gate: forbid a second declaration of an exported schema name — the recurrence guard the 2026-08-25 family ruling ordered

[os-steve]

Filed by the triage seat as part of the maintainer's 2026-08-25 family ruling (decision 甲/A1 on #6172, verbatim acceptance: 「同意」): every exported schema name has exactly one authority — and a gate keeps it true after the cleanup lands, so the #6172/#6155/#6169/#6170 class cannot silently regrow.

What

A check (root-suite test or check: script, implementer's call following the repo's gate conventions) that fails when an exported schema/type name in the published packages is declared more than once with disagreeing shapes — the measured shape of #6172 (FormField, MarkdownSchema, KanbanSchema), #6155 (KanbanCard ×4), and the class #6086 kept hitting.

Constraints from the measurements already on record

• The matcher must discriminate: near-spellings and derived names are NOT collisions (see the finding(docs): three more prose closure claims nothing gates — and one of them is held in place by a test that pins the sentence exists, not that it is true #6186 claim-1 truth-pin PR test(scripts): re-derive the ValidationRule absence claim, not just the sentence #6195 for the house pattern — bare-name matching with masked comments/literals, positive control that injects a real collision and reds, negative controls that stay green on today's tree).
• Deliberate re-exports (export { X } from './x' — one declaration, many export sites) are not collisions; a second declaration or an aliasing re-export that publishes an already-declared name is.
• The population refuses to collapse (assert a minimum scanned-file count — the vacuous-green trap, same PR's discipline).
• Baseline: the gate lands AFTER (or with an allowlist of) the known collisions being cleaned by finding(types): three more type names are declared twice with disagreeing shapes — FormField, MarkdownSchema, KanbanSchema — and one doc asserts FormField is declared once #6172/finding(plugin-chatbot): the chatbot authoring surface is an unnamed inline intersection, and its docs table names a key the node does not carry #6169/finding(plugin-timeline): the timeline renderer reads seven keys TimelineSchema does not declare, and declares three it never reads #6170 — a ratchet with today's population named, shrinking as the family cards land, is acceptable; silently exempting them forever is not.

Sequencing: can land with an explicit baseline before the family cards finish; the baseline empties as they land.

Refs: #6172 (the ruling), #6155, #6169, #6170, #6086, PR #6195 (matcher discipline precedent).

[os-warren]

Claim: PM loop round 30
Session: session_012CZgmFFzqA9cX8tBMhvpFe
Branch: claude/issue-6273-one-authority-per-exported-name
Worktree: objectui-issue-6273
Domain: domain:devx (@ objectui, seat #5748)
File surface: one new gate (a scripts/__tests__/ suite or a scripts/check-*.mjs + its test — your call per the card), plus a named baseline if you take the ratchet route
Container & model: M, mode:subagent, model: opus
Clause-②: no — a gate that observes declarations; it changes no schema and widens no public surface
Serial constraints cleared: in flight #6132 (content/docs/**) — disjoint. ⚠️ #5899 is claimed by another identity (claude[bot]) and is about scripts/check-spec-symbol-derivation.mjs. ⛔ Do not touch that file: your card asks for a new gate, not an extension of that one. If you conclude the right home for this check is inside that existing script, stop and report rather than editing it — that is a serialisation question, not an implementation choice.

Zone 1 — Ruling and constraints (binding)

Filed by triage as part of the maintainer's 2026-08-25 family ruling (decision 甲/A1 on #6172, verbatim 「同意」): every exported schema name has exactly one authority, and a gate keeps that true after the cleanup lands so the #6172 / #6155 / #6169 / #6170 class cannot silently regrow.

The card's constraints are binding and each has a measurement behind it:

• The matcher must discriminate. Near-spellings and derived names are ⛔ not collisions.
• Deliberate re-exports are not collisions — export { X } from './x' is one declaration with many export sites. A second declaration, or an aliasing re-export that publishes an already-declared name, is.
• The population refuses to collapse — assert a minimum scanned-file count. A scan that finds nothing reads exactly like a scan that found nothing wrong.
• Baseline discipline: landing with an explicit, named baseline of today's known collisions is acceptable and it must shrink as finding(types): three more type names are declared twice with disagreeing shapes — FormField, MarkdownSchema, KanbanSchema — and one doc asserts FormField is declared once #6172 / finding(plugin-chatbot): the chatbot authoring surface is an unnamed inline intersection, and its docs table names a key the node does not carry #6169 / finding(plugin-timeline): the timeline renderer reads seven keys TimelineSchema does not declare, and declares three it never reads #6170 land. ⛔ Silently exempting them forever is not.

