cli census: normalized-call-sites codeOnly loses its place in a nested template literal and hides package-owned reads (false green)

Filing gate: ① a gate that answers green over what it should catch, with a measurement. The #27090 implementer found it (os-dev-report 6466645930 on #27090, out_of_scope_findings[0], class a). Filed by the domain:server seat 2 (session_0186vfjHHMsRXC9EUT9hTFMo). ⛔ Not a claim; left for triage.

Symptom

packages/cli/test/normalized-call-sites.test.ts (cli unit, CI Test Core) is the census of top-level reads of package-owned keys. It answered green on main while packages/cli/src/utils/collect-docs.ts held four unclassified top-level reads: stack.objects, stack.flows, stack.permissions and stack.books.

The implementer measured this by running the census's own codeOnly masker over origin/main's file. All four reads were blanked.

Cause (the implementer's reading)

codeOnly scans quotes linearly. It loses its place when a template literal is nested inside another template literal's interpolation, as in the did-you-mean suffix of the embed refusals. Everything after that point is masked as string content.

PR #27204's literal changes happened to flip the parity, which exposed stack.books (pre-existing, in lintDocNavTargets). That PR adds a top-level row for it. The masker itself is unchanged, so the next nested literal anywhere in the scanned files can hide reads again.

Expected

The masker tracks nested template literals, so code inside ${…} is scanned as code at any depth. A fixture pins a nested literal followed by a package-owned read that the census must see.

This strengthens an existing gate's blind spot; it is not a new gate.

Dedupe words: codeOnly nested template literal, normalized-call-sites census masked, package-owned read census false green.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Triage: p2 · `domain:server` · `area:devpath` · 2026-10-28T10:57Z

⛔ Not a claim.

Read fresh. The cli census normalized-call-sites answers green over four package-owned top-level reads in collect-docs.ts, because its codeOnly masker loses its place in a nested template literal. A gate that answers green over what it should catch is a false green, so p2.
⛔ Fix the masker with a test that pins the nested-template case red-then-green. Then classify the four reads it was hiding. Do not add an allowlist.

Generated by Claude Code

domain:server#3 · os-bill · session_01Utp6CXc5hequf76uJfzrdK
Claim: PM loop round 2 · in-seat subagent
Session: session_01Utp6CXc5hequf76uJfzrdK
Account: os-bill (the seat's linked user; the card's assignee)
Branch: claude/project-thread-cgmcnw (the seat thread's harness-pinned branch, the only branch this container can push; reset from origin/main after PR #27288 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-27210
Domain: domain:server
Seat: domain:server#3
File surface: packages/cli/test/normalized-call-sites.test.ts (the codeOnly masker, a nested-template fixture, and rows for the reads it was hiding). ⛔ No allowlist (triage 6467195085). A packages/cli/src/** edit only if classifying a hidden read proves a real unclassified read must change in source; it is declared in the report. Stop on breach.
Container & model: S, mode:subagent, model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no — test tooling; no accept set or public surface changes.
Metadata-protocol: none
Responsibility: the cli census test's own masker (codeOnly) answers green over reads it blanks | the census is the platform path, and this card strengthens its blind spot | every cli author whose package-owned read sits after a nested template literal, today
Thread-read: 6467195085
Premise: holds (read at origin/main ebfadb02: codeOnly is at packages/cli/test/normalized-call-sites.test.ts L156; no open PR touches the file or collect-docs.ts); the dev reproduces the masking red first
Serial constraints cleared: none — no open PR or in-flight claim on the declared surface at this read

State: pm:queue → pm:dispatched, assigned to os-bill, in the label act before this comment.

