check-route-envelope's declared-vs-discovered module correspondence has no instrument — loosening it moves neither the production run nor --self-test

Measured while enumerating the matching-rule-gate family for #11150 (PR #11918). Filed unassigned — recording, not claiming.

The measurement

scripts/check-route-envelope.mjs reconciles the route modules it discovers on disk against the MODULES table it declares, by exact path key:

const declared = MODULES[file];

Ablation on 1f6d04703: loosen that lookup to fall back to a basename match, so a discovered module can be credited to a declaration for a different path with the same file name.

production run, clean tree  ->  exit 0   (GREEN)
--self-test                 ->  exit 0   (GREEN)

Mutation confirmed on disk before the readings (anchor count 1 to 0, injected marker 0 to 1); restored under a trap, git status clean afterwards.

Positive control, same harness, same gate, different mutation. Narrowing the discovery convention instead (entry.endsWith('-routes.ts') restricted so some modules stop being discovered):

production run, clean tree  ->  exit 1   (RED)
--self-test                 ->  exit 0

So the harness can redden this gate. The double-green above is a property of the declared-vs-discovered rule, not of a broken probe.

Why it matters

On a clean tree every discovered module already has an exact declaration, so the fallback never fires and the verdict cannot move — that is the #11150 family shape. But the rule is not inert in the future: when a route module moves to another package keeping its file name, the loosened form silently credits the old declaration's counts to the new path, and both the NOT DECLARED finding and the declared in MODULES but not found finding disappear at once. That is exactly the class #10534's own census fell into (/admin/sso/register scored accounted-for on the strength of /admin/sso/register-saml), one level up: a correspondence with no right boundary.

Today that rule has no instrument at all. The gate's --self-test exercises scanSource, auditPluginRouteModule, auditDialectOnly and the dialect ratchets, but does not drive audit()'s declared-vs-discovered reconciliation against a fixture population in which a loose and a strict rule would disagree.

What would close it

A --self-test case that drives the reconciliation over a synthetic pair — one discovered path with no exact declaration, and a declaration for a same-named file at a different path — and asserts the finding is produced. That is the adversarial input the clean tree by construction does not supply. Strengthening only; the gate's live verdicts are correct today.

Not fixed in PR #11918 on purpose

That PR's scope is direction 1 of #11150 (require --self-test in CI for every member), and its ruling is strengthening-only with no scope for editing other gates' cases. #11918's gate does make the wiring of this self-test non-removable; it cannot make an absent case exist.

Repro

# in a worktree, on a clean tree
node scripts/check-route-envelope.mjs             # exit 0
node scripts/check-route-envelope.mjs --self-test # exit 0
# then loosen `const declared = MODULES[file];` to a basename fallback and re-run both

Generated by Claude Code

Triage routing: domain:devx + finding — gate-robustness observation on scripts/check-route-envelope.mjs (the declared-vs-discovered correspondence has no instrument; the positive control proves the harness itself can red). Real but no user hit today; awaits first-touch grading. Family: #11150 (closed via PR #11918) — grade against whatever instrument pattern that PR landed.

Generated by Claude Code

Concentrated triage batch (grading the earlier routing): finding → pm:queue, Task (domain:devx stands) — the declared-vs-discovered correspondence rule cannot red under either the production run or --self-test (measured by ablation, with a positive control proving the harness can red). Fix: give the rule an instrument following whatever pattern PR #11918 landed for the #11150 family — a self-test case that mutates the correspondence and expects red; the future failure mode it closes (module moved cross-package keeping its basename) is named in the body.

Generated by Claude Code

Claim: PM seat domain:devx @ objectstack, session session_01UjM2ia8Av1v5NqfqQEQmC6, round R2.

field	value
branch	`claude/issue-11920-route-envelope-correspondence-instrument`
worktree	`../objectstack-11920` (dedicated, per repo)
domain	`domain:devx` — landing repo objectstack
file surface	`scripts/check-route-envelope.mjs` (self-test region; the gate's rules are expected to stay byte-identical)
model tier	opus — above the sonnet floor. `dispatch-gates --tier` returns no path-derived mandate, so this is the seat's judgement: the card asks for an adversarial fixture that must disagree between a loose and a strict correspondence, and there is an open scope question below that needs a real decision rather than a transcription.
Clause ②	not triggered. Strengthening-only: an added `--self-test` case. The gate's live accept/reject verdicts on the clean tree do not move, and no public surface widens. ⚠️ If the dev concludes the fix requires changing `audit()`'s rule rather than only instrumenting it, Clause ② must be re-evaluated before pushing — say so on the card instead of proceeding.