Zone 2 — PM mechanism readings

⭐ The house pattern you are asked to follow is not hypothetical — it was used again an hour ago and it caught two defects in itself. PR #6195 is the precedent the card names; PR #6337 (card #6186, merging now) is the fresher and more instructive instance. Read it before writing your matcher. What it establishes:

• Two masks, not one. A member access and a destructuring are code, so scan with comments and string literals blanked. But a computed access spells its key as a string literal, so blanking literals erases the very thing you are looking for. That leg must read comment-masked source where literals survive — and then require the bracket itself to be code, or the gate reds on quoted examples (including its own fixture table).
• ⚠️ Its computed-access leg silently never fired on the first authoring pass. The positive control is what caught it. A leg that cannot fire is the vacuous-green shape these gates exist to prevent, reproduced inside the gate.
• ⚠️ It reddened on its own source the moment it was committed — the moment a tracked-files population first contained it. Expect the same: your gate will name schema types in its fixtures and its diagnostic. Solve it with a real discriminator, ⛔ not a filename exemption.
• Negative controls are the load-bearing half. Every one should be a spelling this repository really writes, cited where it lives. An assertion that reds on legitimate code gets deleted by the first person who hits it, and the claim goes back to unguarded — worse than never writing it.

⚠️ Re-measure the known collisions yourself. The card cites #6172 (FormField, MarkdownSchema, KanbanSchema) and #6155 (KanbanCard ×4), but those family cards are landing right now — several merged today. Your baseline must be today's measurement, not the card's. If a cited collision is already cleaned, say so; if your scan finds collisions the family cards never named, that is new information and it belongs in the report.

Zone 3 — Suggested route (optional; measurement wins)

A root-suite test under scripts/__tests__/ looks right to me — it inherits the vitest run that already exists, needs no workflow wiring, and #6337 just demonstrated the whole shape end to end. ⛔ My guess, not a constraint: if a check: script is the better home by this repo's conventions, take it and say why (and note that a check: script needs its own workflow trigger wiring, including its own path in that workflow's paths: filter — see #6321).

Gates

Derive from your diff. A new gate owes a test that proves it discriminates, shown red-before / green-after in the report. Follow check-changeset-presence.mjs's own verdict on whether a changeset is owed; ⛔ no skip-changeset label (#4912). Capture exit codes by redirect before any pipe and quote each gate's own verdict line.

⛔ Do not edit content/docs/releases/.

Standing

Worktree-first before your first edit. Post your own claim comment with your branch — ⚠️ under mode:subagent your session ID is identical to mine (objectstack#12220), so the branch is what distinguishes your claim. Lead your report with the literal text os-dev-report, write angle-bracket fragments in words, and read it back after posting.

Expected outcome: done with a draft PR carrying Fixes #6273.

---

Generated by Claude Code

[os-warren]

Claim (dev, os-dev subagent) — distinguished by branch, since under mode:subagent my session ID is identical to the PM's.

Session: session_012CZgmFFzqA9cX8tBMhvpFe
Branch: claude/issue-6273-one-authority-per-exported-name (pushed empty as the write-route probe; push exit 0)
Worktree: /home/user/objectui-issue-6273
Repo: objectstack-ai/objectui

Scope acknowledged: one new gate for "every exported schema name has exactly one authority". ⛔ scripts/check-spec-symbol-derivation.mjs is claimed by another identity (#5899) and will not be touched; if I conclude the check belongs inside it I will stop and report rather than edit.

Starting from PR #6337 / PR #6195 as the matcher precedent, and re-measuring today's collision population myself rather than trusting the card's cited list.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

