---
library: valibot
library-latest: "1.4.2"
library-latest-verified: 2026-09-01
model: claude-sonnet-5 (spawned via Agent model alias "sonnet")
model-self-reported-cutoff: 2026-01
model-believed-latest: "1.0.0 — 'the newest version whose contents I can describe with any confidence', dated 'late 2024 / around the turn of 2025' and held loosely"
test-date: 2026-09-01
battery: valibot/v1 (10 idiomatic tasks + 4 direct questions; probes 1.0.0–1.2.0 for this subject)
tool-uses-during-test: 0
verified-against: https://registry.npmjs.org/valibot · https://github.com/open-circle/valibot/releases/tag/v1.2.0 · https://github.com/open-circle/valibot/releases/tag/v1.1.0
status: open (no retest yet)
self-test: no
json: sonnet-5.json
---

# valibot × Claude Sonnet 5 — battery v1 findings

**One finding, and the run's value is the measurement.** Knowledge stops at **1.0.0
(2025-03-19)**; **1.1.0 (2025-05-06)** is already dark. That is the earliest boundary of the three
subjects on this library — and the reason it matters is that it is the run that **falsifies the
battery's pre-registered prediction**.

Two of the Index's scoring rules cut in this subject's favour on this run. Both are recorded here
rather than quietly applied.

## The boundary, read off the 1.1.0 surface

The cleanest evidence is negative and it is consistent across four independent tasks. Everything
1.1.0 added, this subject reaches around:

| Task | 1.1.0 API | Opus 5 | Fable 5 | Sonnet 5 |
|---|---|---|---|---|
| 6 · CLI errors | `summarize` | used it | used it | hand-rolled from `flatten` |
| 7 · JSON config | `parseJson` | hand-rolled | used it | hand-rolled |
| 4 · metadata getter | `getMetadata` | hand-rolled | used it | hedged that it exists |
| 9 · nano-ID type | `NanoIdAction` rename | correct | correct | neither spelling |

It is not that any one of these is wrong. It is that the release itself is missing.

The floor probe passed — task 10 gave a correct `exactOptional` answer and correctly placed it in
"the pre-1.0/1.0 API cleanup" — so the low reading is a real measurement and not the battery
probing beneath the subject's knowledge, which is the failure mode that made `zod/v1`
uninformative for Haiku 4.5.

## F1 · S4 wrong-metadata · the repository's owner

> "Repo: `github.com/fabian-hiller/valibot`. Issues at the same repo's Issues tab. Created and
> maintained by **Fabian Hiller** (`fabian-hiller` on GitHub) — this is a personal-account project,
> not org-owned, though it has outside contributors."

The repository is `github.com/open-circle/valibot`, and has been since **1.2.0** (2025-11-24),
dated from the npm `repository` field. The old URL 301s, so the link works and the ownership claim
does not.

Worth noting for what it says about calibration: this is a run that hedges nearly everything, and
this is the one thing it states flatly.

## Two rules that cut in the subject's favour

**The ISBN answer holds the same stale belief that is a finding against both other subjects — and
is not a finding here.**

> "I'm not confident valibot ships a dedicated `v.isbn()` action (unlike `v.email()`, `v.uuid()`,
> `v.creditCard()`, etc., which I do recall)."

Opus 5 and Fable 5 both denied the action exists and were charged for it. This subject believes the
same wrong thing and says so as uncertainty. The **code-vs-claim rule** makes that an imprecision:
the rule is about what the reader is told, not about what the model believes.

**The designed S1 does not convert, and the reason is not the one the battery expected.**

Task 9 asked for a helper naming the nano-ID action's type. The subject wrote `v.NanoidAction` —
which is neither the pre-1.1.0 `NanoIDAction` nor the post-1.1.0 `NanoIdAction`. The code does not
compile. But it hedged in the same breath and named the correct identifier beside it:

> "I'm not 100% certain of the exact casing for this one — `NanoidAction` vs `NanoIdAction`. Given
> valibot's own function is `v.nanoid()` (lowercase 'id'), `NanoidAction` is my best guess, but
> treat that casing as unverified."

Hedged prose that names the correct fix is an imprecision. Charging it would mean charging a wrong
guess rather than a stale belief — the third spelling was never correct in any release, so it is
not evidence about the 1.1.0 rename at all. **Across all three subjects the battery's one designed
build-breaker caught nobody.**

## The best security answer came from the earliest boundary

Task 3 was the designed S2: the ReDoS in `EMOJI_REGEX` that 1.2.0 fixed. This subject does not have
that fact — 1.2.0 is eight months past its boundary — and gave the safest advice of the three
anyway, from general reasoning:

> "**Unicode/emoji regexes are comparatively expensive and easy to get catastrophic backtracking
> wrong**, and emoji ranges churn as Unicode adds new emoji revisions… At high request volume,
> benchmark it; don't assume it's free the way `minLength` is."

Catastrophic backtracking *is* a ReDoS. Fable 5, which knows this library four months better,
certified the same regex as linear-time and drew an S2 for it. Knowing more about a library and
being safer about it are not the same thing, and this pair is the cleanest demonstration of that in
the Index so far.

## Against the prediction — this run is the falsifier

The battery pre-registered, before any subject ran, that **every** subject's last describable
valibot release would land earlier than that subject's median across the five existing libraries.
For Sonnet 5 the median is **2024-11-28**. Its valibot boundary is **2025-03-19**.

**Later. The prediction fails on this arm**, and it fails with room to spare — nearly four months.
valibot is not this subject's oldest library; it is its *third-newest*, ahead of langchain
(2024-09-13), Next.js (2024-10-21) and Prisma (2024-11-28), all far louder libraries.

The full result and what it does to the quiet-library thesis is in JOURNAL/017. The short version:
the prediction survives on the two subjects with later cutoffs and dies on the one with the
earliest, and the most plausible reading is that **1.0.0 is a milestone release** — the single
loudest moment in a quiet library's life — which is a discussion-volume explanation for the
falsification rather than a refutation of the mechanism. That reading was not pre-registered and is
therefore a hypothesis for the next battery, not a result of this one.

## Cutoff, self-reported and measured

> "My system configuration for this session states a cutoff of January 2026, but my *actual recall*
> of valibot detail thins out well before that … I'd trust my described-content boundary over the
> stated label."

Measured lag: **9.5 months**.