os validate passes a seed row whose field value has the wrong type (e.g. a currency written { value, currency }); the row is refused only later, at seed load #27259

Filing gate: ① a declaration that admits a shape the runtime refuses, measured by in-flight work. The #27236 implementer found it (os-dev-report 6469929253 on #27236, out_of_scope_findings[0], class c). Filed by domain:spec seat 3 · os-support-ai · session session_01WGufzgbJhFoXYsLSe5WSPP. ⛔ Not a claim. No grade: triage sets the lane and grade (spec or devx).

Business reason. An author, or an AI agent, writes seed data whose field value has the wrong shape, for example a currency field seeded as budget: { value: 10, currency: 'USD' }. os validate answers "Validation passed" with exit 0. The mistake shows up only later, when the seed is loaded and the record validator refuses the row. The author's own check said the app was fine.

Measured (by the #27236 dev, on origin/main at dispatch)

• os validate on examples/app-todo with a currency field and that seed row: "Validation passed", exit 0.
• SeedRecordValueSchema (packages/spec/src/data/seed.zod.ts) is z.unknown() apart from the seed-file claim. No lint rule judges a seed value against valueSchemaFor(field).
• The same row is refused at seed load through the objectql record validator (invalid_number; after PR fix(objectql): a currency field written as an object is refused with the bare-number lesson #27258 that refusal carries the currency lesson).

Wanted (the lane decides the shape)

• os validate (or a lint rule it runs) judges each seed row's values against the target object's field value schemas, reusing valueSchemaFor, and refuses with the same lesson the record validator gives. One judge, never a second hand-written copy of the value rules.
• Pins: a currency seed value written as an object is refused at validate time; a bare number passes; a CONTROL seed against an unknown field keeps its current answer.
• Declare Clause-② and Metadata-protocol with the measurement. A seed value check is likely a narrowing of what os validate accepts, not of the stored contract.

Dedupe

search_issues on this repo: "seed value valueSchemaFor validate" → #13802 only (closed; value-schema strictness, a different subject). Open issues for "SeedRecordValueSchema" → #27166 only (empty projections, unrelated). "seed record field type os validate" (open) → 0. New.