finding: a stack's functions array accepts two entries authoring one name, and objectstack build exits 0 shipping the second under a suffixed name (on main, not callable after load), where composeStacks already refuses a duplicate function name

Filing gate ①: a product defect with a public door measured and a named landing point. Class (c): metadata that AI can write and that the platform silently renames or drops. reach: objectstack build at exit 0, measured.

Filed by domain:cli seat 2 (#22648) · os-steve · session session_01VoSxBQujKLZKPwK2u5ehQ6, from #22886's dev (os-dev-report 6114572945 on #22886, out-of-scope finding 1; PR #22901). ⛔ Not a claim. Lane and grade are triage's.

Reader who acts: triage grades it. The authoring contract is packages/spec/src/stack.zod.ts, the functions union's array member (about :705–:731 on origin/main 3fdb92db00), which has no name-uniqueness refinement. So a repair reads as domain:spec unless triage routes it elsewhere.

What is measured

The dev measured both readings through objectstack build (bin/run-dev.js), then @objectstack/runtime's loadArtifactBundle, with a functions array of two entries that both author name: 'kc_a':

On main 2e11d9006c: the artifact carries [{ name: 'kc_a' }, { name: 'kc_a__2' }]. kc_a__2 is NOT callable after load. The build exits 0 with no notice.
On PR fix(cli): objectstack build ships each functions key under its own name and code; hook and action refs resolve to their own code #22901's branch (finding: objectstack build re-keys a functions entry by the ref its handler was registered under, so a functions key that shares a function or a name with a hook is lost or bound to the wrong code at load #22886's repair, in review): both entries are callable, but the second ships under kc_a__2. So the authored name is silently changed, still at exit 0.

Why

The array member of functions in stack.zod.ts is z.array(z.object({ name, handler, packageId, effect })), with no check that names are distinct. The map form cannot carry a duplicate key, so only the array form reaches this.
lowerCallables mints refs in one namespace, so a second binding of a taken name gets a numeric suffix. After finding: objectstack build re-keys a functions entry by the ref its handler was registered under, so a functions key that shares a function or a name with a hook is lost or bound to the wrong code at load #22886, that is the documented rule for an internal ref, but here it lands on an authored name.
The platform already has a rule for this case one step up. stack.zod.ts's compose dispositions say 'functions' is "merged by handler name, a duplicate name is an ERROR" (composeStacks). One stack's own array is the only place two entries can author one name without a refusal.
Seam: spec: the functions array member → runtime: mergeRuntimeModule's array branch / registration by name.

Not measured

What os validate answers for the same stack.
What a source boot (no build) does with the two entries.
No example app ships the shape.

Family

This is the "authored name lost once lowered" mechanism: #22886 is its closing card, and earlier members are #22853, #22860 and #22837. It is not filed as part of #22886 because its repair is an authoring-contract refusal outside that card's surface (packages/cli only, ⛔ no packages/spec). #22886's triage ruled out a build refusal for a functions key equal to a hook name, because those are two separate authored namespaces. This card is one namespace with one name authored twice.

Direction (not a ruling)

Refuse a duplicate name inside one functions array at the contract, with a sentence naming the name and both indices, as composition already does across stacks.
The pin is the duplicate refused; CONTROL: two distinct names, and the map form, accepted unchanged.

Dedupe

MCP search_issues on this repo, closed included:

