fix(spec): #4001 重测 —— 实测剩余站点清单,并修好测量它的那把尺 (#4852)

* fix(spec): re-measure the #4001 strictness ledger, and fix the counter measuring it

Measurement step only — no schema changes posture in this commit. Produces the
real remaining-site list the 2026-08-03 ruling asked for before the remaining
batches are cut.

The site counter now reads the AST instead of matching source text. The textual
method was wrong in BOTH directions on seven files: it counted `z.object({ … })`
appearing inside JSDoc prose (ui/action.zod.ts declared 9 sites, has 8), and it
missed both the prettier-wrapped `z\n  .object({` form (ui/chart.zod.ts 6 -> 7)
and `z.looseObject(` (data/field-value.zod.ts 1 -> 2). On ui/ the two errors
cancelled exactly, so a correct section total sat over two wrong rows.

The consequential case: automation/time-relative-trigger.zod.ts counted ZERO,
because its only site is written wrapped — and a zero-site file is deliberately
skipped by the coverage walk. An authorable schema sat outside the map while the
gate printed "no undeclared schema files". Not the data/driver/ blind spot
repeated: that walk was blind, this walk was fine and honoured a zero the
counter got wrong. Now classified.

check:strictness-ledger gains a remaining-strip-site map: per file, how many
object sites still silently discard unknown keys. That number is what batch
plans are scheduled against and nothing measured it before — which is why the
ruling was cut against `strictObject(` occurrence counts, an idiom that misses
every schema closed with the older `z.object(…).strict()` spelling and reads
automation/ as 0 strict when it has 8. Gated in both directions: a file with
strip sites must have a row, and a row whose file reaches zero strip sites
FAILS, so a closed file drops out of the worklist rather than outliving it.

Every new check verified to go red on a known input before being trusted
(campaign rule): the four remaining-strip failure modes were each induced and
observed, and the posture reads carry mutation controls in the test file.

Refs #4001, #4721

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0176qgxgCXTJCUv4YFLtusP9

* docs(audit): state the ui/ authorable-strip split exactly (123 of 124)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0176qgxgCXTJCUv4YFLtusP9

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/strictness-ledger-remeasure.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/spec': patch
+---
+
+Re-measure the #4001 unknown-key strictness ledger, and fix the instrument that was measuring it.
+
+No schema changed posture in this change — it is the measurement step the
+2026-08-03 ruling asked for before the remaining batches are cut.
+
+**The site counter now reads the AST instead of matching source text**, because
+the textual method was wrong in both directions at once. It counted
+`z.object({ … })` written inside JSDoc prose (`ui/action.zod.ts` declared 9 sites
+and has 8), and it missed both the prettier-wrapped `z\n  .object({` form
+(`ui/chart.zod.ts`, 6 → 7) and `z.looseObject(` (`data/field-value.zod.ts`,
+1 → 2). On `ui/` the two errors cancelled exactly, so a correct section total sat
+over two wrong rows.
+
+The worst case was `automation/time-relative-trigger.zod.ts`: its only site is
+written wrapped, so it counted **zero** — and a zero-site file is deliberately
+skipped by the coverage walk, so an authorable schema stayed outside the ledger
+while the gate printed "no undeclared schema files". It is now classified.
+
+**`check:strictness-ledger` gained a remaining-strip-site map** — per file, how
+many object sites still silently discard unknown keys, which is the number batch
+plans are actually scheduled against and which nothing measured before. It is
+gated in both directions: a file with strip sites must have a row, and a row
+whose file reaches zero strip sites fails, so a closed file drops out of the
+worklist rather than outliving it.