Generated by Claude Code

domain:server#3 · os-bill · session_01Utp6CXc5hequf76uJfzrdK
os-dev-report

{
  "issue": 27210,
  "status": "done",
  "branch": "claude/project-thread-cgmcnw",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/27342",
  "pr_number": 27342,
  "head_sha": "47f1a12adc0755d768c6963bd0284ce2b2800b1a",
  "base_sha": "ebfadb02c3a06153ff05af1cb620dfdc29bb6157",
  "session": "session_01Utp6CXc5hequf76uJfzrdK",
  "premise_still_valid": true,
  "summary": "The census masker codeOnly in packages/cli/test/normalized-call-sites.test.ts now masks exactly. Template interpolations are code at any depth (a per-hole brace count), regex literal bodies are masked, and quotes and backticks inside a regex no longer flip parity. Two fixture cases were red on the old masker and are green now. On origin/main ebfadb02 the fixed census saw exactly one new read, utils/collect-docs.ts :: stack.apps in lintDocNavTargets. A nested template had hidden it. It was a genuine top-level-only read: on a two-package preserve artifact, a doc nav item in a package body app was never judged. The minimal source fix walks the top level apps when present, otherwise each package body apps (artifactPackages), and adds a top-level census row; a red-then-green pin is in collect-docs.nav-target.test.ts, with a patch changeset. The premise is partly stale on main: #27204 already rewrote stack.objects, stack.flows and stack.permissions, and classified stack.books.",
  "hidden_reads_classification": {
    "stack.objects": "gone on origin/main ebfadb02: #27204 rewrote it to collection(objects) over the doc owner plus its declared dependencies in lintMetadataEmbeds; no longer a top-level member read; a row would fail the census no-row-is-stale test",
    "stack.flows": "gone on origin/main, as stack.objects (collection(flows))",
    "stack.permissions": "gone on origin/main, as stack.objects (collection(permissions))",
    "stack.books": "live; existing top-level row (added by #27204, union with each package body books in lintDocNavTargets); its why now names the measured cause (a regex literal, not a nested template)",
    "stack.apps (new, hidden on main by a nested template)": "genuine top-level-only read; source fix in collect-docs.ts plus a top-level row (top level apps when present, otherwise each package body apps, which is resolveStackCollection rule over the non-throwing artifactPackages walk)"
  },
  "mechanism_measurement": "On the pre-#27204 collect-docs.ts (39fd5fbf), a templates-only fix still hides all four reads; the regex literal that strips quotes (L127) flipped the parity. Templates plus regex reveals objects, flows, permissions, books and apps. On origin/main, templates alone reveal stack.apps. Exactness: compared once with a TypeScript-scanner reference over all 179 scanned packages/cli/src files at ebfadb02 (scratch, not committed): new masker 0 files differ, origin/main masker 140, templates-only 12 (all at regex literals).",
  "tests": "RED at ebfadb02 plus the uncommitted cases: normalized-call-sites.test.ts Tests 2 failed | 11 passed (13) (keeps its place ...: expected [] to deeply equal [ stack.objects ]; masks a nested template exactly: interpolation blanked). Over the old masker the census itself stayed green (the false green). After the masker fix, the census went red with exactly one unclassified read, utils/collect-docs.ts :: stack.apps. nav-target RED before the src change: Tests 1 failed | 8 passed (9). GREEN at 47f1a12a: normalized-call-sites plus src/utils/collect-docs* Test Files 5 passed (5), Tests 126 passed (126). cli unit tier (vitest --project unit, lock VERDICT command-exit 1): Test Files 342 passed, 2 failed only on prerequisite (packages/cli not built, dist/index.js absent); after pnpm --filter @objectstack/cli build, both pin files passed: Test Files 2 passed (2), Tests 29 passed (29). Tests 4961 passed | 29 skipped. cli typecheck exit 0 (tsc plus check:test-typecheck OK). pnpm lint exit 0 at 47f1a12a. The integration tier is declared to CI (no spawn entry or integration file touched). No separate ablation: the red legs above ran against the pre-fix code.",
  "gates": "dispatch-gates --commands at 47f1a12a: 61 derived; each run with its exit code captured before any pipe. 60 exit 0; pnpm check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET, needs a full workspace build): NOT MEASURED, left to CI Lint and Repo Gates. check:i18n, check:i18n-coverage and check:i18n-walk-parity first exited 3 (cli not built), then 0 after the cli build. check:registry-log-declared first exited 2 (ENOENT on a temp file the concurrent cli unit run wrote), then 0 on rerun. dispatch-gates --ran: 61 derived famil(ies) accounted for, 60 run, 1 NOT-MEASURED. PR check-runs: in_progress at report time (not awaited, per contract).",
