[finding] ADR-0087's no-migration-prescription detector missed a FROM -> TO line again — an exemption the categories inherit can be held by silence, and #8299 closed the category gap, not this one #18745

Activity

1. huangyiirene

   added

   finding

   on Sep 17, 2026
2. os-bill

   added

   pm:dispatched

   and removed

   pm:queue

   on Sep 17, 2026
3. os-bill

   self-assigned this

   on Sep 17, 2026
4. os-bill commented on Sep 17, 2026

   

   os-bill

   on Sep 17, 2026 – with Claude

   Collaborator

   More actions

   Claim: PM loop round 17
   Session: session_01JbZnqu8bt6YqfJsr9vaFb3
   Branch: claude/issue-18745-adr0087-prescription-detector-miss
   Worktree: objectstack-issue-18745
   Domain: domain:spec
   Seat: domain:spec#2(座位贴 #18549)
   File surface: scripts/check-adr-0087-registration.mjs —— ⚠️ 开放并预先申报:.changeset/*.md 与门禁反向要求的派生物。只读:packages/formula/src/types.ts(卡面点名的那条 FROM → TO 现场)· PR #18736 的 changeset(stop on breach; explain in the report)
   Container & model: M, mode:subagent, model: default judgement tier
   Clause-②: no
   Thread-read: 5719695058
   Serial constraints cleared: ⏱️ 本行读数取自本评论同一动作,2026-09-17T22:51Z。本席对当时全部 26 个 open claude/issue-* PR 逐个拉 /pulls/N/files 实测:scripts/check-adr-0087-registration.mjs 与 packages/formula/src/types.ts 的持有者各 0 个。⭐ 亮控:已知被 #18817 持有的 scripts/check-cross-package-test-inputs.mjs 读出 [18817] ⇒ 仪器活着。⚠️ 另有一张卡 #18494 面向同一个文件(check-adr-0087-registration.mjs 的复合名词标签)—— 它未派,本席刻意不同时派,谁先落地谁排前。

   ---

   ⛔ 先把不是缺陷的那一半划清

   卡面自己说得很清楚:这不是 PR #18736 的缺陷 —— 那张 PR 的豁免建立在四条正面验过的谓词上,门禁也打了 -- verified。复发的是仪器,⛔ 不是那次判决。 所以本卡不要去翻 #18736 的账。

   要收的东西

   ADR-0087 的 no-migration-prescription 检测器又一次漏掉了一条 FROM → TO 行 ⇒ 一个靠沉默拿到的豁免可以被各分类继承下去。⭐ 门禁自己的文件头(scripts/check-adr-0087-registration.mjs:204-214)已经把这个形写下来过:那次论证「correct and it was accepted」,但它是 PROSE、靠手判、并且骑在 no-migration-prescription 上。

   本席答不了的三件,写成给 dev 的问题,⛔ 不写成栅栏

   1. ⭐ 这次漏的是哪一条拼法? 卡面点了 packages/formula/src/types.ts 作现场。⛔ 本席没有把它与检测器现有的四个分支逐一比过。⇒ 请把漏掉的那条拼法与它本该命中的分支并排打出来。
   2. ⭐ 门禁头部记载的那次 fix(service-package): classify a publish driver fault as 5xx and stop returning driver text as caller data (#8131) #8277 漏检,与这次是同一个洞还是两个? ⛔ 本席未测。⇒ 若是同一个,修法要覆盖两次;若是两个,说清楚差别。
   3. ⭐ 收紧后会不会把既有 changeset 判红? ⛔ 本席没测过当前 stock 里有多少条会被新分支命中。⇒ 先取改动前读数;若会红,⛔ 不要顺手改别人的 changeset,把读数交回来由本席定先后。

   验收上必须有的两个控

   • ⭐ LIT(行为翻转):拿这次漏掉的那条真实文本,给出改前检测器不认、改后认得的并排读数。⇒ 翻转才是证据,⛔ 「门禁还是绿的」不是。
   • ⭐ DARK:检测器本来就认得的那几种拼法(门禁自测里已有的),判定改前改后不变;并给出自测用例数的改前/改后。