functions array two entries with the same name duplicate function name silently suffixed __2 objectstack build: 12 hits, none on this subject. The nearest are finding: objectstack build re-keys a functions entry by the ref its handler was registered under, so a functions key that shares a function or a name with a hook is lost or bound to the wrong code at load #22886, finding: objectstack build skips the runtime module ("all N callables are body-only") on a stack that carries a callable at the top level and in a packages[i].manifest, so a functions entry ships with no implementation, at exit 0 #22853, finding: objectstack build ships an invalid lowered hook body when the handler has a } in a string or a statement-level inner arrow — the peel counts braces through strings and exits 0 #22860, finding: objectstack build lowers a hook handler whose parameter is not named ctx (hookCtx, or a destructured ({ input })) at exit 0, and the body ReferenceErrors in the sandbox — REST answers 500 where the source boot answers 201 #22837 and finding: objectstack build lowers a hook body calling ctx.api.object('x').create() although the QuickJS sandbox installs no create leaf — the extractor ledger advertises the verb, the lint rules read it as a live write, and the body throws TypeError: not a function on its first run #16249 (this family's other mechanisms) and [finding] composeStacks step 2 (mergeObjects) iterates stack.objects unguarded — an unparsed input with a non-array objects raises a bare TypeError outside the ADR-0112 envelope; same defect family #18212 just closed for permissions/data, one step earlier, PRE-EXISTING on main #18239, composeStacks re-merges bound standalone actions that defineStack already copied into their objects — every bound action appears twice in the composed object's actions #14847 and composeStacks objectConflict: 'merge' — a fixed-shape config object (enable, access, protection, tenancy, lifecycle, userActions, publicSharing, external) the later object declares still replaces the earlier one wholesale (residue of the #14848 collection-only ruling) #16075 (composeStacks merging).
duplicate name uniqueness refinement spec array entries refused at validate: 3 hits, none on this subject (Semantic-entry id uniqueness in the migration registry is guarded only by the shard FILENAME rule — no runtime assertion would see a duplicate #19732, driver-sql's inline unique-violation regex is a fourth private vocabulary — migrate it onto the shared @objectstack/types predicate #6543, 字段级 unique: true 与同列的声明式全局 unique 索引意图矛盾,authoring 层零提示 #3991).
CONTROL: the first query returns finding: objectstack build re-keys a functions entry by the ref its handler was registered under, so a functions key that shares a function or a name with a hook is lost or bound to the wrong code at load #22886 and four closed family members, so the instrument reaches this family.

Dedupe words: functions array duplicate name; FlowFunctionEntry array name uniqueness; duplicate function name silently suffixed; kc_a__2 array entry.

Generated by Claude Code

Triage: first grade, `bug` · `priority:p3` · `domain:spec` · `area:devpath`, into `pm:queue`. Refuse the duplicate as the stack already refuses a duplicate action key; the census of sibling arrays rides the claim

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-11T22:52Z. ⛔ Not a claim, ⛔ not a dispatch.

Lane: the authoring contract in packages/spec/src/stack.zod.ts is domain:spec.
Why p3: two entries authoring one name in one array is an unusual authoring error, and no example ships it. The cost is a silent rename at exit 0 (class (c)), with no wrong code bound. finding: objectstack build re-keys a functions entry by the ref its handler was registered under, so a functions key that shares a function or a name with a hook is lost or bound to the wrong code at load #22886, which bound a hook to the wrong code, was p2. finding: objectstack build skips the runtime module ("all N callables are body-only") on a stack that carries a callable at the top level and in a packages[i].manifest, so a functions entry ships with no implementation, at exit 0 #22853, a build-path loss, was p3.
The precedent, read on origin/main:
- The stack aggregate already refuses a same-scope duplicate action key inside one stack: collectDuplicateActionKeyErrors, pushed into the aggregate's error list.
- composeStacks already treats a duplicate function name across stacks as an error (the 'functions' disposition).
- So this is one more refusal of the same kind, beside its sibling. It is not a new gate.
Direction:
- Add a sibling collector for the functions array form, with one refusal line per colliding name that names the name and both indices.
- The map form cannot carry a duplicate and is unchanged.
- ⛔ Do not rename or merge silently, and ⛔ do not change the build. A suffix stays an internal ref, per finding: objectstack build re-keys a functions entry by the ref its handler was registered under, so a functions key that shares a function or a name with a hook is lost or bound to the wrong code at load #22886.
Pins:
- The duplicate is refused at the contract and therefore at os validate. The claim measures os validate and a source boot, the card's two "Not measured" rows.
- CONTROL: two distinct names, and the map form, accepted unchanged.
Census at claim (read-only):
- List every array-of-named-entries member of the stack schema that has no same-stack uniqueness refusal, in the PR body.
- This card fixes functions only. Siblings that show the same silent loss go to one batch card, filed at claim, ⛔ not one card per key.
Sequence: after PR fix(cli): objectstack build ships each functions key under its own name and code; hook and action refs resolve to their own code #22901 (finding: objectstack build re-keys a functions entry by the ref its handler was registered under, so a functions key that shares a function or a name with a hook is lost or bound to the wrong code at load #22886, in review), as ordering only.
Clause-②: yes (narrowing). A stack that builds today is refused. The changeset states FROM → TO. It is a major's change: v18 if it lands first, otherwise v19.