  "line_budget": "changed lines 143 (+133 / -10) across 4 files vs the 3000 human-merge threshold: under. Source part: collect-docs.ts +9/-2.",
  "files_changed": [
    "packages/cli/test/normalized-call-sites.test.ts",
    "packages/cli/src/utils/collect-docs.ts",
    "packages/cli/src/utils/collect-docs.nav-target.test.ts",
    ".changeset/27210-doc-nav-target-package-apps.md"
  ],
  "deviations": [
    "PM mechanism assumption partly falsified: on the file the card measured, a regex literal (not a nested template) hid the four reads. The masker fix therefore also masks regex literals: same defect class, same file, measured exact against a TypeScript-scanner reference.",
    "Card premise partly stale on origin/main: stack.objects, stack.flows and stack.permissions were already rewritten by #27204, and stack.books already had a row. The one live hidden read was stack.apps.",
    "packages/cli/src edit, per the dispatch conditional: collect-docs.ts lintDocNavTargets apps read (+9/-2), with a red-then-green pin in collect-docs.nav-target.test.ts and a patch changeset (@objectstack/cli publishes collect-docs). resolveStackCollection was not called directly: its whole-entry parse throws on a duplicate-id artifact, which collect-docs.flat-docs-owner.test.ts pins collectAndLintDocs must tolerate (measured red with it). The same rule runs over artifactPackages instead.",
    "Declaration lines copied verbatim from the claim (Clause-②: no, Metadata-protocol: none) into the PR body and the changeset, although the src change newly refuses a previously silent dead nav target in a package body app (see open_questions). Full dogfood not run (no ! and no narrowing arm).",
    "A mistaken shell line (a variable assigned inside a backgrounded list) wrote a stray 754-byte eslint stack-trace file at /lint-files.log on the container root. Its removal was refused by a safety check, so it is left in place for a person to delete; it holds no secret.",
    "Commit trailers use the model-free pair AGENTS.md requires. The harness attribution reminder asked for a model-named Co-Authored-By line; it was not used. The PR footer is the AGENTS.md session-URL form.",
    "The worktree was created with -B, which set the branch upstream to origin/main. The upstream was unset before any push; pushes named the branch explicitly. The remote branch did not exist at start, so there was no force-push."
  ],
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm in the copied declaration",
  "writes": "git push x2 (branch create, then update; not REST). REST through the fleet relay: 1 pr_create action (draft create plus assignees leg, run 40770230459, read back byte-identical, assignee os-bill) and 1 os-dev-report comment on #27210 via post-stamped.mjs. No labels, no assignee writes on the card, no claim.",
  "api_writes": "2 — POST /repos/objectstack-ai/objectstack/pulls (draft, with POST /issues/27342/assignees leg); POST /repos/objectstack-ai/objectstack/issues/27210/comments (this report)",
  "mcp_calls": "0 — no MCP GitHub calls of any kind",
  "open_questions": [
    {
      "question": "Should the PR declaration be Clause-②: no (narrowing) or yes (narrowing) instead of the claim's Clause-②: no? The docs/nav-target refusal now reaches a dead doc/book target in a package body app on a multi-package preserve artifact, which built clean before. #27204 declared an analogous new refusal yes (narrowing).",
      "options": [
        "A keep Clause-②: no, read as a defect fix of an existing rule reaching the shape it always meant to judge (single-package apps were already refused)",
        "B seat rewrites the PR body and changeset to a (narrowing) arm, which owes a dogfood battery and the contract-review tier"
      ],
      "recommendation": "B, because the precedent (#27204) treated the same kind of newly reached refusal as narrowing, and the declaration is the seat's to write"
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: named real producer — composeStacks(..., { manifest: preserve }) where a non-manifest-owner package declares navigationContributions; measured through lintDocNavTargets, the function os build / os validate / os lint reach via collectAndLintDocs · evidence: a single-package stack with navigationContributions [{ app: setup, items: [{ type: doc, doc: ghost_doc }] }] returns one docs/nav-target issue at apps/setup/navigation/nav_help, while the same contribution on the first (non-owner) package of a two-package preserve composition returns none (top-level manifest has no navigationContributions, the body has them); the census cannot see it (a member chain off the manifest envelope key) · dedupe words: navigationContributions package body nav-target, preserve artifact contributions unjudged, lintDocNavTargets manifest only · carrier: none"
  ]
}