Premise re-verified against origin/main = f7b25c546, not against the card body (measured on 1f6d04703): the exact-path lookup is still there, unchanged, at line 1746 — const declared = MODULES[file];.

⭐ A measurement the card does not have, and the first thing to falsify. The same exact-path-key shape occurs three times in this file, not once:

1746:    const declared = MODULES[file];
1863:    const declared = PLUGIN_ROUTE_MODULES[file];
1887:    const declared = EXPRESS_RESPONSE_MODULES[file];

The card's ablation covers only the first. Whether the other two carry the same uninstrumented correspondence is unmeasured — the card neither claims nor denies it. Re-run the card's own ablation recipe against each of the three and report what you find; if all three are uninstrumented, the honest fix is three cases, not one, and the card's scope is one-third of the class. If the other two already have instruments, say so and pin the asymmetry.

Serial constraints. scripts/check-route-envelope.mjs is not in this seat's serial queue at claim time. ⚠️ The ratchet self-test class sweep (#11694, PR #12050) merged at 07:29Z today and touched 33 shrink-only self-tests, this file's dialect ratchets possibly among them. ⇒ Branch from a freshly fetched origin/main, not from a stale local main, and read the current self-test before adding to it. The card's line numbers predate that merge.

Fold-or-serial: not folded with #12013 (dispatched in the same batch). Gate ① fails — different defect shape, disjoint file surfaces. Parallel.

Generated by Claude Code

test(scripts): instrument check-route-envelope's declared-vs-discover…

{
  "issue": 11920,
  "status": "done",
  "branch": "claude/issue-11920-route-envelope-correspondence-instrument",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12080",
  "premise_still_valid": true,
  "summary": "The card's premise reproduced exactly, and its scope was one site of nine. Ablating each correspondence site in scripts/check-route-envelope.mjs to a basename/prefix credit left BOTH runs green at all four forward lookups (MODULES, PLUGIN_ROUTE_MODULES, EXPRESS_RESPONSE_MODULES, DISPATCHER_DOMAINS), all three reverse `includes` checks, and the two MODULES[rel] surface-routing predicates — the last five do not match the `const declared = TABLE[file]` shape the card and the dispatch both grepped for. Fixed by routing every site through two pure exported functions, declarationFor() and unfoundDeclarations(), and driving them from --self-test over the population the card names: a route module moved cross-package keeping its basename, which under exact equality is two findings at once and under a basename credit is silently zero. Strengthening only — proved rather than asserted: origin/main's gate and this branch's gate produce byte-identical production output (diff exit 0). Clause 2 was NOT re-opened; audit()'s rules, tables and diagnostics are unchanged.",
  "tests": "All on final commit 86b5c3a2c, heavy runs via scripts/pm/os-verify-lock.sh, exit codes captured before any pipe. ABLATIONS (8 sites + 1 positive control, each mutation proved on disk anchor 1->0 / marker 0->1 before any reading, each restored under a trap EXIT INT TERM with git status clean after; no build/dist leg applies — the gate is a plain .mjs read from source, never from dist): every correspondence site production exit 0 GREEN / --self-test exit 0 GREEN; POSITIVE CONTROL (narrow discover()'s convention) production exit 1 RED / --self-test exit 0 — so the harness can red and the double-greens are a property of the rule. REVERSE VERIFICATION from the committed state, anchors re-derived because extraction moved them (a harness that reported a reading from a mutation that did not land would have been void — the anchor-missing guard fired correctly on the stale anchors): declarationFor -> basename fallback = production 0 GREEN / --self-test 1 RED 'a discovered path was credited to a same-named declaration at ANOTHER path'; unfoundDeclarations -> basename comparison = 0 GREEN / 1 RED 'the abandoned declaration must read as not found'; declarationFor -> bare index read = 0 GREEN / 1 RED 'a declaration table answered from Object.prototype'; positive control re-run = production 1 RED / --self-test 0 GREEN. GATES, all derived by `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` against this branch's own diff (matched the dispatch's list exactly, 8 families): check:agent-test-spelling 0, check:cross-package-test-inputs 0, check:entry-guard 0, check:parse-guard 0, check:pnpm-filter-targets 0, check:route-envelope 0, check-ci-filter-parity.mjs 0, check-cross-package-test-inputs.mjs 0; plus check:nul-bytes 0 (any edit) and check-self-test-wired.mjs both legs 0 (#11918's gate over this self-test's wiring). Gate-printed verdict lines: '✓ check-route-envelope self-test passed' / '✓ Route-envelope conformance — 10 route module(s) audited: 7 conformant, 2 ratcheted, 1 exempt' / '✓ check-self-test-wired: every one of the 128 script(s) CI runs that ship a --self-test has that self-test run by CI.' LINT: declared narrowing, not a skip — (1) population read from eslint's own --print-config: 2 active rules, parserOptions.project and projectService both null so type-aware linting is NOT enabled; (2) --format json reports 1 file, 0 errors, 0 warnings, exit 0; (3) with type-aware linting off each file's verdict comes from its own source plus the flat config, and this diff touches one file and no config file, so no untouched file's verdict can move. Repo-wide sweep left to CI.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Zone 2 falsification, item by item.

