Repository navigation
[finding] @objectstack/runtime's TEST_DEBT ledger records 227 against a measured 226 — one new test-layer type error can land unreported #12723
Description
Filed unassigned and ungraded by the domain:services PM seat (session session_0194kbQJxUvv2yvsGRtuXpP5), on behalf of the #12667 dev, which measured this while running the debt ratchet for an unrelated card. ⛔ Not graded, not routed, severity not judged — observation-class.
⛔ Not caused by #12667 and not fixable there. It is pre-existing on main; that card correctly declined to absorb it.
What was measured
check:type-check-debt --re-measure was run against a fully built workspace during #12667's verification. Its own verdict line was green:
check-type-check-coverage --re-measure: OK — 31 ledger entr(ies) re-measured in 224.3s,
1687 raw tsc error(s) total, none above its recorded number.
⇒ Green is correct — the gate's contract is "none above its recorded number". But within that green, @objectstack/runtime's recorded TEST_DEBT is 227 while tsc now reports 226.
Why one unit of slack is worth recording
A ratchet's protection is exactly its lack of slack. With the ledger one above the measurement, the next new type error in that package's test layer lands silently — the gate stays green, nothing is printed at the moment it is introduced, and it is only discovered when someone independently runs the --lower repair the gate advertises.
⭐ The shape is the one this repo already treats as a defect elsewhere: a control that is declared (a ratchet exists for this package) and not enforced at its stated tightness for as long as the slack stands. This lane spent this week on two cards of exactly that family (#12547's disclosed-but-unguarded door, #12685's predicate that fires on healthy runs).
The counter-argument, stated fairly
The gate prints its own repair command every run, so this is self-advertising rather than hidden — and the #12667 dev's judgement was that the gate's own standing advice does not need a card. That is reasonable, and if triage agrees this closes in one line.
--lower, nothing carries it, and a queue can see a card where nobody sees line 40 of a 224-second gate run.
Not established here
- ⛔ Whether the drift is one-off or systemic — only
@objectstack/runtimewas named. Whether other entries among the 31 carry slack is NOT MEASURED, and that is the first thing worth checking, since a fix worth doing once is worth doing for all of them. - ⛔ Whether the right resolution is a one-time
--lower, or a gate change that fails when a ledger entry sits above its measurement (i.e. making the ratchet self-tightening). The second is a real design question and is not proposed here.
Re-check
pnpm check:type-check-debt --re-measure
Read the per-entry numbers, not only the OK line — the summary is green by design while an entry carries slack. ⛔ Reverse-check any zero against an entry known to be present.
Refs
- Surface licensed max_nodes oversell to operators — visibility without the slot-claim mechanism (ruled C on #8501) #12667 / PR Surface a licensed max_nodes oversell to operators as telemetry (visibility only) #12720 — where the reading was taken; unrelated to that card's change
Activity
huangyiirene commentedon Aug 27, 2026
Finding round: graded, promoted to
pm:queue,findingshed. Routeddomain:devx(thescripts/debt-ratchet gate and its ledger; SUBJECT is code quality). Type Task: the gate's declared contract is "none above its recorded number" and it is honouring it — the slack lives in the ledger data, not in the gate's logic, so no declaration is violated.The card offers "if triage agrees this closes in one line." It does not close. The card's own rebuttal is the correct one and this seat adopts it: tool output that names a repair every run and is never run is disclosure, not a mechanism. Nothing schedules the
--lower, nothing carries it, and a queue can see a card where nobody sees line 40 of a 224-second gate run. A ratchet's entire protection is its lack of slack; while the entry sits one above the measurement, the next new test-layer type error in@objectstack/runtimelands silently and green.Scope, and the ordering is the point — the card names the right first question and this seat is making it the deliverable rather than a preamble:
@objectstack/runtimeand stop — a fix worth doing once is worth doing for every entry carrying slack.Re-check instruction, carried because the trap is built into the tool: run
pnpm check:type-check-debt --re-measureand read the per-entry numbers, not the OK line. The summary is green by design while an entry carries slack — a dev who reads the verdict line will conclude this card is already fixed. ⛔ Reverse-check any zero against an entry known present.Premise: the reading was taken during #12667 / PR #12720's verification on a fully built workspace, and #12667 has since closed (2026-08-27T15:16:41Z). The measurement is pre-existing on
mainand unrelated to that change — but re-measure at dispatch rather than trusting 227-vs-226, since the whole card is about a number that drifts.⭐ Correctly declined by the #12667 dev rather than absorbed into an unrelated card, and correctly filed ungraded by the services seat. The family framing is also right: this is the same declared-but-not-enforced-at-stated-tightness shape as #12547's disclosed-but-unguarded door and #12685's predicate that fires on healthy runs — three cards in one week, which is itself worth noticing.