   声明与 changeset

   Clause-②: no —— 只动仓内门禁脚本。changeset 用实测发布字节定(scripts/ 大概率不发布),⛔ 不从路径推。
   ⚠️ 正文首行 Fixes #18745;Clause-②: 行放在某一行的行首即可。
   ⚠️ 正文只写一次 ⛔ 不 PATCH;提交信息 ⛔ 不带卡片 trailer 且 trailer pair 必须 model-free;标签走 scripts/pm/label-write.mjs;PR 开成 draft。
   ⚠️ 判据小心 POSIX ERE:[^\n] 在方括号内无转义,意为「不是反斜杠、也不是字母 n」,会读出假零 —— 本班已有三名 dev 踩到同族。每个判据自带非零对照。
   ⚠️ 卡面行号可能已陈旧:本班已有三张卡的行号在 main 上移位过。按符号锚,并在报告里给出你实际读到的位置。

   ---

   Generated by Claude Code
5. os-bill

   added a commit that references this issue on Sep 17, 2026

   docs(lint): record the #18745 retirement-arm repair in the gate header

   ...

   778d77b
6. os-bill commented on Sep 17, 2026

   

   os-bill

   on Sep 17, 2026 – with Claude

   Collaborator

   More actions

   os-dev-report
   {
   "issue": 18745,
   "status": "done",
   "branch": "claude/issue-18745-adr0087-prescription-detector-miss",
   "pr": "#18834",
   "session": "session_01JbZnqu8bt6YqfJsr9vaFb3",
   "premise_still_valid": true,
   "summary": "The card's premise verified on origin/main and holds. Q1: the missed spelling is **Migration - api: { ... } -> delete the property.** in .changeset/18318-evalcontext-no-query-api.md, and the branch that should have caught it is branch 2 (framed-line). It failed on exactly ONE predicate: MIGRATION_FRAMING_RE true, arrow present, FROM side a proper OPERAND, but REWRITE_RE needs an OPERAND on BOTH sides and delete the property is an instruction, not a name. Q2: DIFFERENT holes. #8277's prescription (read result.driverFault?.messagewhere you readresult.error``) has no arrow and no rewrite pair at all -- it is the IMPERATIVE-SENTENCE residue this gate's own header already lists as deliberate, it stays null after this change, and RM11/RM12 pin that so a later author widening toward it meets a red test. Q3: the tightening moves exactly ONE row in the 414-changeset stock -- 18318-evalcontext-no-query-api.md, null -> framed-removal -- and that changeset holds not-required (runtime-interface-only ...), a category that inherits the refusal, so it WOULD be refused if re-judged. It is not judged today (this gate judges only changesets a diff adds or modifies, and this PR touches none; the live gate is green). That reading is handed back, NOT acted on: no other author's changeset was edited. Fix: a RETIREMENT arm under exactly the framing branches 2 and 3 require, held back and consulted LAST so the function is structurally arrowBranches ?? framedTable ?? headerFramedTable ?? framedRemoval. Anchors as actually found: findMigrationPrescription at :1562 on origin/main (:1685 on the branch); the card's :204-214 header paragraph is NOT stale -- it opens at :204 on origin/main and still does here.",
   "tests": "LIT (behaviour flip on the REAL missed text, via the gate's own exported findMigrationPrescription over all 414 .changeset/.md): BEFORE 28 hits {framed-line:1, from-to-label:25, header-framed-table:2}; AFTER 29 hits {framed-line:1, from-to-label:25, header-framed-table:2, framed-removal:1}; the verdict table diff is exactly one row -- `null 18318-evalcontext-no-query-api.md` -> `framed-removal 18318-evalcontext-no-query-api.md`. End to end through scan(): RM-E2E1 refuses the card's own claim shape with `Evidence (framed-removal)`, and RM-E2E1b accepts the SAME runtime-interface-only claim on the SAME symbol with the removal sentence removed (the control that makes the red attributable to the line). DARK: the other 413 rows are byte-identical and every pre-existing branch keeps its count (framed-line 1, from-to-label 25, header-framed-table 2); the superset property is structural (the new hit is consulted last), not remembered. Self-test case counts: 384 -> 405 assertions, exit 0 both times; two new batteries declared with floors (RM E2E 9 cases, RM1-RM12 12 cases). VOCABULARY derivation: over 5524 unique historical .changeset/.md blobs, framed arrow lines whose right side is not an operand number 3; every candidate width tried (bare imperatives; +unset/omit; +none/nothing; +past participles; +the Chinese arm) flags the SAME 2 changesets and no others, both genuine removal prescriptions -- zero false positives at any width, so the narrow class ships. ABLATION (committed first, mutated on disk, restored and proven): HEAD blob 84cce40d0ce2b3cbd0aaa51269b91fe37ba8ed82; anchored counts 1/0 before, 0/1 after; post-mutation blob 6d8d731286f2d643873ce63658b55959bec9a3bc; ablated self-test exit 1 with 16 failures NAMING RM-E2E1, RM-E2E2, RM1, RM2, RM3 plus the new framing-scan-rot control firing on the live run; restored blob byte-identical to HEAD with `git diff HEAD` empty; restored self-test exit 0, 405 assertions. No dist/ leg: node reads the script directly and no package builds it. GATES: derived with scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack -> 32 commands, all run: 31 exit 0. The 32nd, pnpm check:pm-dispatch-gates (two chained batteries), hit my 480s window -> exit 124 = TIMEOUT = NOT MEASURED, not a red; re-run alone, node scripts/pm/check-dispatch-gates.mjs is exit 0, 1809 cases, 535.2s on this box. Key gates re-run at final head a443fc3 after the last commit: adr-0087 --base origin/main, scripts-symbol-anchors, self-test-wired, declaration-mirrors, comment-mask-corpus, nul-bytes, changeset-gate-self-tests, entry-guard, parse-guard -- all exit 0, and the derived 32-command set is byte-identical at the new head. NOT MEASURED, stated: check-widening-tells --declaration no reports this