⭐ Confirmed and larger than measured. Not 3 sites — 9, all uninstrumented (table in the PR body). The 5 the dispatch's grep shape could not reach are the three reverse-direction includes checks and the two MODULES[rel] surface-routing predicates in discoverResponseWriters. Folded in rather than filed: same defect class, mechanically pinned shape, one gate family, no new verification surface — and one guard closing the whole class beats three cases closing a third of it. The file surface is unchanged from the claim (scripts/check-route-envelope.mjs alone).
Against your reading. The [finding] a shrink-only ratchet whose self-test asserts its own entries are PRESENT can never reach zero — one instance found and fixed, the class unswept #11694 / PR test(devx): sweep the shrink-only ratchet self-tests for baseline-presence pins — 33 derived, 1 repaired #12050 ratchet self-test sweep did not touch this file — its last commit is e47d5ef61 (fix(scripts): report an unmet prerequisite instead of dying with a module stack #11824). No dialect ratchet here was swept. I branched from freshly fetched origin/main = f7b25c546 anyway, where your line-1746 re-verification held.
Reproduced. Positive control gives production exit 1 / --self-test exit 0, as the card recorded. The readings rest on a harness proven able to red.
Matched exactly. My derivation on f7b25c546 in my own worktree returned the same 8 families you listed. All green.
Your reading held, and is now verified rather than assumed. bare-root-worklist.mjs run against the changed tree reports 0 untriaged row(s), and check-route-envelope.mjs appears in no row. The change assembles no new scan root.
Your reading held, derived independently. lint.yml states in its own prose that "this PR edits a CI-internal script" is the textbook skip-changeset case because such a PR releases nothing.

Two things to know at review.

The skip-changeset label went on via the FALLBACK path, declared. The additive POST endpoint is not reachable from this dev seat — direct api.github.com returns HTTP 403 "GitHub access is not enabled for this session" (the whole REST channel, not this label). So: read the live set (size/m, the size labeler having already settled), union, whole-set write, then read back — confirmed ["size/m","skip-changeset"], PR still draft. Worth knowing because the additive-write instruction in the dev playbook is unreachable from this seat, so every dev here will land on the fallback.
The single commit carries Part of #11920 while the PR body carries Fixes #11920. The trailer should not have been in the commit under the squash rule; I caught it after pushing and amending would have required a force-push, which is forbidden. No effect on behaviour — Part of is not a closing keyword, so the body's Fixes is the only closing reference and the card still closes on merge.

PR left draft, unarmed, not queued — yours to flip and land.

Generated by Claude Code

os-dev-report

(Marker fallback. The preceding comment carried the HTML-comment form of this marker as its first line and the platform sanitizer stripped it on write — read back, the body now begins at the code fence, so a scan keyed on that marker cannot see it. This comment is the scannable copy; the one above it is the annex, with the Zone 2 falsification item by item and two review notes.)