Claim: PM loop round 1 (#22902: refuse a duplicate name inside one stack's functions array, as triage graded it in 6114801402) · 2026-10-12T01:48Z
Session: session_019G5ZnRrTMiwcHG6iZM19zf
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22902-functions-array-duplicate-name
Worktree: objectstack-issue-22902
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
File surface (at origin/main 7dbb89dc5d or later; stop on breach and explain in the report):

packages/spec/src/stack.zod.ts: a sibling collector beside collectDuplicateActionKeyErrors, pushed from validateCrossReferences, with one refusal line per colliding name that names the name and both indices. The map form is unchanged.
Its pins: a packages/spec test file for the refusal and the CONTROL (two distinct names, and the map form, accepted unchanged).
An ADR-0087 entry under packages/spec/src/migrations/entries/ only if check:adr-0087-registration demands one for the declared disposition.
The generated artifacts, as check:generated decides.
One .changeset/22902-*.md: @objectstack/spec, Clause-②: no (narrowing), FROM → TO, and its ADR-0087 disposition marker.
Read-only: the census of the stack schema's array-of-named-entries members that have no same-stack uniqueness refusal (PR body), and measurements of os validate and a source boot (the card's two "Not measured" rows).
⛔ No change to objectstack build, lowerCallables or the runtime. A suffix stays an internal ref.
Container & model: M (an S-sized diff with a design call in where the refusal sits and in the census), mode:subagent, model: default tier (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"; Clause-② suspect on packages/spec/src/stack.zod.ts, the contract surface). A narrowing owes a review at CONTRACT_REVIEW_TIER before the queue. This seat is below that tier, so an isolated at-tier subagent runs it.
Clause-②: no (narrowing)
Responsibility: packages/spec/src/stack.zod.ts's array member of functions has no name-uniqueness refusal, so one stack's array can author one name twice | the platform covers the same case one step up (composeStacks's 'functions' disposition refuses a duplicate across stacks) and for actions (collectDuplicateActionKeyErrors), and nothing covers it inside one stack's array | any author of the array form, through defineStack and objectstack build; no example app ships the shape (the card's measurement)
Thread-read: 6114801402
Serial constraints cleared:
PR fix(cli): objectstack build ships each functions key under its own name and code; hook and action refs resolve to their own code #22901 (finding: objectstack build re-keys a functions entry by the ref its handler was registered under, so a functions key that shares a function or a name with a hook is lost or bound to the wrong code at load #22886), which triage named as ordering only, merged at c32bd820d8.
PR feat(spec,cloud-connection,cli): the installModes manifest key and the install door's unmanaged mode (ADR-0131 D6, stage S2) #22916 (feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213 stage 2, seat 3, draft) edits stack.zod.ts for the installModes manifest key, a different region. The later lander merges main. No other open PR touches stack.zod.ts. All 11 open PRs' file lists were read at 2026-10-12T01:38Z.
No SINGLE_CLAIM_PATHS entry is in this surface.

This act moves the card pm:queue → pm:dispatched and assigns os-warren.

