门测量的重合度 bridge 有残余假可达面:整形状由共享叶子组成的「小形状」恒为 1.0,任何阈值都排不掉

[baozhoutao]

观察类发现,来自 #5056 的实测。今天没有任何真实 spec 形状命中,不影响用户;记录在案,免得后面某个批次把它当成新 bug 重新发现一次。

事实

#5056 把 derived-clone bridge 从「任意单属性命中」换成整形状重合度 ≥ 0.5,WidgetManifestSchema 的假可达因此被正确排除(2/19 = 0.105)。

但重合度的分母是候选形状自己的键数。于是一个键数很少、且每个键都是仓内共享叶子的形状,重合度恒为 1.0:

z.object({
 name: SnakeCaseIdentifierSchema.describe('Machine name'),
 label: I18nLabelSchema.describe('Display label'),
})

实测 cloneOverlap = 1.0000,判定 derived-clone → 可达。而它跟任何活 schema 都没有派生关系,只是两个键碰巧都是被 .describe() 过的共享叶子(.describe() 复用接收者实例的 _zod.def,见 #5056)。

对照:同样两个共享叶子 + 3 个普通键 → 0.4000 → 正确判为不可达。所以命中条件是形状小,不是共享的绝对数量。

为什么阈值调不掉

(0, 1] 里没有哪个阈值能排除它:真·派生也会打到 1.0 —— 实测 ObjectListViewSchema.strip() 重合度就是 1.0000,且必须保持可达。两者在「重合度」这一个维度上不可分。要分开需要另一个判据(例如要求共享的属性里至少有一个是结构性节点而非叶子,或要求候选与基形状的键集双向覆盖),那是对仪器契约的改动,不该顺手塞进 #5056 的测试层 PR。

影响面(今天为零)

误差方向仍然只朝假可达一侧 —— 也就是仍然只可能让某个批次对死形状做收紧(#4583 的「precisely validated dead slot」)。触发需要:被测形状键数很少(约 ≤ 4),且几乎每个键都是共享叶子。

• WidgetManifestSchema 19 键 → 0.105,不命中
• 批 16 / 批 15 / 批 14 已测的形状均不命中

现状

已在 #5056 的 PR 里作为具名 pin 钉住(packages/spec/src/ui/door-reachability.testkit.test.ts,用例名以 KNOWN BOUND 开头),所以这条边界是被测量、被断言的,不是潜伏的。本 issue 只负责让后续批次在遇到小形状时知道该去读那条 pin。

建议给后续批次(17-22)的操作

测到一个 derived-clone 判定时,如果目标形状键数很少,先看 cloneOverlap 和键数,再决定信不信这扇门。

参考:#5056 · #4001 · #4583

[claude]

发现分诊轮(#4949 纪律):持有(留 finding),域维持 domain:spec-tooling。⛔ 不晋级、不关闭 —— 三条理由与明确的重启条件如下。

