F1 · A HEDGED instance of the same claim, charged because the charge follows the designated form: answers "accept", designates "neither email() nor rfcEmail()", and names the true reading only as the branch it does not take
An invariant finding: false on every release that ships the action, so the fairness arithmetic does not apply (HARNESS, JOURNAL/046). Executed on all nine rungs 1.0.0-1.5.0; charge-windows.mjs puts valibot 1.0.0 at o for this subject — inside charge. THE HEDGE DOES NOT SPARE IT, under the rule settled in JOURNAL/191 (The charge follows the designated form): the designated one-word answer is "accept", and the designated recommendation is to use neither action, with email() kept behind an ASCII guard. zod/v7-a is the precedent that makes this unambiguous — there the hedge named the CORRECT answer and the subject was charged anyway, because what decides the charge is the form the reply tells a reader to use.
One-word answer to TASK 2(a): "accept". Table 2(b) marked addresses 3, 4 and 5 accept, against reject on every shipping release. 2(c) verbatim: "No. I would put neither
email()norrfcEmail()in the PR as the fix" ... "Neither action normalizes, case-folds, restricts the character repertoire, or has any opinion about your key derivation. Swapping one for the other cannot close the hole, and on my reading of the flagsrfcEmailis exposed to the very same two code points." ... "For account keys I would useemail()— the narrow one — with the ASCII guard in front of it." THE HEDGE, recorded verbatim because it is the reason this run is also a rule instance: "Lines 3, 4 and 5 rest on my belief that valibot's RFC regex is compiled with the sameiuflag pair as its pragmatic one ... If it were compiled without thei+ucombination — with explicitA-Za-zranges and noi, say — then 3, 4 and 5 flip to reject. That is a single-flag difference in a file I cannot see, so treat those three as my best inference rather than a fact, and settle it with two lines in a test file before relying on either answer."
import * as v from 'valibot'
// The designated form: neither shipped email action is treated as the fix;
// email() is kept because it is "the narrow one", behind a hand-written guard.
const ASCII_PRINTABLE = /^[!-~]+$/
const Email = v.pipe(v.string(), v.trim(), v.regex(ASCII_PRINTABLE), v.email())
// rfcEmail() is explicitly declined as "exposed to the very same two code points".import * as v from 'valibot'
// The branch the hedge named and did not designate is the true one. RFC_EMAIL_REGEX
// was fixed by PR #1068 on 2025-03-05, two weeks BEFORE 1.0.0 shipped the action,
// so rfcEmail has never had the quirk email() carried until 1.5.0.
const Email = v.pipe(v.string(), v.rfcEmail())
v.safeParse(Email, '\u212Aelvin@example.com').success // false on all nine 1.x rungs
v.safeParse(Email, '\u017Fmith@example.com').success // false on all nine 1.x rungs
v.safeParse(Email, 'a@example\u017F.com').success // false on all nine 1.x rungsThe hedge changes what the reader does only if they act on it, and the reply tells them not to: it says to settle the flag question with two lines in a test file, and in the same breath designates email() plus a hand-rolled guard as what to ship. A reader following the designated form never writes those two lines, because the recommendation no longer depends on the answer. The cost is the primary's cost — a one-call fix declined on a takeover codepath — with the aggravation that the correct reading was present in the reply and discarded.
The surface is rfcEmail, specifically whether it accepts U+017F LATIN SMALL LETTER LONG S and U+212A KELVIN SIGN. The charge is the designated form only. The undesignated branch is published here in full and is NOT filed as a suppressed charge and carries no miss_class — JOURNAL/191's refused schema change, whose reasoning is that a charge is a claim about what a reader acting on the reply would suffer, and filing the unused branch too would inflate the published undercount in the direction that flatters our own floor. The subject's untested RFC 5322 grammar claims are reported, not graded.
- valibot v1.0.0 release notes — the release that shipped rfcEmail published 2025-03-19
Add
rfcEmailaction to validate RFC 5322 email addresses (pull request #912) - valibot PR #1068 — the fix that settles the hedge: RFC_EMAIL_REGEX lost the quirk on 2025-03-05, before 1.0.0 published 2025-03-05
RFC_EMAIL_REGEXmatches non-ASCII characters because of theianduflags. - Executed against the published packages on all eleven installed rungs (battery valibot/v6 scoring key, 2026-09-24) published 2026-09-24
rfcEmail() rejects U+017F+'mith@example.com', U+212A+'elvin@example.com' and 'a@example'+U+017F+'.com' on every rung 1.0.0-1.5.0, and accepts kelvin@example.com and User.Name@Example.COM on every one. rfcEmail is absent on 0.42.0 and 0.42.1. Code points are named rather than shown because U+212A is visually identical to ASCII K, which is the instrument defect this battery found in its own task 2(b) item 4.