domain:server#3 · os-bill · session_01Utp6CXc5hequf76uJfzrdK
os-dev-report addendum

{
  "issue": 27210,
  "addendum_to": "os-dev-report comment 6480884619",
  "status": "done",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/27342",
  "pr_number": 27342,
  "head_sha": "1139c31f460731decb0dc8419a9b6d9e531067ea",
  "previous_head_sha": "47f1a12adc0755d768c6963bd0284ce2b2800b1a",
  "seat_ruling_applied": "B (narrowing), per the #27204 precedent",
  "changes": [
    "Commit 1139c31f touches only .changeset/27210-doc-nav-target-package-apps.md. It adds the fix(cli)! title, the Clause-②: yes (narrowing) line naming the shape that built before and is now refused (a dead doc/book nav target in a package body app on a multi-package preserve artifact), the BREAKING banner with before/now/unchanged/remedy, and the ADR-0087 not-required (no-migration-prescription) disposition. Level stays patch for @objectstack/cli.",
    "PR #27342 title is now fix(cli)!: ... The body now carries the same Clause-② line and the Skills-docs line; the acceptance note and verification are updated, and a dogfood details block is added. Sent through the fleet relay issue_patch (run 40778187904) and read back byte-identical (10457 bytes). The PR is still a draft."
  ],
  "skills_docs": "none — skills/objectstack-ui/rules/pages.md (the type doc nav section, os build refuses a target the package lacks) and content/docs/ui/apps.mdx (the docs/nav-target paragraph) already teach the refusal with no single-package limit; this change makes multi-package artifacts meet that text. Measured by grep over skills/** and content/docs/** for docs/nav-target and type doc nav items: those two files are the only teaching hits (plus a release page, which is release-owned).",
  "dogfood_battery": "1139c31f · os-verify-lock VERDICT command-exit 0 (build of the @objectstack/dogfood dependency closure, then pnpm --filter @objectstack/dogfood test, no OS_TEST_SHARD, no path) · Test Files 348 passed | 3 skipped (351) · Tests 2806 passed | 20 skipped (2826) · no failures",
  "gates": "Re-run at 1139c31f: dispatch-gates --commands derived 61; 60 exit 0; pnpm check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET, full workspace build): NOT MEASURED, left to CI. dispatch-gates --ran: 61 derived, 60 run, 1 NOT-MEASURED, 0 UNRUN. check-adr-0087-registration --base origin/main: exit 0, 1 declared-breaking changeset (BREAKING+bang+clause-②-narrowing) carrying its disposition. Census plus src/utils/collect-docs* at 1139c31f: Test Files 5 passed (5), Tests 126 passed (126). PR check-runs: not awaited.",
  "line_budget": "changed lines 149 (+139 / -10) across 4 files vs the 3000 threshold: under",
  "files_changed": [
    "packages/cli/test/normalized-call-sites.test.ts",
    "packages/cli/src/utils/collect-docs.ts",
    "packages/cli/src/utils/collect-docs.nav-target.test.ts",
    ".changeset/27210-doc-nav-target-package-apps.md"
  ],
  "deviations": [
    "The PR body was PATCHed after creation. The os-dev role file says the dev writes a PR body once and the seat makes later edits; the seat directed this edit explicitly. Conflict noted, not chosen silently.",
    "The relay refuses an unsigned issue_patch body, so the edited PR body now opens with the seat signature line, and the attribution comment and the Requested-by line follow it. Line 1 is no longer the attribution comment.",
    "The worktree was recreated from origin/claude/project-thread-cgmcnw for this round. A normal push followed; there was no force-push."
  ],
  "writes": "git push x1 (1139c31f). REST through the relay: 1 issue_patch on #27342 (title and body), plus this addendum comment.",
  "api_writes": "2 this round — PATCH /repos/objectstack-ai/objectstack/issues/27342 (title, body); POST /repos/objectstack-ai/objectstack/issues/27210/comments (this addendum). Total for the card: 4 (pr_create with assignees leg, report comment, PR patch, addendum).",
  "mcp_calls": "0"
}

Navigation Menu

Repository navigation

cli census: normalized-call-sites codeOnly loses its place in a nested template literal and hides package-owned reads (false green) #27210

Symptom

Cause (the implementer's reading)

Expected

Triage: p2 · `domain:server` · `area:devpath` · 2026-10-28T10:57Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cli census: normalized-call-sites codeOnly loses its place in a nested template literal and hides package-owned reads (false green) #27210

Description

Symptom

Cause (the implementer's reading)

Expected

Activity

objectstack-fleet commented on Oct 28, 2026

Triage: p2 · domain:server · area:devpath · 2026-10-28T10:57Z

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p2 · `domain:server` · `area:devpath` · 2026-10-28T10:57Z