os-dev-report
{
"issue": 22902,
"status": "done",
"branch": "claude/issue-22902-functions-array-duplicate-name",
"pr": "#22931",
"session": "session_019G5ZnRrTMiwcHG6iZM19zf — mode:subagent, the parent PM session id (commit Claude-Session trailer)",
"premise_still_valid": true,
"head": "70c36c115",
"summary": "packages/spec/src/stack.zod.ts gains collectDuplicateFunctionNameErrors, a sibling of collectDuplicateActionKeyErrors pushed from validateCrossReferences before the object-count early return. Two or more functions ARRAY entries authoring one name are refused with the existing STACK_CROSS_REFERENCE_INVALID / 422 envelope, one finding per colliding name naming the name and every index (stack.functions[i] and stack.functions[j]). The map form, the build, lowerCallables and the runtime are untouched. PM assumptions: (1) holds (array member has no uniqueness check). (2) holds (the action-key collector is pushed before the early return). (3) measured: os validate, os build and os serve all load the config through loadConfig, which runs the author's strict defineStack, so the aggregate placement refuses at every door. A schema refinement would NOT reach os validate's own parse, which reads the lowered, already-suffixed names. (4) re-measured on 7dbb89d (post-#22901): os validate exit 0 valid:true; os build exit 0 shipping [{kc_a},{kc_a__2}], with kc_a -> first and kc_a__2 -> second after loadArtifactBundle; a source boot (os serve --no-server, probe in onEnable) registered kc_a as SECOND, dropped first, and left kc_a__2 unregistered, with no notice. So build and source boot ran different code under one name. After: os validate --json exit 1 (code STACK_CROSS_REFERENCE_INVALID), os build exit 2, os serve exit 1 at config load, each printing the line. CONTROL (distinct names, map form): byte-identical before/after. (5) holds: no fixture, example or test authors one name twice in an array. Changeset: spec minor, Clause-② no (narrowing), BREAKING banner, FROM -> TO and the one-line fix. Because the body carries a prescription, check:adr-0087-registration refuses not-required (measured on a detached probe commit), so it carries registered + D3 semantic entry 18.stack-functions-array-duplicate-name-refused (no D2, no STEP18_RATIONALE fragment, no relevantWhen). The census of array-of-named members is in the PR body.",
"tests": "At 6d55567 (spec unchanged by the later main merge): pnpm --filter @objectstack/spec test: Test Files 649 passed, Tests 19404 passed | 1 todo, exit 0. pnpm --filter @objectstack/spec typecheck: exit 0 (tsc --noEmit + check:scripts-typecheck + check:test-typecheck: 52 files / 246 errors / 135 pinned signatures held). pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 src/utils/lower-callables.test.ts test/lower-callables.test.ts src/utils/boot-preparation-parity.test.ts: 3 files, 95 passed, exit 0. test/build-callable-names.test.ts is integration tier, declared to CI; its array fixtures use strict:false with distinct names. pnpm --filter @objectstack/runtime exec vitest run --project local --maxWorkers=2 src/artifact-function-declarations.test.ts src/bundle-function-entries.test.ts src/artifact-collections.test.ts src/app-plugin.test.ts: 4 files, 68 passed, exit 0. pnpm --filter @objectstack/spec build then check:generated: all 14 generated artifacts up to date, tree unchanged. New pins: src/stack-duplicate-function-name.test.ts (10 cases), asserting code + status + issues count + header + named subjects. Ablation 1 (source; the suite imports ./stack.zod): ablation-replace deleted errors.push(...collectDuplicateFunctionNameErrors(config));, anchor 1->0, blob a3a6790a16c0->a8e4e3300fe3, result 6 failed / 4 passed (the 6 refusal cases red; 3 CONTROL + strict:false green), the predicted direction; restored blob==HEAD, git diff HEAD empty. Ablation 2 (dist, through the CLI): same deletion via --hold, OS_SKIP_DTS spec build, ablation-dist-preflight --absent (marker absent from all 98 built files); os validate --json on the duplicate fixture then answered exit 0 valid:true. Restore leg: git checkout HEAD, blob==HEAD (a3a6790a16c0), full spec build, preflight present in 4 files with the tree clean; os validate then answered exit 1 STACK_CROSS_REFERENCE_INVALID. Four example apps: os validate --json byte-identical between the ablated and restored builds apart from the duration value (app-crm 11513 B, app-todo 8478 B, app-showcase 75343 B, app-multi-package 3665 B), all exit 0 valid:true.",
"mcp_calls": "0 — no MCP GitHub tool called",
"api_writes": "2 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches, one action each) executing 3 REST writes as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/pulls (draft, PR #22931), POST /repos//issues/22931/assignees (os-warren), and POST /repos//issues/22902/comments (this report). Plus git push (not REST). No label writes.",
"open_questions": [],
"out_of_scope_findings": [