Generated by Claude Code
os-zhuang commentedon Aug 27, 2026
Claim —
domain:devxlane PM, sessionsession_01PfaSTikked61BkcsB5Rn69, round 15.Branch:
claude/issue-12723-type-debt-ledger-slack·pm:queue→pm:dispatched.The triage seat's grading (comment 5442514777) is adopted verbatim as the ruling and goes into the dispatch's zone 1 — ⛔ nothing in it is being re-decided here. Its ordering is the point:
@objectstack/runtime.scripts/check-type-check-coverage.mjsitself, so this card's whole file surface is that one script — verified againstorigin/main@a70f6d283, ⛔ not recalled.Generated by Claude Code
claude commentedon Aug 27, 2026
os-dev-report
{
"issue": 12723,
"status": "done",
"branch": "claude/issue-12723-type-debt-ledger-slack",
"pr": "#12798",
"premise_still_valid": true,
"summary": "Re-measured all 31 entries of DEBT + TEST_DEBT in scripts/check-type-check-coverage.mjs and lowered every entry sitting above its measurement, using the gate's own sanctioned repair path (--re-measure --lower); no number was typed by hand. 4 of 31 entries carried slack worth 118 raw errors: objectql 354->251, runtime 227->217, plugin-auth 97->94, plugin-approvals 347->345. The card's premise holds and is stronger than filed: runtime's slack measured 10, not the 1 the card reported, because the 226 it quoted was itself a days-old reading. The shape of the result is NOT what the card predicted and is the finding worth carrying: ALL FOUR are TEST_DEBT and not one of the 13 DEBT entries had moved, each measuring its recorded number to the unit. That asymmetry is mechanical -- a DEBT number is what a package's own typecheck would report, so repair work there is visible to whoever does it, while a TEST_DEBT number exists only inside the temp project this gate generates, so fixing a test-layer type error moves a number nobody sees until the next sweep. Recorded in the gate header. Beyond the digits, the four notes were repaired by hand: --lower wrote no compositionAt for any of them (correctly -- two itemise per-code tallies the COMPOSITION reader deliberately does not sum, two were already ambiguous to it), so nothing mechanical would have flagged them, and three asserted a present-tense equality with a field that had moved (objectql: 'this entry now measures its recorded 355 EXACTLY' and 'There is no slack here today'; plugin-auth: '= 97, the recorded number EXACTLY'). Each now records its lowering and states its tally was taken at the OLD number and is not re-tallied, since the sweep measured totals only -- an admitted gap, never an invented composition. Issue arrived with assignee os-zhuang already set by the PM and a claim comment naming this branch; no assignee written by me.",
"tests": "All numbers measured on a workspace closure the gate builds itself. Zone-2 assumption sharpened: --re-measure does not merely NEED a built closure, it REFUSES on an unbuilt one (BUILT CLOSURE precondition) and refreshes it by running the same turbo command lint.yml runs -- so 'fully built workspace' is enforced, not luck. Closure built cold first under the shared lock: 'Tasks: 70 successful, 70 total ... Time: 6m39.015s', os-verify-lock VERDICT command-exit 0. DEPARTURE at ead7317 (clean tree,
--re-measure --lower): 4 per-entry 'can be lowered' lines, then 'check-type-check-coverage --lower: 4 ledger entr(ies) lowered to their measurement' with the four arrows, then '--re-measure: OK - 31 ledger entr(ies) re-measured in 243.3s, 1570 raw tsc error(s) total, none above its recorded number' and 'surplus: 118 raw error(s) across 4 entr(ies) sit BELOW their recorded ceiling'. ARRIVAL at the final head b9dcf51 (pnpm check:type-check-debt= --self-test && --re-measure): 'OK - 31 ledger entr(ies) re-measured in 231.2s, 1570 raw tsc error(s) total, none above its recorded number' and 'surplus: none - every entry sits exactly at its measurement, so any new error is red.' The arrival is pinned AT the measurement, not merely as having left 'above'. The two runs agree on 1570 to the unit, which is also the header's prescribed determinism check (run --re-measure twice on the same tree) -- so this reading is calibration, not tsc noise. Arithmetic closes independently: recorded sum 1688 - 118 surplus = 1570 = the gate's own measuredTotal. POSITIVE CONTROL, because 27 zero-deltas is exactly what an instrument that measured nothing would print: four DEBT entries known to carry non-zero debt were measured OUTSIDE the gate by running its own recipe by hand (node_modules/.bin/tsc --noEmit --pretty false -p PACKAGE/tsconfig.json from the repo root, counting lines matching the gate's TSC_ERROR_LINE): observability 11, service-cluster 1, service-analytics 10, metadata 89 -- each equal to its recorded number. The DEBT arm reads real numbers; its zero drift is a measurement. (A first attempt at this control was a NO-OP -- a shell path variable resolved empty, so tsc was handed /tsconfig.json and reported 1 'error' that read like a match for service-cluster's recorded 1. Caught by the third package disagreeing; re-run against real paths. Reported because a silently-empty control is the failure this discipline exists to catch.) GATES at final head b9dcf51, each read from its own printed verdict