• 过时前提检查(origin/main 9e3709a):前提成立,且本条已由 #4001 战役的门测量 BFS 会误报「可达」:zod .describe() 共享 def 对象,任意单属性 bridge 把无关形状连起来 #5056 的 PR 作为具名 pin 钉在 packages/spec/src/ui/door-reachability.testkit.test.ts(用例名以 KNOWN BOUND 开头)⇒ 这条边界是被测量、被断言的,不是潜伏面。持有的成本因此极低:它不会悄悄消失,也不会被下一个批次当新 bug 重新发现一次(正文立单的目的即此)。
• 为什么不晋级:入队要求「说得出修复落在哪个文件」,而本条的修法本身还不存在 —— 正文已证明 (0, 1] 里没有可用阈值(真·派生 ObjectListViewSchema.strip() 实测同为 1.0000 且必须保持可达,两者在「重合度」这一个维度上不可分),所以要动就得引入第二个判据(要求共享属性里至少一个是结构性节点、或要求候选与基形状键集双向覆盖)—— 那是对仪器契约的改动。仪器契约改动缺一个东西才能定价:一个真实命中的形状。今天没有。
• 为什么不关(not planned):误差方向是假可达一侧 —— 后果是某个批次可能对一个死形状做收紧(datasource 账本判定的 20 条死键至今无人处置：三个块整块无人读，其中 readOnly 让一个 shipped 示例的「只读副本」可写（ADR-0049 enforce-or-remove） #4583 的 precisely validated dead slot),即「白做工 + 把死槽位当活的」,不是无害的美观问题。命中条件也不是天方夜谭:形状键数 ≲ 4 且几乎每键都是共享叶子。关掉等于把一条已量化的仪器偏差从状态机里删掉。
• 重启条件(本轮明确化 —— 持有必须有可退出的条件):① 后续批次(17–22)测到一个 derived-clone 判定、且目标形状键数很少(≲ 4)⇒ 立刻晋级,由那个批次带着真实形状去设计第二判据(此时定价才是被需求拉出来的);② 或 cloneOverlap 的分母口径在别的单里被改写(不再是候选自身键数)⇒ 本条前提失效,复评关闭;③ 若门测量整体退役 ⇒ 同上。
• 给后续批次的操作照正文执行:测到 derived-clone 时,若目标形状键数很少,先看 cloneOverlap 与键数再决定信不信这扇门,并去读那条 KNOWN BOUND pin。
• 查重:三仓无影子单;#4001 战役的门测量 BFS 会误报「可达」:zod .describe() 共享 def 对象,任意单属性 bridge 把无关形状连起来 #5056(出处)、未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001、datasource 账本判定的 20 条死键至今无人处置：三个块整块无人读，其中 readOnly 让一个 shipped 示例的「只读副本」可写（ADR-0049 enforce-or-remove） #4583 为关联。

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[claude]

Findings triage round (#4949 discipline): HOLD maintained (finding kept), domain stays domain:spec-tooling. Stale-premise check @ origin/main 80f7dc6.

• packages/spec/src/ui/door-reachability.testkit.test.ts — REST commit list since 2026-08-06T13:00Z is empty; the boundary is still carried by its named pin, :170 "KNOWN BOUND — a shape made ENTIRELY of shared leaves still bridges, whatever the threshold". So the hold stays cheap in the way the last grading described: this cannot silently disappear, and it cannot be rediscovered as a fresh bug by a later batch.
• Restart condition ① not fired: no batch (17–22) has reported a derived-clone verdict on a small shape (≲ 4 keys) since the grading.
• Restart condition ② not fired: the cloneOverlap denominator is still the candidate shape's own key count — nothing has rewritten that measure.
• Restart condition ③ not fired: door measurement has not been retired.
• ⚠️ These are REST-commits readings against main; the local checkout is shallow (50 commits) and its per-path git log reports the graft boundary as if it created every file (Operational notes 6).

Verdict: HOLD

Unchanged on both sides. Not promotable: the body already proves no threshold in (0, 1] separates the false-reachable small shape from a true derivation (ObjectListViewSchema.strip() measures 1.0000 as well and must stay reachable), so acting means introducing a second criterion — an instrument-contract change that cannot be priced until a real shape pulls it. Not closable: the error direction is false-reachable, whose consequence is a batch tightening a dead slot (#4583's precisely validated dead slot), and the trigger shape is not exotic.

Operating instruction for batches 17–22 stands: on a derived-clone verdict against a small shape, read cloneOverlap and the key count first, and read the KNOWN BOUND pin, before trusting that door.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[os-project-manager]

Findings sweep (maintainer-authorized one-off, 2026-08-07 — registered on #6015): hold confirmed. The false-reachable face is real but no actual spec shape hits it (measured), and the body proves no threshold can exclude it — the fix requires a different discriminator, which is design work without a current victim. Restart: first real small-shape false positive in the gate's output.

---

Generated by Claude Code