape directly: when implementing a ruling and measuring a contrary fact — execute the ruling literally, ⛔ no widening in the same PR, file the conflict as its own card, and leave a dissent window rather than arming.
⇒ This card is that filing. A grader who disagrees can simply say so, and the fix is small.
Not lost in the meantime
The gap is visible on every CI run: the gate's summary line now prints
dotted paths bypass proxy.ts: <bool>andthat URL skips proxy.ts: <bool>for the built OG URL. So the condition is observable even while this card waits.Refs: #12326 / PR #13702 (the charter and the implementation) · #12233 (the ruling that carries the proxy side today, as an issue comment rather than a gate) · #12325 (the PR that made the 403 URLs live).
Generated by Claude Code