docs(audits): append a dated erratum to the 2026-07 strictness ledger's flow-function row

[os-trump]

Fixes#13101

Route

The triage grading fixed the route at B — keep the dated record's sentence as written, append a dated erratum beside it. Verbatim, untranslated, from that grading (comment 5460587677):

方向定为 B，⛔ A 需上报。

Route A (rewriting the sentence in place) was therefore never attempted: it would leave a dated audit record no longer stating what the 2026-07 audit actually concluded, with nothing marking that it changed. Route C was rejected by the grading on the family's own severity argument — the claim propagates through the sentences the next author reads, and an audit ledger is exactly such a sentence.

The original sentence is byte-identical. The diff is 29 insertions / 0 deletions, verified by git diff --numstat and by comparing the row's bytes against its HEAD blob.

What the erratum corrects — both defects, not one

The grading warned that fixing only the vocabulary would leave a more authoritative wrong sentence behind, so the note covers both. Both were re-verified against the cited evidence on this ref rather than transcribed from the card.

1. The predicate is a FIRST FILTER, not a detector (#12685).selected > 0 AND acted = 0 AND unmeasured = 0 cannot separate a broken sweep from a healthy idempotent one — a sweep that re-selects the same records and gates each on "already handled" satisfies it on every run while that work stands. The discriminator is the per-node fold, FlowRunSummary.nodes[] / gates[]. Confirmed as the live vocabulary in packages/spec/src/automation/execution.zod.ts, which now reads "is the FIRST FILTER for a broken sweep, not a verdict (#12685) ... What separates them is the per-node fold below".

2. The causal direction is backwards (#13096). The ledger says a misspelled effect is "precisely what keeps ... the broken-sweep query silent on the one run that needed it" — i.e. the run escapes the query. The measurement says the opposite:

• packages/services/service-automation/src/builtin/screen-nodes.ts computes const unmeasured = registration.effect === 'writes' and emits metrics: { unmeasuredEffect: true } only when that holds. A dropped declaration therefore emits no metrics at all, so the run folds to selected > 0, acted 0, unmeasured 0 — which satisfies the filter.
• The same file's @module block and packages/spec/src/automation/flow-function.zod.ts's @module block already carry the corrected reading: the run "lands INSIDE Surface flow run summaries (selected / acted / skipped) — a scheduled flow that does nothing is currently indistinguishable from one with nothing to do #4354's broken-sweep first filter, reading exactly like the broken sweep that filter exists to detect".
• packages/qa/dogfood/test/flow-function-effect.dogfood.test.ts pins it end to end. Its header states the undeclared case "reports acted: 0, unmeasured: 0 on a run that wrote, which is indistinguishable from a dead sweep", and its pure-function case asserts unmeasured === 0 with the comment that the broken-sweep query "is free to fire on this run".

So the failure surfaces as a false positive inside the candidate set, not as a silence.

Placement — why beside the row rather than at the file head

docs/audits/ has an existing correction convention, and it has two shapes, both head blockquotes: a CORRECTION (2026-06-16) heading in 2026-06-dead-surface-disposition-plan.md and a bolded SUPERSEDED — 2026-07-25. lead in 2026-06-security-identity-property-liveness.md. Both invalidate a whole file. This is one clause in one row of a 1805-line ledger whose other 59 rows are unaffected, so a head note would overstate the correction.

The file's own structure settles it: the automation/ triage table is already followed by a prose paragraph annotating a row (the trigger-registry.zod.ts note). The erratum takes that same position, directly under the table whose last row it corrects, in the blockquote form the directory's convention uses.

This placement is also inert to the gate. parseLedger in packages/spec/scripts/lib/strictness-ledger-doc.ts only collects lines matching line.startsWith('|') inside a triage or strip section, so a blockquote cannot become a phantom row or disturb coverage.

Verification — union run at c904f1f1e (the final commit)

Gate family derived mechanically with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no hand-fed paths; the script took its own change set from the merge base and confirmed the repo assertion against this checkout's origin). It derived 12 families. Exit codes were captured before any pipe; verdict lines are the gates' own.

11 green. The one the card asked for specifically:

✓ strictness ledger: 60 file(s) across 5 triaged director(ies) — every row names a live sited file, no undeclared schema files.
✓ remaining-strip map: 22 open file(s) / 124 strip site(s) across 4 director(ies) — no file with strip sites is missing a row, no closed file still carries one, every Class cell resolves.
✓ docs/audits/2026-07-unknown-key-strictness-ledger.counts.md is current — 437 site(s) measured, 1 authorable strip site(s) left.

That third line is the proof the card asked for: the .counts.md companion is still current, so the prose erratum disturbed nothing the gate owns. Also green: check:cross-package-test-inputs, check:doc-authoring, check:empty-state, check:liveness, check:merge-driver, check:variant-docs, check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, and check:doc-formula-expressions (green only after building its prerequisites — it first reported PREREQUISITE NOT MET for @objectstack/formula and then @objectstack/lint, which is NOT MEASURED rather than red; after turbo run build for both it reported ✓ check:doc-formula-expressions self-test: 57 cases passed and three further clean verdict lines).

1 not measurable locally.scripts/check-test-completeness.mjs exits 1 printing its own usage line: it requires a turbo test log PATH as its first argument, plus optional --scheduled and --package-list files — all of them produced and supplied by the CI job. A local invocation without them measured nothing, so this is recorded as NOT MEASURED rather than as a failure.

Repo-wide pnpm lint was not run; it is CI's, and this diff is a single markdown file under docs/audits/ with no ESLint population.

Changeset

None, per the changeset gate's own text in .github/workflows/pr-automation.yml, which names this case explicitly:

2. It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the 'skip-changeset' label. PREFERRED

The diff is one file under docs/, publishes from no package, and releases nothing. The skip-changeset label is applied to this PR.

Scope

One file, no code change, no content/docs/releases/ touch. The row's authorable verdict, its "strict as of" claim and every generated count are untouched.

Authored in session session_01LpRNHxWZgSUgVnFT9mQQo4 (durable copy, since a body edit normalises the footer below to its bare form).