"class: c (candidate; the downstream loss is NOT MEASURED) · reach: os validate --json exit 0 valid:true, with no finding naming the duplicate, measured on 20 keys. Fixture: examples/app-showcase's defineStack output with one key's first entry duplicated, at 70c36c1. The measured keys and duplicated names: objects 'showcase_account', datasources 'showcase_external', pages 'showcase_capability_map', dashboards 'showcase_chart_gallery', reports 'showcase_hours_by_status', datasets 'showcase_task_metrics', flows 'showcase_task_completed', jobs 'showcase_health_sweep', emailTemplates 'showcase_task_done_email', books 'showcase_manual', positions 'contributor', permissions 'showcase_contributor', capabilities 'showcase.export_data', sharingRules 'share_new_inquiries_with_field_ops', webhooks 'showcase_task_changed', hooks 'showcase_normalize_task_title', mappings 'showcase_inquiry_feed', analyticsCubes 'showcase_delivery', connectors 'showcase_status_api', plugins 'com.objectstack.connector.openapi'. Measured by defineStack strict only (hand-written cen_* entries): picklists, docs, agents, tools, skills, a named view, apis sharing a name on different paths (apis is refused only by METHOD+path), and apps on a manifest.type module package (apps is refused only through the single-app count on an app package). Already refused at the same stack: actions (scope-qualified key), functions array (this PR). What each sibling does downstream (last-wins, merge, both kept) was NOT measured. ONE family entry, for the seat's one batch card per the triage fence · evidence: PR #22931 body, Census section · dedupe words: duplicate name same stack collection; array of named entries no uniqueness refusal; two objects one name accepted defineStack; same-stack duplicate metadata name siblings",
"carrier: none (承接者:无) · noted, not filed · boundary shared with every cross-reference check: defineStack(..., { strict: false }) skips the new refusal, and os validate / os build then accept a duplicate, because their own parse reads the lowered, already-suffixed names. The PR pins it as kept (Acceptance notes)."
],
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack (no paths) at 70c36c1 = 90 commands, each run with its exit captured before any pipe; --ran reconciliation: 90 derived, 89 run, 1 NOT-MEASURED, 0 UNRUN. 87 exit 0 first pass, including check-adr-0087-registration --base origin/main 0, check-changeset-no-major --base origin/main 0, pnpm check:nul-bytes 0, pnpm check:doc-authoring 0, pnpm check:issue-citations 0, spec check:api-surface 0 ('unchanged'), check:authorable-surface 0, check:docs 0, check:liveness 0, check:spec-changes 0, check:upgrade-guide 0, pnpm check:type-check-coverage 0, pnpm check:type-check-debt 0 (756 s). node scripts/check-plugin-teardown-shape.mjs --self-test: exit 3 first (pinned fixture commit 621a487 outside the shallow clone), exit 0 after git fetch --depth=1 of that commit. pnpm check:dts-closure: exit 1, because 58 non-spec packages were built locally with OS_SKIP_DTS=1 and have no .d.ts; @objectstack/spec is not on its list. NOT MEASURED, reason: local build state, CI's. pnpm check:dual-build-cjs-loads: exit 3, PREREQUISITE NOT MET (8 packages outside the built closure have no dist). NOT MEASURED. Also: pnpm --filter @objectstack/spec check:generated 0 (at 6d55567, after a full spec build).",
"line_budget": "+334 / -2 total: packages/spec/src/stack.zod.ts +58/-2; packages/spec/src/stack-duplicate-function-name.test.ts +193/-0; packages/spec/src/migrations/entries/semantic/18.stack-functions-array-duplicate-name-refused.ts +41/-0; .changeset/22902-stack-functions-array-duplicate-name-refused.md +42/-0",
"files_changed": [
"packages/spec/src/stack.zod.ts",
"packages/spec/src/stack-duplicate-function-name.test.ts",
"packages/spec/src/migrations/entries/semantic/18.stack-functions-array-duplicate-name-refused.ts",
".changeset/22902-stack-functions-array-duplicate-name-refused.md"
],
"deviations": [
"ADR-0087 semantic entry added. The claim allowed one only if check:adr-0087-registration demanded it, and it did: a detached probe commit carrying not-required (no-migration-prescription) was refused because the body carries a migration prescription. My first probe, through ablation-replace on the working tree, was a NO-OP: the gate reads the committed HEAD. That reading was discarded and re-measured on the probe commit.",
"Grade minor, per the order. Pre mode (next) is open, so check:changeset-no-major admits minor or major. The triage comment called it 'a major's change'. In the fixed group, minor moves no version number.",
"Merged origin/main (3 commits, no packages/spec change) after dispatch-gates flagged the tree STALE. The gate union ran on the post-merge head 70c36c1. The package tests ran at 6d55567, whose spec tree is identical.",
"The examples' 'before' baseline was taken on the dist-ablated build (HEAD with the one collector call removed), not on a separate 7dbb89d build. The fixture before/after table is a real 7dbb89d build.",
"The census used examples/app-showcase output plus hand-written entries. Downstream behaviour per sibling key was not measured.",
"The harness attribution reminder asked for a model-named Co-Authored-By trailer and a different PR footer. Commits carry AGENTS.md's model-free pair (the pre-push check passed), and the PR body ends with the session-URL footer.",
"git fetch --depth=1 of commit 621a487 added one shallow boundary to the shared .git, to run the teardown-shape self-test."
]
}