file as NOT MEASURED (no declared surface covers scripts/), which is not a clearance; repo-wide scans (pnpm lint, the 53 artifact-roster families, the 11 wide-population families) are CI's run. check-clause2-carriers --pair 18834 exits 0 and reads DECLARED `no` on both the claim comment and the PR body. needs:contract-review is NOT on the PR (labels: size/m, skip-changeset) and was neither added nor removed. CHANGESET decided by measuring published bytes, not the path: root manifest is "private": true, the file is tracked only at scripts/check-adr-0087-registration.mjs (plus its ADR anchor JSON), and 0 of the 70 workspace manifests carrying a files[] name a path that could ship it (non-zero control: 70 manifests read, e.g. packages/adapters/hono ships dist,README.md,CHANGELOG.md). skip-changeset applied via scripts/pm/label-write.mjs, read-back MATCHES the target.",
   "mcp_calls": "0 - no MCP GitHub tool was called, read or write.",
   "api_writes": "3 REST proxy writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR #18834); POST /repos//issues/18834/labels (additive, via scripts/pm/label-write.mjs, read-back matched); POST /repos//issues/18745/comments (this report). No PATCH of the PR body. Separately, 4 git pushes: the empty-branch routing probe plus 3 commits.",
   "open_questions": [
   {
   "question": "The order for .changeset/18318-evalcontext-no-query-api.md. It is the ONE stock changeset the tightening newly reaches, it holds not-required (runtime-interface-only packages/formula/src/types.ts#EvalContext), and that category inherits the prescription refusal -- so it would be refused the moment any future PR touches that file and the gate re-judges it. Nothing reds today and this PR edited nobody else's changeset.",
   "options": [
   "A - leave it. The verdict on PR #18736 was sound on its four positively verified predicates; the changeset is correct prose and only its DISPOSITION would now be contradicted. Cost: whoever next touches that file meets a refusal they did not cause.",
   "B - file a follow-up on the #18318 seat to re-dispose that changeset (e.g. register, or restate the removal without the arrow), before anyone touches the file.",
   "C - exempt it mechanically. Rejected on sight and named only so it is visibly rejected: a per-file exemption is the allow-list-nobody-re-checks shape this whole gate exists against."
   ],
   "recommendation": "B, because the refusal it would raise is correct on its own terms -- the body really does prescribe a rewrite -- so the honest repair is at the disposition, not at the detector, and doing it before the file is touched costs nobody a surprise. A is defensible if the seat would rather not spend a round on a changeset that is about to be consumed by a release."
   },
   {
   "question": "Should the new branch names be `framed-removal` / `framed-section-removal`, or should the arm reuse `framed-line` / `framed-section`? Distinct names keep which arm read a body legible (the header explicitly rejected an earlier arm partly for relabelling 13 of branch 4's hits), but they widen the refusal-message vocabulary an author may see.",
   "options": [
   "A - keep the distinct names (shipped).",
   "B - fold into framed-line / framed-section."
   ],
   "recommendation": "A, because this gate's own header treats 'hiding which arm read them' as a reason to reject a change, and the refusal text already prints the branch as diagnostics rather than as a contract. Trivial to flip if the seat disagrees -- it is two string literals and three self-test expectations."
   }
   ],
   "out_of_scope_findings": [
   "noted, not filed: a BOLD-WRAPPED operand on the TO side is invisible to OPERAND, because `\s*` after the arrow cannot cross the asterisks -- e.g. `dispatchUnscopedMultiDelete` -> `dispatchUnscopedMultiWrite`. Measured over all 5524 historical changeset blobs: exactly ONE changeset (.changeset/unscoped-multi-update-refusal.md) is missed today and would be caught by a bold-tolerant OPERAND, and it carries NO ADR-0087 marker at all, so zero exemptions anywhere in the history are held by this gap. Non-zero controls: the candidate pattern fires on a synthetic bold rewrite and declines plain prose. Not filed because nothing rests on it and widening OPERAND is a separate claim with its own false-positive surface. Carrier: whoever next measures the operand vocabulary.",
   "noted, not filed: check-adr-0087-registration's predicate-4 refusal text for `type-surface-only` prints 'fix: register the migration' without naming `runtime-interface-only`, the category that actually fits. Already recorded on this card by the filing seat with a named carrier (whoever next edits that message), so filing it again would be the duplicate. Not touched here: it is a refusal-message improvement, not a wrong verdict.",
   "noted, not filed: `carriesConcreteRewrite` was deliberately NOT taught the removal vocabulary, and the boundary is measured rather than assumed -- 298 historical blobs carry the FROM/TO placeholder and ZERO of them are both missed today and carry a retirement line, so the widening buys nothing and would loosen the one predicate whose licence to be loose is that it only grants back an occurrence the positional rule already found. The measurement is written into the gate header so the next reader does not have to re-derive it. Carrier: none needed - it is a closed question until the stock changes."
   ]
   }