os-dev-report

{
 "issue": 6273,
 "status": "done",
 "branch": "claude/issue-6273-one-authority-per-exported-name",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6348",
 "premise_still_valid": true,
 "summary": "New root-suite gate scripts/__tests__/one-authority-per-exported-name-6273.test.ts re-derives, from source on every test run, every exported type-level name in the published packages that carries more than one authority — a second `export interface|type|enum` declaration, or a `type`-marked aliasing re-export publishing a name something else already declares. Deliberate re-exports (`export { X } from './x'`, `export *`, `X as X`) are one declaration with many export sites and are not counted; near-spellings and derived names are anchored out on both ends. Chose the root-suite test over a `check:` script: it inherits the existing vitest run and needs no workflow job or `paths:` entry (#6321), and PR #6337 is the freshest house precedent for exactly this shape. scripts/check-spec-symbol-derivation.mjs (#5899, other identity) was NOT touched and no serialisation question arose — its claim is 'a local declaration sharing a name with an @objectstack/spec export must be derived from the spec', a different population and a different verdict from 'two authorities inside objectui'. CARD BODY: read in full via the GitHub API; NO sanitizer truncation — every section closes, the final sentence terminates, and the card contains no angle-bracket fragments anywhere for the sanitizer to have eaten (it is written in the words-not-brackets style the dispatch mandates). Channel note: direct REST to api.github.com is REFUSED for this seat ('GitHub access is not enabled for this session. An org admin must connect the Claude GitHub App for this organization'), so every GitHub read and write here went through the MCP channel and a byte-level diff of the stored body against an independent fetch was not possible; the truncation verdict rests on the API-delivered body being structurally complete. Git push works normally (the git proxy is a separate route).",
 "tests": "Union taken at the FINAL commit 78a9140c9; heavy commands serialised through scripts/pm/os-verify-lock.sh; every exit code captured by redirect BEFORE any pipe. (1) `pnpm exec vitest run --project unit scripts/__tests__` EXIT=0 — 'Test Files 78 passed (78) / Tests 2273 passed (2273)'. (2) `pnpm type-check:scripts` (tsc -p tsconfig.scripts.json) EXIT=0, clean — and NOT a not-measured green: `tsc --listFiles` reports 1 hit for the new file, so it really is in the program (tsconfig.scripts.json includes scripts/**/*.ts with no test exclusion). (3) `pnpm lint:root` EXIT=0 — its own line '28 problems (0 errors, 28 warnings)', all pre-existing no-explicit-any warnings in other files; `eslint --format json` on the new file alone reports 'files linted: 1 errors: 0 warnings: 0'. (4) `node scripts/check-control-bytes.mjs` EXIT=0 — 'check-control-bytes: OK (scanned 5225 tracked text file(s); skipped 85 binary)'; plus a self-scan `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` on the new file, exit 1 (no control bytes). (5) `node scripts/check-lint-coverage.mjs` EXIT=0 — 'lint coverage: 46/46 packages linted, 0 with outstanding errors (0 total)'. (6) `node scripts/check-type-check-coverage.mjs` EXIT=0 — 'type-check coverage: 45/46 via type-check … test type-check coverage: 41/41 packages compile their tests'. (7) `node scripts/check-changeset-presence.mjs` EXIT=0 — its own verdict: 'No source of a released package changed in this range, so no changeset is owed'; so NO changeset was added, and no skip-changeset label (#4912 — that mechanism does not exist in this repo). NARROWING DECLARED: repo-wide `pnpm lint` (turbo, all packages) was NOT run locally; `lint:root` covers exactly the root-level tree this one-file diff lives in, and CI runs the full farm once regardless. REVERSE VERIFICATION, tree-level, on the real population (fixture positive controls alone would only prove the analyzer fires): injected a second `export interface MarkdownRendererProps` into packages/plugin-markdown/src/types.ts from a script carrying `trap restore EXIT INT TERM` with absolute paths resolved from `git rev-parse --show-toplevel`. THE MUTATION WAS CONFIRMED ON DISK, not by the editor's exit code — anchored grep of the injected marker returned 1 (want 1) AND `git hash-object` moved from the HEAD blob e71cadc1540187bd20551a257e5a2b409e286058 to 3a90fa20731a7c3d70c5b237feab0ebca7f3bff4; both checks were hard gates that abort the run and void the readings. Mutated leg EXIT=1, naming exactly the injected collision: 'MarkdownRendererProps — a NEW colliding name' with both sites, 'Test Files 1 failed (1) | Tests 1 failed | 10 passed (11)'. Restore leg used `git checkout HEAD -- ABSOLUTE_PATH` (never a bare checkout, which would restore from the polluted index) and was PROVED the same way: blob back to e71cadc154… byte-identical, marker count 0, `git diff HEAD` 0 lines — all three hard gates. Restored leg EXIT=0, 'Test Files 1 passed (1) | Tests 11 passed (11)'. NO BUILD/dist LEG EXISTS to invalidate: the gate reads tracked SOURCE text through vitest, nothing resolves through a package's dist, so neither leg needed a rebuild — stated rather than assumed. Expected direction was RED-on-mutation and that is what was observed.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #6349 (unassigned, unlabelled, left for PM triage): the collision population is 46 names, of which 42 are named by NO family card — the ratchet cannot shrink past #6155/#6172's four without an owner for the rest. Includes the full site table.",
 "not filed, reported here as re-measurement of the card's own citations: `FormField` (#6172) is ALREADY CLEAN — one declaration at packages/types/src/form.ts:911 — so the card's cited list is stale by one; `MarkdownSchema`, `KanbanSchema` and `KanbanCard` x4 are still live, and KanbanCard's four files match #6155's count exactly, which is the evidence that this gate's population is co-extensive with the one the family cards counted.",
 "not filed, folded into #6349: `KanbanColumn` collides across the EXACT same four files as `KanbanCard` and no card mentions it — whoever takes #6155 is already standing in front of the second half.",
 "not filed, folded into #6349: two collisions are INTERNAL to packages/types — `ActionSchema` (crud.ts vs ui-action.ts) and `BreadcrumbItem`/`BreadcrumbSchema` (data-display.ts vs navigation.ts) — where a consumer importing from the barrel cannot say which one it meant."
 ]
}

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

ACCEPT — PR #6348

domain:devx @ objectui execution seat (#5748), PM session session_012CZgmFFzqA9cX8tBMhvpFe, R30. Read against the diff and origin/main, ⛔ not against the report.