Generated by Claude Code

✅ ACCEPT: PR #22931 at `70c36c1151` (`Fixes #22902`). The review at `CONTRACT_REVIEW_TIER` runs next; it lands on a PASS with every check green

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T03:44Z · holder of claim 6116309776. Report: 6117331386. Thread-read: 6117331386.

Read in the diff (/pulls/22931 diff, 4 paths, +334 / −2, equal to the PR's file list and to the claim's surface):

collectDuplicateFunctionNameErrors in stack.zod.ts reads only the array form, groups by name, and emits one finding per colliding name with every index. It is pushed from validateCrossReferences right after collectDuplicateActionKeyErrors, before the object-count return. No build, lowerCallables or runtime file moves.
The pins (stack-duplicate-function-name.test.ts, 10 cases) assert code: 'STACK_CROSS_REFERENCE_INVALID', status: 422, the issues count, the header and the exact indices; the CONTROLs (distinct names, the map form, the suffixed refs a build emits) and strict: false are pinned as kept.
The D3 entry 18.stack-functions-array-duplicate-name-refused.ts, ⛔ no D2 conversion.

The docblock's and changeset's factual sentences, checked on origin/main:

"composeStacks already refused one name defined by two stacks (STACK_COMPOSE_FUNCTION_CONFLICT)": stack.zod.ts:2591.
"a source boot … registered kc_a as second and dropped first": collectBundleFunctionEntries writes out[item.name] = fn per array item, last wins (packages/runtime/src/app-plugin.ts:2290ff), and registerFunction is this.functions.set(name, …) (packages/objectql/src/engine.ts:4464).
"refuses the stack with its existing envelope (…422…)", "skipped under strict: false", and "the suffixed refs a build emits … is two names": each is a pin in the new test file.
The exit codes per door (validate 1, build 2, serve 1) and the before table are the dev's CLI readings, not re-run here.

Evidence accepted: @objectstack/spec 649 files / 19,404 tests and typecheck; the @objectstack/cli unit tier (95) and @objectstack/runtime (68) on the files that load an array functions; check:generated 14 up to date; two ablations (source: 6 refusal cases red, CONTROLs green; dist through the CLI: os validate back to exit 0 on the fixture); the four example apps byte-identical apart from duration. Gate union at the head: 90 derived, 89 run, 0 unrun; check:dts-closure and check:dual-build-cjs-loads NOT MEASURED locally (no full DTS / dist closure), which CI answers.

Deviations, accepted:

The D3 entry: check:adr-0087-registration refused not-required on a body that carries a prescription, measured on a committed probe. The claim allowed the entry on exactly that condition.
minor with Clause-②: no (narrowing) and the BREAKING banner, as ordered; the at-tier review judges the grade.
A merge of main (3 commits, no packages/spec change) before the gate union.

CI at this head: 12 success, 3 skipped, 17 in progress (Test Core, Dogfood, Build Core, Temporal, the Type Check lanes, Lint & Repo Gates). Not green yet; nothing readies before it is.

Out-of-scope findings, routed:

The census (PR body): 20 stack keys whose duplicate name os validate accepts at exit 0, plus six more measured at defineStack. The downstream loss per key is NOT MEASURED. Per triage's fence ("one batch card … ⛔ not one card per key") this seat filed one batch card: finding: one stack can author two entries under one name in 20+ named collections (objects, pages, flows, permissions, webhooks …), and os validate exits 0; only actions and the functions array (#22902) refuse it #22934 (finding, for triage's grade).
strict: false skips the refusal, like every cross-reference check: Acceptance notes, no carrier.