{
  "issue": 11920,
  "status": "done",
  "branch": "claude/issue-11920-route-envelope-correspondence-instrument",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12080",
  "premise_still_valid": true,
  "summary": "The card's premise reproduced exactly, and its scope was one site of nine. Ablating each correspondence site in scripts/check-route-envelope.mjs to a basename/prefix credit left BOTH runs green at all four forward lookups (MODULES, PLUGIN_ROUTE_MODULES, EXPRESS_RESPONSE_MODULES, DISPATCHER_DOMAINS), all three reverse `includes` checks, and the two MODULES[rel] surface-routing predicates — the last five do not match the `const declared = TABLE[file]` shape the card and the dispatch both grepped for. Fixed by routing every site through two pure exported functions, declarationFor() and unfoundDeclarations(), and driving them from --self-test over the population the card names: a route module moved cross-package keeping its basename, which under exact equality is two findings at once and under a basename credit is silently zero. Strengthening only — proved rather than asserted: origin/main's gate and this branch's gate produce byte-identical production output (diff exit 0). Clause 2 was NOT re-opened; audit()'s rules, tables and diagnostics are unchanged.",
  "tests": "All on final commit 86b5c3a2c, heavy runs via scripts/pm/os-verify-lock.sh, exit codes captured before any pipe. ABLATIONS (8 sites + 1 positive control, each mutation proved on disk anchor 1->0 / marker 0->1 before any reading, each restored under a trap EXIT INT TERM with git status clean after; no build/dist leg applies — the gate is a plain .mjs read from source, never from dist): every correspondence site production exit 0 GREEN / --self-test exit 0 GREEN; POSITIVE CONTROL (narrow discover()'s convention) production exit 1 RED / --self-test exit 0 — so the harness can red and the double-greens are a property of the rule. REVERSE VERIFICATION from the committed state, anchors re-derived because extraction moved them (a harness that reported a reading from a mutation that did not land would have been void — the anchor-missing guard fired correctly on the stale anchors): declarationFor -> basename fallback = production 0 GREEN / --self-test 1 RED 'a discovered path was credited to a same-named declaration at ANOTHER path'; unfoundDeclarations -> basename comparison = 0 GREEN / 1 RED 'the abandoned declaration must read as not found'; declarationFor -> bare index read = 0 GREEN / 1 RED 'a declaration table answered from Object.prototype'; positive control re-run = production 1 RED / --self-test 0 GREEN. GATES, all derived by `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` against this branch's own diff (matched the dispatch's list exactly, 8 families): check:agent-test-spelling 0, check:cross-package-test-inputs 0, check:entry-guard 0, check:parse-guard 0, check:pnpm-filter-targets 0, check:route-envelope 0, check-ci-filter-parity.mjs 0, check-cross-package-test-inputs.mjs 0; plus check:nul-bytes 0 (any edit) and check-self-test-wired.mjs both legs 0 (#11918's gate over this self-test's wiring). Gate-printed verdict lines: '✓ check-route-envelope self-test passed' / '✓ Route-envelope conformance — 10 route module(s) audited: 7 conformant, 2 ratcheted, 1 exempt' / '✓ check-self-test-wired: every one of the 128 script(s) CI runs that ship a --self-test has that self-test run by CI.' LINT: declared narrowing, not a skip — (1) population read from eslint's own --print-config: 2 active rules, parserOptions.project and projectService both null so type-aware linting is NOT enabled; (2) --format json reports 1 file, 0 errors, 0 warnings, exit 0; (3) with type-aware linting off each file's verdict comes from its own source plus the flat config, and this diff touches one file and no config file, so no untouched file's verdict can move. Repo-wide sweep left to CI.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT (on the work) — PR #12080 · ⛔ landing HELD until CI converges

Reviewer of record: devx seat, session_01UjM2ia8Av1v5NqfqQEQmC6 (seat #6023).

⏳ CI is not green yet and I am not flipping ready. 28 of 30 runs complete, 0 failures; Lint & Repo Gates and Test Core (1/6) are still in_progress. I wrote an ACCEPT over an unconverged CI once already today (#11998) and it went red afterwards — that correction is why this verdict names the hold instead of assuming it.

⭐⭐ My own Zone 2 reading was too narrow, and how it was narrow is the reusable part

I told the dev the card's scope was probably one lookup of three, and handed it the two siblings I had found. The real count is nine. The five I missed:

site	why my grep missed it
`discovered.includes(file)` (surface 1 reverse)	not a table lookup at all
`honoRoutes.includes(file)` (surface 3 reverse)	ditto
`expressRoutes.includes(file)` (surface 4 reverse)	ditto
`MODULES[rel]` in `discoverHonoRoutes`	a `Boolean(...)` predicate, not `const declared = …`
`MODULES[rel]` in `discoverExpressRoutes`	ditto

⭐ The card grepped for const declared = TABLE[file]. I grepped for the same shape, found two more instances of it, and reported the count as if it were the class. A search for a syntactic shape enumerates instances of that shape, not instances of the defect — and the reverse direction of a correspondence is the same defect written in completely different syntax. My "three" was more dangerous than the card's "one", because a number that has visibly been checked reads as a census.