⭐ The number the card did not know: 46 collisions, and 42 of them have no owner

The card's baseline clause says a ratchet naming today's population is acceptable, "silently exempting them forever is not." The measured population is 46 names, of which the family cards (#6172 / #6155 / #6169 / #6170) name four. So the ratchet can drain to 42 as those land and then stops — which is the shape the card's own clause warns about, reached honestly rather than by exemption.

That is why filing #6349 (the full site table, now labelled finding) is the load-bearing half of this delivery. ⚠️ Triage should read the ratchet baseline as "42 names awaiting an owner", not as "cleanup in progress".

The card's citations were stale, and the re-measurement is what proves the population is the right one

I re-derived all of it on origin/main rather than accepting the report:

the card says	measured	verdict
FormField collides (#6172)	1 declaration, packages/types/src/form.ts:911	⛔ already clean — the cited list is stale by one
KanbanCard ×4 (#6155)	exactly 4 files	✅ matches #6155's own count
MarkdownSchema, KanbanSchema	still live	✅

⭐ The KanbanCard agreement is the important one and the report names why: it is the evidence that this gate's population is co-extensive with the one the family cards counted by hand. A new scanner that agreed with nothing would be measuring something else and nobody could tell.

Two of the folded-in findings I checked personally because they are the most consequential — both hold:

• ActionSchema — packages/types/src/crud.ts:67 and ui-action.ts:374, both inside packages/types
• BreadcrumbItem — data-display.ts:1225 and navigation.ts:179, likewise

⚠️ Those two are worse than a cross-package duplicate: a consumer importing from the barrel cannot say which one it meant, and no error tells them. Also folded in: KanbanColumn collides across the exact same four files as KanbanCard, and no card mentions it — whoever takes #6155 is already standing in front of the second half.

The gate's own discipline

Root-suite test over a check: script, with the reason given rather than the preference: it inherits the existing vitest run and needs no workflow job or paths: entry — which, per #6321, is a whole class of defect avoided rather than a convenience. #6337 is cited as the house precedent for the shape, which is what my order asked.

⭐ Reverse verification at tree level, on the real population — and the report says exactly why fixtures alone would not do: "fixture positive controls alone would only prove the analyzer fires." So it injected a genuine second export interface MarkdownRendererProps into a real package and watched the gate name it with both sites. Mutation confirmed by anchored grep AND blob hash as hard gates that abort the run and void the readings — not by an editor's exit code. Restore via git checkout HEAD -- with an absolute path (never the bare form, which restores from a polluted index), proven three ways: blob back to e71cadc154…, marker count 0, git diff HEAD empty.

Discrimination: deliberate re-exports (export { X } from './x', export *, X as X) are one declaration with many export sites and are not counted; near-spellings anchored out at both ends. No build leg exists to invalidate — the gate reads tracked source through vitest, nothing resolves through a dist — stated rather than skipped.

On #5899 — the constraint was met, and better than met

⛔ scripts/check-spec-symbol-derivation.mjs untouched, as ordered. But the dev did more than avoid the file: it established that no serialisation question arose, because that gate answers "a local declaration sharing a name with an @objectstack/spec export must be derived from the spec" — a different population and a different verdict from "two authorities inside objectui". That is the difference between obeying a boundary and understanding it.

Gates

All green at 78a9140c9, each quoted from its own verdict line. Notably type-check:scripts was proven not to be a not-measured green: tsc --listFiles reports 1 hit for the new file, so it really is in the program. check-changeset-presence says none is owed and none was added. Narrowing declared: repo-wide pnpm lint not run locally, lint:root covers the root-level tree this one-file diff lives in, CI runs the full farm regardless.

Channel note recorded, not worked around: direct REST to api.github.com is refused for this seat, so a byte-level diff of the stored card body against an independent fetch was impossible; the no-truncation verdict rests on the API-delivered body being structurally complete, and the report says so instead of claiming a check it could not run.

Landing

Arming on every-check-green — ⛔ not the required subset — then following to MERGED.

---

Generated by Claude Code