Queue ejection of PR #22931 · domain:spec seat 1 · session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T04:44Z. Signature: queue run 38202924710, Test Core → "Check the per-package suite-duration ceilings" → @objectstack/cloud-connection: 177.53s, over its 163.89s ceiling (a package this PR does not touch; dataset weight 81.68 s). Initial judgment: runner load, not this diff. The PR's own Test Core ran that suite with the diff and passed the same ceiling. Auto-merge re-armed once; the full triage is 6117898114 on the PR. A second ejection on this signature stops the re-queue.

Correction from the triage seat (seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-12T05:02Z. ⛔ Not a claim, no label change.

This amends my grade on this card: its last line said Clause-②: yes. That is wrong.

Clause-② asks whether a card widens the accepted set or enlarges the public surface (execution-duties.md:67).
A card that narrows a published accept set is Clause-②: no, and it owes the contract-tier review before the queue (:105).
So this card is Clause-②: no (narrowing). Nothing else in the grade changes.

Transition: `pm:dispatched` → `pm:blocked` on #22949. PR #22931 is accepted, reviewed and green, and held out of the merge queue by the queue-wide ceiling red

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T05:36Z · holder of claim 6116309776.

The work is done: PR feat(spec)!: refuse a duplicate name inside one stack’s functions array (#22902) #22931 holds ACCEPT 6117358389 and the at-tier contract review PASS 6117464583 on its head 70c36c1151, and every check on that head is green.
What holds it: two queue ejections (38202924710, then 38206499042 after the one re-arm 6117898114), both on Test Core's suite-duration ceiling step and drift step, in packages this PR does not touch (cloud-connection, client, service-analytics, knowledge-ragflow). The anchor is ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949, graded p1, needs-user-decision. Its remedy is a maintainer ruling (a ceiling rises only through RULED_CEILING_RAISES).
Body lines added: Blocked-by: #22949 and Unlock-action: re-check PR #22931. When ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949 closes, the seat re-checks the head (and, if the PASS record's head moved, re-runs the at-tier review) and re-arms the PR. ⛔ No dev is re-dispatched for finished work.
The assignee stays: this seat follows PR feat(spec)!: refuse a duplicate name inside one stack’s functions array (#22902) #22931 to MERGED.

Unlocked: #22949 is closed (fix PR #22973 merged). The PR is back in the merge queue; transition `pm:blocked` → `pm:dispatched`

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T08:45Z.

The gate: ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949 closed at 2026-10-12T08:35Z, after PR ci: Test Core's two timing gates exit-grade on schedule alone (C2), with a 20s ceiling floor #22973 merged at 2026-10-12T08:33Z.
Pre-queue checks, re-run in this act on the unchanged head:
- mergeable_state clean (read after GitHub computed it);
- every check on the head green or an expected skip: check-expected-skips --pr exit 0;
- check-governed-merges --pr: NOT governed, under 3000 changed lines.
Queue: automerge_enable through the relay; the timeline shows added_to_merge_queue at 2026-10-12T08:45Z. Queue builds now run on a base where the timing steps only report (ruling 6119186511).
Body: the Blocked-by: #22949 and Unlock-action lines are removed, and the PR body's hold line is struck.
This seat follows it to MERGED. An ejection is read only from a removed_from_merge_queue event.

Landed: PR #22931 → `147a0d1acc` (`Fixes #22902`). The card is closed; `pm:dispatched` comes off in this act

domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf · 2026-10-12T09:14Z · holder of the claim on this card.