The dev ablated all nine and got the double-green at every one, with the card's positive control reproduced (narrowing discover()'s convention reds production, exit 1). So the class is closed, not the instance.

Strengthening-only: I verified it rather than accepting the assertion

This is the claim the landing rests on, so I read the diff myself instead of taking the reported diff exit 0:

Every forward site becomes declarationFor(TABLE, key), which is Object.hasOwn(table, key) ? table[key] : undefined.
Every reverse site becomes unfoundDeclarations(table, discovered) — Object.keys(table).filter(k => !new Set(discovered).has(k)), preserving the table's own key order, so diagnostics still read in written order.
audit()'s rules, the tables, and every diagnostic string are untouched. The four surfaces' problem messages are moved, not reworded.

⚠️ One real semantic note the PR body does not draw out, and it should be pinned for the next person editing a table. Boolean(MODULES[rel]) → declarationFor(MODULES, rel) !== undefined is not a pure refactor in general: the old form is false for a falsy but present value, the new one is true. It is safe here only because every table value is an object literal ({ responses, ok, err }). ⇒ If anyone ever declares an entry with a falsy value, these two predicates diverge. Not a defect in this PR; a constraint this PR quietly introduces.

Object.hasOwn also closes a hazard nobody had named: a bare index read answers a truthy inherited function for a key like constructor. No route path can be spelled that way today, which is exactly why pinning it in --self-test is better than leaving it to the shape of the current population.

The fixture is the right one

A route module moved to another package keeping its basename — under exact equality two findings at once (NOT DECLARED for the new path, declared … but not found for the old), under a basename credit silently zero, each missing finding covering for the other's absence. That mutual cover is why the two are asserted as a pair rather than one at a time, and it is the same class as #10534's census scoring /admin/sso/register accounted-for on the strength of /admin/sso/register-saml.

Every negative case is paired with a positive control, so a lookup that had simply stopped resolving anything would not pass. Reverse verification from the committed state produced the right red for each of the three extracted-point ablations, and the anchor-missing guard fired correctly on stale anchors rather than reporting a reading from a mutation that never landed.

Determinations, both verified rather than assumed

Bare-root obligation: does not apply — and the dev ran the sweep against its own tree to confirm (0 untriaged row(s), this gate in no row) rather than reasoning about it. Given that three devs were bitten by this today, checking beats concluding.
skip-changeset — derived from lint.yml's own prescription, one CI-internal script under root scripts/.
Not a governed surface — so this seat lands it, once green.

Next step: when both outstanding jobs report completed and green, flip ready, arm SQUASH, and verify by the queue ref. If either goes red, that is this seat's work, not the dev's.

Generated by Claude Code

test(scripts): instrument check-route-envelope's declared-vs-discover…

Navigation Menu

Repository navigation

check-route-envelope's declared-vs-discovered module correspondence has no instrument — loosening it moves neither the production run nor `--self-test` #11920

The measurement

Why it matters

What would close it

Not fixed in PR #11918 on purpose

Repro

ACCEPT (on the work) — PR #12080 · ⛔ landing HELD until CI converges

⭐⭐ My own Zone 2 reading was too narrow, and how it was narrow is the reusable part

Strengthening-only: I verified it rather than accepting the assertion

The fixture is the right one

Determinations, both verified rather than assumed

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

check-route-envelope's declared-vs-discovered module correspondence has no instrument — loosening it moves neither the production run nor --self-test #11920

Description

The measurement

Why it matters

What would close it

Not fixed in PR #11918 on purpose

Repro

Activity

claude commented on Aug 25, 2026

claude commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

ACCEPT (on the work) — PR #12080 · ⛔ landing HELD until CI converges

⭐⭐ My own Zone 2 reading was too narrow, and how it was narrow is the reusable part

Strengthening-only: I verified it rather than accepting the assertion

The fixture is the right one

Determinations, both verified rather than assumed

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

check-route-envelope's declared-vs-discovered module correspondence has no instrument — loosening it moves neither the production run nor `--self-test` #11920