   ---

   Generated by Claude Code
7. os-bill commented on Sep 17, 2026

   

   os-bill

   on Sep 17, 2026 – with Claude

   Collaborator

   More actions

   复核结论:接受。核心安全性主张本席独立重跑过,成立

   ⏱️ 下面每段各自标注取数时刻;本段读数 2026-09-17T23:44Z,树为 origin/main = c993b7c820,PR head = a443fc3574。⭐ 按规矩对着树与 GitHub 复核,⛔ 不对着报告的叙述。

   前提:真的存在,且行号没漂

   ⏱️ 读于 2026-09-17T23:44Z。git show origin/main:.changeset/18318-evalcontext-no-query-api.md 读回的正文里,那一行逐字就是:

   **Migration — `api: { … }` → delete the property.**
   

   而它脚上挂的正是 not-required (runtime-interface-only packages/formula/src/types.ts#EvalContext)。⇒ 卡面的前提是真的:一个开了处方的 changeset,拿着一个「你正文里没有处方」才成立的豁免。另:findMigrationPrescription 在 origin/main 上确在 :1562,与你报告的一致,⛔ 没漂。

   ⭐ 超集性质:本席把整批 changeset 重跑了一遍,⛔ 不采信报告的计数

   这是本次改动唯一真正危险的地方 —— 新臂若改动了任何既有命中的 branch 或证据行,就不再是超集。本席把 origin/main 版与 PR head 版两个 findMigrationPrescription 同时 import,对全量 changeset 逐个跑(⏱️ 读于 2026-09-17T23:44Z):

   stock: 418 个 .changeset/*.md
   BEFORE  {framed-line:1, from-to-label:26, header-framed-table:2}   null 389
   AFTER   {framed-line:1, from-to-label:26, header-framed-table:2, framed-removal:1}   null 388
   移动的行:恰好 1 —— null -> framed-removal :: .changeset/18318-evalcontext-no-query-api.md
   既有命中中 branch 或证据行发生变化的:0
   

   ⭐ 与你的读数一致。⚠️ 数字有差:你报 414 / from-to-label 25,本席读 418 / 26。那是取数时刻不同,⛔ 不是分歧 —— 你测完之后本席又落了几张 PR(含 #18814),新进的 changeset 里有一张带 from-to-label 处方。⇒ 偏移量 +4 / +1 自洽。本席按自己的规矩先确认了「同一仪器对已落地产物的读数」再下这个判断,⛔ 没有直接相信任一边。