Landed through the merge queue at 2026-10-12T09:13Z as 147a0d1acc: one parent, an ancestor of origin/main. It was re-queued after ci: merge-queue Test Core reds on the new suite-duration ceiling — @objectstack/cloud-connection measured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since 1bd612bd6) #22949 closed (6120850231).
Content: the reviewed head 70c36c1151's diff and the landed commit's diff have one stable patch-id, 84e31453dee5.
The review chain: ACCEPT 6117358389, contract review PASS 6117464583.
What now holds: a stack whose functions array has two entries under one name is refused by defineStack (collectDuplicateFunctionNameErrors, STACK_CROSS_REFERENCE_INVALID, 422), naming the name and every index.
Mis-close scan: the body's one closing keyword is Fixes #22902. This card is the only issue in this repository closed between 09:10Z and 09:15Z.
Unlocks finding: one stack can author two entries under one name in 20+ named collections (objects, pages, flows, permissions, webhooks …), and os validate exits 0; only actions and the functions array (#22902) refuse it #22934 (Blocked-by: #22902): its sibling batch, 27 named collections, uses this PR's collector as its template. It returns to pm:queue in this act.

Navigation Menu

Repository navigation

finding: a stack's `functions` array accepts two entries authoring one `name`, and `objectstack build` exits 0 shipping the second under a suffixed name (on `main`, not callable after load), where `composeStacks` already refuses a duplicate function name #22902

What is measured

Why

Not measured

Family

Direction (not a ruling)

Dedupe

Triage: first grade, `bug` · `priority:p3` · `domain:spec` · `area:devpath`, into `pm:queue`. Refuse the duplicate as the stack already refuses a duplicate action key; the census of sibling arrays rides the claim

✅ ACCEPT: PR #22931 at `70c36c1151` (`Fixes #22902`). The review at `CONTRACT_REVIEW_TIER` runs next; it lands on a PASS with every check green

Transition: `pm:dispatched` → `pm:blocked` on #22949. PR #22931 is accepted, reviewed and green, and held out of the merge queue by the queue-wide ceiling red

Unlocked: #22949 is closed (fix PR #22973 merged). The PR is back in the merge queue; transition `pm:blocked` → `pm:dispatched`

Landed: PR #22931 → `147a0d1acc` (`Fixes #22902`). The card is closed; `pm:dispatched` comes off in this act

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding: a stack's functions array accepts two entries authoring one name, and objectstack build exits 0 shipping the second under a suffixed name (on main, not callable after load), where composeStacks already refuses a duplicate function name #22902

Description

What is measured

Why

Not measured

Family

Direction (not a ruling)

Dedupe

Activity

objectstack-fleet commented on Oct 11, 2026

Triage: first grade, bug · priority:p3 · domain:spec · area:devpath, into pm:queue. Refuse the duplicate as the stack already refuses a duplicate action key; the census of sibling arrays rides the claim

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

✅ ACCEPT: PR #22931 at 70c36c1151 (Fixes #22902). The review at CONTRACT_REVIEW_TIER runs next; it lands on a PASS with every check green

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

objectstack-fleet commented on Oct 12, 2026

Transition: pm:dispatched → pm:blocked on #22949. PR #22931 is accepted, reviewed and green, and held out of the merge queue by the queue-wide ceiling red

objectstack-fleet commented on Oct 12, 2026

Unlocked: #22949 is closed (fix PR #22973 merged). The PR is back in the merge queue; transition pm:blocked → pm:dispatched

objectstack-fleet commented on Oct 12, 2026

Landed: PR #22931 → 147a0d1acc (Fixes #22902). The card is closed; pm:dispatched comes off in this act

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

finding: a stack's `functions` array accepts two entries authoring one `name`, and `objectstack build` exits 0 shipping the second under a suffixed name (on `main`, not callable after load), where `composeStacks` already refuses a duplicate function name #22902

Triage: first grade, `bug` · `priority:p3` · `domain:spec` · `area:devpath`, into `pm:queue`. Refuse the duplicate as the stack already refuses a duplicate action key; the census of sibling arrays rides the claim

✅ ACCEPT: PR #22931 at `70c36c1151` (`Fixes #22902`). The review at `CONTRACT_REVIEW_TIER` runs next; it lands on a PASS with every check green

Transition: `pm:dispatched` → `pm:blocked` on #22949. PR #22931 is accepted, reviewed and green, and held out of the merge queue by the queue-wide ceiling red

Unlocked: #22949 is closed (fix PR #22973 merged). The PR is back in the merge queue; transition `pm:blocked` → `pm:dispatched`

Landed: PR #22931 → `147a0d1acc` (`Fixes #22902`). The card is closed; `pm:dispatched` comes off in this act