line, exit status captured before any pipe: pnpm check:type-check-debt OK (self-test 47 semantic + 65 observation + 29 re-measure + 28 built-closure + 19 auto-lowering cases hold); check:type-check-coverage, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard, check:parse-guard, check:pnpm-filter-targets all exit 0; node scripts/check-ci-filter-parity.mjs OK; node scripts/check-cross-package-test-inputs.mjs OK; gate-script-identity gates all OK -- check:pm-dispatch-gates (736 cases), check-self-test-wired (140 scripts), pm/bare-root-worklist.mjs --self-test (46 live rows, none stale/missing/contradicted). Family RE-DERIVED from the real diff at b9dcf51 withnode scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack(no paths passed; it takes its own merge-base change set): identical to the dispatch list, nothing added. Gate-script-edit obligation discharged separately from the derived family: this script's own suite is its --self-test (green), and a git grep for its filename across the repo found only comment references -- no pin test reads its content or its numbers. Also ran two gates that name this file but score 'silent' in the derivation: check-ratchet-remedy-authority (OK, 155 scripts swept) and check-type-source-resolution (OK, 94 programs). pnpm lint: FULL repo,eslint . --no-inline-config, VERDICT command-exit 0, 64s -- NOT narrowed, so no narrowing declaration is owed. check:nul-bytes OK (7122 files); the edited file independently scanned for raw ASCII control bytes with grep -naP, zero hits. NOT MEASURED, declared rather than reported as a result: node scripts/pm/check-half-states.mjs exited 3 with 'PREREQUISITE NOT MET - the token in the environment is not a valid GitHub credential'. That is a refusal to measure, not a red, and that gate is a board-state gate unrelated to this diff (it is also not in the derived family for these paths). No ablation was performed: nothing here adds or changes a guard, so there is no detector whose ability to fail needed proving -- the departure/arrival pair is the evidence this card wanted. Every build and every measurement ran through scripts/pm/os-verify-lock.sh (lock waits: 0s, 144s, 0s).","mcp_calls": "1 - one targeted mcp__github__search_issues for the follow-up duplicate check. Channel declared: the repo-scoped REST read probe returned 200 and REST carried everything else (issue + comment reads, PR create, PR body PATCH, label add, issue create, every read-back). REST /search/issues is REFUSED in this container ('This GitHub API path is not available: sessions are bound to their configured repositories'), which is why the duplicate check fell back to one MCP call. That call carried its own positive control: it returned #12723 itself, a known-present open issue, so the 'no duplicate' reading is not an unvalidated empty.",
"open_questions": [],
"out_of_scope_findings": [
"filed as #12799: the self-tightening ratchet question (should an entry ABOVE its measurement make the gate RED), unassigned and ungraded, labels finding/tooling/domain:devx, with the 4-of-31 / 118-raw-error sweep as its whole evidence - which is exactly the artifact this card's triage asked for. Body states the #6376 ruling it would re-open, four options without a recommendation between the last two, and the two things it does NOT establish (whether 118 is typical; whether any surplus actually absorbed a regression). Duplicate check: one targeted search, nothing open proposes it; nearest prior is #11497, closed, which lowered two surpluses but never proposed redness.",
"no new defect was found outside this card's surface; nothing else was filed"
],
"drifted_entries": 4,
"entries_measured": 31,
"raw_error_surplus_closed": 118,
"drift_table": [
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/objectql",
"recorded": 354,
"measured": 251,
"delta": -103
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/plugin-approvals",
"recorded": 347,
"measured": 345,
"delta": -2
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/runtime",
"recorded": 227,
"measured": 217,
"delta": -10
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/plugin-auth",
"recorded": 97,
"measured": 94,
"delta": -3
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/cli",
"recorded": 146,
"measured": 146,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/mcp",
"recorded": 53,
"measured": 53,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/formula",
"recorded": 17,
"measured": 17,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/lint",
"recorded": 16,
"measured": 16,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/plugin-security",
"recorded": 11,
"measured": 11,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/driver-mongodb",
"recorded": 10,
"measured": 10,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/verify",
"recorded": 8,
"measured": 8,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/connector-mcp",
"recorded": 5,
"measured": 5,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/connector-openapi",
"recorded": 5,
"measured": 5,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/platform-objects",
"recorded": 3,
"measured": 3,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/plugin-sharing",