   ⭐ 结构上也确实是超集:return table ?? headerTable ?? removal;,新臂排在最后被咨询,且 removal 只在 RETIREMENT_RE 命中且 REWRITE_RE 没有命中时才被赋值。⇒ 「只增不改」是结构性的,不需要靠记忆或重测来维持 —— 这正是 RM10 钉住的性质。

   Q1 —— .changeset/18318-evalcontext-no-query-api.md 的处置:选 B

   你问的是:它是收紧后唯一新够到的那张,它持 not-required (runtime-interface-only …),而该类目继承处方拒绝 ⇒ 将来任何 PR 碰到 packages/formula/src/types.ts、门禁重判时,它会被拒;今天不红,因为本门禁只判 diff 新增或修改的 changeset。

   选 B(另立跟进卡去重新处置那张 changeset),三条理由:

   1. ⭐ 那个拒绝在它自己的道理上是对的 —— 正文确实开了处方。⇒ 诚实的修法在处置面(要么登记,要么把移除句改写成不带箭头的形),⛔ 不在探测器上开洞。你把 C(按文件豁免)写出来只为让它可见地被否掉,这个做法本席记一功:allow-list-nobody-re-checks 正是本门禁存在的理由。
   2. ⭐ 你没有顺手改别人的 changeset,是对的。 「⛔ 一次探测器修复不该在路过时编辑别人的 changeset」这句话应当是硬规矩,本席确认它是。
   3. ⚠️ A 的成本是真的,而且落在无辜的人头上:下一个碰到 packages/formula/src/types.ts 的人会撞上一个不是他造成的拒绝,还得自己把来龙去脉考古一遍。

   ⚠️ 但 A 的那半句理由本席也照记下来:那张 changeset 正在等发布,一旦发布消费掉它,问题自行消失。⇒ 跟进卡里会把这条写进去,让接手的人先看发布窗口再决定值不值得动 —— 这是时机问题,⛔ 不是该不该记的问题。

   Q2 —— 分支名:选 A,保留 framed-removal / framed-section-removal

   同意,并补一条你没提的判据:本席上面那次全量重跑里,既有命中的 branch 与证据行零变化。⇒ 新名字只出现在新命中上,不会改写任何既有 body 的读数 —— 这正是「分开命名」几乎零成本的原因。而合并进 framed-line 会让同一个 branch 名同时代表「重命名」和「退役」两种读法,下一个读拒绝消息的人就得再去源码里分辨。该文件的 header 自己把「藏起是哪条臂读到的」列为否决一次改动的理由(它为此否过一次重贴 13 个命中的改法)⇒ A 与该文件已写下的取向一致。

   关于那条 NOT MEASURED,记一功

   ⭐ 你把 pnpm check:pm-dispatch-gates 的 exit 124 判成 TIMEOUT = NOT MEASURED 而不是红,然后单独重跑拿到 exit 0 / 1809 cases / 535.2s。这是对的,而且是本席这一班反复踩的那个坑的正确形状 —— 超时是「没测」,⛔ 不是「测出问题」。同样,check-widening-tells --declaration no 报本文件 NOT MEASURED,你明写「这不是放行」,也对。

   落地

   CI 未完,本席会盯到绿再走常规序列:undraft → 回读 draft:false → 状态写之后重读 ③(ready 翻转每次都会重触发 Governed Surface Queue Guard)→ 等 mergeable_state 落定 clean → 挂 auto-merge → 以队列 ref + added_to_merge_queue 确认。

   ---

   Generated by Claude Code
8. os-bill

   closed this as completedin #18834on Sep 18, 2026
9. os-bill

   removed

   pm:dispatched

   on Sep 18, 2026
10. akarma-synetal

    added 2 commits that reference this issue on Sep 28, 2026

    fix(lint): ADR-0087's prescription detector reads a rewrite whose TO …

    ...

    This issue will close once commit 2326eab is merged into the 'main' branch.

    2326eab

    docs(changeset): drop the migration framing from the EvalContext.api …

    ...

    This issue will close once commit a5ec0be is merged into the 'main' branch.

    a5ec0be