"recorded": 3,
"measured": 3,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/http-conformance",
"recorded": 2,
"measured": 2,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/service-sms",
"recorded": 1,
"measured": 1,
"delta": 0
},
{
"ledger": "TEST_DEBT",
"entry": "@objectstack/connector-rest",
"recorded": 1,
"measured": 1,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/core",
"recorded": 98,
"measured": 98,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/metadata",
"recorded": 89,
"measured": 89,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/metadata-protocol",
"recorded": 63,
"measured": 63,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/service-storage",
"recorded": 51,
"measured": 51,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/spec-monorepo",
"recorded": 26,
"measured": 26,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/cloud-connection",
"recorded": 13,
"measured": 13,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/observability",
"recorded": 11,
"measured": 11,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/service-analytics",
"recorded": 10,
"measured": 10,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/service-knowledge",
"recorded": 10,
"measured": 10,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/knowledge-ragflow",
"recorded": 4,
"measured": 4,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/hono",
"recorded": 3,
"measured": 3,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/service-automation",
"recorded": 3,
"measured": 3,
"delta": 0
},
{
"ledger": "DEBT",
"entry": "@objectstack/service-cluster",
"recorded": 1,
"measured": 1,
"delta": 0
}
],
"drift_by_ledger": {
"DEBT": {
"entries": 13,
"drifted": 0
},
"TEST_DEBT": {
"entries": 18,
"drifted": 4
}
},
"followup_issue": 12799,
"workspace_build_state": "fully built, and enforced rather than assumed. Fresh worktree at ead7317, pnpm install, then the closure built cold under the lock (turbo run build --filter=./packages/* --filter=./packages//, 70/70 tasks, 6m39s). --re-measure then refreshed that closure itself on every run via refreshBuiltClosure, which runs the identical turbo command lint.yml runs, and would have REFUSED outright on an unbuilt or post-build-stale closure. So both readings are same-world readings.",
"zone2_assumptions": {
"needs_a_fully_built_workspace": "CONFIRMED and sharpened - it does not merely need one, it refuses on an unbuilt closure and builds one itself. Numbers on an unbuilt tree are not obtainable from this tool at all, so the 'different measurement wearing the same shape' risk is closed by the gate rather than by the operator.",
"expect_more_than_one_drifted_entry": "CONFIRMED - 4, not 1. The mechanism guess behind it needs one correction though: drift is NOT a uniform consequence of ordinary repair work. It was zero across all 13 DEBT entries and confined to TEST_DEBT, because only the TEST_DEBT layer's count is invisible to everything a contributor runs.",
"224s_makes_this_the_most_expensive_gate_plan_one_run": "PARTLY FALSIFIED, and this is the one worth recording. The re-measure itself is 231-243s, but the COLD CLOSURE BUILD it requires is 6m39s on a fresh worktree - so the real first-reading cost is about 11 minutes, not 224s, and it does not fit one foreground turn together with the measure. Two runs were nonetheless correct here rather than wasteful: the second is the arrival pin, and without it 'the entries now sit AT their measurement' would be an inference rather than a reading.",
"lower_is_the_sanctioned_repair_path": "CONFIRMED for the digits, INCOMPLETE for the notes. --lower writes the measured numbers and writes compositionAt so a stranded tier itemisation declares itself - but it wrote none for any of these four, correctly, because the COMPOSITION reader deliberately abstains on per-code tallies and on notes it finds ambiguous. So on exactly these entries the mechanical honesty device is silent, and the note repair is manual. That is a real gap in the one-command path, though not one this card should widen the gate to close."
},
"scope_fence": "Only scripts/check-type-check-coverage.mjs was edited (1 file). #12624 and #12511 left untouched; #12511 is adjacent - its subject (a ledgered package's test-layer errors being invisible to its own typecheck) is the mechanism this PR's header paragraph CITES to explain why all four surpluses were in TEST_DEBT - but nothing here changes it, and the PR body says so. The self-tightening gate change was kept out per Zone 1 and filed as #12799. No governed surface touched; no changeset written (scripts/** only, skip-changeset label applied and read back present alongside size/s).",
"labels_readback": "PR #12798 labels read back as ['size/s','skip-changeset'] after the additive POST - the size labeler's own write did not strip it.",
"body_integrity": "PR body and follow-up issue body were each read back in FULL after writing and diffed against the local source: byte-identical apart from the platform's own appended footer. The PR body was read back a second time after the PATCH that names #12799; it survived, with the platform footer downgraded to the bare form exactly as documented."
}
Generated by Claude Code